Meine Bibliothek
Meine Bibliothek

+ Zur Bibliothek hinzufügen

Support

Ihre Anfragen

Rufen Sie uns an

+7 (495) 789-45-86

Profil

Adware.Downware.2077

Added to the Dr.Web virus database: 2014-01-28

Virus description added:

Technical Information

To ensure autorun and distribution:
Creates the following services:
  • [<HKLM>\SYSTEM\ControlSet001\services\Guard.Mail.ru] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
  • '%TEMP%\GuardMailRu.exe' /install /nocheck
  • '%PROGRAM_FILES%\Mail.Ru\Guard\GuardMailRu.exe'
  • '%TEMP%\GuardMailRu.exe' /INSTALL2 /LANG=ru /GUID={53A5189C-21E6-45C7-BFC2-BF114FA47A0F}
  • '<Current directory>\MedalHonorWG_9370816_270.exe'
  • '%HOMEPATH%\Documents\MailRuSputnik.exe' /silent /rfr=openpart /partner_new_url=http://lo###oney.ru/v_install?si############################## /partner_online_url=http://lo###oney.ru/coi?gu#####################################
Executes the following:
  • '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%PROGRAM_FILES%\Mail.Ru\Sputnik\SputnikFlashPlayer.exe" "%PROGRAM_FILES%\Mail.Ru\Sputnik\SputnikFlashPlayer.exe" ENABLE ALL
  • '<SYSTEM32>\conhost.exe'
  • '<SYSTEM32>\reg.exe' import C:/Users/FFPXOMEV/AppData/Local/Temp/ie.reg
  • '<SYSTEM32>\cscript.exe' //B //Nologo "%TEMP%\shortcut.js"
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\start_search.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\stop.gif
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\st_d.gif
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\st_u.gif
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\stream_green_100x17.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\tabs\add_ico.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\tabs\add_ico_1.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\stream_logo_120x90.bmp
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\tabs\404_form.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\travel.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\troecarstvie.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\top.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\torg.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\tv.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\weather.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\widget.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\video.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\wap.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\tabs\logoback155.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\tabs\portal-menu__bg.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\tabs\input_right.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\tabs\logo.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\tabs\thumbail_bg.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\toolbar-logo.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\tria.gif
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\tabs\thumbnail_bg.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\tabs\thumbnail_bg_1.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\tabs\bg_line.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\tabs\button.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\tabs\ajax-loader.gif
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\tabs\ajax-loader_1.gif
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\tabs\button_bg.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\tabs\ico.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\tabs\input_bg.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\tabs\close.gif
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\tabs\form.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\hi_tech.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\horo.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\foto.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\games.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\hosting.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\lady.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\legenda.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\jagger.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\jokes.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\deti.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\dictionaries.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\content.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\crossfire.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\drive.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\encyclopedies.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\files.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\education.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\email.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\pics.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\rabota.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\ok.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\perfect_world.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\realty.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\soft.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\sputnik.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\search.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\showbiz.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\mail_agent.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\maps.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\loong.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\love.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\mobile.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\my_world.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\news.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\money.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\my_site.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\trib.gif
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\send.js
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\storage.js
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\search.js
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\searchControl.js
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\toolbar.js
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\webMetrics.js
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\xcom.services.js
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\version.js
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\vote.js
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\ggrelease.js
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\highlighter.js
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\ggdebug.js
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\gglib.js
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\httpRequestObserver.js
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\rawdeflate.js
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\resizeImage.js
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\installation.js
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\observers.js
  • %PROGRAM_FILES%\Mail.Ru\Sputnik\MailRuSputnik.dll
  • %PROGRAM_FILES%\Mail.Ru\Sputnik\SputnikFlashPlayer.exe
  • %TEMP%\shortcut.js
  • %APPDATA%\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mail.Ru.lnk
  • %PROGRAM_FILES%\Mail.Ru\Sputnik\MailRuSputnik.exe
  • %PROGRAM_FILES%\Mail.Ru\Guard\GuardMailRu.exe
  • <SYSTEM32>\config\systemprofile\AppData\Roaming\{DCD48218-E972-4d0c-9E5F-43462BC13E3B}\{9bed5ee2-0547-4706-8600-d3897629ade0}
  • %TEMP%\GuardMailRu.exe
  • <Auxiliary element>
  • %TEMP%\ie.reg
  • %HOMEPATH%\Favorites\Mail.Ru.url
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\xcom.services.ok.js
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\xmlObjects.js
  • %HOMEPATH%\Favorites\Mail.Ru Агент - используй для общения!.url
  • <LS_APPDATA>Low\Mail.Ru\Sputnik\MailRu.ico
  • %TEMP%\Mail.Ru.lnk
  • <LS_APPDATA>Low\Mail.Ru\GoMailRu.ico
  • %HOMEPATH%\Desktop\Искать в Интернете.url
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\2_10.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\2_4.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\1_8.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\1_9.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\2_5.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\2_8.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\2_9.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\2_6.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\2_7.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\0_8.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\0_9.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\0_10.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\0_5.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\1_10.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\1_6.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\1_7.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\1_4.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\1_5.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\defaults\preferences\mail.ru.js
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\install.rdf
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\components\odnoklassniki.xcom.js
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\components\sputnik.xcom.js
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\addonListener.js
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\base64.js
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\chevron.js
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\ajaxService.js
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\lib\attention.js
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\3_5.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\3_6.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\3_10.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\3_4.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\3_7.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather_default.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\zoom.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\3_8.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\3_9.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.currency.chf.xml
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.currency.cny.xml
