Защити созданное

Другие наши ресурсы

  • free.drweb.kz — бесплатные утилиты, плагины, информеры
  • av-desk.com — интернет-сервис для поставщиков услуг Dr.Web AV-Desk
  • curenet.drweb.kz — сетевая лечащая утилита Dr.Web CureNet!
Закрыть

Библиотека
Моя библиотека

Чтобы добавить ресурс в библиотеку, войдите в аккаунт.

+ Добавить в библиотеку

Ресурсов: -

Последний: -

Моя библиотека

Поиск
Поиск

Поиск

Поддержка
Круглосуточная поддержка | Правила обращения

Напишите

Запрос через форму

Позвоните

Глобальная поддержка:
+7 (495) 789-45-86

ЧаВо | Форум

Ваши запросы

  • Все: -
  • Незакрытые: -
  • Последний: -
Создать новый запрос Частые вопросы

Позвоните

Глобальная поддержка:
+7 (495) 789-45-86

Свяжитесь с нами Незакрытые запросы: 

Профиль

Профиль

KZ

RU CN DE EN ES FR IT JP KZ UZ PL BY
Закрыть
Сервисы
Сканеры
Dr.Web vxCube
Демо
Экспертиза ВКИ
Вирусная библиотека
База знаний

Технологии

Термины

Обучение и просвещение

Мифы

Новости

Trojan.DownLoader26.57710

Добавлен в вирусную базу Dr.Web: 2018-07-14

Описание добавлено:

