Mi biblioteca
Mi biblioteca

+ Añadir a la biblioteca

Soporte
Soporte 24 horas | Normas de contactar

Sus solicitudes

Perfil

Adware.Gexin.3013

Added to the Dr.Web virus database: 2018-09-25

Virus description added:

Technical information

Malicious functions:
Executes code of the following detected threats:
  • Adware.Gexin.2.origin
Network activity:
Connecting to:
  • UDP(DNS) <Google DNS>
  • TCP(HTTP/1.1) z.c####.com:80
  • TCP(HTTP/1.1) w####.com:80
  • TCP(HTTP/1.1) l####.tbs.qq.com:80
  • TCP(HTTP/1.1) api.map.b####.com:80
  • TCP(HTTP/1.1) www.pand####.cn:80
  • TCP(HTTP/1.1) c.c####.com:80
  • TCP(HTTP/1.1) gm.mm####.com:80
  • TCP(HTTP/1.1) m.w####.cn:80
  • TCP(HTTP/1.1) pco####.ta####.com:80
  • TCP(HTTP/1.1) kln.g####.sina####.com:80
  • TCP(HTTP/1.1) m1.pand####.cn:80
  • TCP(TLS/1.0) kln.g####.sina####.com:443
  • TCP(TLS/1.0) 2####.58.212.142:443
  • TCP(TLS/1.0) weib####.g####.sina####.com:443
  • TCP(TLS/1.0) tvaw####.g####.sina####.com:443
  • TCP(TLS/1.0) imgaliy####.mia####.com:443
  • TCP(TLS/1.0) w####.com.edg####.net:443
  • TCP(TLS/1.0) m.w####.cn:443
DNS requests:
  • api.map.b####.com
  • c####.mm####.com
  • c.c####.com
  • h5.sin####.cn
  • i####.pand####.cn
  • imgaliy####.mia####.com
  • l####.tbs.qq.com
  • m.w####.cn
  • m1.pand####.cn
  • pand####.cn
  • pco####.c####.com
  • s11.c####.com
  • sit####.b####.com
  • t####.sin####.cn
  • u.pand####.cn
  • w####.com
  • ww1.sin####.cn
  • ww2.sin####.cn
  • ww3.sin####.cn
  • ww4.sin####.cn
  • www.pand####.cn
  • www.w####.com
  • wx1.sin####.cn
  • wx2.sin####.cn
  • z13.c####.com
HTTP GET requests:
  • api.map.b####.com/getscript?v=####&ak=####&services=####&t=####
  • api.map.b####.com/images/blank.gif?product=####&v=####&t=####&code=####
  • c.c####.com/core.php?web_id=####&t=####
  • c.c####.com/z_stat.php?id=####&web_id=####
  • gm.mm####.com/9.gif?abc=####&rnd=####
  • kln.g####.sina####.com/upload/2015/06/12/2/toolbar_icon_discuss_default....
  • m.w####.cn/5066970342?&jumpfrom=####
  • m1.pand####.cn/Api/PlatProps/CheckAppVersion?AppType=####
  • m1.pand####.cn/Api/PlatProps/CheckAppVersion?isDiff=####&android=####&ap...
  • m1.pand####.cn/Article/Detail?id=####&title=####
  • m1.pand####.cn/assets/2018/04/29/3311e2b6451-275220_jpg!800x800.jpg
  • m1.pand####.cn/assets/2018/04/29/336cc5a2041-143150_jpg!800x800.jpg
  • m1.pand####.cn/assets/2018/04/30/342bcb57815-9600_png!100x100.png
  • m1.pand####.cn/assets/2018/04/30/342d5249197-9600_png!100x100.png
  • m1.pand####.cn/assets/2018/04/30/34445b91613-11097_png!100x100.png
  • m1.pand####.cn/assets/2018/04/30/344a57e3093-13357_png!100x100.png
  • m1.pand####.cn/assets/2018/04/30/344f7449582-10445_png!100x100.png
  • m1.pand####.cn/assets/2018/05/25/2b1b2c01005-333809_jpg!1500x1500.jpg
  • m1.pand####.cn/assets/2018/06/04/26a989b9071-188862_jpg!1134x1134.jpg
  • m1.pand####.cn/assets/2018/06/07/6bf72da6890-278499_jpg!800x800.jpg
  • m1.pand####.cn/assets/2018/06/09/17785741169-207933_jpg!1181x1181.jpg
  • m1.pand####.cn/assets/2018/06/09/565c7073129-165210_jpg!1181x1181.jpg
  • m1.pand####.cn/assets/2018/06/11/3371cf62134-367579_jpg!1600x1600.jpg
  • m1.pand####.cn/assets/2018/06/13/51728ba6527-197721_jpg!1000x1000.jpg
  • m1.pand####.cn/assets/2018/06/13/58a3bee6517-193712_jpg!1000x1000.jpg
  • m1.pand####.cn/assets/2018/06/14/1315d5c5096-215221_jpg!1000x1000.jpg
  • m1.pand####.cn/assets/2018/06/14/14e9b2c2154-142140_jpg!1000x1000.jpg
  • m1.pand####.cn/assets/2018/06/15/2818b762328-328732_jpg!1000x1000.jpg
  • m1.pand####.cn/assets/2018/06/15/342edc23511-287559_jpg!500x500.jpg
  • m1.pand####.cn/assets/2018/06/22/262c1bd6158-146419_jpg!1000x1000.jpg
  • m1.pand####.cn/assets/2018/06/22/2aedeb87633-216248_jpg!1000x1000.jpg
  • m1.pand####.cn/assets/2018/06/28/342ea739109-182276_jpg!1000x1000.jpg
  • m1.pand####.cn/assets/2018/07/04/34014673366-203384_jpg!1000x1000.jpg
  • m1.pand####.cn/assets/2018/07/09/2b856359714-187466_jpg!640x1000.jpg
