Mi biblioteca
Mi biblioteca

+ Añadir a la biblioteca

Soporte
Soporte 24 horas | Normas de contactar

Sus solicitudes

Perfil

Trojan.MulDrop5.34121

Added to the Dr.Web virus database: 2014-07-07

Virus description added:

Technical Information

To ensure autorun and distribution:
Modifies the following registry keys:
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Tm95037Q32601' = '%HOMEPATH%\Ca63970A50275\Ranga.exe'
Malicious functions:
Creates and executes the following:
  • '%HOMEPATH%\Ca63970A50275\Ranga.exe'
Modifies file system :
Creates the following files:
  • %HOMEPATH%\Ca63970A50275\X56021D35886.ECN
  • %HOMEPATH%\Ca63970A50275\74818.YMB
  • %HOMEPATH%\Ca63970A50275\21721.SZS
  • %HOMEPATH%\Ca63970A50275\Q67826Q67184.NTI
  • %HOMEPATH%\Ca63970A50275\67237.ION
  • %HOMEPATH%\Ca63970A50275\25713.IMQ
  • %HOMEPATH%\Ca63970A50275\L3451G39525.WCT
  • %HOMEPATH%\Ca63970A50275\31611.PJC
  • %HOMEPATH%\Ca63970A50275\28491.NFE
  • %HOMEPATH%\Ca63970A50275\79788.IKP
  • %HOMEPATH%\Ca63970A50275\42020.BTH
  • %HOMEPATH%\Ca63970A50275\I81071W3360.HZL
  • %HOMEPATH%\Ca63970A50275\M48767K41728.XSO
  • %HOMEPATH%\Ca63970A50275\23334.KDD
  • %HOMEPATH%\Ca63970A50275\C84202H44661.ZZT
  • %HOMEPATH%\Ca63970A50275\Y23472G23335.XCV
  • %HOMEPATH%\Ca63970A50275\34272.BFG
  • %HOMEPATH%\Ca63970A50275\58349.IKX
  • %HOMEPATH%\Ca63970A50275\M92284U97433.RYI
  • %HOMEPATH%\Ca63970A50275\M75038P53862.HIV
  • %HOMEPATH%\Ca63970A50275\21645.UYV
  • %HOMEPATH%\Ca63970A50275\64682.PDQ
  • %HOMEPATH%\Ca63970A50275\11524.LRW
  • %HOMEPATH%\Ca63970A50275\54573.RKC
  • %HOMEPATH%\Ca63970A50275\28344.OKG
  • %HOMEPATH%\Ca63970A50275\M8895W10143.PIR
  • %HOMEPATH%\Ca63970A50275\V96219R71192.LTI
  • %HOMEPATH%\Ca63970A50275\L70358H60038.VEX
  • %HOMEPATH%\Ca63970A50275\J27737W21096.BNM
  • %HOMEPATH%\Ca63970A50275\D55099P31371.PNR
  • %HOMEPATH%\Ca63970A50275\20608.GMZ
  • %HOMEPATH%\Ca63970A50275\L52971D43762.RCR
  • %HOMEPATH%\Ca63970A50275\47009.LVG
  • %HOMEPATH%\Ca63970A50275\X10629F10615.VSE
  • %HOMEPATH%\Ca63970A50275\Q33831C97652.IFK
  • %HOMEPATH%\Ca63970A50275\Z22829C88218.LNP
  • %HOMEPATH%\Ca63970A50275\H87387W26932.XXG
  • %HOMEPATH%\Ca63970A50275\N74011S27762.IQN
  • %HOMEPATH%\Ca63970A50275\X38415W59504.OCP
  • %HOMEPATH%\Ca63970A50275\38844.LBJ
  • %HOMEPATH%\Ca63970A50275\N27945N37229.SJM
