PARA USUARIOS

Cerrar

Mi biblioteca
Mi biblioteca

+ Añadir a la biblioteca

Buscar
Buscar

Soporte
Soporte 24 horas | Normas de contactar

Escribir

una solicitud al rellenar un formulario

Llamar

+7 (495) 789-45-86

Foro

Sus solicitudes

Crear una nueva solicitud

Llamar

+7 (495) 789-45-86

Perfil

ES

RU CN DE EN ES FR IT JP KZ UZ PL BY
Cerrar
Servicios
Escáneres
Dr.Web vxCube
Demo
Peritaje de IIV
Biblioteca de virus
Base de conocimiento

Tecnologías

Términos

Formación y educación

Mitos

Noticias

Trojan.MulDrop5.33615

Added to the Dr.Web virus database: 2014-06-16

Virus description added:

Technical Information

To ensure autorun and distribution:
Modifies the following registry keys:
  • [<HKLM>\SOFTWARE\Classes\bwpfile\Shell\open\command] '' = '%PROGRAM_FILES%\UPCSmartGuard\3371068\6.3.2.123-3371068L\Program\PrvCnt.exe "%1"'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'fspex.exe' = '%TEMP%\ins1.tmp\<Virus name>.exe -ReportOnly'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'fspex.exe' = '%TEMP%\ins1.tmp\<Virus name>.exe /NoIntervention'
  • [<HKLM>\SOFTWARE\Classes\iadfile\Shell\open\command] '' = '%PROGRAM_FILES%\UPCSmartGuard\3371068\632~1.123\Program\REGISTER.EXE "%1"'
Creates the following services:
  • [<HKLM>\SYSTEM\ControlSet001\Services\BackWeb Plug-in - 3371068] 'Start' = '00000002'
  • [<HKLM>\SYSTEM\ControlSet001\Services\FSBWSYS] 'Start' = '00000002'
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
  • [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fspex.exe' = '%PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fspex.exe:*:Enabled:fspex.exe'
Creates and executes the following:
  • '%PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwsys.exe'
  • '%PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fspex.exe' -reg -msvcrt
  • '%PROGRAM_FILES%\UPCSmartGuard\3371068\Program\BWDataSetNotifier-3371068.exe' -regserver
  • '%TEMP%\ins1.tmp\install_comp_Pre_885\instcomp.exe' /PRE
  • '%TEMP%\ins1.tmp\custom_comp_615_885\fsbwreg.exe'
  • '%PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwsys.exe' -i
Modifies file system :
Creates the following files:
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-strict-sve.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-strict-trk.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\fssld_csy.ini
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-strict-slv.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-strict-plk.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-strict-ptb.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-strict-ptg.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\fssld_esn.ini
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\fssld_fin.ini
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\fssld_fra.ini
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\fssld_eng.ini
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\fssld_dan.ini
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\fssld_deu.ini
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\fssld_ell.ini
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-strict-nor.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-strict-dan.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-strict-deu.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-strict-ell.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-strict-csy.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-officelan-slv.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-officelan-sve.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-officelan-trk.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-strict-hun.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-strict-ita.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-strict-nld.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-strict-fra.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-strict-eng.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-strict-esn.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-strict-fin.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\ILAUNCHR_.EXE
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwres.dll
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\FSLD32.DLL
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbw.dpf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwih.exe
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwres.eng
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwsys_.exe
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\PExTNBPIRes.eng
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwui_.dll
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwares.eng
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\PExTNBPlugin.dll
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwce.dll
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwdiag.ini
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbw.cr
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\admin.pub
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\fssld_plk.ini
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\fssld_ptb.ini
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\fssld_ptg.ini
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\fssld_nor.ini
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\fssld_hun.ini
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\fssld_ita.ini
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\fssld_nld.ini
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\_bwfiles.txt
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\InitData\Data\6_15 Security Profiles 2006_02_01.iip
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\CustomDataMerge.tmp
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\info.iad
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\fssld_slv.ini
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\fssld_sve.ini
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\fssld_trk.ini