  • m1.pand####.cn/assets/2018/07/14/2a6476c6096-373514_jpg!750x750.jpg
  • m1.pand####.cn/assets/2018/07/14/347400a9206-141520_jpg!800x800.jpg
  • m1.pand####.cn/assets/2018/07/14/34ad2862347-245984_jpg!750x1177.jpg
  • m1.pand####.cn/assets/2018/08/14/5715ae04022-35587_jpg!800x800.jpg
  • m1.pand####.cn/assets/2018/08/27/57123821718-290079_jpg!1000x1000.jpg
  • m1.pand####.cn/assets/2018/08/28/628900e8944-139555_jpg!1000x1000.jpg
  • m1.pand####.cn/assets/2018/08/29/62291bf5449-109299_jpg!1000x1000.jpg
  • m1.pand####.cn/assets/2018/08/30/33e34ed4478-130518_jpg!1000x1000.jpg
  • m1.pand####.cn/assets/2018/08/31/273c9f34552-146547_jpg!750x360.jpg
  • m1.pand####.cn/assets/2018/08/31/28268413640-263747_jpg!750x360.jpg
  • m1.pand####.cn/assets/2018/08/31/282c1159052-197548_jpg!750x360.jpg
  • m1.pand####.cn/assets/2018/08/31/288d76f5375-15889_png!200x200.png
  • m1.pand####.cn/assets/2018/08/31/28a39939231-16175_png!200x200.png
  • m1.pand####.cn/assets/2018/09/01/5a5b8d01922-180883_jpg!1000x1000.jpg
  • m1.pand####.cn/assets/2018/09/03/5793c865774-16139_png!167x167.png
  • m1.pand####.cn/assets/2018/09/03/5874de58368-117046_jpg!1000x1000.jpg
  • m1.pand####.cn/assets/2018/09/04/57ef4827425-114543_jpg!1000x1000.jpg
  • m1.pand####.cn/assets/2018/09/06/592eed18056-210562_jpg!1000x1000.jpg
  • m1.pand####.cn/assets/2018/09/12/18a84157246-211032_jpg!1000x1000.jpg
  • m1.pand####.cn/assets/2018/09/12/1d1f0538775-176727_jpg!1000x1000.jpg
  • m1.pand####.cn/assets/2018/09/12/1d6d10b6814-151158_jpg!1000x1000.jpg
  • m1.pand####.cn/assets/2018/09/12/e588cc6619-140011_jpg!1000x1000.jpg
  • m1.pand####.cn/assets/2018/09/14/4fa69649668-245612_jpg!1000x1000.jpg
  • m1.pand####.cn/assets/2018/09/14/61ac8524913-252563_png!659x169.png
  • m1.pand####.cn/assets/2018/09/15/27663322525-175840_jpg!1000x1000.jpg
  • m1.pand####.cn/assets/2018/09/25/137bec73744-180351_jpg!1000x1000.jpg
  • m1.pand####.cn/assets/2018/09/25/29051744113-140275_jpg!1000x1000.jpg
  • m1.pand####.cn/assets/2018/09/25/29960c89336-159524_jpg!1000x1000.jpg
  • m1.pand####.cn/assets/2018/09/25/501c4315248-136623_jpg!1000x1000.jpg
  • m1.pand####.cn/assets/2018/09/25/6191cd86355-114949_jpg!1000x1000.jpg
  • m1.pand####.cn/assets/2018/09/25/6278cd05919-194070_jpg!1000x1000.jpg
  • m1.pand####.cn/assets/images/loading-74-74.gif
  • pco####.ta####.com/app.gif?&cna=####
  • w####.com/5066970342
  • www.pand####.cn/?title=####
  • www.pand####.cn/authorization/index.html
  • www.pand####.cn/html/news/index.html
  • www.pand####.cn/statics/css/base_news.css
  • www.pand####.cn/statics/css/reset_index.css
  • www.pand####.cn/statics/css/style.css
  • www.pand####.cn/statics/css/style_news.css
  • www.pand####.cn/statics/images/bg.jpg
  • www.pand####.cn/statics/images/bg_1.jpg
  • www.pand####.cn/statics/images/bg_2.jpg
  • www.pand####.cn/statics/images/bg_3.jpg
  • www.pand####.cn/statics/images/border.png
  • www.pand####.cn/statics/images/controls.png
  • www.pand####.cn/statics/images/loading.gif
  • www.pand####.cn/statics/images/loading_background.png
  • www.pand####.cn/statics/images/logo.png
  • www.pand####.cn/statics/images/mask.png
  • www.pand####.cn/statics/images/music.png
  • www.pand####.cn/statics/images/overlay.png
  • www.pand####.cn/statics/images/p2-4.png
  • www.pand####.cn/statics/images/p2-5.png
  • www.pand####.cn/statics/images/p2-6.png
  • www.pand####.cn/statics/images/progress.gif
  • www.pand####.cn/statics/images/ui-bg-tabbtn.png
  • www.pand####.cn/statics/images/ui-case-eye.png
  • www.pand####.cn/statics/images/ui-contact-wechat.png
  • www.pand####.cn/statics/images/ui-contact-weibo.png
  • www.pand####.cn/statics/images/ui-plax-bird2.png
  • www.pand####.cn/statics/images/ui-plax-bird3.png
  • www.pand####.cn/statics/images/ui-plax-design.png
  • www.pand####.cn/statics/images/ui-plax-logo.png
  • www.pand####.cn/statics/images/ui-plax-xiongzai-other.png
  • www.pand####.cn/statics/images/ui-plax-xiongzai.png
  • www.pand####.cn/statics/images/ui-title-about.png
