Mi biblioteca
Mi biblioteca

+ Añadir a la biblioteca

Soporte
Soporte 24 horas | Normas de contactar

Sus solicitudes

Perfil

Trojan.Crossrider.11

Added to the Dr.Web virus database: 2013-10-25

Virus description added:

Technical Information

To ensure autorun and distribution
Creates or modifies the following files
  • %WINDIR%\tasks\shop-up-chromeinstaller.job
  • <SYSTEM32>\tasks\shop-up-chromeinstaller
  • %WINDIR%\tasks\shop-up-firefoxinstaller.job
  • <SYSTEM32>\tasks\shop-up-firefoxinstaller
  • %WINDIR%\tasks\shop-up-codedownloader.job
  • <SYSTEM32>\tasks\shop-up-codedownloader
  • %WINDIR%\tasks\shop-up-enabler.job
  • <SYSTEM32>\tasks\shop-up-enabler
  • %WINDIR%\tasks\temp_shop-up-enabler.job
  • <SYSTEM32>\tasks\temp_shop-up-enabler
  • %WINDIR%\tasks\shop-up-updater.job
  • <SYSTEM32>\tasks\shop-up-updater
Malicious functions
Terminates or attempts to terminate
the following user processes:
  • firefox.exe
Registers BHO
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110411281122}]
Modifies file system
Creates the following files
  • %TEMP%\nsh2118.tmp
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\159_cortica_rollover_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\170_icm1_5_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\4_jquery_1_7_1.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\158_50onred_ads_only_no_fb_m.j...
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\128_superfish_pricora_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\87_ginyas_wrapper.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\91_monetizationloader.js.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\17_jquery.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\116_ads_only_5_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\28_initializer.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\108_icm_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\13_crossriderapputils.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\21_debug.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\xhr.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\175_coolmirage_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\usercode\extension.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\usercode\background.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\options.xul
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\dialog.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\background.html
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\search_dialog.xul
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\baseobject.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\main.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\options.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\browser.xul
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\7_hooks.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\155_ibario_pops_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\125_arcadi2_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\142_intext_fa_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\117_coupons_intext_ads_5_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\171_arcadi2_sourceid_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\101_cortica_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\14_crossriderutils.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\120_luck_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\64_appapimessage.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\126_revizer_ws_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\72_appapivalidation.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\92_superfish_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\47_resources_background.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\105_corticas_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\98_omnicommands.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\102_dealply_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\22_resources.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\138_getdeal_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\174_arcadi_serp_dynamic_id_m.j...
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\127_revizer_p_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\107_coupish_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\1_base.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\104_jollywallet_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\123_intext_adv_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\103_intext_5_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\141_corticas_ru_m.js.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\9_search_engine_hook.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\119_similar_web_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\124_superfish_no_search_no_cou...
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\135_arcadi3_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\searchsettings.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\reloadobserver.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\logfile.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\skin\popup.html
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\skin\update.css
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\skin\button2.png
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\skin\button5.png
