Meine Bibliothek
Meine Bibliothek

+ Zur Bibliothek hinzufügen

Support

Ihre Anfragen

Rufen Sie uns an

+7 (495) 789-45-86

Profil

Trojan.DownLoader11.20679

Added to the Dr.Web virus database: 2014-07-05

Virus description added:

Technical Information

Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
  • [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\AntiSoft\F30245_s_0516.exe' = '%PROGRAM_FILES%\AntiSoft\F30245_s_0516.exe:*:Enabled:百度杀毒安装程序'
  • [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\AntiSoft\F30245_s_0516.exe' = '%PROGRAM_FILES%\AntiSoft\F30245_s_0516.exe:*:Enabled:百度杀毒安装程序'
Creates and executes the following:
  • '%TEMP%\BDDownloader_Installer\1.0.106.1[2014-4-22-17-33-23]\bddownloader.exe' /install
  • '%PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\BDDownloader.exe'
  • '%PROGRAM_FILES%\AntiSoft\F30245_s_0516.exe'
Executes the following:
  • '<SYSTEM32>\notepad.exe' %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\css1[1].css
Modifies file system :
Creates the following files:
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmantivirus\Microsoft.VC80.CRT\msvcm80.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmantivirus\Microsoft.VC80.CRT\msvcp80.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvrtpplugins\Microsoft.VC80.CRT\.svn\text-base\msvcr80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmantivirus\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmantivirus\Microsoft.VC80.CRT\.svn\entries
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmantivirus\Microsoft.VC80.CRT\.svn\format
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmantivirus\Microsoft.VC80.CRT\msvcr80.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmantivirus\Microsoft.VC80.CRT\.svn\all-wcprops
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvrtpplugins\Microsoft.VC80.CRT\.svn\text-base\msvcp80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvrtpplugins\Microsoft.VC80.CRT\.svn\format
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvrtpplugins\Microsoft.VC80.CRT\.svn\prop-base\msvcm80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvrtpplugins\Microsoft.VC80.CRT\.svn\all-wcprops
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvrtpplugins\Microsoft.VC80.CRT\.svn\entries
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvrtpplugins\Microsoft.VC80.CRT\.svn\text-base\Microsoft.VC80.CRT.manifest.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvrtpplugins\Microsoft.VC80.CRT\.svn\text-base\msvcm80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvrtpplugins\Microsoft.VC80.CRT\.svn\prop-base\msvcp80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvrtpplugins\Microsoft.VC80.CRT\.svn\prop-base\msvcr80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmantivirus\Microsoft.VC80.CRT\.svn\prop-base\msvcm80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmsysrepair\Microsoft.VC80.CRT\.svn\entries
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmsysrepair\Microsoft.VC80.CRT\.svn\format
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmsysrepair\Microsoft.VC80.CRT\msvcr80.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmsysrepair\Microsoft.VC80.CRT\.svn\all-wcprops
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmsysrepair\Microsoft.VC80.CRT\.svn\prop-base\msvcr80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmsysrepair\Microsoft.VC80.CRT\.svn\text-base\Microsoft.VC80.CRT.manifest.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmsysrepair\Microsoft.VC80.CRT\.svn\prop-base\msvcm80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmsysrepair\Microsoft.VC80.CRT\.svn\prop-base\msvcp80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmsysrepair\Microsoft.VC80.CRT\msvcp80.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmantivirus\Microsoft.VC80.CRT\.svn\text-base\Microsoft.VC80.CRT.manifest.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmantivirus\Microsoft.VC80.CRT\.svn\text-base\msvcm80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmantivirus\Microsoft.VC80.CRT\.svn\prop-base\msvcp80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmantivirus\Microsoft.VC80.CRT\.svn\prop-base\msvcr80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmsysrepair\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmsysrepair\Microsoft.VC80.CRT\msvcm80.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmantivirus\Microsoft.VC80.CRT\.svn\text-base\msvcp80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmantivirus\Microsoft.VC80.CRT\.svn\text-base\msvcr80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkv\Microsoft.VC80.CRT\.svn\prop-base\msvcp80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkv\Microsoft.VC80.CRT\.svn\prop-base\msvcr80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkv\Microsoft.VC80.CRT\.svn\format
