Meine Bibliothek
Meine Bibliothek

+ Zur Bibliothek hinzufügen

Support

Ihre Anfragen

Rufen Sie uns an

+7 (495) 789-45-86

Profil

Trojan.DownLoader10.10853

Added to the Dr.Web virus database: 2013-08-28

Virus description added:

Technical Information

Malicious functions:
Creates and executes the following:
  • '%ALLUSERSPROFILE%\Application Data\unrar.exe' a -p123 "%ALLUSERSPROFILE%\Application Data\wripten.rar" "wripten.exe"
Executes the following:
  • '<SYSTEM32>\cmd.exe' /c ""c:\1.bat" "
Modifies file system :
Creates the following files:
  • %ALLUSERSPROFILE%\Application Data\wripten.rar
  • C:\Documents and Settings\aliim.exe
  • C:\Documents and Settings\qd.exe
  • %ALLUSERSPROFILE%\Application Data\ycx.exe
  • C:\1.bat
  • %ALLUSERSPROFILE%\Application Data\qd.exe
  • %ALLUSERSPROFILE%\Application Data\unrar.exe
Deletes the following files:
  • C:\1.bat
Moves itself:
  • from C:\update\8159 to C:\update\10135
  • from C:\update\6334 to C:\update\8159
  • from C:\update\12467 to C:\update\14622
  • from C:\update\10135 to C:\update\12467
  • from C:\update\515 to C:\update\2422
  • from C:\update\31493 to C:\update\515
  • from C:\update\4561 to C:\update\6334
  • from C:\update\2422 to C:\update\4561
  • from C:\update\14622 to C:\update\16421
  • from C:\update\25934 to C:\update\28177
  • from C:\update\23975 to C:\update\25934
  • from C:\update\30160 to C:\update\32403
  • from C:\update\28177 to C:\update\30160
  • from C:\update\18302 to C:\update\20441
  • from C:\update\16421 to C:\update\18302
  • from C:\update\22159 to C:\update\23975
  • from C:\update\20441 to C:\update\22159
  • from C:\update\8441 to C:\update\10587
  • from C:\update\6139 to C:\update\8441
  • from C:\update\12318 to C:\update\14159
  • from C:\update\10587 to C:\update\12318
  • from C:\update\32272 to C:\update\1907
  • from C:\update\29842 to C:\update\32272
  • from C:\update\4154 to C:\update\6139
  • from C:\update\1907 to C:\update\4154
  • from C:\update\14159 to C:\update\16171
  • from C:\update\25680 to C:\update\27460
  • from C:\update\23956 to C:\update\25680
  • from C:\update\29344 to C:\update\31493
  • from C:\update\27460 to C:\update\29344
  • from C:\update\18470 to C:\update\20560
  • from C:\update\16171 to C:\update\18470
  • from C:\update\22232 to C:\update\23956
  • from C:\update\20560 to C:\update\22232
  • from C:\update\13405 to C:\update\15155
  • from C:\update\11720 to C:\update\13405
  • from C:\update\16935 to C:\update\18819
  • from C:\update\15155 to C:\update\16935
  • from C:\update\6273 to C:\update\8366
  • from C:\update\4392 to C:\update\6273
  • from C:\update\10041 to C:\update\11720
  • from C:\update\8366 to C:\update\10041
  • from C:\update\18819 to C:\update\20968
  • from C:\update\30438 to C:\update\32554
  • from C:\update\28570 to C:\update\30438
  • from C:\update\2291 to C:\update\4796
  • from C:\update\32554 to C:\update\2291
  • from C:\update\22757 to C:\update\24661
  • from C:\update\20968 to C:\update\22757
  • from C:\update\26800 to C:\update\28570
  • from C:\update\24661 to C:\update\26800
  • from C:\update\10617 to C:\update\12759
  • from C:\update\8292 to C:\update\10617
  • from C:\update\14536 to C:\update\16417
  • from C:\update\12759 to C:\update\14536
  • from C:\update\1660 to C:\update\4040
  • from C:\update\32403 to C:\update\1660
  • from C:\update\6294 to C:\update\8292
  • from C:\update\4040 to C:\update\6294
  • from C:\update\16417 to C:\update\18504
  • from C:\update\30145 to C:\update\32588
