マイライブラリ
マイライブラリ

+ マイライブラリに追加

電話

お問い合わせ履歴

電話(英語)

+7 (495) 789-45-86

Profile

BackDoor.Attack.761

Added to the Dr.Web virus database: 2016-06-02

Virus description added:

Technical Information

Malicious functions:
Executes the following:
  • '<SYSTEM32>\cmd.exe'
Injects code into
the following system processes:
  • <SYSTEM32>\cmd.exe
Modifies file system:
Creates the following files:
  • <Current directory>\Skin.dll
  • %WINDIR%\show.dat
  • <SYSTEM32>\SkinH_EL.dll
Sets the 'hidden' attribute to the following files:
  • %WINDIR%\show.dat
Network activity:
Connects to:
  • 'www.wr##ch.cc':80
  • 'ho##.##ucities.edu.tw':80
  • 'localhost':1036
TCP:
HTTP GET requests:
  • http://www.wr##ch.cc/blog/yamie0319/11925509
  • http://www.wr##ch.cc/blog/yamie0319/11925872
  • http://www.wr##ch.cc/blog/yamie0319/11926358
  • http://www.wr##ch.cc/blog/yamie0319/11922744
  • http://www.wr##ch.cc/blog/yamie0319/11922783
  • http://www.wr##ch.cc/blog/yamie0319/11925157
  • http://www.wr##ch.cc/blog/yamie0319/11928180
  • http://www.wr##ch.cc/blog/yamie0319/11929832
  • http://www.wr##ch.cc/blog/yamie0319/11929287
  • http://www.wr##ch.cc/blog/yamie0319/11926669
  • http://www.wr##ch.cc/blog/yamie0319/11927867
  • http://www.wr##ch.cc/blog/yamie0319/11927904
  • http://www.wr##ch.cc/blog/yamie0319/11921977
  • http://www.wr##ch.cc/blog/yamie0319/11916659
  • http://www.wr##ch.cc/blog/yamie0319/11917034
  • http://www.wr##ch.cc/blog/yamie0319/11917424
  • http://www.wr##ch.cc/blog/yamie0319/11916211
  • http://www.wr##ch.cc/blog/yamie0319/11916656
  • http://www.wr##ch.cc/blog/yamie0319/11916657
  • http://www.wr##ch.cc/blog/yamie0319/11920291
  • http://www.wr##ch.cc/blog/yamie0319/11920646
  • http://www.wr##ch.cc/blog/yamie0319/11921968
  • http://www.wr##ch.cc/blog/yamie0319/11917710
  • http://www.wr##ch.cc/blog/yamie0319/11918693
  • http://www.wr##ch.cc/blog/yamie0319/11919261
  • http://www.wr##ch.cc/blog/darenjpg/11364938
  • http://www.wr##ch.cc/blog/darenjpg/11364937
  • http://www.wr##ch.cc/blog/darenjpg/11364936
  • http://www.wr##ch.cc/blog/darenjpg/11364941
  • http://www.wr##ch.cc/blog/darenjpg/11364940
  • http://www.wr##ch.cc/blog/darenjpg/11364939
  • http://www.wr##ch.cc/blog/darenjpg/11364931
  • http://www.wr##ch.cc/blog/darenjpg/11364930
  • http://www.wr##ch.cc/blog/darenjpg/11364929
  • http://www.wr##ch.cc/blog/darenjpg/11364935
  • http://www.wr##ch.cc/blog/darenjpg/11364934
  • http://www.wr##ch.cc/blog/darenjpg/11364933
  • http://www.wr##ch.cc/blog/darenjpg/11364657
  • http://www.wr##ch.cc/blog/darenjpg/11366813
  • http://www.wr##ch.cc/blog/darenjpg/11358382
  • http://www.wr##ch.cc/blog/darenjpg/11328300
  • http://www.wr##ch.cc/blog/yamie0319/11929101
  • http://www.wr##ch.cc/blog/yamie0319/11928326
  • http://www.wr##ch.cc/blog/darenjpg/11367022
  • http://www.wr##ch.cc/blog/darenjpg/9506520
  • http://www.wr##ch.cc/blog/darenjpg/9504916
