Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\setting[3].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\setting[3].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\setting[2].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\setting[2].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\setting[3].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\setting[4].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\setting[4].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\setting[3].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\setting[4].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\setting[2].ini
<SYSTEM32>\autorun.ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\setting[1].ini
<SYSTEM32>\chrome.exe
%WINDIR%\chrome.exe
<SYSTEM32>\setting.ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\setting[1].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\setting[2].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\setting[1].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\setting[1].ini
Sets the 'hidden' attribute to the following files:
<SYSTEM32>\setting.ini
<Drive name for removable media>:\autorun.inf
<SYSTEM32>\chrome.exe
<SYSTEM32>\autorun.ini
Deletes the following files:
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\setting[3].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\setting[3].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\setting[3].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\setting[3].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\setting[4].ini
<SYSTEM32>\setting.ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\setting[4].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\setting[4].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\setting[2].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\setting[1].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\setting[1].ini
<SYSTEM32>\setting.ini.old
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\setting[1].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\setting[2].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\setting[2].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\setting[1].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\setting[2].ini
Moves the following files:
from <SYSTEM32>\setting.ini.old to <SYSTEM32>\setting.ini
from <SYSTEM32>\setting.ini to <SYSTEM32>\setting.ini.old
Network activity:
Connects to:
'h1.##pway.com':80
TCP:
HTTP GET requests:
h1.##pway.com/sdb5/setting.ini
h1.##pway.com/sdb4/setting.ini
h1.##pway.com/sdb3/setting.ini
h1.##pway.com/sdb6/setting.ini
h1.##pway.com/sdb9/setting.ini
h1.##pway.com/sdb8/setting.ini
h1.##pway.com/sdb7/setting.ini
h1.##pway.com/sdb2/setting.ini
h1.##pway.com/poojasharma3/setting.ini
h1.##pway.com/poojasharma2/setting.ini
h1.##pway.com/poojasharma1/setting.ini
h1.##pway.com/poojasharma4/setting.ini
h1.##pway.com/sdb1/setting.ini
h1.##pway.com/sdb0/setting.ini
h1.##pway.com/poojasharma5/setting.ini
UDP:
DNS ASK h1.##pway.com
Miscellaneous:
Searches for the following windows:
ClassName: 'Indicator' WindowName: '(null)'
Descargue Dr.Web para Android
Gratis por 3 meses
Todos los componentes de protección
Renovación de la demo a través de AppGallery/Google Pay
Si Vd. continúa usando este sitio web, esto significa que Vd. acepta el uso de archivos Cookie y otras tecnologías para que recabemos las estadísticas sobre los visitantes. Más información