  • from C:\update\28088 to C:\update\30145
  • from C:\update\2197 to C:\update\4392
  • from C:\update\32588 to C:\update\2197
  • from C:\update\20959 to C:\update\23412
  • from C:\update\18504 to C:\update\20959
  • from C:\update\25805 to C:\update\28088
  • from C:\update\23412 to C:\update\25805
  • from C:\update\27347 to C:\update\29842
  • from C:\update\26887 to C:\update\29212
  • from C:\update\24444 to C:\update\26887
  • from C:\update\31357 to C:\update\369
  • from C:\update\29212 to C:\update\31357
  • from C:\update\17711 to C:\update\20104
  • from C:\update\15258 to C:\update\17711
  • from C:\update\22387 to C:\update\24444
  • from C:\update\20104 to C:\update\22387
  • from C:\update\369 to C:\update\2257
  • from C:\update\11962 to C:\update\13738
  • from C:\update\10238 to C:\update\11962
  • from C:\update\15672 to C:\update\17866
  • from C:\update\13738 to C:\update\15672
  • from C:\update\4412 to C:\update\6215
  • from C:\update\2257 to C:\update\4412
  • from C:\update\8096 to C:\update\10238
  • from C:\update\6215 to C:\update\8096
  • from C:\update\19433 to C:\update\21768
  • from C:\update\17039 to C:\update\19433
  • from C:\update\23825 to C:\update\26320
  • from C:\update\21768 to C:\update\23825
  • from C:\update\10671 to C:\update\12549
  • from C:\update\8477 to C:\update\10671
  • from C:\update\14587 to C:\update\17039
  • from C:\update\12549 to C:\update\14587
  • from C:\update\26320 to C:\update\28749
  • from C:\update\7790 to C:\update\10298
  • from C:\update\5282 to C:\update\7790
  • from C:\update\12802 to C:\update\15258
  • from C:\update\10298 to C:\update\12802
  • from C:\update\31153 to C:\update\684
  • from C:\update\28749 to C:\update\31153
  • from C:\update\2774 to C:\update\5282
  • from C:\update\684 to C:\update\2774
  • from C:\update\1026 to C:\update\3116
  • from C:\update\31495 to C:\update\1026
  • from C:\update\5624 to C:\update\8080
  • from C:\update\3116 to C:\update\5624
  • from C:\update\24912 to C:\update\27263
  • from C:\update\22456 to C:\update\24912
  • from C:\update\29510 to C:\update\31495
  • from C:\update\27263 to C:\update\29510
  • from C:\update\8080 to C:\update\10536
  • from C:\update\20855 to C:\update\22759
  • from C:\update\19092 to C:\update\20855
  • from C:\update\24846 to C:\update\27347
  • from C:\update\22759 to C:\update\24846
  • from C:\update\12939 to C:\update\15235
  • from C:\update\10536 to C:\update\12939
  • from C:\update\17374 to C:\update\19092
  • from C:\update\15235 to C:\update\17374
  • from C:\update\28727 to C:\update\30602
  • from C:\update\26954 to C:\update\28727
  • from C:\update\32679 to C:\update\2389
  • from C:\update\30602 to C:\update\32679
  • from C:\update\19747 to C:\update\21837
  • from C:\update\17866 to C:\update\19747
  • from C:\update\24345 to C:\update\26954
  • from C:\update\21837 to C:\update\24345
  • from C:\update\2389 to C:\update\4842
  • from C:\update\16343 to C:\update\18538
  • from C:\update\13992 to C:\update\16343
  • from C:\update\20419 to C:\update\22456
  • from C:\update\18538 to C:\update\20419
  • from C:\update\7239 to C:\update\9525
  • from C:\update\4842 to C:\update\7239
  • from C:\update\11589 to C:\update\13992
  • from C:\update\9525 to C:\update\11589
  • from C:\update\4478 to C:\update\6813
  • from C:\update\2476 to C:\update\4478
  • from C:\update\8975 to C:\update\10738
  • from C:\update\6813 to C:\update\8975
  • from C:\update\29219 to C:\update\31048
  • from C:\update\27074 to C:\update\29219
  • from C:\update\220 to C:\update\2476