Technical Information

To ensure autorun and distribution:
Modifies the following registry keys:
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '28377' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '2955' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '23481' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '13804' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1561' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '24652' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '12409' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '2732' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '23258' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '13581' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1338' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '14027' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '21863' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '32712' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '23035' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '10792' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '31317' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '21640' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '9398' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '32488' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '20246' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '8003' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '31094' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '24875' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '12632' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1784' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '23704' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '9174' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '32293' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '20050' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '10373' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '30899' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '21222' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '8979' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '29504' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '19827' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '7584' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '18851' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '18879' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '12186' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '30675' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '19604' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '7361' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '27887' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '18210' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '5967' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '16815' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '25098' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '15421' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '3178' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '18433' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '8756' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '29281' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '3875' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '29700' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1534' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '22059' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '12382' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '139' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '20664' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '10987' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1310' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '21836' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '9593' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '32684' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '20441' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '11211' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '31122' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '23453' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '9370' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '29895' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '20218' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '7976' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '31067' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '18824' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '6581' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '29672' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '17430' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '7753' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '31290' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '10764' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '9202' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '12605' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '3374' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '28305' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '18628' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '6386' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '29477' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '17234' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '7557' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '28082' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '18405' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '6163' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '29254' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '362' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '20023' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '7780' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '23899' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '14222' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1980' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '25071' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '12828' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '585' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '23676' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '13999' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1757' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '24848' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '15617' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '4768' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '8031' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '17708' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '29950' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '16507' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '27355' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '17315' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '20244' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '4626' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '27717' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '11738' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '14080' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '24929' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '2367' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '30897' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '28164' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '6969' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '27381' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '13941' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '14444' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '2202' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '25292' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '15615' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '26464' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '4544' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '25069' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '17817' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '25513' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1251' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '30844' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '15392' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '29056' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '19797' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '30646' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '6160' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '29251' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '19574' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '7332' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '220' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '20746' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '11069' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1392' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '22084' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '12407' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '10316' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '14804' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '14107' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '18094' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '8528' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '16924' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '4933' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '27046' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '23729' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '21385' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '27801' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '29474' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '18934' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '21613' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '5715' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '4321' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '12883' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '640' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '21165' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '11488' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '32014' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '22337' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '10094' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '8700' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '29225' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '19548' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '26241' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '22560' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '2035' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '8477' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '29002' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '16759' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '7082' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '27608' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '17931' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '8254' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '28779' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '19102' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '6859' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '7305' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '18154' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '16564' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '30396' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '7638' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '27412' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '15169' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '5492' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '26018' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '16341' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '4098' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '27189' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '14946' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '2704' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '25795' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '863' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '11712' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '23954' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '14723' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '2481' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '25572' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '13329' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '3652' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '24177' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '14500' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '2258' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '22783' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '13106' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '13552' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '24400' = '<Full path to file>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '18601' = '<Full path to file>'