  • %HOMEPATH%\Ca63970A50275\Q95320J66749.ZMU
  • %HOMEPATH%\Ca63970A50275\J23040S6011.KOA
  • %HOMEPATH%\Ca63970A50275\C27652H37234.LEZ
  • %HOMEPATH%\Ca63970A50275\51685.VCU
  • %HOMEPATH%\Ca63970A50275\S48755K60254.XHC
  • %HOMEPATH%\Ca63970A50275\49530.YON
  • %HOMEPATH%\Ca63970A50275\56502.WRV
  • %HOMEPATH%\Ca63970A50275\V29207G85423.QCP
  • %HOMEPATH%\Ca63970A50275\57880.VXB
  • %HOMEPATH%\Ca63970A50275\39275.WWA
  • %HOMEPATH%\Ca63970A50275\9076.CZO
  • %HOMEPATH%\Ca63970A50275\T95725Q34204.WQM
  • %HOMEPATH%\Ca63970A50275\T72234J4625.ZBH
  • %HOMEPATH%\Ca63970A50275\77765.VLY
  • %HOMEPATH%\Ca63970A50275\53100.MPC
  • %HOMEPATH%\Ca63970A50275\27244.WSQ
  • %HOMEPATH%\Ca63970A50275\I26129X67741.FLJ
  • %HOMEPATH%\Ca63970A50275\S66770P58669.XFA
  • %HOMEPATH%\Ca63970A50275\A41007G9196.OES
  • %HOMEPATH%\Ca63970A50275\G40029V49843.HJA
  • %HOMEPATH%\Ca63970A50275\26123.UFH
  • %HOMEPATH%\Ca63970A50275\99085.QFS
  • %HOMEPATH%\Ca63970A50275\S24212S45822.OZH
  • %HOMEPATH%\Ca63970A50275\Z59486M99027.CGY
  • %HOMEPATH%\Ca63970A50275\37577.VFZ
  • %HOMEPATH%\Ca63970A50275\Z23471E72534.RKU
  • %HOMEPATH%\Ca63970A50275\V6353P33682.SBD
  • %HOMEPATH%\Ca63970A50275\74993.EUW
  • %HOMEPATH%\Ca63970A50275\84258.KAF
  • %HOMEPATH%\Ca63970A50275\J61800T57326.DHL
  • %HOMEPATH%\Ca63970A50275\E38094G54034.SIU
  • %HOMEPATH%\Ca63970A50275\Q4903B24306.FUA
  • %HOMEPATH%\Ca63970A50275\98227.MET
  • %HOMEPATH%\Ca63970A50275\M19587H83249.UZC
  • %HOMEPATH%\Ca63970A50275\53421.HFE
  • %HOMEPATH%\Ca63970A50275\L69921F17788.BWD
  • %HOMEPATH%\Ca63970A50275\51958.UAD
  • %HOMEPATH%\Ca63970A50275\K1593E12978.CJP
  • %HOMEPATH%\Ca63970A50275\L64826F53414.RBH
  • %HOMEPATH%\Ca63970A50275\49373.RFT
  • %HOMEPATH%\Ca63970A50275\D5700S51112.FNM
  • %HOMEPATH%\Ca63970A50275\55048.VOB
  • %HOMEPATH%\Ca63970A50275\81026.VQC
  • %HOMEPATH%\Ca63970A50275\V46498X77257.PVE
  • %HOMEPATH%\Ca63970A50275\A68845C78797.YIO
  • %HOMEPATH%\Ca63970A50275\69710.FAL
  • %HOMEPATH%\Ca63970A50275\T6501V16374.WBT
  • %HOMEPATH%\Ca63970A50275\R16480D13535.JHK
  • %HOMEPATH%\Ca63970A50275\66011.PVU
  • %HOMEPATH%\Ca63970A50275\17954.UFJ
  • %HOMEPATH%\Ca63970A50275\75394.HQF
  • %HOMEPATH%\Ca63970A50275\66401.GBB
  • %HOMEPATH%\Ca63970A50275\N76569V74480.BKV
  • %HOMEPATH%\Ca63970A50275\X18507C68802.CEC
  • %HOMEPATH%\Ca63970A50275\99173.IKD