  • from C:\update\31048 to C:\update\220
  • from C:\update\10738 to C:\update\12645
  • from C:\update\23043 to C:\update\25551
  • from C:\update\20535 to C:\update\23043
  • from C:\update\28056 to C:\update\30560
  • from C:\update\25551 to C:\update\28056
  • from C:\update\14788 to C:\update\16564
  • from C:\update\12645 to C:\update\14788
  • from C:\update\18445 to C:\update\20535
  • from C:\update\16564 to C:\update\18445
  • from C:\update\845 to C:\update\2827
  • from C:\update\31836 to C:\update\845
  • from C:\update\5018 to C:\update\6893
  • from C:\update\2827 to C:\update\5018
  • from C:\update\26350 to C:\update\28440
  • from C:\update\24443 to C:\update\26350
  • from C:\update\30112 to C:\update\31836
  • from C:\update\28440 to C:\update\30112
  • from C:\update\6893 to C:\update\8970
  • from C:\update\20249 to C:\update\22306
  • from C:\update\18384 to C:\update\20249
  • from C:\update\24749 to C:\update\27074
  • from C:\update\22306 to C:\update\24749
  • from C:\update\11448 to C:\update\13852
  • from C:\update\8970 to C:\update\11448
  • from C:\update\16200 to C:\update\18384
  • from C:\update\13852 to C:\update\16200
  • from C:\update\9756 to C:\update\11794
  • from C:\update\7457 to C:\update\9756
  • from C:\update\14250 to C:\update\16601
  • from C:\update\11794 to C:\update\14250
  • from C:\update\1292 to C:\update\3225
  • from C:\update\32257 to C:\update\1292
  • from C:\update\5472 to C:\update\7457
  • from C:\update\3225 to C:\update\5472
  • from C:\update\16601 to C:\update\18900
  • from C:\update\29402 to C:\update\31910
  • from C:\update\27312 to C:\update\29402
  • from C:\update\1647 to C:\update\4151
  • from C:\update\31910 to C:\update\1647
  • from C:\update\20885 to C:\update\23237
  • from C:\update\18900 to C:\update\20885
  • from C:\update\25431 to C:\update\27312
  • from C:\update\23237 to C:\update\25431
  • from C:\update\9869 to C:\update\11857
  • from C:\update\7622 to C:\update\9869
  • from C:\update\14160 to C:\update\16308
  • from C:\update\11857 to C:\update\14160
  • from C:\update\294 to C:\update\2789
  • from C:\update\30560 to C:\update\294
  • from C:\update\5218 to C:\update\7622
  • from C:\update\2789 to C:\update\5218
  • from C:\update\16308 to C:\update\18098
  • from C:\update\27114 to C:\update\28789
  • from C:\update\25439 to C:\update\27114
  • from C:\update\30520 to C:\update\32257
  • from C:\update\28789 to C:\update\30520
  • from C:\update\20005 to C:\update\22095
  • from C:\update\18098 to C:\update\20005
  • from C:\update\23767 to C:\update\25439
  • from C:\update\22095 to C:\update\23767
  • from C:\update\22654 to C:\update\24443
  • from C:\update\18226 to C:\update\20110
  • from C:\update\16449 to C:\update\18226
  • from C:\update\22206 to C:\update\24727
  • from C:\update\20110 to C:\update\22206
  • from C:\update\11384 to C:\update\13063
  • from C:\update\9291 to C:\update\11384
  • from C:\update\14748 to C:\update\16449
  • from C:\update\13063 to C:\update\14748
  • from C:\update\24727 to C:\update\27262
  • from C:\update\3951 to C:\update\5884
  • from C:\update\1704 to C:\update\3951
  • from C:\update\8131 to C:\update\10116
  • from C:\update\5884 to C:\update\8131
  • from C:\update\28986 to C:\update\30710
  • from C:\update\27262 to C:\update\28986
  • from C:\update\32539 to C:\update\1704
  • from C:\update\30710 to C:\update\32539
  • from C:\update\17133 to C:\update\19380
  • from C:\update\14729 to C:\update\17133
  • from C:\update\21417 to C:\update\23769