  • http://www.wr##ch.cc/blog/darenjpg/9429362
  • http://www.wr##ch.cc/blog/darenjpg/11325276
  • http://www.wr##ch.cc/blog/darenjpg/9528996
  • http://www.wr##ch.cc/blog/darenjpg/9507417
  • http://www.wr##ch.cc/blog/yamie0319/11899782
  • http://www.wr##ch.cc/blog/yamie0319/11900167
  • http://www.wr##ch.cc/blog/yamie0319/11901097
  • http://www.wr##ch.cc/blog/yamie0319/11899384
  • http://www.wr##ch.cc/blog/yamie0319/11899437
  • http://www.wr##ch.cc/blog/yamie0319/11899781
  • http://www.wr##ch.cc/blog/yamie0319/11904104
  • http://www.wr##ch.cc/blog/yamie0319/11905232
  • http://www.wr##ch.cc/blog/yamie0319/11905516
  • http://www.wr##ch.cc/blog/yamie0319/11902441
  • http://www.wr##ch.cc/blog/yamie0319/11903325
  • http://www.wr##ch.cc/blog/yamie0319/11903747
  • http://www.wr##ch.cc/blog/yamie0319/11899132
  • http://www.wr##ch.cc/blog/yamie0319/11889589
  • http://www.wr##ch.cc/blog/yamie0319/11889590
  • http://www.wr##ch.cc/blog/yamie0319/11891541
  • http://www.wr##ch.cc/blog/yamie0319/11888879
  • http://www.wr##ch.cc/blog/yamie0319/11888901
  • http://www.wr##ch.cc/blog/yamie0319/11889587
  • http://www.wr##ch.cc/blog/yamie0319/11894919
  • http://www.wr##ch.cc/blog/yamie0319/11895911
  • http://www.wr##ch.cc/blog/yamie0319/11897769
  • http://www.wr##ch.cc/blog/yamie0319/11893313
  • http://www.wr##ch.cc/blog/yamie0319/11894129
  • http://www.wr##ch.cc/blog/yamie0319/11894916
  • http://www.wr##ch.cc/blog/yamie0319/11912011
  • http://www.wr##ch.cc/blog/yamie0319/11912131
  • http://www.wr##ch.cc/blog/yamie0319/11912360
  • http://www.wr##ch.cc/blog/yamie0319/11911574
  • http://www.wr##ch.cc/blog/yamie0319/11911590
  • http://www.wr##ch.cc/blog/yamie0319/11911975
  • http://www.wr##ch.cc/blog/yamie0319/11914441
  • http://www.wr##ch.cc/blog/yamie0319/11914770
  • http://www.wr##ch.cc/blog/yamie0319/11915922
  • http://www.wr##ch.cc/blog/yamie0319/11912580
  • http://www.wr##ch.cc/blog/yamie0319/11913104
  • http://www.wr##ch.cc/blog/yamie0319/11913973
  • http://www.wr##ch.cc/blog/yamie0319/11911572
  • http://www.wr##ch.cc/blog/yamie0319/11906734
  • http://www.wr##ch.cc/blog/yamie0319/11907010
  • http://www.wr##ch.cc/blog/yamie0319/11907011
  • http://www.wr##ch.cc/blog/yamie0319/11905560
  • http://www.wr##ch.cc/blog/yamie0319/11906625
  • http://www.wr##ch.cc/blog/yamie0319/11906679
  • http://www.wr##ch.cc/blog/yamie0319/11910504
  • http://www.wr##ch.cc/blog/yamie0319/11910954
  • http://www.wr##ch.cc/blog/yamie0319/11911570
  • http://www.wr##ch.cc/blog/yamie0319/11907771
  • http://www.wr##ch.cc/blog/yamie0319/11909273
  • http://www.wr##ch.cc/blog/yamie0319/11909275
  • http://www.wr##ch.cc/blog/darenjpg/11364861
  • http://www.wr##ch.cc/blog/darenjpg/11364860
  • http://www.wr##ch.cc/blog/darenjpg/11364859
  • http://www.wr##ch.cc/blog/darenjpg/11364864
  • http://www.wr##ch.cc/blog/darenjpg/11364863
  • http://www.wr##ch.cc/blog/darenjpg/11364862
  • http://www.wr##ch.cc/blog/darenjpg/11364855