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkv\Microsoft.VC80.CRT\.svn\prop-base\msvcm80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkv\Microsoft.VC80.CRT\.svn\text-base\msvcp80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkv\Microsoft.VC80.CRT\.svn\text-base\msvcr80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkv\Microsoft.VC80.CRT\.svn\text-base\Microsoft.VC80.CRT.manifest.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkv\Microsoft.VC80.CRT\.svn\text-base\msvcm80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkv\Microsoft.VC80.CRT\.svn\entries
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\Microsoft.VC80.CRT\.svn\text-base\msvcr80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkv\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\Microsoft.VC80.CRT\.svn\text-base\msvcm80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\Microsoft.VC80.CRT\.svn\text-base\msvcp80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkv\Microsoft.VC80.CRT\msvcr80.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkv\Microsoft.VC80.CRT\.svn\all-wcprops
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkv\Microsoft.VC80.CRT\msvcm80.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkv\Microsoft.VC80.CRT\msvcp80.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvtrayplugins\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvtrayplugins\Microsoft.VC80.CRT\.svn\text-base\msvcp80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvtrayplugins\Microsoft.VC80.CRT\.svn\text-base\msvcr80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvtrayplugins\Microsoft.VC80.CRT\.svn\text-base\Microsoft.VC80.CRT.manifest.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvtrayplugins\Microsoft.VC80.CRT\.svn\text-base\msvcm80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvrtpplugins\Microsoft.VC80.CRT\msvcp80.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvrtpplugins\Microsoft.VC80.CRT\msvcr80.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvrtpplugins\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvrtpplugins\Microsoft.VC80.CRT\msvcm80.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvtrayplugins\Microsoft.VC80.CRT\.svn\prop-base\msvcr80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvtrayplugins\Microsoft.VC80.CRT\msvcr80.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvtrayplugins\Microsoft.VC80.CRT\.svn\all-wcprops
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvtrayplugins\Microsoft.VC80.CRT\msvcm80.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvtrayplugins\Microsoft.VC80.CRT\msvcp80.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvtrayplugins\Microsoft.VC80.CRT\.svn\prop-base\msvcm80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvtrayplugins\Microsoft.VC80.CRT\.svn\prop-base\msvcp80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvtrayplugins\Microsoft.VC80.CRT\.svn\entries
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvtrayplugins\Microsoft.VC80.CRT\.svn\format
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmsysrepair\Microsoft.VC80.CRT\.svn\text-base\msvcm80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\BDMTinyXml.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\BDMStringUtils.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\BDMFrameWork.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\BDMBase.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\BDKVDownloadProtect.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\BDKVDownloadProtect_x64.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\BDConfig.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\BDPerflog.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\BDMLog.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\BDKVDeskBand.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\BDKVDeskBand64.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\BDMSDWrench.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\BDCooly.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\DesktopToast.exe
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\BDMMsg.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\tuopan.png
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\ToastImage.png
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\explugin\ieBaiduSDDetectPlug.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\dl.dll
  • %TEMP%\BDDownloader_Installer\1.0.106.1[2014-4-22-17-33-23]\bddownloader.exe
  • %TEMP%\nsdD.tmp
  • %TEMP%\nsxE.tmp\System.dll
  • %TEMP%\BDDownloader_Installer\1.0.106.1[2014-4-22-17-33-23]\bdcomproxy.dll
  • %CommonProgramFiles%\Baidu\BDDownload\106\bddownloader.exe
  • %TEMP%\BDDownloader_Installer\1.0.106.1[2014-4-22-17-33-23]\7z.dll
  • %TEMP%\BDDownloader_Installer\1.0.106.1[2014-4-22-17-33-23]\dl.dll
  • %ALLUSERSPROFILE%\Application Data\Baidu\BaiduSd\Config\809.dat
  • %ALLUSERSPROFILE%\Application Data\Baidu\BaiduSd\Config\811.dat
  • %ALLUSERSPROFILE%\Application Data\Baidu\BaiduSd\Config\900.dat
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\explugin\npBaiduSDDetectPlug.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bd0001.dll