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.currency.byr.xml
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.currency.cad.xml
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.currency.dkk.xml
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.currency.isk.xml
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.currency.jpy.xml
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.currency.eur.xml
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.currency.gbp.xml
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\mail.ru.search_provider.xml
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\mail.ru.searchtools.xml
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\contents.rdf
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\http_form_strings.properties
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\mail.ru.toolbar.properties
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.2gis.xml
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.currency.aud.xml
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\mail.ru.weather_city.xml
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\InformerStream.xml
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.my.xml
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.provider.xml
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.maps.xml
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.money.xml
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.url-rank.xml
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\mail.ru.fast-services.xml
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\mail.ru.search.xml
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.weather.xml
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\mail.ru.cyrrencies.xml
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.currency.sek.xml
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.currency.sgd.xml
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.currency.kzt.xml
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.currency.nok.xml
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.currency.try.xml
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.currency.xdr.xml
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.mail.xml
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.currency.uah.xml
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\informer.currency.usd.xml
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\content\defaultValue.js
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\content\informerPanel.xml
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\content\chevron.xml
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\content\contents.rdf
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\content\mail.ru.xml
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\content\newtabhomepage.js
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\content\save_controls.js
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\content\music_window.js
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\content\newtab.xul
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\prefs.tmp
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\MRSputnikData\install_options.xml
  • <Current directory>\MedalHonorWG_9370816_270.exe
  • %HOMEPATH%\Documents\MailRuSputnik.exe
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\META-INF\manifest.mf
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome.manifest
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\content\brand.js
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\META-INF\zigbert.rsa
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\META-INF\zigbert.sf
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\form\404_form.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\form\contents.rdf
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\content\tabs_storage.js
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\content\tools.js
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\form\logo.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\ansi.properties
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\blank.html
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\form\logoback155.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\form\search404.css
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\content\settings.js
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\content\settings.xul
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\content\search.js
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\content\search.xml
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\content\sputnik\mailruInformers.js
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\content\sputnik\sputnik.toolbar.xul
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\content\tabs.js
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\content\sputnik\mailruObservers.js
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\content\sputnik\sputnik.js
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\mail.ru.services.xml
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\marks.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\messages.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\mailru_logo.gif
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\map.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\money.gif
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\odnoklassniki_info_logo.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\odnoklassniki_logo.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\notifications.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\odnoklassniki.ru.toolbar.css
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\hilite_text.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\informer_class.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\gripper.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\guests.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\jams_100x17.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\mail.ru.tabs.css
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\mail.ru.toolbar.css
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\mail.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\mail.ru.search.css
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\blogs.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\boomz.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\auto.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\berserk.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\bugz.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\catalog.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\chats.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\business_tycoon.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\cards.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\search_discuss.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\search_page.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\preferences.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\req_vote.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\search_text.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\allods.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\answers.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\3sider.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\services\afisha.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\contents.rdf
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\currencies\aud_na.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\checkbox-disabled.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\checkbox-unchecked.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\currencies\byr_na.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\currencies\cny_na.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\currencies\dkk_na.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\currencies\cad_na.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\currencies\chf_na.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\2gis.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\arrow.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik\mail.ru.toolbar.dtd
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\locale\ru-RU\sputnik_form_edit.html
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\back.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\c_t.gif
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\checkbox-checked.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\back_dark.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\c_b.gif
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\currencies\xdr_na.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\currency_arrow_down.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\currencies\uah_na.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\currencies\usd_na.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\currency_arrow_up.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\flow.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\greycar.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\discussions.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\eqv.gif
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\currencies\isk_na.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\currencies\jpy_na.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\currencies\eur_na.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\currencies\gbp_na.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\currencies\kzt_na.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\currencies\sgd_na.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\currencies\try_na.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\currencies\nok_na.png
  • %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\currencies\sek_na.png
Deletes the following files:
  • %TEMP%\Mail.Ru.lnk
  • %TEMP%\shortcut.js
Moves the following files:
  • from %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\prefs.tmp to %APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\prefs.js
Network activity:
UDP:
  • DNS ASK dn#.##ftncsi.com
  • DNS ASK mr#.mail.ru
Miscellaneous:
Searches for the following windows:
  • ClassName: 'Shell_TrayWnd' WindowName: ''

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android