  • from C:\update\19380 to C:\update\21417
  • from C:\update\7297 to C:\update\9792
  • from C:\update\4796 to C:\update\7297
  • from C:\update\12274 to C:\update\14729
  • from C:\update\9792 to C:\update\12274
  • from C:\update\23769 to C:\update\25963
  • from C:\update\2548 to C:\update\4585
  • from C:\update\693 to C:\update\2548
  • from C:\update\6989 to C:\update\9291
  • from C:\update\4585 to C:\update\6989
  • from C:\update\27847 to C:\update\29941
  • from C:\update\25963 to C:\update\27847
  • from C:\update\31671 to C:\update\693
  • from C:\update\29941 to C:\update\31671
  • from C:\update\29163 to C:\update\31498
  • from C:\update\26769 to C:\update\29163
  • from C:\update\787 to C:\update\3230
  • from C:\update\31498 to C:\update\787
  • from C:\update\19775 to C:\update\21861
  • from C:\update\17476 to C:\update\19775
  • from C:\update\24317 to C:\update\26769
  • from C:\update\21861 to C:\update\24317
  • from C:\update\3230 to C:\update\5660
  • from C:\update\16527 to C:\update\18830
  • from C:\update\14124 to C:\update\16527
  • from C:\update\20923 to C:\update\22654
  • from C:\update\18830 to C:\update\20923
  • from C:\update\8011 to C:\update\10205
  • from C:\update\5660 to C:\update\8011
  • from C:\update\12086 to C:\update\14124
  • from C:\update\10205 to C:\update\12086
  • from C:\update\21193 to C:\update\23701
  • from C:\update\19103 to C:\update\21193
  • from C:\update\26157 to C:\update\28612
  • from C:\update\23701 to C:\update\26157
  • from C:\update\12363 to C:\update\14401
  • from C:\update\10116 to C:\update\12363
  • from C:\update\16804 to C:\update\19103
  • from C:\update\14401 to C:\update\16804
  • from C:\update\28612 to C:\update\31016
  • from C:\update\10135 to C:\update\12616
  • from C:\update\7640 to C:\update\10135
  • from C:\update\15072 to C:\update\17476
  • from C:\update\12616 to C:\update\15072
  • from C:\update\547 to C:\update\2633
  • from C:\update\31016 to C:\update\547
  • from C:\update\5138 to C:\update\7640
  • from C:\update\2633 to C:\update\5138
  • from C:\update\262 to C:\update\2299
  • from C:\update\30783 to C:\update\262
  • from C:\update\4703 to C:\update\6949
  • from C:\update\2299 to C:\update\4703
  • from C:\update\25218 to C:\update\26969
  • from C:\update\23533 to C:\update\25218
  • from C:\update\28797 to C:\update\30783
  • from C:\update\26969 to C:\update\28797
  • from C:\update\6949 to C:\update\8938
  • from C:\update\19515 to C:\update\21579
  • from C:\update\17230 to C:\update\19515
  • from C:\update\23983 to C:\update\26282
  • from C:\update\21579 to C:\update\23983
  • from C:\update\11289 to C:\update\13438
  • from C:\update\8938 to C:\update\11289
  • from C:\update\15277 to C:\update\17230
  • from C:\update\13438 to C:\update\15277
  • from C:\update\30059 to C:\update\32306
  • from C:\update\28126 to C:\update\30059
  • from C:\update\1474 to C:\update\3721
  • from C:\update\32306 to C:\update\1474
  • from C:\update\21804 to C:\update\24155
  • from C:\update\19400 to C:\update\21804
  • from C:\update\26297 to C:\update\28126
  • from C:\update\24155 to C:\update\26297
  • from C:\update\3721 to C:\update\5710
  • from C:\update\17355 to C:\update\19553
  • from C:\update\15004 to C:\update\17355
  • from C:\update\21437 to C:\update\23533
  • from C:\update\19553 to C:\update\21437
  • from C:\update\8015 to C:\update\10066
  • from C:\update\5710 to C:\update\8015
  • from C:\update\12548 to C:\update\15004
  • from C:\update\10066 to C:\update\12548