  • %ALLUSERSPROFILE%\Application Data\Baidu\BaiduSd\Config\806.dat
  • %ALLUSERSPROFILE%\Application Data\Baidu\BaiduSd\Config\810.dat
  • %ALLUSERSPROFILE%\Application Data\Baidu\BaiduSd\Config\901.dat
  • %ALLUSERSPROFILE%\Application Data\Baidu\BaiduSd\Config\804.dat
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\BaiduSdTray.exe
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\BaiduSdUpdate.exe
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\BaiduSd.exe
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\BaiduSdSvc.exe
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\BDKVWsc.exe
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\BaiduSdRepair.exe
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\BaiduSdBugRpt.exe
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\BDDownloader.exe
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\ToastLogo.ico
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\hips.xml
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\iexplore.exe.xml
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmsysrepair\Microsoft.VC80.CRT\.svn\text-base\msvcp80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmsysrepair\Microsoft.VC80.CRT\.svn\text-base\msvcr80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\NetService.ini
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\app.ico
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\tips.xml
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\GameNoDisturb.ini
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\uninst.exe
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\BDMUpdate.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\DriverManager.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\BDMReport.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\BDMSkin.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\ad.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\updlog.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\BDShellExt.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\BDShellExt64.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\BDMPatchAgent.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\BDKVMainFrame.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\BDLogicUtils.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\BaiduSdUProxy64.exe
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\BDKVLogs.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\BDMEvents.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\BDMNet.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\BDMAVE.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\BDMDownload.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmsysrepair\BSRLib.dat
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\BAV\BDAVCScan.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmsysrepair\BDMSRCore.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmsysrepair\BDMSREng.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmantivirus\blacksign.dat
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmantivirus\cache_config.dat
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\BAV\bdmp.dat
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\BAV\bdvs.dat
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\coolyplugins\CoolyContainerConfig.xml
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvtrayplugins\TrayPluginContainerConfig.xml
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvrtpplugins\RtpContainerConfig.xml
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvtrayplugins\BDKVTrayTipsPlugin.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvtrayplugins\UserDetectionPlugin.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvrtpplugins\PrivacyProtect.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvrtpplugins\fm.dat
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvrtpplugins\FileMon.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvrtpplugins\HIPS.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmantivirus\kav_verify.dat
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmantivirus\BDUDiskGuard.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmantivirus\bduf.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmantivirus\BDMRepBase.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmantivirus\BDMRepMgr.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmantivirus\TrustAndIso.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\Skins\Default\BDKV.rdb
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmantivirus\CompatibilityChecker.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmantivirus\KavUpdate.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmantivirus\BDMPerfMon.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmantivirus\systemfile.dat
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmantivirus\virus_type.dat
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmantivirus\monitor_config.dat