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-officelan-ptg.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-normal-nor.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-normal-plk.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-normal-ptb.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-normal-nld.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-normal-fra.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-normal-hun.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-normal-ita.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-office-csy.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-office-dan.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-office-deu.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-normal-trk.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-normal-ptg.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-normal-slv.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-normal-sve.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-normal-fin.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-custom-ptg.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-custom-slv.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-custom-sve.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-custom-ptb.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-custom-nld.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-custom-nor.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-custom-plk.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-normal-ell.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-normal-eng.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-normal-esn.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-normal-deu.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-custom-trk.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-normal-csy.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-normal-dan.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-officelan-eng.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-officelan-esn.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-officelan-fin.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-officelan-ell.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-officelan-csy.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-officelan-dan.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-officelan-deu.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-officelan-nor.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-officelan-plk.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-officelan-ptb.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-officelan-nld.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-officelan-fra.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-officelan-hun.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-officelan-ita.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-office-trk.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-office-fra.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-office-hun.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-office-ita.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-office-fin.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-office-ell.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-office-eng.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-office-esn.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-office-ptg.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-office-slv.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-office-sve.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-office-ptb.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-office-nld.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-office-nor.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-office-plk.rtf
  • %PROGRAM_FILES%\Common\fsbwares.esn
  • %PROGRAM_FILES%\Common\fsbwares.fin
  • %PROGRAM_FILES%\Common\fsbwares.fra
  • %PROGRAM_FILES%\Common\fsbwares.eng
  • %PROGRAM_FILES%\Common\fsbwares.dan
  • %PROGRAM_FILES%\Common\fsbwares.deu
  • %PROGRAM_FILES%\Common\fsbwares.ell
  • %PROGRAM_FILES%\Common\fsbwares.nor
  • %PROGRAM_FILES%\Common\fsbwares.plk
  • %PROGRAM_FILES%\Common\fsbwares.ptb
  • %PROGRAM_FILES%\Common\fsbwares.nld
  • %PROGRAM_FILES%\Common\fsbwares.hun
  • %PROGRAM_FILES%\Common\fsbwares.ita
  • %PROGRAM_FILES%\Common\fsbwares.jpn
  • %PROGRAM_FILES%\Common\fsbwares.csy
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwres.sve
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwres.trk
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\dfwunin.dll
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwres.slv
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwres.plk
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwres.ptb
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwres.ptg
  • %PROGRAM_FILES%\Common\fsbw.dpf
  • %PROGRAM_FILES%\Common\fsbw.cr
  • %PROGRAM_FILES%\Common\fsbwih.exe
  • %WINDIR%\fsbwinst.log
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\PExTNBPIRes.jpn
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwres.jpn
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwares.jpn
  • %TEMP%\ins1.tmp\RCX2.tmp
  • %TEMP%\ins1.tmp\RCX3.tmp
  • %TEMP%\ins1.tmp\RCX4.tmp
  • %TEMP%\ins1.tmp\RCX1.tmp
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\readme.txt
  • %TEMP%\ins1.tmp\runner.exe
  • %TEMP%\ins1.tmp\runner.dll
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\BWCHelpr-3371068.dll
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\ServiceWrapper-3371068.exe
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\enabled.txt
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\BWfiles-3371068.dll
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fspex.exe
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\BWDataSets-3371068.dll
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\BWDataSetNotifier-3371068.exe
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\InitData\Data\6_15 Czech Custom Resources.iip
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwui.dll
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\fsbwce.ini
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwsys.exe
  • %PROGRAM_FILES%\Common\fsbwares.trk