  • from C:\update\9181 to C:\update\11218
  • from C:\update\6882 to C:\update\9181
  • from C:\update\13775 to C:\update\16228
  • from C:\update\11218 to C:\update\13775
  • from C:\update\32322 to C:\update\2049
  • from C:\update\30265 to C:\update\32322
  • from C:\update\4478 to C:\update\6882
  • from C:\update\2049 to C:\update\4478
  • from C:\update\16228 to C:\update\18628
  • from C:\update\28983 to C:\update\30812
  • from C:\update\27259 to C:\update\28983
  • from C:\update\32745 to C:\update\2276
  • from C:\update\30812 to C:\update\32745
  • from C:\update\20917 to C:\update\22988
  • from C:\update\18628 to C:\update\20917
  • from C:\update\25561 to C:\update\27259
  • from C:\update\22988 to C:\update\25561
  • from C:\update\2670 to C:\update\4721
  • from C:\update\783 to C:\update\2670
  • from C:\update\7154 to C:\update\9561
  • from C:\update\4721 to C:\update\7154
  • from C:\update\28372 to C:\update\30047
  • from C:\update\26282 to C:\update\28372
  • from C:\update\31771 to C:\update\783
  • from C:\update\30047 to C:\update\31771
  • from C:\update\9561 to C:\update\11863
  • from C:\update\23835 to C:\update\26199
  • from C:\update\21421 to C:\update\23835
  • from C:\update\28374 to C:\update\30265
  • from C:\update\26199 to C:\update\28374
  • from C:\update\13963 to C:\update\16441
  • from C:\update\11863 to C:\update\13963
  • from C:\update\18936 to C:\update\21421
  • from C:\update\16441 to C:\update\18936
  • from C:\update\16944 to C:\update\19400
  • from C:\update\22140 to C:\update\24335
  • from C:\update\20207 to C:\update\22140
  • from C:\update\26163 to C:\update\28149
  • from C:\update\24335 to C:\update\26163
  • from C:\update\13937 to C:\update\16288
  • from C:\update\11952 to C:\update\13937
  • from C:\update\18431 to C:\update\20207
  • from C:\update\16288 to C:\update\18431
  • from C:\update\28149 to C:\update\30451
  • from C:\update\7085 to C:\update\9384
  • from C:\update\5099 to C:\update\7085
  • from C:\update\11477 to C:\update\13152
  • from C:\update\9384 to C:\update\11477
  • from C:\update\32544 to C:\update\1507
  • from C:\update\30451 to C:\update\32544
  • from C:\update\3244 to C:\update\5099
  • from C:\update\1507 to C:\update\3244
  • from C:\update\22030 to C:\update\23951
  • from C:\update\19816 to C:\update\22030
  • from C:\update\26119 to C:\update\27895
  • from C:\update\23951 to C:\update\26119
  • from <Current directory>\wripten.exe to C:\update\15316
  • from <Full path to virus> to <Current directory>\wripten.exe
  • from C:\update\17873 to C:\update\19816
  • from C:\update\15316 to C:\update\17873
  • from C:\update\27895 to C:\update\29776
  • from C:\update\6172 to C:\update\8333
  • from C:\update\4281 to C:\update\6172
  • from C:\update\10097 to C:\update\11952
  • from C:\update\8333 to C:\update\10097
  • from C:\update\31866 to C:\update\774
  • from C:\update\29776 to C:\update\31866
  • from C:\update\2501 to C:\update\4281
  • from C:\update\774 to C:\update\2501
  • from C:\update\23875 to C:\update\25626
  • from C:\update\22190 to C:\update\23875
  • from C:\update\27405 to C:\update\29339
  • from C:\update\25626 to C:\update\27405
  • from C:\update\16534 to C:\update\18418
  • from C:\update\14758 to C:\update\16534
  • from C:\update\20512 to C:\update\22190
  • from C:\update\18418 to C:\update\20512
  • from C:\update\29339 to C:\update\31536
  • from C:\update\10048 to C:\update\12347
  • from C:\update\7644 to C:\update\10048
  • from C:\update\14437 to C:\update\16944