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmantivirus\scan_mgr_config.dat
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmantivirus\BDMAVCached.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmantivirus\BDMAVEng.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmantivirus\wverify.dat
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmantivirus\BDKitUtils.dll
  • %TEMP%\nsv7.tmp\nsProcess.dll
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\css1[1].css
  • %HOMEPATH%\Start Menu\Programs\AntiSoft\Uninstall.lnk
  • %PROGRAM_FILES%\AntiSoft\uninst.exe
  • %TEMP%\nstA.tmp
  • %TEMP%\nspB.tmp\System.dll
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\css1[1].css:Zone.Identifier
  • %TEMP%\nsv7.tmp\ExecCmd.dll
  • %PROGRAM_FILES%\AntiSoft\F30245_s_0516.exe
  • %TEMP%\nsa3.tmp\Inetc.dll
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\iplookup[1].php
  • %TEMP%\nsf2.tmp
  • %TEMP%\nsa3.tmp\Base64.dll
  • %TEMP%\nsv7.tmp\Base64.dll
  • %TEMP%\nsv7.tmp\Inetc.dll
  • %TEMP%\i.rar
  • %TEMP%\nsb6.tmp
  • %TEMP%\nspB.tmp\PluginInstallHelper.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\repairplugins\baidusdRepair.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\repairplugins\RepairPluginContainerConfig.xml
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\KVTray_PluginConfig.xml
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\Repair_PluginConfig.xml
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvtrayplugins\BDDownLoadProtectPlugin.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvtrayplugins\BDKVRmvDevPlugin.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkv\BDKVVirusPlugins.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkv\KVMainframePluginContainerConfig.xml
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\KVRtp_PluginConfig.xml
  • %TEMP%\nspB.tmp\GetSupplyId.dll
  • %TEMP%\nspB.tmp\res\InstallWnd.zip
  • %TEMP%\nspB.tmp\NewPih.dll
  • %TEMP%\nspB.tmp\KVInstallHelper.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\Cooly_PluginConfig.xml
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\KVMainframe_PluginConfig.xml
  • %TEMP%\nspB.tmp\BDMSkin.dll
  • <Auxiliary element>
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\Skins\Default\BDKVConfig.rdb
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmantivirus\Microsoft.VC80.ATL\.svn\entries
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmantivirus\Microsoft.VC80.ATL\.svn\format
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmantivirus\Microsoft.VC80.ATL\atl80.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmantivirus\Microsoft.VC80.ATL\.svn\all-wcprops
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmantivirus\Microsoft.VC80.ATL\.svn\text-base\atl80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmsysrepair\Microsoft.VC80.ATL\Microsoft.VC80.ATL.manifest
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmantivirus\Microsoft.VC80.ATL\.svn\prop-base\atl80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmantivirus\Microsoft.VC80.ATL\.svn\text-base\Microsoft.VC80.ATL.manifest.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmantivirus\Microsoft.VC80.ATL\Microsoft.VC80.ATL.manifest
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvrtpplugins\Microsoft.VC80.ATL\.svn\all-wcprops
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvrtpplugins\Microsoft.VC80.ATL\.svn\entries
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvrtpplugins\Microsoft.VC80.ATL\Microsoft.VC80.ATL.manifest
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvrtpplugins\Microsoft.VC80.ATL\atl80.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvrtpplugins\Microsoft.VC80.ATL\.svn\text-base\Microsoft.VC80.ATL.manifest.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvrtpplugins\Microsoft.VC80.ATL\.svn\text-base\atl80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvrtpplugins\Microsoft.VC80.ATL\.svn\format
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvrtpplugins\Microsoft.VC80.ATL\.svn\prop-base\atl80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmsysrepair\Microsoft.VC80.ATL\atl80.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\Microsoft.VC80.CRT\.svn\entries
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\Microsoft.VC80.CRT\.svn\format
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\Microsoft.VC80.CRT\msvcr80.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\Microsoft.VC80.CRT\.svn\all-wcprops
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\Microsoft.VC80.CRT\.svn\prop-base\msvcr80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\Microsoft.VC80.CRT\.svn\text-base\Microsoft.VC80.CRT.manifest.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\Microsoft.VC80.CRT\.svn\prop-base\msvcm80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\Microsoft.VC80.CRT\.svn\prop-base\msvcp80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\Microsoft.VC80.CRT\msvcp80.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmsysrepair\Microsoft.VC80.ATL\.svn\format