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\skin\skin.css
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\skin\icon24.png
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\skin\button3.png
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\skin\button1.png
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\skin\icon16.png
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\skin\panelarrow-up.png
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\skin\icon128.png
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api\dom_bg.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\skin\icon48.png
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\skin\crossrider_statusbar.png
  • %ProgramFiles(x86)%\shop-up\shop-up-helper.exe
  • %ProgramFiles(x86)%\shop-up\shop-up-buttonutil.exe
  • %ProgramFiles(x86)%\shop-up\shop-up-buttonutil64.exe
  • %ProgramFiles(x86)%\shop-up\shop-up-buttonutil.dll
  • %ProgramFiles(x86)%\shop-up\shop-up-buttonutil64.dll
  • %ProgramFiles(x86)%\shop-up\shop-up.ico
  • %ProgramFiles(x86)%\shop-up\shop-up-bho.dll
  • %ProgramFiles(x86)%\shop-up\shop-up-bho64.dll
  • %ProgramFiles(x86)%\shop-up\background.html
  • %ProgramFiles(x86)%\shop-up\shop-up-bg.exe
  • %ProgramFiles(x86)%\shop-up\shop-up-enabler.exe
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\skin\button4.png
  • %ProgramFiles(x86)%\shop-up\shop-up-codedownloader.exe
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api\tabs.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api\browseraction.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api\asyncdb.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\registry.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\updatemanager.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\console.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\delegate.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\consts.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\progresslistenerobserver.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\reports.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\installer.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\folderiowrapper.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\httpobserver.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\idbwrapper.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\requestobject.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\prefs.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\uninstallobserver.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\utils.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api\request.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api\firefoxnotifications.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api\message.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api\pageaction.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api\firefoxomnibox.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api\dbmanager.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api\background.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api\webrequest.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api\firefox.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api\filemanager.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api\contextmenu.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\extensiondatastore.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\16_ffappapiwrapper.js
  • %ProgramFiles(x86)%\shop-up\shop-up-updater.exe
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\129_widdit_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\93_superfish_no_coupons_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\updatemanager.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\app_api.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\util.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\delegate.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\consts.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\crossriderapi.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\reports.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\installer.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\onbgdocumentload.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\events.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\extensiondatastore.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\storagewrapper.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\api\pageaction.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\93_superfish_no_coupons_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\api\cookie.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\api\chrome.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\api\pageactionbg.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\popup.html
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\background.html
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\icons\icon48.png
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\icons\actions\1.png
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\icons\icon16.png
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\icons\icon128.png
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\manifest.json
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins.json
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\manifest.xml