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
  • [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
Modifies file system:
Creates the following files:
  • C:\lsass.exe
Network activity:
Connects to:
  • '11#.#52.37.141':3128
  • '84.##9.135.224':3128
  • '12#.#3.161.189':3128
  • '89.##5.19.140':3128
  • '88.##9.142.24':3128
  • '10#.#6.233.189':3128
  • '18#.#29.247.120':3128
  • '19#.#87.131.89':3128
  • '92.##5.57.42':3128
  • '74.##.170.213':3128
  • '92.##5.207.203':3128
  • '21#.#32.72.136':3128
  • '18#.#29.159.42':3128
  • '20#.#09.254.47':3128
  • '78.##.186.173':3128
  • '84.#.45.182':3128
  • '93.##6.176.220':3128
  • '18#.#4.245.254':3128
  • '58.##.132.79':3128
  • '93.##7.149.28':3128
  • '92.##4.254.132':3128
  • '60.##.41.233':3128
  • '72.##2.126.196':3128
  • '19#.#3.227.209':3128
  • '94.##0.192.7':3128
  • '21#.#0.66.107':3128
  • '84.##3.245.240':3128
  • '78.#1.30.21':3128
  • '79.##9.62.78':3128
  • '22#.#66.56.7':3128
  • '11#.#01.100.169':3128
  • '88.##8.156.109':3128
  • '78.##.228.224':3128
  • '79.##1.3.160':3128
  • '64.#6.51.27':3128
  • '82.##.172.234':3128
  • '86.##5.26.155':3128
  • '95.#6.5.156':3128
  • '12#.#.105.239':3128
  • '85.##.251.108':3128
  • '89.##.150.11':3128
  • '87.##0.150.139':3128
  • '78.##.189.81':3128
  • '77.##.14.165':3128
  • '21#.#32.93.46':3128
  • '12#.#25.184.20':3128
  • '58.#.183.2':3128
  • '19#.#7.218.38':3128
  • '88.##8.183.198':3128
  • '11#.#2.200.67':3128
  • '92.##5.97.104':3128
  • '89.##.108.236':3128
  • '11#.#4.89.230':3128
  • '19#.#84.3.252':3128
  • '20#.#88.124.246':3128
  • '11#.#5.163.88':3128
  • '20#.#0.100.21':3128
  • '99.##9.222.45':3128
  • '19#.#83.66.207':3128
  • '19#.#98.94.50':3128
  • '89.##.186.150':3128
  • '93.##6.243.133':3128
  • '12#.#53.231.39':3128
  • '89.##8.232.149':3128
  • '20#.#1.105.100':3128
  • '78.##9.173.75':3128
  • '86.#3.66.74':3128
  • '18#.#29.220.176':3128
  • '88.##1.220.20':3128
  • '19#.#01.87.21':3128
  • '93.##.21.162':3128
  • '82.##7.22.212':3128
  • '86.##1.150.31':3128
  • '21#.#85.11.24':3128
  • '21#.#12.12.6':3128
  • '84.#0.95.7':3128
  • '59.##9.177.93':3128
  • '83.#.70.132':3128
  • '99.##7.54.23':3128
  • '18#.#3.24.83':3128
  • '78.##.132.177':3128
  • '12#.#3.118.220':3128
  • '95.##4.58.64':3128
  • '81.##.18.239':3128
  • '93.##7.168.227':3128
  • '85.##.192.69':3128
  • '89.##3.88.199':3128
  • '89.#8.42.22':3128
  • '85.##1.40.19':3128
  • '82.##2.213.137':3128
  • '77.##.58.249':3128
  • '86.##6.70.10':3128
  • '78.##9.134.198':3128
  • '77.##.58.170':3128
  • '19#.78.6.97':3128
  • '11#.#00.218.170':3128
  • '21#.#0.126.243':3128
  • '18#.#20.203.64':3128
  • '18#.#29.144.158':3128
  • '89.#1.88.50':3128
  • '88.##6.159.116':3128
  • '93.##2.101.63':3128
  • '95.##4.41.180':3128
  • '84.#2.51.5':3128
  • '89.##6.77.217':3128
  • '12#.#95.192.60':3128
  • '78.##.75.108':3128
  • '11#.#02.156.147':3128
  • '11#.#5.18.247':3128
  • '17#.#17.65.9':3128
  • '20#.#4.118.97':3128
  • '78.##.108.70':3128
  • '83.##.46.110':3128
  • '93.##8.9.180':3128
  • '91.##3.126.174':3128
  • '85.##6.204.74':3128
  • '83.##1.5.158':3128
  • '93.##5.224.71':3128
  • '81.##.48.150':3128
  • '85.##5.65.72':3128
  • '86.#8.49.65':3128
  • '11#.#4.138.21':3128
  • '86.##6.70.108':3128
  • '19#.#26.161.188':3128
  • '89.##0.235.17':3128
  • '61.##.37.130':3128
  • '99.##6.233.250':3128
  • '94.##6.155.125':3128
  • '87.##0.250.252':3128
  • '11#.#11.184.200':3128
  • '82.##6.40.180':3128
  • '21#.#46.228.68':3128
  • '87.##.194.60':3128
  • '18#.#29.162.83':3128
  • '82.#7.86.27':3128
  • '95.##4.46.108':3128
  • '59.##9.81.42':3128
  • '94.##0.107.2':3128
  • '11#.#2.235.224':3128
  • '18#.#22.224.128':3128
  • '18#.#30.6.162':3128
  • '12#.#4.91.69':3128
  • '12#.#3.173.237':3128
  • '10#.#6.136.225':3128
  • '18#.#6.37.132':3128
  • '95.##4.3.116':3128
  • '94.##0.222.46':3128
  • '19#.#6.61.83':3128
  • '11#.#01.11.99':3128
  • '85.#5.97.15':3128
  • '18#.#29.220.21':3128
  • '79.##6.200.72':3128
  • '87.##1.87.180':3128
  • '78.##.191.12':3128
  • '78.##.78.154':3128
  • '99.##3.96.76':3128
  • '41.##4.52.34':3128
  • '81.##.177.190':3128
  • '94.##7.165.210':3128
  • '87.##.10.211':3128
  • '19#.#06.129.250':3128
  • '87.##1.96.110':3128
  • '19#.#1.235.67':3128
  • '84.##4.161.22':3128
  • '94.##.78.154':3128
  • '68.##7.209.75':3128
  • '12#.#03.73.202':3128
  • '95.##0.215.60':3128
  • '11#.#4.60.171':3128
  • '99.##4.29.15':3128
  • '10#.#08.237.100':3128
  • '24.##9.200.119':3128
  • '82.##7.172.150':3128
  • '19#.#99.220.80':3128
  • '95.#5.22.10':3128
  • '86.##2.254.15':3128
  • '74.##3.89.116':3128
  • '72.##2.235.178':3128
  • '21#.#24.124.103':3128
  • '92.##4.171.249':3128
  • '94.##4.169.211':3128
  • '88.##4.18.23':3128
  • '95.##4.96.148':3128
  • '18#.#29.153.134':3128
  • '77.##.150.208':3128
  • '12#.#37.205.141':3128
  • '19#.#3.138.186':3128
  • '80.##3.197.223':3128
  • '94.##0.222.87':3128
  • '14#.#30.26.60':3128
  • '95.##4.73.74':3128
  • '12#.#76.35.134':3128
TCP:
HTTP POST requests:
  • http://95.##4.46.108/+4431.html
  • http://12#.#3.161.189/+4431.html
  • http://89.##5.19.140/+4431.html
  • http://88.##9.142.24/+4431.html
  • http://94.##6.155.125/+4431.html
  • http://10#.#6.233.189/+4431.html
  • http://18#.#29.247.120/+4431.html
  • http://19#.#87.131.89/+4431.html
  • http://92.##5.57.42/+4431.html
  • http://74.##.170.213/+4431.html
  • http://84.##9.135.224/+4431.html
  • http://92.##5.207.203/+4431.html
  • http://18#.#29.159.42/+4431.html
  • http://20#.#09.254.47/+4431.html
  • http://78.##.186.173/+4431.html
  • http://84.#.45.182/+4431.html
  • http://93.##6.176.220/+4431.html
  • http://18#.#4.245.254/+4431.html