  • %HOMEPATH%\Ca63970A50275\47538.HBK
  • %HOMEPATH%\Ca63970A50275\A51427T28717.URJ
  • %HOMEPATH%\Ca63970A50275\V2018U82288.KXN
  • %HOMEPATH%\Ca63970A50275\K57515Q98716.ZCV
  • %HOMEPATH%\Ca63970A50275\3105.WZF
  • %HOMEPATH%\Ca63970A50275\62772.DCQ
  • %HOMEPATH%\Ca63970A50275\38506.EGY
  • %HOMEPATH%\Ca63970A50275\54680.ZXB
  • %HOMEPATH%\Ca63970A50275\Z53547E69732.EUO
  • %HOMEPATH%\Ca63970A50275\8270.KBE
  • %HOMEPATH%\Ca63970A50275\U80935E15610.AKE
  • %HOMEPATH%\Ca63970A50275\98042.XYN
  • %HOMEPATH%\Ca63970A50275\X95556Z4943.WCH
  • %HOMEPATH%\Ca63970A50275\51856.RSS
  • %HOMEPATH%\Ca63970A50275\T34488Z6595.QQV
  • %HOMEPATH%\Ca63970A50275\56829.IDF
  • %HOMEPATH%\Ca63970A50275\19854.VPG
  • %HOMEPATH%\Ca63970A50275\Y15177L12409.ZBQ
  • %HOMEPATH%\Ca63970A50275\S59737M80925.HNX
  • %HOMEPATH%\Ca63970A50275\B57541B84965.XUO
  • %HOMEPATH%\Ca63970A50275\29757.VVY
  • %HOMEPATH%\Ca63970A50275\Z20855I57732.NLP
  • %HOMEPATH%\Ca63970A50275\W35193K55656.NJX
  • %HOMEPATH%\Ca63970A50275\19845.NEK
  • %HOMEPATH%\Ca63970A50275\27920.VLZ
  • %HOMEPATH%\Ca63970A50275\M75148Y81681.JNP
  • %HOMEPATH%\Ca63970A50275\P2196M71225.PPX
  • %HOMEPATH%\Ca63970A50275\K28079Z99020.SCE
  • %HOMEPATH%\Ca63970A50275\R67782J46487.QKW
  • %HOMEPATH%\Ca63970A50275\G64637O79489.UHS
  • %HOMEPATH%\Ca63970A50275\C84704B59178.BQI
  • %HOMEPATH%\Ca63970A50275\L27522O73787.PXB
  • %HOMEPATH%\Ca63970A50275\7207.VLL
  • %HOMEPATH%\Ca63970A50275\41355.BOT
  • %HOMEPATH%\Ca63970A50275\J70699H86149.IPT
  • %HOMEPATH%\Ca63970A50275\66387.NGM
  • %HOMEPATH%\Ca63970A50275\Y4433V19968.AZA
  • %HOMEPATH%\Ca63970A50275\E99855W76569.QPX
  • %HOMEPATH%\Ca63970A50275\26063.RWX
  • %HOMEPATH%\Ca63970A50275\11206.PCU
  • %HOMEPATH%\Ca63970A50275\83759.EDJ
  • %HOMEPATH%\Ca63970A50275\V94456A60320.LPU
  • %HOMEPATH%\Ca63970A50275\48249.ROI
  • %HOMEPATH%\Ca63970A50275\30174.FYO
  • %HOMEPATH%\Ca63970A50275\N17773Q71142.GDH
  • %HOMEPATH%\Ca63970A50275\42615.IWT
  • %HOMEPATH%\Ca63970A50275\E48078S42426.ZEV
  • %HOMEPATH%\Ca63970A50275\H34937F27362.CAF
  • %HOMEPATH%\Ca63970A50275\W3948O98393.IPO
  • %HOMEPATH%\Ca63970A50275\X84400I26180.OWM
  • %HOMEPATH%\Ca63970A50275\C39842U66228.JPB
  • %HOMEPATH%\Ca63970A50275\36046.DMJ
  • %HOMEPATH%\Ca63970A50275\Y88536G20233.EGV
  • %HOMEPATH%\Ca63970A50275\U23567V48745.MKM