  • %PROGRAM_FILES%\Common\fsbwares.ptg
  • %PROGRAM_FILES%\Common\fsbwares.slv
  • %PROGRAM_FILES%\Common\fsbwares.sve
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\InitData\Data\TNB Config Czech.iip
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295255372\615_Czech_CustomisationPackage_01.jar
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295255372\info.iad
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295255373\tnbconf.ini
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwupst.dll
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\InitData\Data\usrprefs.ini
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295255373\info.iad
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwres.nor
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwares.dan
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwares.esn
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwares.hun
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwares.csy
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwares.deu
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\PExTNBPIRes.dan
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\PExTNBPIRes.nor
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwares.ptg
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwares.slv
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\PExTNBPIRes.csy
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwares.ptb
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwares.nld
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwares.nor
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwares.plk
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwares.sve
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fssgsup.dll
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\cscozarm.dll
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\PExTNBPIRes.fin
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsremoval.ini
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwst.exe
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\nicrm.dll
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsprodrm.dll
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwares.fin
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwares.fra
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwares.ita
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\PExTNBPIRes.deu
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\PExTNBPIRes.fra
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\PExTNBPIRes.ita
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\PExTNBPIRes.sve
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwres.csy
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwres.dan
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwres.deu
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\trendrm.dll
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwares.ell
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\PExTNBPIRes.ell
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\PExTNBPIRes.trk
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwres.hun
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwres.ita
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwres.nld
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwres.fra
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwres.ell
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwres.esn
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwres.fin
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwares.trk
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\PExTNBPIRes.ptb
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\PExTNBPIRes.ptg
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\PExTNBPIRes.slv
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\PExTNBPIRes.plk
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\PExTNBPIRes.esn
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\PExTNBPIRes.hun
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\PExTNBPIRes.nld
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\sophosrm.dll
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fssgsup.ini
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwups_.dll
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\aawrm.dll
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\vsrm.dll
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\igpsdet.dll
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\mcafeerm.dll
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-custom-ita.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\6.3.2.123-3371068L\Install\readme.txt
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\6.3.2.123-3371068L\Install\LiteInst.exe
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\clasid.bak
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\6.3.2.123-3371068L\Install\win2000.dll
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\6.3.2.123-3371068L\Program\runner.exe
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\6.3.2.123-3371068L\Program\wtsisctd.exe
  • %WINDIR%\bwUnin-6.3.2.123-3371068L.exe
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\InitData\Data\GenFlash\1\info.iad
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\InitData\Data\InfoCenter.GIF
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\InitData\Data\InfoCenter.htm
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\InitData\Data\GenFlash\1\gen.bis
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\InitData\Data\background.gif
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\InitData\Data\browser.htm
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\InitData\Data\GenFlash\1\gen.bif
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\6.3.2.123-3371068L\Program\runner.dll
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\6.3.2.123-3371068L\Program\bwmib.dll
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\6.3.2.123-3371068L\Program\bwsec.dll
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\6.3.2.123-3371068L\Program\bwxtext.dll
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\6.3.2.123-3371068L\Program\bwlang.ini