  • from C:\update\12347 to C:\update\14437
  • from C:\update\656 to C:\update\2707
  • from C:\update\31536 to C:\update\656
  • from C:\update\5188 to C:\update\7644
  • from C:\update\2707 to C:\update\5188
  • from C:\update\22812 to C:\update\25006
  • from C:\update\20461 to C:\update\22812
  • from C:\update\26887 to C:\update\28977
  • from C:\update\25006 to C:\update\26887
  • from C:\update\14883 to C:\update\16620
  • from C:\update\13152 to C:\update\14883
  • from C:\update\18475 to C:\update\20461
  • from C:\update\16620 to C:\update\18475
  • from C:\update\28977 to C:\update\31485
  • from C:\update\9644 to C:\update\11322
  • from C:\update\7969 to C:\update\9644
  • from C:\update\13007 to C:\update\14758
  • from C:\update\11322 to C:\update\13007
  • from C:\update\1173 to C:\update\3576
  • from C:\update\31485 to C:\update\1173
  • from C:\update\5875 to C:\update\7969
  • from C:\update\3576 to C:\update\5875
  • from C:\update\7350 to C:\update\9597
  • from C:\update\4999 to C:\update\7350
  • from C:\update\11530 to C:\update\13725
  • from C:\update\9597 to C:\update\11530
  • from C:\update\30348 to C:\update\88
  • from C:\update\27840 to C:\update\30348
  • from C:\update\2543 to C:\update\4999
  • from C:\update\88 to C:\update\2543
  • from C:\update\13725 to C:\update\15609
  • from C:\update\25951 to C:\update\28407
  • from C:\update\23469 to C:\update\25951
  • from C:\update\30810 to C:\update\341
  • from C:\update\28407 to C:\update\30810
  • from C:\update\17751 to C:\update\19531
  • from C:\update\15609 to C:\update\17751
  • from C:\update\21418 to C:\update\23469
  • from C:\update\19531 to C:\update\21418
  • from C:\update\827 to C:\update\3074
  • from C:\update\31244 to C:\update\827
  • from C:\update\5059 to C:\update\7358
  • from C:\update\3074 to C:\update\5059
  • from C:\update\24451 to C:\update\26750
  • from C:\update\22048 to C:\update\24451
  • from C:\update\28788 to C:\update\31244
  • from C:\update\26750 to C:\update\28788
  • from C:\update\7358 to C:\update\9445
  • from C:\update\21674 to C:\update\23869
  • from C:\update\19323 to C:\update\21674
  • from C:\update\25750 to C:\update\27840
  • from C:\update\23869 to C:\update\25750
  • from C:\update\11949 to C:\update\14451
  • from C:\update\9445 to C:\update\11949
  • from C:\update\16894 to C:\update\19323
  • from C:\update\14451 to C:\update\16894
  • from C:\update\13128 to C:\update\15629
  • from C:\update\11041 to C:\update\13128
  • from C:\update\18124 to C:\update\20554
  • from C:\update\15629 to C:\update\18124
  • from C:\update\5663 to C:\update\7387
  • from C:\update\3129 to C:\update\5663
  • from C:\update\9111 to C:\update\11041
  • from C:\update\7387 to C:\update\9111
  • from C:\update\20554 to C:\update\23059
  • from C:\update\1227 to C:\update\3696
  • from C:\update\31951 to C:\update\1227
  • from C:\update\6125 to C:\update\8477
  • from C:\update\3696 to C:\update\6125
  • from C:\update\25459 to C:\update\27699
  • from C:\update\23059 to C:\update\25459
  • from C:\update\29675 to C:\update\31951
  • from C:\update\27699 to C:\update\29675
  • from C:\update\11735 to C:\update\13466
  • from C:\update\9593 to C:\update\11735
  • from C:\update\15304 to C:\update\17306
  • from C:\update\13466 to C:\update\15304
  • from C:\update\2431 to C:\update\4887
  • from C:\update\341 to C:\update\2431
  • from C:\update\7290 to C:\update\9593
  • from C:\update\4887 to C:\update\7290
  • from C:\update\17306 to C:\update\19641
  • from C:\update\29500 to C:\update\31488