  • www.pand####.cn/statics/images/ui-title-authorization.png
  • www.pand####.cn/statics/images/ui-title-contact.png
  • www.pand####.cn/statics/images/ui-title-news.png
  • www.pand####.cn/statics/images/ui-title-theatre.png
  • www.pand####.cn/statics/images/wechat.jpg
  • www.pand####.cn/statics/images/works_ahover.png
  • www.pand####.cn/statics/images/xz.mp3
  • www.pand####.cn/statics/js/Slide.js
  • www.pand####.cn/statics/js/app.min.js?ver=####
  • www.pand####.cn/statics/js/f2e.js
  • www.pand####.cn/statics/js/f2e_authorization.js
  • www.pand####.cn/statics/js/global.js
  • www.pand####.cn/statics/js/html5.js
  • www.pand####.cn/statics/js/init.min.js
  • www.pand####.cn/statics/js/jquery-1.8.2.min.js
  • www.pand####.cn/statics/js/jquery-ui.min.js
  • www.pand####.cn/statics/js/jquery.colorbox-min.js
  • www.pand####.cn/statics/js/jquery.min.js
  • www.pand####.cn/statics/js/jquery.nav.js
  • www.pand####.cn/statics/js/jquery.plugin.js
  • www.pand####.cn/statics/js/jquery.poshytip.js
  • www.pand####.cn/statics/js/jquery.scrollTo.js
  • www.pand####.cn/statics/js/jquery.waypoints.js
  • www.pand####.cn/statics/js/main.js
  • www.pand####.cn/statics/js/mosaic.1.0.1.js
  • www.pand####.cn/statics/js/plax.js
  • www.pand####.cn/statics/js/script.js
  • www.pand####.cn/statics/js/script_news.js
  • www.pand####.cn/statics/js/system/util/objectUtil.js?ver=####
  • www.pand####.cn/thetare_1.html
  • www.pand####.cn/thetare_2.html
  • www.pand####.cn/thetare_3.html
  • www.pand####.cn/thetare_4.html
  • www.pand####.cn/uploadfile/2015/0613/20150613014318747.jpg
  • www.pand####.cn/uploadfile/2015/0613/20150613015029577.jpg
  • www.pand####.cn/uploadfile/2015/0613/20150613015055686.jpg
  • www.pand####.cn/uploadfile/2015/0615/20150615095226420.jpg
  • www.pand####.cn/uploadfile/2015/0615/20150615095424660.jpg
  • www.pand####.cn/uploadfile/2015/0615/20150615095604279.jpg
  • www.pand####.cn/uploadfile/2015/0615/20150615095734237.jpg
  • www.pand####.cn/uploadfile/2015/0615/20150615095921470.jpg
  • www.pand####.cn/uploadfile/2015/0615/20150615100034735.jpg
  • www.pand####.cn/uploadfile/2016/0922/thumb_300_130_20160922104308882.jpg
  • www.pand####.cn/uploadfile/2016/0922/thumb_300_130_20160922110309993.jpg
  • www.pand####.cn/uploadfile/2016/1007/20161007015629233.jpg
  • www.pand####.cn/uploadfile/haibao/01_1.jpg
  • www.pand####.cn/uploadfile/haibao/02_1.jpg
  • www.pand####.cn/uploadfile/haibao/03_1.jpg
  • www.pand####.cn/uploadfile/image/20130117/20121228095610_28712.jpg
  • www.pand####.cn/uploadfile/juchang/01/01.jpg
  • www.pand####.cn/uploadfile/juchang/01/02.jpg
  • www.pand####.cn/uploadfile/juchang/01/03.jpg
  • www.pand####.cn/uploadfile/juchang/01/04.jpg
  • www.pand####.cn/uploadfile/juchang/01/05.jpg
  • www.pand####.cn/uploadfile/juchang/01/06.jpg
  • www.pand####.cn/uploadfile/juchang/01/07.jpg
  • www.pand####.cn/uploadfile/juchang/01/08.jpg
  • www.pand####.cn/uploadfile/juchang/01/09.jpg
  • www.pand####.cn/uploadfile/juchang/01/10.jpg
  • www.pand####.cn/uploadfile/juchang/01/11.jpg
  • www.pand####.cn/uploadfile/juchang/01/12.jpg
  • www.pand####.cn/uploadfile/juchang/01/13.jpg
  • www.pand####.cn/uploadfile/juchang/01/14.jpg
  • www.pand####.cn/uploadfile/juchang/01/15.jpg
  • www.pand####.cn/uploadfile/juchang/01/16.jpg
  • www.pand####.cn/uploadfile/juchang/01/17.jpg
  • www.pand####.cn/uploadfile/juchang/01/18.jpg
  • www.pand####.cn/uploadfile/juchang/01/19.jpg
  • www.pand####.cn/uploadfile/juchang/01/20.jpg
  • www.pand####.cn/uploadfile/juchang/01/21.jpg
  • www.pand####.cn/uploadfile/juchang/01/22.jpg
  • www.pand####.cn/uploadfile/juchang/01/23.jpg
  • www.pand####.cn/uploadfile/juchang/01/24.jpg
  • www.pand####.cn/uploadfile/juchang/01/25.jpg
  • www.pand####.cn/uploadfile/juchang/01/26.jpg
  • www.pand####.cn/uploadfile/juchang/01/27.jpg
  • www.pand####.cn/uploadfile/juchang/01/28.jpg
  • www.pand####.cn/uploadfile/juchang/01/29.jpg