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\6.3.2.123-3371068L\Plugins\Npavi32.dll
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\6.3.2.123-3371068L\Program\BWCHelpr.dll
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\6.3.2.123-3371068L\Program\bwfiles.dll
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\6.3.2.123-3371068L\Program\pacsupport.js
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\6.3.2.123-3371068L\Program\register.exe
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\6.3.2.123-3371068L\Program\Restart.exe
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\6.3.2.123-3371068L\Program\loading.htm
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\6.3.2.123-3371068L\Program\Cpuinf32.dll
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\6.3.2.123-3371068L\Program\ding.wav
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\6.3.2.123-3371068L\Program\IAdHide.dll
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-custom-nor.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-custom-plk.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-custom-ptb.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-custom-nld.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-custom-fra.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-custom-hun.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-custom-ita.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-high-csy.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-high-dan.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-high-deu.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-custom-trk.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-custom-ptg.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-custom-slv.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-custom-sve.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-custom-fin.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\InitData\Data\chn.idx
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\InitData\Data\DefPrefs.ini
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\InitData\Data\main.wkg
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\InitData\Data\chn.dat
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\InitData\Data\cert.db
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\InitData\Data\chandir.dat
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\InitData\Data\chandir.idx
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-custom-ell.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-custom-eng.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-custom-esn.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-custom-deu.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\1.bpf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-custom-csy.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-custom-dan.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\6.3.2.123-3371068L\Program\Sprite6.exe
  • %TEMP%\ins1.tmp\installer\Installer.zip
  • %TEMP%\ins1.tmp\install_comp_Pre_885\instcomp.exe
  • %TEMP%\ins1.tmp\LiteInstActivator.ini
  • %TEMP%\ins1.tmp\custom_comp_615_885\fsbwreg.exe
  • %TEMP%\ins1.tmp\core\core.zip
  • %TEMP%\ins1.tmp\custom_comp_615_885\admin.pub
  • %TEMP%\ins1.tmp\custom_comp_615_885\comp.zip
  • %TEMP%\ins1.tmp\Pre6Import\Pre6Import.zip
  • %TEMP%\ins1.tmp\preseeded_infopak_6_15_Czech_Custom_Resources\6_15 Czech Custom Resources.iip
  • %TEMP%\ins1.tmp\preseeded_infopak_6_15_Czech_Custom_Resources\6_15 Czech Custom Resources.zip
  • %TEMP%\ins1.tmp\olepro32\olepro.zip
  • %TEMP%\ins1.tmp\mfc\mfc.zip
  • %TEMP%\ins1.tmp\msvcp\msvcp.zip
  • %TEMP%\ins1.tmp\msvcrt\msvcrt.zip
  • %TEMP%\ins1.tmp\comctl32\401comupd.exe
  • %TEMP%\ins1.tmp\BWHelper.dll
  • %TEMP%\ins1.tmp\LiteInstRC_EN.dll
  • %TEMP%\ins1.tmp\App\App.zip
  • %TEMP%\ins1.tmp\pacsupport.js
  • %TEMP%\BWInstall.log
  • %WINDIR%\warhead.ini
  • %TEMP%\ins1.tmp\bw.inf
  • %TEMP%\ins1.tmp\Cfg\Cfg.zip
  • %TEMP%\ins1.tmp\Cfg\Resources.zip
  • %TEMP%\ins1.tmp\clntutil\clntutil.zip
  • %TEMP%\ins1.tmp\BWRegistration\LiteInstActivator.ini
  • %TEMP%\ins1.tmp\BackWebDiet\backwebdiet.zip
  • %TEMP%\ins1.tmp\backwebEn\backwebEn.zip
  • %TEMP%\ins1.tmp\BWDataSets\BWDataSets.zip
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\6.3.2.123-3371068L\Install\bwUnin.exe
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\6.3.2.123-3371068L\Program\EN\UninstallRC.dll
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\6.3.2.123-3371068L\Program\EN\ClientRc.dll
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\6.3.2.123-3371068L\Program\backweb.tlb
  • %TEMP%\ins1.tmp\README.TXT
  • %TEMP%\BWDump.log
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\6.3.2.123-3371068L\Program\backweb.dll
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\6.3.2.123-3371068L\Program\BWDataSets.dll
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\6.3.2.123-3371068L\Program\BWDataSetNotifier.dll
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\6.3.2.123-3371068L\Program\EN\SpriteRC.dll
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\6.3.2.123-3371068L\Program\ServiceWrapper.dll
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\6.3.2.123-3371068L\Program\EN\registerRC.dll
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\6.3.2.123-3371068L\Program\clntutil.dll
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\6.3.2.123-3371068L\Program\Pre6Import.dll
  • %TEMP%\ins1.tmp\Win2000.dll
  • %TEMP%\ins1.tmp\ServiceSupport\ServiceWrapper.dll
  • %TEMP%\ins1.tmp\SettingsFile\bwsetup.ini
  • %TEMP%\ins1.tmp\snmpapi\snmpapi.zip
  • %TEMP%\ins1.tmp\preseeded_infopak_TNB_Config_Czech\TNB Config Czech.zip
  • %TEMP%\ins1.tmp\preseeded_infopak_6_15_Security_Profiles_2006_02_01\6_15 Security Profiles 2006_02_01.iip
  • %TEMP%\ins1.tmp\preseeded_infopak_6_15_Security_Profiles_2006_02_01\6_15 Security Profiles 2006_02_01.zip
  • %TEMP%\ins1.tmp\preseeded_infopak_TNB_Config_Czech\TNB Config Czech.iip
  • %TEMP%\ins1.tmp\uninstaller\uninstaller.zip
  • %TEMP%\ins1.tmp\params.ini
  • %TEMP%\ins1.tmp\<Virus name>.exe