  • http://www.wr##ch.cc/blog/darenjpg/11364854
  • http://www.wr##ch.cc/blog/darenjpg/11364853
  • http://www.wr##ch.cc/blog/darenjpg/11364858
  • http://www.wr##ch.cc/blog/darenjpg/11364857
  • http://www.wr##ch.cc/blog/darenjpg/11364856
  • http://www.wr##ch.cc/blog/darenjpg/11364865
  • http://www.wr##ch.cc/blog/darenjpg/11364875
  • http://www.wr##ch.cc/blog/darenjpg/11364874
  • http://www.wr##ch.cc/blog/darenjpg/11364873
  • http://www.wr##ch.cc/blog/darenjpg/11364878
  • http://www.wr##ch.cc/blog/darenjpg/11364877
  • http://www.wr##ch.cc/blog/darenjpg/11364876
  • http://www.wr##ch.cc/blog/darenjpg/11364869
  • http://www.wr##ch.cc/blog/darenjpg/11364867
  • http://www.wr##ch.cc/blog/darenjpg/11364866
  • http://www.wr##ch.cc/blog/darenjpg/11364872
  • http://www.wr##ch.cc/blog/darenjpg/11364871
  • http://www.wr##ch.cc/blog/darenjpg/11364870
  • http://www.wr##ch.cc/blog/darenjpg/11364836
  • http://www.wr##ch.cc/blog/darenjpg/11364835
  • http://www.wr##ch.cc/blog/darenjpg/11364834
  • http://www.wr##ch.cc/blog/darenjpg/11364839
  • http://www.wr##ch.cc/blog/darenjpg/11364838
  • http://www.wr##ch.cc/blog/darenjpg/11364837
  • http://www.wr##ch.cc/blog/darenjpg/11364830
  • http://www.wr##ch.cc/blog/darenjpg/11364829
  • http://www.wr##ch.cc/blog/darenjpg/11364828
  • http://www.wr##ch.cc/blog/darenjpg/11364833
  • http://www.wr##ch.cc/blog/darenjpg/11364832
  • http://www.wr##ch.cc/blog/darenjpg/11364831
  • http://www.wr##ch.cc/blog/darenjpg/11364840
  • http://www.wr##ch.cc/blog/darenjpg/11364849
  • http://www.wr##ch.cc/blog/darenjpg/11364848
  • http://www.wr##ch.cc/blog/darenjpg/11364847
  • http://www.wr##ch.cc/blog/darenjpg/11364852
  • http://www.wr##ch.cc/blog/darenjpg/11364851
  • http://www.wr##ch.cc/blog/darenjpg/11364850
  • http://www.wr##ch.cc/blog/darenjpg/11364843
  • http://www.wr##ch.cc/blog/darenjpg/11364842
  • http://www.wr##ch.cc/blog/darenjpg/11364841
  • http://www.wr##ch.cc/blog/darenjpg/11364846
  • http://www.wr##ch.cc/blog/darenjpg/11364845
  • http://www.wr##ch.cc/blog/darenjpg/11364844
  • http://www.wr##ch.cc/blog/darenjpg/11364912
  • http://www.wr##ch.cc/blog/darenjpg/11364911
  • http://www.wr##ch.cc/blog/darenjpg/11364910
  • http://www.wr##ch.cc/blog/darenjpg/11364915
  • http://www.wr##ch.cc/blog/darenjpg/11364914
  • http://www.wr##ch.cc/blog/darenjpg/11364913
  • http://www.wr##ch.cc/blog/darenjpg/11364906
  • http://www.wr##ch.cc/blog/darenjpg/11364905
  • http://www.wr##ch.cc/blog/darenjpg/11364904
  • http://www.wr##ch.cc/blog/darenjpg/11364909
  • http://www.wr##ch.cc/blog/darenjpg/11364908
  • http://www.wr##ch.cc/blog/darenjpg/11364907
  • http://www.wr##ch.cc/blog/darenjpg/11364916
  • http://www.wr##ch.cc/blog/darenjpg/11364925
  • http://www.wr##ch.cc/blog/darenjpg/11364924
  • http://www.wr##ch.cc/blog/darenjpg/11364923
  • http://www.wr##ch.cc/blog/darenjpg/11364928
  • http://www.wr##ch.cc/blog/darenjpg/11364927