  • www.pand####.cn/uploadfile/juchang/01/30.jpg
  • www.pand####.cn/uploadfile/juchang/01/31.jpg
  • www.pand####.cn/uploadfile/juchang/01/32.jpg
  • www.pand####.cn/uploadfile/juchang/01/33.jpg
  • www.pand####.cn/uploadfile/juchang/01/34.jpg
  • www.pand####.cn/uploadfile/juchang/01/35.jpg
  • www.pand####.cn/uploadfile/juchang/01/36.jpg
  • www.pand####.cn/uploadfile/juchang/01/37.jpg
  • www.pand####.cn/uploadfile/juchang/01/38.jpg
  • www.pand####.cn/uploadfile/juchang/01/39.jpg
  • www.pand####.cn/uploadfile/juchang/01/40.jpg
  • www.pand####.cn/uploadfile/juchang/01/41.jpg
  • www.pand####.cn/uploadfile/juchang/01/42.jpg
  • www.pand####.cn/uploadfile/juchang/01/43.jpg
  • www.pand####.cn/uploadfile/juchang/01/44.jpg
  • www.pand####.cn/uploadfile/juchang/01/45.jpg
  • www.pand####.cn/uploadfile/juchang/01/46.jpg
  • www.pand####.cn/uploadfile/juchang/01/47.jpg
  • www.pand####.cn/uploadfile/juchang/01/48.jpg
  • www.pand####.cn/uploadfile/juchang/01/49.jpg
  • www.pand####.cn/uploadfile/juchang/01/50.jpg
  • www.pand####.cn/uploadfile/juchang/01/51.jpg
  • www.pand####.cn/uploadfile/juchang/01/52.jpg
  • www.pand####.cn/uploadfile/juchang/02/01.jpg
  • www.pand####.cn/uploadfile/juchang/02/02.jpg
  • www.pand####.cn/uploadfile/juchang/02/03.jpg
  • www.pand####.cn/uploadfile/juchang/02/04.jpg
  • www.pand####.cn/uploadfile/juchang/02/05.jpg
  • www.pand####.cn/uploadfile/juchang/02/06.jpg
  • www.pand####.cn/uploadfile/juchang/02/07.jpg
  • www.pand####.cn/uploadfile/juchang/02/08.jpg
  • www.pand####.cn/uploadfile/juchang/02/09.jpg
  • www.pand####.cn/uploadfile/juchang/02/10.jpg
  • www.pand####.cn/uploadfile/juchang/02/11.jpg
  • www.pand####.cn/uploadfile/juchang/02/12.jpg
  • www.pand####.cn/uploadfile/juchang/02/13.jpg
  • www.pand####.cn/uploadfile/juchang/02/14.jpg
  • www.pand####.cn/uploadfile/juchang/02/15.jpg
  • www.pand####.cn/uploadfile/juchang/02/16.jpg
  • www.pand####.cn/uploadfile/juchang/02/17.jpg
  • www.pand####.cn/uploadfile/juchang/02/18.jpg
  • www.pand####.cn/uploadfile/juchang/02/19.jpg
  • www.pand####.cn/uploadfile/juchang/02/20.jpg
  • www.pand####.cn/uploadfile/juchang/02/21.jpg
  • www.pand####.cn/uploadfile/juchang/02/22.jpg
  • www.pand####.cn/uploadfile/juchang/02/23.jpg
  • www.pand####.cn/uploadfile/juchang/02/24.jpg
  • www.pand####.cn/uploadfile/juchang/02/25.jpg
  • www.pand####.cn/uploadfile/juchang/02/26.jpg
  • www.pand####.cn/uploadfile/juchang/02/27.jpg
  • www.pand####.cn/uploadfile/juchang/02/28.jpg
  • www.pand####.cn/uploadfile/juchang/02/29.jpg
  • www.pand####.cn/uploadfile/juchang/02/30.jpg
  • www.pand####.cn/uploadfile/juchang/02/31.jpg
  • www.pand####.cn/uploadfile/juchang/02/32.jpg
  • www.pand####.cn/uploadfile/juchang/02/33.jpg
  • www.pand####.cn/uploadfile/juchang/02/34.jpg
  • www.pand####.cn/uploadfile/juchang/02/35.jpg
  • www.pand####.cn/uploadfile/juchang/02/36.jpg
  • www.pand####.cn/uploadfile/juchang/02/37.jpg
  • www.pand####.cn/uploadfile/juchang/02/38.jpg
  • www.pand####.cn/uploadfile/juchang/02/39.jpg
  • www.pand####.cn/uploadfile/juchang/02/40.jpg
  • www.pand####.cn/uploadfile/juchang/02/41.jpg
  • www.pand####.cn/uploadfile/juchang/02/42.jpg
  • www.pand####.cn/uploadfile/juchang/02/43.jpg
  • www.pand####.cn/uploadfile/juchang/02/44.jpg
  • www.pand####.cn/uploadfile/juchang/02/45.jpg
  • www.pand####.cn/uploadfile/juchang/02/46.jpg
  • www.pand####.cn/uploadfile/juchang/02/47.jpg
  • www.pand####.cn/uploadfile/juchang/02/48.jpg
  • www.pand####.cn/uploadfile/juchang/02/49.jpg
  • www.pand####.cn/uploadfile/juchang/02/50.jpg
  • www.pand####.cn/uploadfile/juchang/02/51.jpg
  • www.pand####.cn/uploadfile/juchang/02/52.jpg
  • www.pand####.cn/uploadfile/juchang/03/01.jpg
  • www.pand####.cn/uploadfile/juchang/04/01.jpg
  • www.pand####.cn/uploadfile/juchang/04/02.jpg
  • www.pand####.cn/uploadfile/juchang/04/03.jpg
  • www.pand####.cn/uploadfile/juchang/04/04.jpg
  • z.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...