  • %TEMP%\ins1.tmp\UninstallEn\UninstallEn.zip
  • %TEMP%\ins1.tmp\Sprite\npavi.zip
  • %TEMP%\ins1.tmp\Sprite\Sprite.zip
  • %TEMP%\ins1.tmp\SpriteEn\SpriteEn.zip
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-block-fin.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-block-fra.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-block-hun.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-block-esn.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-block-deu.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-block-ell.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-block-eng.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-block-ptb.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-block-ptg.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-block-slv.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-block-plk.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-block-ita.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-block-nld.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-block-nor.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-block-dan.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\avsld_plk.ini
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\avsld_ptb.ini
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\avsld_ptg.ini
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\avsld_nor.ini
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\avsld_hun.ini
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\avsld_ita.ini
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\avsld_nld.ini
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\BW_datapak.bis
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\bw_name.html
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-block-csy.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\BW_datapak.bif
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\avsld_slv.ini
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\avsld_sve.ini
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\avsld_trk.ini
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-bypass-trk.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-custom-csy.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-custom-dan.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-bypass-sve.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-bypass-ptb.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-bypass-ptg.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-bypass-slv.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-custom-fin.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-custom-fra.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-custom-hun.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-custom-esn.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-custom-deu.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-custom-ell.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-custom-eng.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-bypass-plk.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-bypass-deu.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-bypass-ell.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-bypass-eng.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-bypass-dan.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-block-sve.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-block-trk.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-bypass-csy.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-bypass-ita.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-bypass-nld.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-bypass-nor.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-bypass-hun.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-bypass-esn.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-bypass-fin.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\dfw-bypass-fra.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\avsld_fra.ini
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-medium-eng.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-medium-esn.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-medium-fin.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-medium-ell.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-medium-csy.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-medium-dan.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-medium-deu.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-medium-nor.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-medium-plk.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-medium-ptb.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-medium-nld.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-medium-fra.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-medium-hun.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-medium-ita.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-high-trk.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-high-fra.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-high-hun.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-high-ita.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-high-fin.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-high-ell.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-high-eng.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-high-esn.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-high-ptg.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-high-slv.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-high-sve.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-high-ptb.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-high-nld.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-high-nor.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-high-plk.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-off-slv.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-off-sve.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-off-trk.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-off-ptg.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-off-nor.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-off-plk.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-off-ptb.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\avsld_eng.ini