  • http://www.wr##ch.cc/blog/darenjpg/11364926
  • http://www.wr##ch.cc/blog/darenjpg/11364919
  • http://www.wr##ch.cc/blog/darenjpg/11364918
  • http://www.wr##ch.cc/blog/darenjpg/11364917
  • http://www.wr##ch.cc/blog/darenjpg/11364922
  • http://www.wr##ch.cc/blog/darenjpg/11364921
  • http://www.wr##ch.cc/blog/darenjpg/11364920
  • http://www.wr##ch.cc/blog/darenjpg/11364887
  • http://www.wr##ch.cc/blog/darenjpg/11364886
  • http://www.wr##ch.cc/blog/darenjpg/11364885
  • http://www.wr##ch.cc/blog/darenjpg/11364890
  • http://www.wr##ch.cc/blog/darenjpg/11364889
  • http://www.wr##ch.cc/blog/darenjpg/11364888
  • http://www.wr##ch.cc/blog/darenjpg/11364881
  • http://www.wr##ch.cc/blog/darenjpg/11364880
  • http://www.wr##ch.cc/blog/darenjpg/11364879
  • http://www.wr##ch.cc/blog/darenjpg/11364884
  • http://www.wr##ch.cc/blog/darenjpg/11364883
  • http://www.wr##ch.cc/blog/darenjpg/11364882
  • http://www.wr##ch.cc/blog/darenjpg/11364891
  • http://www.wr##ch.cc/blog/darenjpg/11364900
  • http://www.wr##ch.cc/blog/darenjpg/11364899
  • http://www.wr##ch.cc/blog/darenjpg/11364898
  • http://www.wr##ch.cc/blog/darenjpg/11364903
  • http://www.wr##ch.cc/blog/darenjpg/11364902
  • http://www.wr##ch.cc/blog/darenjpg/11364901
  • http://www.wr##ch.cc/blog/darenjpg/11364894
  • http://www.wr##ch.cc/blog/darenjpg/11364893
  • http://www.wr##ch.cc/blog/darenjpg/11364892
  • http://www.wr##ch.cc/blog/darenjpg/11364897
  • http://www.wr##ch.cc/blog/darenjpg/11364896
  • http://www.wr##ch.cc/blog/darenjpg/11364895
  • http://www.wr##ch.cc/blog/yamie0319/11887362
  • http://www.wr##ch.cc/blog/yamie0319/11263995
  • http://www.wr##ch.cc/blog/yamie0319/11264192
  • http://www.wr##ch.cc/blog/yamie0319/11264666
  • http://www.wr##ch.cc/blog/yamie0319/11259101
  • http://www.wr##ch.cc/blog/yamie0319/11259616
  • http://www.wr##ch.cc/blog/yamie0319/11263498
  • http://www.wr##ch.cc/blog/yamie0319/11269839
  • http://www.wr##ch.cc/blog/yamie0319/11270170
  • http://www.wr##ch.cc/blog/yamie0319/11270343
  • http://www.wr##ch.cc/blog/yamie0319/11264689
  • http://www.wr##ch.cc/blog/yamie0319/11267711
  • http://www.wr##ch.cc/blog/yamie0319/11268497
  • http://www.wr##ch.cc/blog/yamie0319/11259100
  • http://www.wr##ch.cc/blog/yamie0319/11249940
  • http://www.wr##ch.cc/blog/yamie0319/11249958
  • http://www.wr##ch.cc/blog/yamie0319/11252401
  • http://www.wr##ch.cc/blog/yamie0319/11247671
  • http://www.wr##ch.cc/blog/yamie0319/11247672
  • http://www.wr##ch.cc/blog/yamie0319/11249277
  • http://www.wr##ch.cc/blog/yamie0319/11256618
  • http://www.wr##ch.cc/blog/yamie0319/11257449
  • http://www.wr##ch.cc/blog/yamie0319/11258766
  • http://www.wr##ch.cc/blog/yamie0319/11253485
  • http://www.wr##ch.cc/blog/yamie0319/11254478
  • http://www.wr##ch.cc/blog/yamie0319/11255871
  • http://www.wr##ch.cc/blog/yamie0319/11290619
  • http://www.wr##ch.cc/blog/yamie0319/11290675