HTTP POST requests:
  • l####.tbs.qq.com/ajax?c=####&k=####
  • l####.tbs.qq.com/ajax?c=####&v=####&k=####
  • m1.pand####.cn/Api/Ad/IndexAd
  • m1.pand####.cn/Api/Article/HeadLine
  • m1.pand####.cn/Api/Product/Index
  • m1.pand####.cn/Api/Slide/IndexBanner
  • m1.pand####.cn/api/PlatProps/PlatBaseData
  • m1.pand####.cn/api/PlatProps/PlatVendor
  • m1.pand####.cn/api/PlatProps/SetUserMenuStates
  • m1.pand####.cn/api/PlatProps/UserMenuStates
Modified file system:
Creates the following files:
  • /data/data/####/.jg.ic
  • /data/data/####/0b64ce14b17f10e210b31193214fde1f1845e616660ac5f....0.tmp
  • /data/data/####/0ceff1c986f9a91d45820132d3e582de8b95dd48759c96e....0.tmp
  • /data/data/####/0f9a83acba42df0d7b11df8665ac630ed21e145ff5b4967....0.tmp
  • /data/data/####/1241399989b91df928b20f29ebad29bf2da7f153c32d5f7....0.tmp
  • /data/data/####/163d5aa0f06541ae8e50a7d20b043270d5b0cd7a5ffe8f3....0.tmp
  • /data/data/####/17bafc8588015ba4f030fa94fc4d31b8524683e3f9b1289....0.tmp
  • /data/data/####/29a397d8bee17938933261a49102c384452f40957d1d320....0.tmp
  • /data/data/####/2bc84f344867893e142c0fd7bf4bcb3a261feff0012860c....0.tmp
  • /data/data/####/3465faeec90634635a01fb2d8ac59c6fa8210372a7579de....0.tmp
  • /data/data/####/35d8727d2eba668394d36e0d2b823b44287b2d0ab41e9b1....0.tmp
  • /data/data/####/38621109dc8351a50e47128b3aff90616525e5f17dca34d....0.tmp
  • /data/data/####/4145d620b3f9e47758e90e4fbf89c16845a7f499935d92e....0.tmp
  • /data/data/####/438f41d196916d351ecbead185ec49b70b9475af21062dc....0.tmp
  • /data/data/####/517caf5fcecb5720fe2c705f704ba11f8d415d8202fd664....0.tmp
  • /data/data/####/551766938674fcc51eaaa4791d35c6d17a2b37e756bb3db....0.tmp
  • /data/data/####/581a29acbe503fb534261f2cc12135812ac5bf1c3f85af1....0.tmp
  • /data/data/####/59c49f33c286e7d47e73daefc0fde586a9272e0d8302586....0.tmp
  • /data/data/####/5b085a69866f9a41d267d87e3ada3b1c1906ff747cf8399....0.tmp
  • /data/data/####/5b1993cadfaf07a9d709a685288c87e80a15f322525372b....0.tmp
  • /data/data/####/66e6b0086ec394a3b8acdafec981c71ed314911dcb0618b....0.tmp
  • /data/data/####/68a63322e3d1c47c88f1867b0371a8c0ed019f2c6d70704....0.tmp
  • /data/data/####/6fa95f15c9ca91762e168d69d19e764eb65e634abd4c483....0.tmp
  • /data/data/####/70685e78e7e95981a1780d4aa260145ea3fe09c0380341c....0.tmp
  • /data/data/####/7325e18de1ca702429f502e6d08079fb452445372deb00c....0.tmp
  • /data/data/####/74dfb4d4f708f7e22e7415401dce606e3a6557e33ffed08....0.tmp
  • /data/data/####/759f45d1a215c55a3b715085b6e4342d02be4410f3f2e1f....0.tmp
  • /data/data/####/7d365d4925acc89c4e6117dff2ce78d2ea0db7f7403e111....0.tmp
  • /data/data/####/7d41bc32d25be31ca534e5cee87ac2d1c875948ca870e99....0.tmp
  • /data/data/####/7e92dcf4ffa39b38b511ced879f115c56cbdf05e44d5a86....0.tmp
  • /data/data/####/865af199e9265b4919b4acd75b7a0f3395b2d1b1428057c....0.tmp
  • /data/data/####/867d3b6a60022bd2edbefaac0d8b4d78ba8f760ab8c177d....0.tmp
  • /data/data/####/8765ec71eaa027a4414da50e275a809c6f393c84cd4e550....0.tmp
  • /data/data/####/8d1b2616e42504db0025904301aecf4a4300f2b7ef9a510....0.tmp
  • /data/data/####/967bf131ec91ad5e5abd61fc907e7920848152b32bc4e66....0.tmp
  • /data/data/####/9bda328134df5e49dba2449842d00c37bf0db06c2368584....0.tmp
  • /data/data/####/9fd484f3d9410417a41ee982599e117be0ee79e00b94370....0.tmp
  • /data/data/####/BMWEEXOPEN_NATIVE_SP.xml
  • /data/data/####/CookiePrefsFile.xml
  • /data/data/####/MultiDex.lock
  • /data/data/####/Updater.xml
  • /data/data/####/WXStorage-journal
  • /data/data/####/a1110162fed518ba4b7c4fc18937703acc0f10ee6dab756....0.tmp
  • /data/data/####/a714f4fd48b24849701579c089a6a0763598ede10f45571....0.tmp
  • /data/data/####/a7bff7a9e91f2d164e91b5c479e9536750a20b19a6b03c1....0.tmp
  • /data/data/####/ad77a21bf51b26382949813c036afebf2c0055a9751bced....0.tmp
  • /data/data/####/bc57703ae9f69e5af63f5b2bb599f89c09a4b453ebbab71....0.tmp
  • /data/data/####/bcf3727edfde36824316539d82ff430340fa25d4f4dc543....0.tmp
  • /data/data/####/bdbe67324a323515003d24e5631008db279d5b05863a44e....0.tmp
  • /data/data/####/bf75bfded0d4991c17acda41afc274babf38c1ffd9533ac....0.tmp
  • /data/data/####/bfc49c207723b15a435acdc04d50a4e78a63c429a9bc5c1....0.tmp