  • http://58.##.132.79/+4431.html
  • http://93.##7.149.28/+4431.html
  • http://92.##4.254.132/+4431.html
  • http://60.##.41.233/+4431.html
  • http://58.#.183.2/+4431.html
  • http://19#.#3.227.209/+4431.html
  • http://12#.#25.184.20/+4431.html
  • http://84.##3.245.240/+4431.html
  • http://78.#1.30.21/+4431.html
  • http://79.##9.62.78/+4431.html
  • http://22#.#66.56.7/+4431.html
  • http://11#.#01.100.169/+4431.html
  • http://88.##8.156.109/+4431.html
  • http://78.##.228.224/+4431.html
  • http://21#.#32.93.46/+4431.html
  • http://79.##1.3.160/+4431.html
  • http://21#.#32.72.136/+4431.html
  • http://64.#6.51.27/+4431.html
  • http://95.#6.5.156/+4431.html
  • http://12#.#.105.239/+4431.html
  • http://85.##.251.108/+4431.html
  • http://89.##.150.11/+4431.html
  • http://87.##0.150.139/+4431.html
  • http://78.##.189.81/+4431.html
  • http://77.##.14.165/+4431.html
  • http://82.##.172.234/+4431.html
  • http://94.##0.192.7/+4431.html
  • http://86.##5.26.155/+4431.html
  • http://21#.#0.66.107/+4431.html
  • http://19#.#7.218.38/+4431.html
  • http://88.##8.183.198/+4431.html
  • http://11#.#2.200.67/+4431.html
  • http://92.##5.97.104/+4431.html
  • http://89.##.108.236/+4431.html
  • http://11#.#4.89.230/+4431.html
  • http://20#.#88.124.246/+4431.html
  • http://19#.#84.3.252/+4431.html
  • http://11#.#5.163.88/+4431.html
  • http://20#.#0.100.21/+4431.html
  • http://99.##9.222.45/+4431.html
  • http://19#.#83.66.207/+4431.html
  • http://19#.#98.94.50/+4431.html
  • http://19#.#01.87.21/+4431.html
  • http://93.##6.243.133/+4431.html
  • http://12#.#53.231.39/+4431.html
  • http://89.##8.232.149/+4431.html
  • http://20#.#1.105.100/+4431.html
  • http://78.##9.173.75/+4431.html
  • http://95.##4.73.74/+4431.html
  • http://18#.#29.220.176/+4431.html
  • http://88.##1.220.20/+4431.html
  • http://89.##.186.150/+4431.html
  • http://93.##.21.162/+4431.html
  • http://82.##7.22.212/+4431.html
  • http://86.##1.150.31/+4431.html
  • http://21#.#85.11.24/+4431.html
  • http://84.#0.95.7/+4431.html
  • http://21#.#12.12.6/+4431.html
  • http://59.##9.177.93/+4431.html
  • http://83.#.70.132/+4431.html
  • http://99.##7.54.23/+4431.html
  • http://81.##.18.239/+4431.html
  • http://78.##.132.177/+4431.html
  • http://12#.#3.118.220/+4431.html
  • http://95.##4.58.64/+4431.html
  • http://18#.#3.24.83/+4431.html
  • http://93.##7.168.227/+4431.html
  • http://85.##.192.69/+4431.html
  • http://89.##3.88.199/+4431.html
  • http://89.#8.42.22/+4431.html
  • http://85.##1.40.19/+4431.html
  • http://82.##2.213.137/+4431.html
  • http://77.##.58.249/+4431.html
  • http://86.##6.70.10/+4431.html
  • http://78.##9.134.198/+4431.html
  • http://77.##.58.170/+4431.html
  • http://72.##2.126.196/+4431.html
  • http://19#.78.6.97/+4431.html
  • http://11#.#00.218.170/+4431.html
  • http://18#.#29.144.158/+4431.html
  • http://88.##6.159.116/+4431.html
  • http://93.##2.101.63/+4431.html
  • http://89.#1.88.50/+4431.html
  • http://84.#2.51.5/+4431.html
  • http://95.##4.41.180/+4431.html
  • http://89.##6.77.217/+4431.html
  • http://93.##5.224.71/+4431.html
  • http://12#.#3.173.237/+4431.html
  • http://10#.#6.136.225/+4431.html
  • http://12#.#95.192.60/+4431.html
  • http://17#.#17.65.9/+4431.html
  • http://20#.#4.118.97/+4431.html
  • http://78.##.108.70/+4431.html
  • http://93.##8.9.180/+4431.html
  • http://91.##3.126.174/+4431.html
  • http://85.##6.204.74/+4431.html
  • http://78.##.75.108/+4431.html
  • http://82.##6.40.180/+4431.html
  • http://81.##.48.150/+4431.html
  • http://83.##1.5.158/+4431.html
  • http://11#.#5.18.247/+4431.html
  • http://11#.#11.184.200/+4431.html
  • http://18#.#30.6.162/+4431.html
  • http://11#.#2.235.224/+4431.html
  • http://61.##.37.130/+4431.html
  • http://99.##6.233.250/+4431.html
  • http://86.#8.49.65/+4431.html
  • http://18#.#29.162.83/+4431.html
  • http://82.#7.86.27/+4431.html
  • http://11#.#52.37.141/+4431.html
  • http://59.##9.81.42/+4431.html
  • http://11#.#02.156.147/+4431.html
  • http://21#.#24.124.103/+4431.html
  • http://19#.#26.161.188/+4431.html
  • http://89.##0.235.17/+4431.html
  • http://11#.#4.138.21/+4431.html
  • http://21#.#46.228.68/+4431.html
  • http://12#.#4.91.69/+4431.html
  • http://86.##6.70.108/+4431.html
  • http://87.##0.250.252/+4431.html
  • http://18#.#22.224.128/+4431.html
  • http://85.##5.65.72/+4431.html
  • http://87.##.194.60/+4431.html
  • http://94.##0.107.2/+4431.html
  • http://18#.#20.203.64/+4431.html
  • http://99.##4.29.15/+4431.html
  • http://78.##.78.154/+4431.html
  • http://94.##0.222.46/+4431.html
  • http://11#.#01.11.99/+4431.html
  • http://19#.#6.61.83/+4431.html
  • http://85.#5.97.15/+4431.html
  • http://18#.#29.220.21/+4431.html
  • http://79.##6.200.72/+4431.html
  • http://99.##3.96.76/+4431.html
  • http://18#.#6.37.132/+4431.html
  • http://12#.#03.73.202/+4431.html
  • http://95.##4.3.116/+4431.html
  • http://84.##4.161.22/+4431.html
  • http://81.##.177.190/+4431.html
  • http://94.##7.165.210/+4431.html
  • http://87.##.10.211/+4431.html
  • http://19#.#06.129.250/+4431.html
  • http://19#.#1.235.67/+4431.html
  • http://21#.#0.126.243/+4431.html
  • http://87.##1.96.110/+4431.html
  • http://68.##7.209.75/+4431.html
  • http://94.##.78.154/+4431.html
  • http://41.##4.52.34/+4431.html
  • http://87.##1.87.180/+4431.html
  • http://94.##0.222.87/+4431.html
  • http://83.##.46.110/+4431.html
  • http://10#.#08.237.100/+4431.html
  • http://19#.#99.220.80/+4431.html
  • http://82.##7.172.150/+4431.html
  • http://74.##3.89.116/+4431.html
  • http://86.##2.254.15/+4431.html
  • http://72.##2.235.178/+4431.html
  • http://24.##9.200.119/+4431.html
  • http://95.#5.22.10/+4431.html
  • http://14#.#30.26.60/+4431.html
  • http://11#.#4.60.171/+4431.html
  • http://92.##4.171.249/+4431.html
  • http://88.##4.18.23/+4431.html
  • http://95.##4.96.148/+4431.html
  • http://18#.#29.153.134/+4431.html
  • http://77.##.150.208/+4431.html
  • http://12#.#37.205.141/+4431.html
  • http://19#.#3.138.186/+4431.html
  • http://80.##3.197.223/+4431.html
  • http://95.##0.215.60/+4431.html
  • http://78.##.191.12/+4431.html
  • http://94.##4.169.211/+4431.html
  • http://86.#3.66.74/+4431.html
  • http://12#.#76.35.134/+4431.html
Miscellaneous:
Creates and executes the following:
  • 'C:\lsass.exe' exe <Full path to file>