  • http://www.wr##ch.cc/blog/yamie0319/11291082
  • http://www.wr##ch.cc/blog/yamie0319/11289877
  • http://www.wr##ch.cc/blog/yamie0319/11290012
  • http://www.wr##ch.cc/blog/yamie0319/11290466
  • http://www.wr##ch.cc/blog/yamie0319/11307615
  • http://www.wr##ch.cc/blog/yamie0319/11308033
  • http://www.wr##ch.cc/blog/yamie0319/11308203
  • http://www.wr##ch.cc/blog/yamie0319/11307024
  • http://www.wr##ch.cc/blog/yamie0319/11307141
  • http://www.wr##ch.cc/blog/yamie0319/11307159
  • http://www.wr##ch.cc/blog/yamie0319/11287716
  • http://www.wr##ch.cc/blog/yamie0319/11276457
  • http://www.wr##ch.cc/blog/yamie0319/11277034
  • http://www.wr##ch.cc/blog/yamie0319/11278248
  • http://www.wr##ch.cc/blog/yamie0319/11274233
  • http://www.wr##ch.cc/blog/yamie0319/11275568
  • http://www.wr##ch.cc/blog/yamie0319/11276446
  • http://www.wr##ch.cc/blog/yamie0319/11285705
  • http://www.wr##ch.cc/blog/yamie0319/11286328
  • http://www.wr##ch.cc/blog/yamie0319/11286539
  • http://www.wr##ch.cc/blog/yamie0319/11281093
  • http://www.wr##ch.cc/blog/yamie0319/11283919
  • http://www.wr##ch.cc/blog/yamie0319/11284263
  • http://www.wr##ch.cc/blog/yamie0319/11112445
  • http://www.wr##ch.cc/blog/yamie0319/11194626
  • http://www.wr##ch.cc/blog/yamie0319/11195819
  • http://www.wr##ch.cc/blog/yamie0319/11092565
  • http://www.wr##ch.cc/blog/yamie0319/11111634
  • http://www.wr##ch.cc/blog/yamie0319/11111732
  • http://www.wr##ch.cc/blog/yamie0319/11203175
  • http://www.wr##ch.cc/blog/yamie0319/11209021
  • http://www.wr##ch.cc/blog/yamie0319/11209825
  • http://www.wr##ch.cc/blog/yamie0319/11197510
  • http://www.wr##ch.cc/blog/yamie0319/11198347
  • http://www.wr##ch.cc/blog/yamie0319/11198572
  • http://www.wr##ch.cc/blog/yamie0319/10971871
  • http://www.wr##ch.cc/blog/yamie0319/
  • http://www.wr##ch.cc/blog/darenjpg/
  • http://www.wr##ch.cc/album/album.php?id##################
  • http://ho##.##ucities.edu.tw/bnbvip/mid.htm
  • http://www.wr##ch.cc/album/album.php?id###############
  • http://www.wr##ch.cc/album/album.php?id################
  • http://www.wr##ch.cc/blog/yamie0319/10933793
  • http://www.wr##ch.cc/blog/yamie0319/10941374
  • http://www.wr##ch.cc/blog/yamie0319/10941773
  • http://www.wr##ch.cc/album/album.php?id#################
  • http://www.wr##ch.cc/blog/yamie0319/10907644
  • http://www.wr##ch.cc/blog/yamie0319/10928883
  • http://www.wr##ch.cc/blog/yamie0319/11228947
  • http://www.wr##ch.cc/blog/yamie0319/11219918
  • http://www.wr##ch.cc/blog/yamie0319/11237541
  • http://www.wr##ch.cc/blog/yamie0319/11219904
  • http://www.wr##ch.cc/blog/yamie0319/11222339
  • http://www.wr##ch.cc/blog/yamie0319/11226337
  • http://www.wr##ch.cc/blog/yamie0319/11245504
  • http://www.wr##ch.cc/blog/yamie0319/11246719
  • http://www.wr##ch.cc/blog/yamie0319/11247670
  • http://www.wr##ch.cc/blog/yamie0319/11238776
  • http://www.wr##ch.cc/blog/yamie0319/11243133
  • http://www.wr##ch.cc/blog/yamie0319/11245495