  • /data/data/####/c139f1bf2a7c616753e608043f383a194f5b67148fefe9f....0.tmp
  • /data/data/####/c14a9d7ee6dc6a8bd2d280ff81b0dc3bc4acdfdae80e3ee....0.tmp
  • /data/data/####/c1d4ee002ddda519818d0cd19e56f9b9e3f76f892c93a85....0.tmp
  • /data/data/####/c2ec2f21fc740424a555d29855bc0251474e1ff5cb7c9cb....0.tmp
  • /data/data/####/c62237e570b949fbed6946d588d0c039012e95a6ac29840....0.tmp
  • /data/data/####/c898873fc057a3d58c1808c147457a182303e1fd4de3806....0.tmp
  • /data/data/####/ca68c95a9e7f33704d52bc8fd14a39f241ec023651fa2a6....0.tmp
  • /data/data/####/cc6c6fadf838f5b52264be60e15dc836594c094e3f36f1f....0.tmp
  • /data/data/####/core_info
  • /data/data/####/d3fb35063e13c0b0ba813973d8dd8fde4ed34188bbbff42....0.tmp
  • /data/data/####/d6d290e86975fe7a641037bfac88eecd90759aecee4ec8d....0.tmp
  • /data/data/####/data_0
  • /data/data/####/data_1
  • /data/data/####/data_2
  • /data/data/####/data_3
  • /data/data/####/dbca87c42f8fbdfb9c08db9dd1e9f703f5139307ed108a3....0.tmp
  • /data/data/####/debug.conf
  • /data/data/####/df36c67faa7cb6a05c3616e4ba73c4c6f44e3de7db4c77d....0.tmp
  • /data/data/####/e617dcb23b33ad0020bd0519353dcdb2b396cd05bd3dadd....0.tmp
  • /data/data/####/ed1db85e2d493e9cdf84e27ccde7a9cd3401c9b2ce60d44....0.tmp
  • /data/data/####/ed8fed4a8d0751f1c48f5904bccf46b7028e1b15d34a9ab....0.tmp
  • /data/data/####/efc7c966176ed6b28f2c6e24c4f4bd0c5d9d3d744faf163....0.tmp
  • /data/data/####/efe3d84dfbd1b6713f970bf849a49cfbd548e5338ffdfc1....0.tmp
  • /data/data/####/f5a6189b63b65d0fed6f953cc1f751eee7070c96723c842....0.tmp
  • /data/data/####/f7ca666fa18b24dd55346ad8580e7d4a5ed29dd72ce5559....0.tmp
  • /data/data/####/f_000001
  • /data/data/####/f_000002
  • /data/data/####/f_000003
  • /data/data/####/f_000004
  • /data/data/####/f_000005
  • /data/data/####/f_000006
  • /data/data/####/f_000007
  • /data/data/####/f_000008
  • /data/data/####/f_000009
  • /data/data/####/f_00000a
  • /data/data/####/f_00000b
  • /data/data/####/f_00000c
  • /data/data/####/f_00000d
  • /data/data/####/f_00000e
  • /data/data/####/f_00000f
  • /data/data/####/f_000010
  • /data/data/####/f_000011
  • /data/data/####/f_000012
  • /data/data/####/f_000013
  • /data/data/####/f_000014
  • /data/data/####/f_000015
  • /data/data/####/f_000016
  • /data/data/####/f_000017
  • /data/data/####/f_000018
  • /data/data/####/f_000019
  • /data/data/####/f_00001a
  • /data/data/####/f_00001b
  • /data/data/####/f_00001c
  • /data/data/####/f_00001d
  • /data/data/####/f_00001e
  • /data/data/####/f_00001f
  • /data/data/####/f_000020
  • /data/data/####/f_000021
  • /data/data/####/f_000022
  • /data/data/####/f_000023
  • /data/data/####/f_000024
  • /data/data/####/f_000025
  • /data/data/####/f_000026
  • /data/data/####/f_000027
  • /data/data/####/f_000028
  • /data/data/####/f_000029
  • /data/data/####/f_00002a
  • /data/data/####/f_00002b
  • /data/data/####/f_00002c
  • /data/data/####/f_00002d
  • /data/data/####/f_00002e
  • /data/data/####/f_00002f
  • /data/data/####/f_000030
  • /data/data/####/f_000031
  • /data/data/####/f_000032
  • /data/data/####/f_000033
  • /data/data/####/f_000034
  • /data/data/####/f_000035
  • /data/data/####/f_000036
  • /data/data/####/f_000037
  • /data/data/####/f_000038
  • /data/data/####/f_000039
  • /data/data/####/f_00003a
  • /data/data/####/index
  • /data/data/####/journal.tmp
  • /data/data/####/libjiagu1390117721.so
  • /data/data/####/libweexjsb.so
  • /data/data/####/multidex.version.xml
  • /data/data/####/tbs_download_config.xml
  • /data/data/####/tbs_download_stat.xml
  • /data/data/####/tbscoreinstall.txt
  • /data/data/####/tbslock.txt
  • /data/data/####/webview.db-journal
  • /data/data/####/webviewCookiesChromium.db-journal
  • /data/media/####/Share.png
  • /data/media/####/ad_sel.png
  • /data/media/####/add.png
  • /data/media/####/addAddress.js
  • /data/media/####/addressEdit.js
  • /data/media/####/agencyArea.js
  • /data/media/####/agencyAreaStat.js
  • /data/media/####/agentDistribution.js
  • /data/media/####/appSaveImageSlider.js
  • /data/media/####/applyAgent.js