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmsysrepair\Microsoft.VC80.ATL\.svn\prop-base\atl80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmsysrepair\Microsoft.VC80.ATL\.svn\all-wcprops
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmsysrepair\Microsoft.VC80.ATL\.svn\entries
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\Microsoft.VC80.CRT\msvcm80.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmsysrepair\Microsoft.VC80.ATL\.svn\text-base\Microsoft.VC80.ATL.manifest.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\bdmsysrepair\Microsoft.VC80.ATL\.svn\text-base\atl80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\Microsoft.VC80.ATL\Microsoft.VC80.ATL.manifest
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\Microsoft.VC80.ATL\atl80.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\licenses\directui license.txt
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\licenses\duilib license.txt
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\Microsoft.VC80.ATL\.svn\format
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\Microsoft.VC80.ATL\.svn\prop-base\atl80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\Microsoft.VC80.ATL\.svn\all-wcprops
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\Microsoft.VC80.ATL\.svn\entries
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\Skins\Default\BDKVTray\TrayPlugin.rdb
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\Skins\Default\BDKVTray.rdb
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\Skins\Default\BDKVUpdate.rdb
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\Skins\Default\BDKVQuarantine.rdb
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\Skins\Default\BDKVTips.rdb
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\Skins\Default\TrayDldProtect.rdb
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\Skins\Default\TrayPlugin.rdb
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\Skins\Default\KVCommonRes.rdb
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\Skins\Default\SearchProtection.rdb
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\Microsoft.VC80.ATL\.svn\text-base\Microsoft.VC80.ATL.manifest.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvtrayplugins\Microsoft.VC80.ATL\.svn\all-wcprops
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvtrayplugins\Microsoft.VC80.ATL\.svn\entries
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvtrayplugins\Microsoft.VC80.ATL\Microsoft.VC80.ATL.manifest
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvtrayplugins\Microsoft.VC80.ATL\atl80.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvtrayplugins\Microsoft.VC80.ATL\.svn\text-base\Microsoft.VC80.ATL.manifest.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvtrayplugins\Microsoft.VC80.ATL\.svn\text-base\atl80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvtrayplugins\Microsoft.VC80.ATL\.svn\format
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkvtrayplugins\Microsoft.VC80.ATL\.svn\prop-base\atl80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkv\Microsoft.VC80.ATL\.svn\text-base\atl80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkv\Microsoft.VC80.ATL\atl80.dll
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkv\Microsoft.VC80.ATL\.svn\all-wcprops
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\Microsoft.VC80.ATL\.svn\text-base\atl80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkv\Microsoft.VC80.ATL\Microsoft.VC80.ATL.manifest
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkv\Microsoft.VC80.ATL\.svn\prop-base\atl80.dll.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkv\Microsoft.VC80.ATL\.svn\text-base\Microsoft.VC80.ATL.manifest.svn-base
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkv\Microsoft.VC80.ATL\.svn\entries
  • %PROGRAM_FILES%\Baidu\BaiduSd\1.8.0.1243\plugins\bdkv\Microsoft.VC80.ATL\.svn\format
Deletes the following files:
  • %TEMP%\nsxE.tmp\System.dll
  • <Auxiliary element>
Network activity:
Connects to:
  • 'do##.albags.cn':22
  • 'do##.0791jc.cn':22
  • 'f.##txgt.cn':80
  • 'in#.###ol.sina.com.cn':80
  • 'localhost':1037
TCP:
HTTP GET requests:
  • f.##txgt.cn/<Auxiliary name>.exe/css1.css
  • in#.###ol.sina.com.cn/iplookup/iplookup.php
UDP:
  • DNS ASK do##.albags.cn
  • DNS ASK do##.0791jc.cn
  • DNS ASK in#.###ol.sina.com.cn
  • DNS ASK f.##txgt.cn
Miscellaneous:
Searches for the following windows:
  • ClassName: 'BDKVUpV' WindowName: '(null)'
  • ClassName: '#32770' WindowName: '(null)'
  • ClassName: 'OnLineWnd' WindowName: '(null)'
  • ClassName: 'BDKVUpA' WindowName: '(null)'
  • ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
  • ClassName: '' WindowName: '(null)'
  • ClassName: 'Shell_TrayWnd' WindowName: '(null)'
  • ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
  • ClassName: 'IEFrame' WindowName: '(null)'

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android