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\avsld_esn.ini
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\avsld_fin.ini
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\avsld_ell.ini
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\avsld_csy.ini
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\avsld_dan.ini
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\avsld_deu.ini
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-off-nld.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-off-csy.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-off-dan.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-off-deu.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-medium-trk.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-medium-ptg.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-medium-slv.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-medium-sve.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-off-fra.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-off-hun.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-off-ita.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-off-fin.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-off-ell.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-off-eng.rtf
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\IP295254749\av-off-esn.rtf
Deletes the following files:
  • %TEMP%\ins1.tmp\mfc\mfc.zip
  • %TEMP%\ins1.tmp\msvcp\msvcp.zip
  • %TEMP%\ins1.tmp\LiteInstActivator.ini
  • %TEMP%\ins1.tmp\LiteInstRC_EN.dll
  • %TEMP%\ins1.tmp\pacsupport.js
  • %TEMP%\ins1.tmp\params.ini
  • %TEMP%\ins1.tmp\msvcrt\msvcrt.zip
  • %TEMP%\ins1.tmp\olepro32\olepro.zip
  • %TEMP%\ins1.tmp\install_comp_Pre_885\instcomp.exe
  • %TEMP%\ins1.tmp\comctl32\401comupd.exe
  • %TEMP%\ins1.tmp\core\core.zip
  • %TEMP%\ins1.tmp\Cfg\Resources.zip
  • %TEMP%\ins1.tmp\clntutil\clntutil.zip
  • %TEMP%\ins1.tmp\custom_comp_615_885\fsbwreg.exe
  • %TEMP%\ins1.tmp\installer\Installer.zip
  • %TEMP%\ins1.tmp\custom_comp_615_885\admin.pub
  • %TEMP%\ins1.tmp\custom_comp_615_885\comp.zip
  • %TEMP%\ins1.tmp\Sprite\npavi.zip
  • %TEMP%\ins1.tmp\Sprite\Sprite.zip
  • %TEMP%\ins1.tmp\SettingsFile\bwsetup.ini
  • %TEMP%\ins1.tmp\snmpapi\snmpapi.zip
  • %TEMP%\ins1.tmp\uninstaller\uninstaller.zip
  • %TEMP%\ins1.tmp\Win2000.dll
  • %TEMP%\ins1.tmp\SpriteEn\SpriteEn.zip
  • %TEMP%\ins1.tmp\UninstallEn\UninstallEn.zip
  • %TEMP%\ins1.tmp\ServiceSupport\ServiceWrapper.dll
  • %TEMP%\ins1.tmp\preseeded_infopak_6_15_Czech_Custom_Resources\6_15 Czech Custom Resources.zip
  • %TEMP%\ins1.tmp\preseeded_infopak_6_15_Security_Profiles_2006_02_01\6_15 Security Profiles 2006_02_01.iip
  • %TEMP%\ins1.tmp\Pre6Import\Pre6Import.zip
  • %TEMP%\ins1.tmp\preseeded_infopak_6_15_Czech_Custom_Resources\6_15 Czech Custom Resources.iip
  • %TEMP%\ins1.tmp\preseeded_infopak_TNB_Config_Czech\TNB Config Czech.zip
  • %TEMP%\ins1.tmp\README.TXT
  • %TEMP%\ins1.tmp\preseeded_infopak_6_15_Security_Profiles_2006_02_01\6_15 Security Profiles 2006_02_01.zip
  • %TEMP%\ins1.tmp\preseeded_infopak_TNB_Config_Czech\TNB Config Czech.iip
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwares.nld
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwares.nor
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwares.ita
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwares.jpn
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwares.ptg
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwares.slv
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwares.plk
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwares.ptb
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwares.hun
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwares.deu
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwares.ell
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwares.csy
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwares.dan
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwares.fin
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwares.fra
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwares.eng
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwares.esn
  • %TEMP%\ins1.tmp\backwebEn\backwebEn.zip
  • %TEMP%\ins1.tmp\bw.inf
  • %TEMP%\ins1.tmp\<Virus name>.exe
  • %TEMP%\ins1.tmp\BackWebDiet\backwebdiet.zip
  • %TEMP%\ins1.tmp\BWRegistration\LiteInstActivator.ini
  • %TEMP%\ins1.tmp\Cfg\Cfg.zip
  • %TEMP%\ins1.tmp\BWDataSets\BWDataSets.zip
  • %TEMP%\ins1.tmp\BWHelper.dll
  • %TEMP%\ins1.tmp\App\App.zip
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwui_.dll
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwsys_.exe
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwares.sve
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwares.trk
  • %TEMP%\ins1.tmp\runner.dll
  • %WINDIR%\warhead.ini
  • %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\fsbwups_.dll
  • %TEMP%\ins1.tmp\runner.exe
Moves the following files:
  • from %TEMP%\ins1.tmp\RCX3.tmp to %TEMP%\ins1.tmp\runner.exe
  • from %TEMP%\ins1.tmp\RCX4.tmp to %TEMP%\ins1.tmp\runner.dll
  • from %TEMP%\ins1.tmp\RCX2.tmp to %TEMP%\ins1.tmp\runner.dll
  • from %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\CustomDataMerge.tmp to %PROGRAM_FILES%\UPCSmartGuard\3371068\Program\CustomDataMerge.txt
  • from %TEMP%\ins1.tmp\RCX1.tmp to %TEMP%\ins1.tmp\runner.exe
Miscellaneous:
Searches for the following windows:
  • ClassName: '(null)' WindowName: 'BackWeb Agent'
  • ClassName: 'Shell_TrayWnd' WindowName: '(null)'
  • ClassName: 'Indicator' WindowName: '(null)'

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Free trial

 

Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

Free trial

 

Download Dr.Web

Download by serial number

Download on App Store

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

 

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android

Free trial

14 days

Download now
Get it on Google Play