  • /data/media/####/applyUpgrade.js
  • /data/media/####/arror.png
  • /data/media/####/award.js
  • /data/media/####/b1.png
  • /data/media/####/b10.png
  • /data/media/####/b11.png
  • /data/media/####/b12.png
  • /data/media/####/b2.png
  • /data/media/####/b3.png
  • /data/media/####/b4.png
  • /data/media/####/b5.png
  • /data/media/####/b6.png
  • /data/media/####/b7.png
  • /data/media/####/b8.png
  • /data/media/####/b9.png
  • /data/media/####/bankEdit.js
  • /data/media/####/blank.html
  • /data/media/####/blank.png
  • /data/media/####/bot_arrow_1.png
  • /data/media/####/bot_arrow_2.png
  • /data/media/####/bundle.zip
  • /data/media/####/buy.png
  • /data/media/####/c10_ico.png
  • /data/media/####/c11_ico.png
  • /data/media/####/c12_ico.png
  • /data/media/####/c13_ico.png
  • /data/media/####/c14_ico.png
  • /data/media/####/c15_ico.png
  • /data/media/####/c16_ico.png
  • /data/media/####/c17_ico.png
  • /data/media/####/c18_ico.png
  • /data/media/####/c19_ico.png
  • /data/media/####/c1_ico.png
  • /data/media/####/c20_ico.png
  • /data/media/####/c21_ico.png
  • /data/media/####/c22_ico.png
  • /data/media/####/c23_ico.png
  • /data/media/####/c24_ico.png
  • /data/media/####/c25_ico.png
  • /data/media/####/c26_ico.png
  • /data/media/####/c27_ico.png
  • /data/media/####/c2_ico.png
  • /data/media/####/c31_ico.png
  • /data/media/####/c32_ico.png
  • /data/media/####/c33_ico.png
  • /data/media/####/c3_ico.png
  • /data/media/####/c4_ico.png
  • /data/media/####/c5_ico.png
  • /data/media/####/c6_ico.png
  • /data/media/####/c7_ico.png
  • /data/media/####/c8_ico.png
  • /data/media/####/c9_ico.png
  • /data/media/####/card.png
  • /data/media/####/card_pic.png
  • /data/media/####/center_bg.png
  • /data/media/####/close.png
  • /data/media/####/code.png
  • /data/media/####/code_ico.png
  • /data/media/####/collect_off.png
  • /data/media/####/collect_on.png
  • /data/media/####/commission.js
  • /data/media/####/cumulativeInventory.js
  • /data/media/####/evaluationList.js
  • /data/media/####/evaluationSubmission.js
  • /data/media/####/exchange.js
  • /data/media/####/face.jpg
  • /data/media/####/face.png
  • /data/media/####/face1.jpg
  • /data/media/####/face1.png
  • /data/media/####/face2.png
  • /data/media/####/fhadd.png
  • /data/media/####/font_1469606063_76593.ttf
  • /data/media/####/font_1469606522_9417143.woff
  • /data/media/####/font_zn5b3jswpofuhaor.ttf
  • /data/media/####/forget.js
  • /data/media/####/fx_ico1.png
  • /data/media/####/fx_ico2.png
  • /data/media/####/fx_ico3.png
  • /data/media/####/gamesList.js
  • /data/media/####/home_ico.png
  • /data/media/####/icon_close.png
  • /data/media/####/iconfont-eros.ttf
  • /data/media/####/iconfont.ttf
  • /data/media/####/index.js
  • /data/media/####/index_banner_bg.png
  • /data/media/####/integral.js
  • /data/media/####/join.js
  • /data/media/####/joininfo.js
  • /data/media/####/kefu.js
  • /data/media/####/kefu.png
  • /data/media/####/kejian.png
  • /data/media/####/list-card.png
  • /data/media/####/lmtt_ico.png
  • /data/media/####/loading-50-50.gif
  • /data/media/####/loading-74-74.gif
  • /data/media/####/login.js
  • /data/media/####/logo.png
  • /data/media/####/md5.json
  • /data/media/####/messageDetail.js
  • /data/media/####/messages.js
  • /data/media/####/modifyPwd.js
  • /data/media/####/msg_agent.png
  • /data/media/####/msg_distribution.png
  • /data/media/####/msg_finance.png
  • /data/media/####/msg_ico.png
  • /data/media/####/msg_order.png
  • /data/media/####/msg_other.png
  • /data/media/####/msg_system.png
  • /data/media/####/myCollect.js
  • /data/media/####/myFans.js
  • /data/media/####/myTeam.js
  • /data/media/####/n1_ico.png
  • /data/media/####/n2_ico.png
  • /data/media/####/n3_ico.png
  • /data/media/####/n4_ico.png
  • /data/media/####/n5_ico.png
  • /data/media/####/nav1.png
  • /data/media/####/nav2.png
  • /data/media/####/nav3.png
  • /data/media/####/nav4.png
  • /data/media/####/nav5.png
  • /data/media/####/nearbyStores.js
  • /data/media/####/none_ico.png
  • /data/media/####/off_check.png
  • /data/media/####/off_radio.png