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\cookie_store.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\api\message.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\bg_app_api.js
  • %TEMP%\nsw2cbc.tmp\md5dll.dll
  • %TEMP%\nsh2119.tmp\system.dll
  • %TEMP%\nsh2119.tmp\pccodkpau.tmp
  • %TEMP%\nsh2119.tmp\wrapperutils.dll
  • %TEMP%\nsh2119.tmp\rmxuq.exe
  • %TEMP%\nsh2119.tmp\stdutils.dll
  • %TEMP%\nsh2cac.tmp
  • %TEMP%\nsw2cbc.tmp\stdutils.dll
  • %TEMP%\nsw2cbc.tmp\system.dll
  • %TEMP%\nsw2cbc.tmp\nsislog.dll
  • %TEMP%\shop-upinstaller_1598743539.log
  • %TEMP%\nsw2cbc.tmp\installerutils.dll
  • %TEMP%\nsw2cbc.tmp\nsisos.dll
  • %TEMP%\nsw2cbc.tmp\userinfo.dll
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\popupresource\newpopup.js
  • %ProgramFiles(x86)%\shop-up\utils.exe
  • %TEMP%\nsw2cbc.tmp\temp_file_before.tmp
  • %TEMP%\nsw2cbc.tmp\temp_file_after.tmp
  • %ProgramFiles(x86)%\shop-up\uninstall.exe
  • %ProgramFiles(x86)%\shop-up\42822.crx
  • %ProgramFiles(x86)%\shop-up\shop-up-chromeinstaller.exe
  • %TEMP%\nsw2cbc.tmp\execdos.dll
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\background.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\main.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\xhr.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\logging.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\popupresource\popup.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\logfile.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\78_crossriderinfo.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\129_widdit_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\117_coupons_intext_ads_5_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\158_50onred_ads_only_no_fb_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\128_superfish_pricora_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\87_ginyas_wrapper.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\91_monetizationloader.js.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\17_jquery.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\80_chpopupappapi.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\116_ads_only_5_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\28_initializer.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\108_icm_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\13_crossriderapputils.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\155_ibario_pops_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\170_icm1_5_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\4_jquery_1_7_1.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\21_debug.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\usercode\extension.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\usercode\background.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\crossridermanifest.json
  • %ProgramFiles(x86)%\shop-up\42822.xpi
  • %ProgramFiles(x86)%\shop-up\shop-up-firefoxinstaller.exe
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\install.rdf
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\locale\en-us\translations.dtd
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\defaults\preferences\prefs.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome.manifest
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins.json
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\manifest.xml
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\19_chappapiwrapper.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\175_coolmirage_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\159_cortica_rollover_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\7_hooks.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\125_arcadi2_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\101_cortica_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\14_crossriderutils.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\120_luck_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\64_appapimessage.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\126_revizer_ws_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\72_appapivalidation.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\92_superfish_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\47_resources_background.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\105_corticas_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\142_intext_fa_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\102_dealply_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\138_getdeal_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\171_arcadi2_sourceid_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\174_arcadi_serp_dynamic_id_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\107_coupish_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\1_base.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\104_jollywallet_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\123_intext_adv_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\97_resourceapiwrapper.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\103_intext_5_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\141_corticas_ru_m.js.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\9_search_engine_hook.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\119_similar_web_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\124_superfish_no_search_no_coupons_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\22_resources.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\135_arcadi3_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\127_revizer_p_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\78_crossriderinfo.js