  • http://www.wr##ch.cc/blog/yamie0319/11221429
  • http://www.wr##ch.cc/blog/yamie0319/11213435
  • http://www.wr##ch.cc/blog/yamie0319/11214825
  • http://www.wr##ch.cc/blog/yamie0319/11215520
  • http://www.wr##ch.cc/blog/yamie0319/11210709
  • http://www.wr##ch.cc/blog/yamie0319/11210851
  • http://www.wr##ch.cc/blog/yamie0319/11211085
  • http://www.wr##ch.cc/blog/yamie0319/11218580
  • http://www.wr##ch.cc/blog/yamie0319/11219098
  • http://www.wr##ch.cc/blog/yamie0319/11220687
  • http://www.wr##ch.cc/blog/yamie0319/11216398
  • http://www.wr##ch.cc/blog/yamie0319/11217425
  • http://www.wr##ch.cc/blog/yamie0319/11217427
  • http://www.wr##ch.cc/blog/yamie0319/11855571
  • http://www.wr##ch.cc/blog/yamie0319/11855890
  • http://www.wr##ch.cc/blog/yamie0319/11856166
  • http://www.wr##ch.cc/blog/yamie0319/11853842
  • http://www.wr##ch.cc/blog/yamie0319/11853845
  • http://www.wr##ch.cc/blog/yamie0319/11854343
  • http://www.wr##ch.cc/blog/yamie0319/11859401
  • http://www.wr##ch.cc/blog/yamie0319/11859404
  • http://www.wr##ch.cc/blog/yamie0319/11859959
  • http://www.wr##ch.cc/blog/yamie0319/11857053
  • http://www.wr##ch.cc/blog/yamie0319/11858026
  • http://www.wr##ch.cc/blog/yamie0319/11858834
  • http://www.wr##ch.cc/blog/yamie0319/11853840
  • http://www.wr##ch.cc/blog/yamie0319/11358937
  • http://www.wr##ch.cc/blog/yamie0319/11359149
  • http://www.wr##ch.cc/blog/yamie0319/11359167
  • http://www.wr##ch.cc/blog/yamie0319/11358083
  • http://www.wr##ch.cc/blog/yamie0319/11358084
  • http://www.wr##ch.cc/blog/yamie0319/11358572
  • http://www.wr##ch.cc/blog/yamie0319/11361226
  • http://www.wr##ch.cc/blog/yamie0319/11363888
  • http://www.wr##ch.cc/blog/yamie0319/11364228
  • http://www.wr##ch.cc/blog/yamie0319/11359657
  • http://www.wr##ch.cc/blog/yamie0319/11360713
  • http://www.wr##ch.cc/blog/yamie0319/11360714
  • http://www.wr##ch.cc/blog/yamie0319/11874245
  • http://www.wr##ch.cc/blog/yamie0319/11874253
  • http://www.wr##ch.cc/blog/yamie0319/11874834
  • http://www.wr##ch.cc/blog/yamie0319/11873708
  • http://www.wr##ch.cc/blog/yamie0319/11873813
  • http://www.wr##ch.cc/blog/yamie0319/11873829
  • http://www.wr##ch.cc/blog/yamie0319/11882986
  • http://www.wr##ch.cc/blog/yamie0319/11885698
  • http://www.wr##ch.cc/blog/yamie0319/11885788
  • http://www.wr##ch.cc/blog/yamie0319/11876937
  • http://www.wr##ch.cc/blog/yamie0319/11878888
  • http://www.wr##ch.cc/blog/yamie0319/11882094
  • http://www.wr##ch.cc/blog/yamie0319/11872438
  • http://www.wr##ch.cc/blog/yamie0319/11863964
  • http://www.wr##ch.cc/blog/yamie0319/11864495
  • http://www.wr##ch.cc/blog/yamie0319/11867010
  • http://www.wr##ch.cc/blog/yamie0319/11861015
  • http://www.wr##ch.cc/blog/yamie0319/11861488
  • http://www.wr##ch.cc/blog/yamie0319/11861530
  • http://www.wr##ch.cc/blog/yamie0319/11870628
  • http://www.wr##ch.cc/blog/yamie0319/11871960
  • http://www.wr##ch.cc/blog/yamie0319/11872437