  • %HOMEPATH%\Ca63970A50275\P58820X13106.RLE
  • %HOMEPATH%\Ca63970A50275\93913.HQV
  • %HOMEPATH%\Ca63970A50275\20337.MPZ
  • %HOMEPATH%\Ca63970A50275\1387.ADC
  • %HOMEPATH%\Ca63970A50275\9973.UDG
  • %HOMEPATH%\Ca63970A50275\33414.RGO
  • %HOMEPATH%\Ca63970A50275\23822.KZB
  • %HOMEPATH%\Ca63970A50275\L80996R36639.CXJ
  • %HOMEPATH%\Ca63970A50275\84118.RPI
  • %HOMEPATH%\Ca63970A50275\95928.FQJ
  • %HOMEPATH%\Ca63970A50275\90566.BJV
  • %HOMEPATH%\Ca63970A50275\C62023J65294.STX
  • %HOMEPATH%\Ca63970A50275\C32154L6086.GOL
  • %HOMEPATH%\Ca63970A50275\M45137A38803.PJA
  • %HOMEPATH%\Ca63970A50275\18459.WUK
  • %HOMEPATH%\Ca63970A50275\45130.FCS
  • %HOMEPATH%\Ca63970A50275\7989.NTQ
  • %HOMEPATH%\Ca63970A50275\23238.KJI
  • %HOMEPATH%\Ca63970A50275\16576.EZF
  • %HOMEPATH%\Ca63970A50275\90324.RNM
  • %HOMEPATH%\Ca63970A50275\12915.YSZ
  • %HOMEPATH%\Ca63970A50275\S53526J6376.YUW
  • %HOMEPATH%\Ca63970A50275\68429.JBB
  • %HOMEPATH%\Ca63970A50275\P68618R62426.LJH
  • %HOMEPATH%\Ca63970A50275\Q49181Q48396.RMD
  • %HOMEPATH%\Ca63970A50275\86231.NPD
  • %HOMEPATH%\Ca63970A50275\MT.JSW
  • %HOMEPATH%\Ca63970A50275\Y64775V17425.CFU
  • %HOMEPATH%\Od94928J79164.TC1
  • %TEMP%\aut1.tmp
  • %HOMEPATH%\Ca63970A50275\O92578Y21538.TNO
  • %HOMEPATH%\Ca63970A50275\40000.WPR
  • %HOMEPATH%\Ca63970A50275\I32907X57836.JTE
  • %HOMEPATH%\Ca63970A50275\O57838R10674.ESK
  • %HOMEPATH%\Ca63970A50275\R76094Y46049.TAY
  • %HOMEPATH%\Ca63970A50275\44585.DAS
  • %HOMEPATH%\Ca63970A50275\78702.CNA
  • %HOMEPATH%\Ca63970A50275\J6533O22094.EUP
  • %HOMEPATH%\Ca63970A50275\68836.BYG
  • %HOMEPATH%\Ca63970A50275\17880.MEA
  • %HOMEPATH%\Ca63970A50275\86540.PJX
  • %HOMEPATH%\Ca63970A50275\55249.JXJ
  • %HOMEPATH%\Ca63970A50275\16588.JNU
  • %HOMEPATH%\Ca63970A50275\73964.LKV
  • %HOMEPATH%\Ca63970A50275\I37968D17418.NKP
  • %HOMEPATH%\Ca63970A50275\G74123G40923.ISC
  • %HOMEPATH%\Ca63970A50275\57481.WUI
  • %HOMEPATH%\Ca63970A50275\Y66159G70148.JIM
  • %HOMEPATH%\Ca63970A50275\21225.STY
  • %HOMEPATH%\Ca63970A50275\Y58100G10329.WPN
  • %HOMEPATH%\Ca63970A50275\92919.IJH
  • %HOMEPATH%\Ca63970A50275\67213.ARE
  • %HOMEPATH%\Ca63970A50275\G64769Q57692.RKU
  • %HOMEPATH%\Ca63970A50275\28916.PGX
  • %HOMEPATH%\Ca63970A50275\I20863E88531.EMN
  • %HOMEPATH%\Ca63970A50275\48076.HTE
  • %HOMEPATH%\Ca63970A50275\28148.HHK
  • %HOMEPATH%\Ca63970A50275\O64217P94116.CHU