  • from C:\update\27671 to C:\update\29500
  • from C:\update\1026 to C:\update\3129
  • from C:\update\31488 to C:\update\1026
  • from C:\update\21803 to C:\update\23618
  • from C:\update\19641 to C:\update\21803
  • from C:\update\25525 to C:\update\27671
  • from C:\update\23618 to C:\update\25525
  • from C:\update\19592 to C:\update\22048
  • from C:\update\19413 to C:\update\21192
  • from C:\update\17267 to C:\update\19413
  • from C:\update\23083 to C:\update\25144
  • from C:\update\21192 to C:\update\23083
  • from C:\update\10837 to C:\update\13189
  • from C:\update\8382 to C:\update\10837
  • from C:\update\15383 to C:\update\17267
  • from C:\update\13189 to C:\update\15383
  • from C:\update\25144 to C:\update\27639
  • from C:\update\6597 to C:\update\9053
  • from C:\update\4507 to C:\update\6597
  • from C:\update\11460 to C:\update\13762
  • from C:\update\9053 to C:\update\11460
  • from C:\update\30124 to C:\update\32586
  • from C:\update\27639 to C:\update\30124
  • from C:\update\2235 to C:\update\4507
  • from C:\update\32586 to C:\update\2235
  • from C:\update\13588 to C:\update\16018
  • from C:\update\11093 to C:\update\13588
  • from C:\update\18421 to C:\update\20720
  • from C:\update\16018 to C:\update\18421
  • from C:\update\4314 to C:\update\6714
  • from C:\update\2276 to C:\update\4314
  • from C:\update\9010 to C:\update\11093
  • from C:\update\6714 to C:\update\9010
  • from C:\update\20720 to C:\update\22810
  • from C:\update\1328 to C:\update\3418
  • from C:\update\32215 to C:\update\1328
  • from C:\update\5926 to C:\update\8382
  • from C:\update\3418 to C:\update\5926
  • from C:\update\25266 to C:\update\27669
  • from C:\update\22810 to C:\update\25266
  • from C:\update\30021 to C:\update\32215
  • from C:\update\27669 to C:\update\30021
  • from C:\update\23567 to C:\update\25654
  • from C:\update\21272 to C:\update\23567
  • from C:\update\28156 to C:\update\30651
  • from C:\update\25654 to C:\update\28156
  • from C:\update\14558 to C:\update\16831
  • from C:\update\12611 to C:\update\14558
  • from C:\update\18868 to C:\update\21272
  • from C:\update\16831 to C:\update\18868
  • from C:\update\30651 to C:\update\364
  • from C:\update\12114 to C:\update\14615
  • from C:\update\9609 to C:\update\12114
  • from C:\update\17110 to C:\update\19592
  • from C:\update\14615 to C:\update\17110
  • from C:\update\2820 to C:\update\5224
  • from C:\update\364 to C:\update\2820
  • from C:\update\7522 to C:\update\9609
  • from C:\update\5224 to C:\update\7522
  • from C:\update\23578 to C:\update\25459
  • from C:\update\21384 to C:\update\23578
  • from C:\update\27553 to C:\update\29228
  • from C:\update\25459 to C:\update\27553
  • from C:\update\15859 to C:\update\17596
  • from C:\update\13762 to C:\update\15859
  • from C:\update\19451 to C:\update\21384
  • from C:\update\17596 to C:\update\19451
  • from C:\update\29228 to C:\update\30906
  • from C:\update\6929 to C:\update\9049
  • from C:\update\5035 to C:\update\6929
  • from C:\update\10776 to C:\update\12611
  • from C:\update\9049 to C:\update\10776
  • from C:\update\32591 to C:\update\1525
  • from C:\update\30906 to C:\update\32591
  • from C:\update\3252 to C:\update\5035
  • from C:\update\1525 to C:\update\3252
Network activity:
Connects to:
  • 'af#####815.meibu.net':12315
  • '12#.#25.114.144':80
TCP:
HTTP GET requests:
  • 12#.#25.114.144/
UDP:
  • DNS ASK af#####815.meibu.net
  • DNS ASK www.ba##u.com

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android