  • http://www.wr##ch.cc/blog/yamie0319/11867970
  • http://www.wr##ch.cc/blog/yamie0319/11870563
  • http://www.wr##ch.cc/blog/yamie0319/11870627
  • http://www.wr##ch.cc/blog/yamie0319/11333161
  • http://www.wr##ch.cc/blog/yamie0319/11334928
  • http://www.wr##ch.cc/blog/yamie0319/11335157
  • http://www.wr##ch.cc/blog/yamie0319/11330962
  • http://www.wr##ch.cc/blog/yamie0319/11332180
  • http://www.wr##ch.cc/blog/yamie0319/11332732
  • http://www.wr##ch.cc/blog/yamie0319/11339112
  • http://www.wr##ch.cc/blog/yamie0319/11339412
  • http://www.wr##ch.cc/blog/yamie0319/11339434
  • http://www.wr##ch.cc/blog/yamie0319/11335998
  • http://www.wr##ch.cc/blog/yamie0319/11338367
  • http://www.wr##ch.cc/blog/yamie0319/11338878
  • http://www.wr##ch.cc/blog/yamie0319/11330606
  • http://www.wr##ch.cc/blog/yamie0319/11323568
  • http://www.wr##ch.cc/blog/yamie0319/11326051
  • http://www.wr##ch.cc/blog/yamie0319/11326074
  • http://www.wr##ch.cc/blog/yamie0319/11308535
  • http://www.wr##ch.cc/blog/yamie0319/11309153
  • http://www.wr##ch.cc/blog/yamie0319/11310283
  • http://www.wr##ch.cc/blog/yamie0319/11327559
  • http://www.wr##ch.cc/blog/yamie0319/11328664
  • http://www.wr##ch.cc/blog/yamie0319/11330374
  • http://www.wr##ch.cc/blog/yamie0319/11326676
  • http://www.wr##ch.cc/blog/yamie0319/11326680
  • http://www.wr##ch.cc/blog/yamie0319/11326872
  • http://www.wr##ch.cc/blog/yamie0319/11351437
  • http://www.wr##ch.cc/blog/yamie0319/11352662
  • http://www.wr##ch.cc/blog/yamie0319/11354036
  • http://www.wr##ch.cc/blog/yamie0319/11348125
  • http://www.wr##ch.cc/blog/yamie0319/11348321
  • http://www.wr##ch.cc/blog/yamie0319/11348833
  • http://www.wr##ch.cc/blog/yamie0319/11356847
  • http://www.wr##ch.cc/blog/yamie0319/11357228
  • http://www.wr##ch.cc/blog/yamie0319/11357717
  • http://www.wr##ch.cc/blog/yamie0319/11355178
  • http://www.wr##ch.cc/blog/yamie0319/11355180
  • http://www.wr##ch.cc/blog/yamie0319/11355696
  • http://www.wr##ch.cc/blog/yamie0319/11347780
  • http://www.wr##ch.cc/blog/yamie0319/11343377
  • http://www.wr##ch.cc/blog/yamie0319/11343749
  • http://www.wr##ch.cc/blog/yamie0319/11343842
  • http://www.wr##ch.cc/blog/yamie0319/11339880
  • http://www.wr##ch.cc/blog/yamie0319/11340791
  • http://www.wr##ch.cc/blog/yamie0319/11343132
  • http://www.wr##ch.cc/blog/yamie0319/11346736
  • http://www.wr##ch.cc/blog/yamie0319/11346740
  • http://www.wr##ch.cc/blog/yamie0319/11347277
  • http://www.wr##ch.cc/blog/yamie0319/11344367
  • http://www.wr##ch.cc/blog/yamie0319/11345176
  • http://www.wr##ch.cc/blog/yamie0319/11346183
UDP:
  • DNS ASK www.wr##ch.cc
  • DNS ASK ho##.##ucities.edu.tw
Miscellaneous:
Searches for the following windows:
  • ClassName: 'MS_WebcheckMonitor' WindowName: ''
  • ClassName: 'MS_AutodialMonitor' WindowName: ''
  • ClassName: 'Shell_TrayWnd' WindowName: ''

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android