  • %HOMEPATH%\Ca63970A50275\R62123W84759.KWS
  • %HOMEPATH%\Ca63970A50275\Q25010Y98658.SYV
  • %HOMEPATH%\Ca63970A50275\72593.QKJ
  • %HOMEPATH%\Ca63970A50275\A4323Q22652.KWJ
  • %HOMEPATH%\Ca63970A50275\77257.PVF
  • %HOMEPATH%\Ca63970A50275\73454.KMA
  • %HOMEPATH%\Ca63970A50275\L39272J50587.ZRD
  • %HOMEPATH%\Ca63970A50275\F55418T2187.QTO
  • %HOMEPATH%\Ca63970A50275\V90186Z83826.TMK
  • %HOMEPATH%\Ca63970A50275\C40735Q46305.KOS
  • %HOMEPATH%\Ca63970A50275\X33001R96624.YMN
  • %HOMEPATH%\Ca63970A50275\40286.OPB
  • %HOMEPATH%\Ca63970A50275\S94200T16784.GZN
  • %HOMEPATH%\Ca63970A50275\Z57975P4823.RMN
  • %HOMEPATH%\Ca63970A50275\Y75040E70992.FAN
  • %HOMEPATH%\Ca63970A50275\42533.VGY
  • %HOMEPATH%\Ca63970A50275\H26460V41665.LPS
  • %HOMEPATH%\Ca63970A50275\C34453Y43887.XYK
  • %HOMEPATH%\Ca63970A50275\8889.GBW
  • %HOMEPATH%\Ca63970A50275\Y31392D86157.YHA
  • %HOMEPATH%\Ca63970A50275\39157.AAE
  • %HOMEPATH%\Ca63970A50275\E3873V52177.YCC
  • %HOMEPATH%\Ca63970A50275\Y22215D34037.ZNB
  • %HOMEPATH%\Ca63970A50275\53586.DOD
  • %HOMEPATH%\Ca63970A50275\H90714X9826.MEG
  • %HOMEPATH%\Ca63970A50275\95063.GWB
  • %HOMEPATH%\Ca63970A50275\Q84814T51352.TDL
  • %HOMEPATH%\Ca63970A50275\H22608H33696.SEG
  • %HOMEPATH%\Ca63970A50275\52125.WYZ
  • %HOMEPATH%\Ca63970A50275\45284.JYG
  • %HOMEPATH%\Ca63970A50275\92317.CZM
  • %HOMEPATH%\Ca63970A50275\M95096W96016.PRI
  • %HOMEPATH%\Ca63970A50275\K75287D98022.NTX
  • %HOMEPATH%\Ca63970A50275\69972.GVE
  • %HOMEPATH%\Ca63970A50275\Z30792P27260.LMC
  • %HOMEPATH%\Ca63970A50275\40787.QZD
  • %HOMEPATH%\Ca63970A50275\58039.PNQ
  • %HOMEPATH%\Ca63970A50275\73590.XLC
  • %HOMEPATH%\Ca63970A50275\K91965P22626.LKD
  • %HOMEPATH%\Ca63970A50275\Y38297R27650.BRN
  • %HOMEPATH%\Ca63970A50275\29988.VKQ
  • %HOMEPATH%\Ca63970A50275\A64485H6990.IGI
  • %HOMEPATH%\Ca63970A50275\P82669B44040.OXV
  • %HOMEPATH%\Ca63970A50275\C66417U11361.BRN
  • %HOMEPATH%\Ca63970A50275\59717.SAU
  • %HOMEPATH%\Ca63970A50275\M37119K49758.JRZ
  • %HOMEPATH%\Ca63970A50275\S57711G70739.YVJ
  • %HOMEPATH%\Ca63970A50275\52579.GNU
  • %HOMEPATH%\Ca63970A50275\72759.OCC
  • %HOMEPATH%\Ca63970A50275\Q55823O80305.TFZ
  • %HOMEPATH%\Ca63970A50275\84910.PCA
  • %HOMEPATH%\Ca63970A50275\V80011U72722.WVB
  • %HOMEPATH%\Ca63970A50275\15940.UBS
  • %HOMEPATH%\Ca63970A50275\25442.VCI