  • %ProgramFiles(x86)%\shop-up\installer.log
Deletes the following files
  • %WINDIR%\tasks\temp_shop-up-enabler.job
  • %TEMP%\nsh2119.tmp\stdutils.dll
  • %TEMP%\nsh2119.tmp\rmxuq.exe
  • %TEMP%\nsh2119.tmp\pccodkpau.tmp
  • %TEMP%\nsw2cbc.tmp\userinfo.dll
  • %TEMP%\nsw2cbc.tmp\temp_file_before.tmp
  • %TEMP%\nsw2cbc.tmp\temp_file_after.tmp
  • %TEMP%\nsh2119.tmp\system.dll
  • %TEMP%\nsw2cbc.tmp\system.dll
  • %TEMP%\nsw2cbc.tmp\nsisos.dll
  • %TEMP%\nsw2cbc.tmp\nsislog.dll
  • %TEMP%\nsw2cbc.tmp\md5dll.dll
  • %TEMP%\nsw2cbc.tmp\installerutils.dll
  • %TEMP%\nsw2cbc.tmp\execdos.dll
  • <SYSTEM32>\tasks\temp_shop-up-enabler
  • %TEMP%\nsw2cbc.tmp\stdutils.dll
  • %TEMP%\nsh2119.tmp\wrapperutils.dll
Network activity
TCP
HTTP GET requests
  • http://st###.#rvstatsdata.com/installer.gif?ac###################################################################################################################################################...
  • http://st###.#yncstatsdata.com/monetization.gif?ev###############################################################################################################################################...
  • http://er####.srvstatsdata.com/ie-error.gif?ac###################################################################################################################################################...
  • http://st###.#rvstatsdata.com/stats.gif?ac#######################################################################################################################################################...
  • http://st###.#rvstatsdata.com/apps.gif?ac########################################################################################################################################################...
UDP
  • DNS ASK st###.#rvstatsdata.com
  • DNS ASK st###.#yncstatsdata.com
  • DNS ASK er####.srvstatsdata.com
  • DNS ASK ap######ic.crossrider.com
Miscellaneous
Searches for the following windows
  • ClassName: 'MS_AutodialMonitor' WindowName: ''
  • ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
  • '%TEMP%\nsh2119.tmp\rmxuq.exe'
  • '%ProgramFiles(x86)%\shop-up\shop-up-chromeinstaller.exe' /installcrx /agentregpath='Shop-Up' /extensionfilepath='%ProgramFiles(x86)%\Shop-Up\42822.crx' /appid=42822 /srcid='000478' /subid='0' /zdata='0' /bic=02EC0407AD3B423AA6788926F43F72ABIE /verifi...
  • '%ProgramFiles(x86)%\shop-up\shop-up-firefoxinstaller.exe' /installxpi /agentregpath='Shop-Up' /extensionfilepath='%ProgramFiles(x86)%\Shop-Up\42822.xpi' /appid=42822 /srcid='000478' /subid='0' /zdata='0' /bic=02EC0407AD3B423AA6788926F43F72ABIE /verifi...
  • '%ProgramFiles(x86)%\shop-up\shop-up-codedownloader.exe' /installapp /agentregpath='Shop-Up' /appid=42822 /srcid='000478' /subid='0' /zdata='0' /bic=02EC0407AD3B423AA6788926F43F72ABIE /verifier=fc0b09802f528515ac95ff9331d66c6e /installerversion=1_29_...
  • '%ProgramFiles(x86)%\shop-up\shop-up-helper.exe' /externallog='%TEMP%\Shop-UpInstaller_1598743539.log'
  • '%ProgramFiles(x86)%\shop-up\shop-up-bg.exe' /executebg /externallog='%TEMP%\Shop-UpInstaller_1598743539.log'
  • '%ProgramFiles(x86)%\shop-up\shop-up-enabler.exe' /enablebho /agentregpath='Shop-Up' /appid=42822 /srcid='000478' /subid='0' /zdata='0' /bic=02EC0407AD3B423AA6788926F43F72ABIE /verifier=fc0b09802f528515ac95ff9331d66c6e /installerversion=1_29_1...
  • '%ProgramFiles(x86)%\shop-up\shop-up-chromeinstaller.exe' /installcrx /agentregpath='Shop-Up' /extensionfilepath='%ProgramFiles(x86)%\Shop-Up\42822.crx' /appid=42822 /srcid='000478' /subid='0' /zdata='0' /bic=02EC0407AD3B423AA6788926F43F72ABIE /verifi...' (with hidden window)
  • '%ProgramFiles(x86)%\shop-up\shop-up-firefoxinstaller.exe' /installxpi /agentregpath='Shop-Up' /extensionfilepath='%ProgramFiles(x86)%\Shop-Up\42822.xpi' /appid=42822 /srcid='000478' /subid='0' /zdata='0' /bic=02EC0407AD3B423AA6788926F43F72ABIE /verifi...' (with hidden window)
  • '%ProgramFiles(x86)%\shop-up\shop-up-codedownloader.exe' /installapp /agentregpath='Shop-Up' /appid=42822 /srcid='000478' /subid='0' /zdata='0' /bic=02EC0407AD3B423AA6788926F43F72ABIE /verifier=fc0b09802f528515ac95ff9331d66c6e /installerversion=1_29_...' (with hidden window)
  • '%ProgramFiles(x86)%\shop-up\shop-up-helper.exe' /externallog='%TEMP%\Shop-UpInstaller_1598743539.log'' (with hidden window)
  • '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Shop-Up\Shop-Up-bho.dll"' (with hidden window)
  • '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Shop-Up\Shop-Up-bho64.dll"' (with hidden window)
  • '%ProgramFiles(x86)%\shop-up\shop-up-bg.exe' /executebg /externallog='%TEMP%\Shop-UpInstaller_1598743539.log'' (with hidden window)
  • '%ProgramFiles(x86)%\shop-up\shop-up-enabler.exe' /enablebho /agentregpath='Shop-Up' /appid=42822 /srcid='000478' /subid='0' /zdata='0' /bic=02EC0407AD3B423AA6788926F43F72ABIE /verifier=fc0b09802f528515ac95ff9331d66c6e /installerversion=1_29_1...' (with hidden window)
Executes the following
  • '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Shop-Up\Shop-Up-bho.dll"
  • '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Shop-Up\Shop-Up-bho64.dll"
  • '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\Shop-Up\Shop-Up-bho64.dll"

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android