  • /data/media/####/onlinekefu.png
  • /data/media/####/orderDetail.js
  • /data/media/####/orderList.js
  • /data/media/####/orderLogistics.js
  • /data/media/####/orderPay.js
  • /data/media/####/orderPut.js
  • /data/media/####/parentchildComment.js
  • /data/media/####/parentchildLive.js
  • /data/media/####/parentchildTV.js
  • /data/media/####/parentchildTVList.js
  • /data/media/####/paySuccess.js
  • /data/media/####/pcode_ico.png
  • /data/media/####/photo_ico.png
  • /data/media/####/pl_ico.png
  • /data/media/####/pl_ico1.png
  • /data/media/####/post_ico.png
  • /data/media/####/post_icoy.png
  • /data/media/####/price.png
  • /data/media/####/pro.png
  • /data/media/####/pro1.png
  • /data/media/####/pro2.png
  • /data/media/####/proDetail.js
  • /data/media/####/proList.js
  • /data/media/####/pro_1.png
  • /data/media/####/pro_2.png
  • /data/media/####/product1.png
  • /data/media/####/psd.png
  • /data/media/####/purchase.js
  • /data/media/####/purchaseApplications.js
  • /data/media/####/purchaseMoney.js
  • /data/media/####/q1.png
  • /data/media/####/q2.png
  • /data/media/####/q3.png
  • /data/media/####/q4.png
  • /data/media/####/qou.png
  • /data/media/####/qq_ico.png
  • /data/media/####/rebate.js
  • /data/media/####/rebatePerformance.js
  • /data/media/####/rebateStat.js
  • /data/media/####/rebateTable.js
  • /data/media/####/recharge.js
  • /data/media/####/recommendFriends.js
  • /data/media/####/register.js
  • /data/media/####/remittanceCertificate.js
  • /data/media/####/resetpwd.js
  • /data/media/####/saixuan.png
  • /data/media/####/salesSend.js
  • /data/media/####/saveImageSlider.js
  • /data/media/####/search.png
  • /data/media/####/search_ico.png
  • /data/media/####/sel_check.png
  • /data/media/####/sel_radio.png
  • /data/media/####/sendBackProduct.js
  • /data/media/####/sendGoods.js
  • /data/media/####/set_face.png
  • /data/media/####/setting.js
  • /data/media/####/sfz1.png
  • /data/media/####/sfz2.png
  • /data/media/####/share.js
  • /data/media/####/share_wx_circle.png
  • /data/media/####/share_wx_friend.png
  • /data/media/####/ship1.js
  • /data/media/####/ship2.js
  • /data/media/####/ship3.js
  • /data/media/####/shipOrder.js
  • /data/media/####/shipmentMoney.js
  • /data/media/####/shop.png
  • /data/media/####/shop_ico.png
  • /data/media/####/star-off.png
  • /data/media/####/star-on.png
  • /data/media/####/star.png
  • /data/media/####/statistics.js
  • /data/media/####/stock.js
  • /data/media/####/stockRecord.js
  • /data/media/####/storeDetail.js
  • /data/media/####/storeManage.js
  • /data/media/####/subordinate.js
  • /data/media/####/suc_pic.png
  • /data/media/####/t_bg.png
  • /data/media/####/teamOrder.js
  • /data/media/####/tel.png
  • /data/media/####/tj_banner.png
  • /data/media/####/top_arrow_1.png
  • /data/media/####/top_arrow_2.png
  • /data/media/####/tvDetail.js
  • /data/media/####/tv_ico.png
  • /data/media/####/tz1.png
  • /data/media/####/tz2.png
  • /data/media/####/up.jpg
  • /data/media/####/upgrade.js
  • /data/media/####/userBill.js
  • /data/media/####/userinfo.js
  • /data/media/####/vip_ico.png
  • /data/media/####/warehouseStock.js
  • /data/media/####/webView.js
  • /data/media/####/weix_ico.png
  • /data/media/####/withdraw.js
  • /data/media/####/withdrawList.js
  • /data/media/####/wx_ico.png
  • /data/media/####/xz_ico.png
  • /data/media/####/xzlogo.png
  • /data/media/####/yuer_ico.png
  • /data/media/####/zan.png
  • /data/media/####/zan1.png
  • /data/media/####/zt_ico1.png
  • /data/media/####/zt_ico2.png
  • /data/media/####/zy_img.png
Miscellaneous:
Executes next shell scripts:
  • /data/app-lib/<Package>-1/libweexjsb.so 50 0
  • chmod 755 <Package Folder>/.jiagu/libjiagu1390117721.so
  • getprop ro.product.cpu.abi
Loads the following dynamic libraries:
  • Patcher
  • libjiagu1390117721
  • weexjsc
Uses the following algorithms to encrypt data:
  • DESede-ECB-PKCS5Padding
  • RSA-ECB-NoPadding
Uses the following algorithms to decrypt data:
  • AES-CBC-PKCS5Padding
Uses special library to hide executable bytecode.
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android