Рекомендации по лечению

  1. В случае если операционная система способна загрузиться (в штатном режиме или режиме защиты от сбоев), скачайте лечащую утилиту Dr.Web CureIt! и выполните с ее помощью полную проверку вашего компьютера, а также используемых вами переносных носителей информации.
  2. Если загрузка операционной системы невозможна, измените настройки BIOS вашего компьютера, чтобы обеспечить возможность загрузки ПК с компакт-диска или USB-накопителя. Скачайте образ аварийного диска восстановления системы Dr.Web® LiveDisk или утилиту записи Dr.Web® LiveDisk на USB-накопитель, подготовьте соответствующий носитель. Загрузив компьютер с использованием данного носителя, выполните его полную проверку и лечение обнаруженных угроз.
Демо бесплатно

 

Скачать Dr.Web

По серийному номеру

Выполните полную проверку системы с использованием Антивируса Dr.Web Light для macOS. Данный продукт можно загрузить с официального сайта Apple App Store.

Демо бесплатно

 

Скачать Dr.Web

По серийному номеру

Скачать Dr.Web с Apple Store

На загруженной ОС выполните полную проверку всех дисковых разделов с использованием продукта Антивирус Dr.Web для Linux.

Демо бесплатно

 

Скачать Dr.Web

По серийному номеру

  1. Если мобильное устройство функционирует в штатном режиме, загрузите и установите на него бесплатный антивирусный продукт Dr.Web для Android Light. Выполните полную проверку системы и используйте рекомендации по нейтрализации обнаруженных угроз.
  2. Если мобильное устройство заблокировано троянцем-вымогателем семейства Android.Locker (на экране отображается обвинение в нарушении закона, требование выплаты определенной денежной суммы или иное сообщение, мешающее нормальной работе с устройством), выполните следующие действия:
    • загрузите свой смартфон или планшет в безопасном режиме (в зависимости от версии операционной системы и особенностей конкретного мобильного устройства эта процедура может быть выполнена различными способами; обратитесь за уточнением к инструкции, поставляемой вместе с приобретенным аппаратом, или напрямую к его производителю);
    • после активации безопасного режима установите на зараженное устройство бесплатный антивирусный продукт Dr.Web для Android Light и произведите полную проверку системы, выполнив рекомендации по нейтрализации обнаруженных угроз;
    • выключите устройство и включите его в обычном режиме.

Подробнее о Dr.Web для Android

Демо бесплатно на 14 дней

Выдаётся при установке

Скачать с сайта
Скачать с Google Play