  • %HOMEPATH%\Ca63970A50275\Y58110C44701.XRR
  • %HOMEPATH%\Ca63970A50275\51801.YZX
  • %HOMEPATH%\Ca63970A50275\29198.ADZ
  • %HOMEPATH%\Ca63970A50275\5539.RVP
  • %HOMEPATH%\Ca63970A50275\U78167B68232.CPY
  • %HOMEPATH%\Ca63970A50275\49098.UJO
  • %HOMEPATH%\Ca63970A50275\52714.QFH
  • %HOMEPATH%\Ca63970A50275\96004.LAS
  • %HOMEPATH%\Ca63970A50275\39042.UEX
  • %HOMEPATH%\Ca63970A50275\75389.SYG
  • %HOMEPATH%\Ca63970A50275\31283.XLR
  • %HOMEPATH%\Ca63970A50275\77422.DNH
  • %HOMEPATH%\Ca63970A50275\39123.TBU
  • %HOMEPATH%\Ca63970A50275\63875.UXT
  • %HOMEPATH%\Ca63970A50275\5510.HYL
  • %HOMEPATH%\Ca63970A50275\53488.HOP
  • %HOMEPATH%\Ca63970A50275\40305.XPX
  • %HOMEPATH%\Ca63970A50275\W55791K73347.VPJ
  • %HOMEPATH%\Ca63970A50275\19331.LUA
  • %HOMEPATH%\Ca63970A50275\32785.AMI
  • %HOMEPATH%\Ca63970A50275\41097.HPF
  • %HOMEPATH%\Ca63970A50275\25702.TWV
  • %HOMEPATH%\Ca63970A50275\A69314E69760.WAI
  • %HOMEPATH%\Ca63970A50275\P91275M62621.DMB
  • %HOMEPATH%\Ca63970A50275\59204.PRO
  • %HOMEPATH%\Ca63970A50275\T29409O31973.GNI
  • %HOMEPATH%\Ca63970A50275\71845.UEI
  • %HOMEPATH%\Ca63970A50275\36483.CQM
  • %HOMEPATH%\Ca63970A50275\H34526V6827.KZH
  • %HOMEPATH%\Ca63970A50275\38985.HCJ
  • %HOMEPATH%\Ca63970A50275\85325.UNU
  • %HOMEPATH%\Ca63970A50275\T26424B97754.LDZ
  • %HOMEPATH%\Ca63970A50275\28226.YHI
  • %HOMEPATH%\Ca63970A50275\34920.LEB
  • %HOMEPATH%\Ca63970A50275\86222.WVM
  • %HOMEPATH%\Ca63970A50275\R29301C99418.FLF
  • %HOMEPATH%\Ca63970A50275\J8408U48002.WBS
  • %HOMEPATH%\Ca63970A50275\80722.EZS
  • %HOMEPATH%\Ca63970A50275\L86324Q99307.YPZ
  • %HOMEPATH%\Ca63970A50275\4193.TDM
  • %HOMEPATH%\Ca63970A50275\D28572P20249.LWN
  • %HOMEPATH%\Ca63970A50275\36308.NTG
  • %HOMEPATH%\Ca63970A50275\W14268Z29236.OLG
  • %HOMEPATH%\Ca63970A50275\96265.SJJ
  • %HOMEPATH%\Ca63970A50275\85432.ZRL
  • %HOMEPATH%\Ca63970A50275\71296.CPN
  • %HOMEPATH%\Ca63970A50275\15947.HWS
  • %HOMEPATH%\Ca63970A50275\44242.MQO
  • %HOMEPATH%\Ca63970A50275\N20219Z9264.XPQ
  • %HOMEPATH%\Ca63970A50275\46777.DSD
  • %HOMEPATH%\Ca63970A50275\B71729H27473.ZFE
  • %HOMEPATH%\Ca63970A50275\94948.ECV
  • %HOMEPATH%\Ca63970A50275\11193.UUD
  • %HOMEPATH%\Ca63970A50275\Z97779J41384.GBW
  • %HOMEPATH%\Ca63970A50275\19113.QVA
  • %HOMEPATH%\Ca63970A50275\39135.VHQ
  • %HOMEPATH%\Ca63970A50275\27409.MAI
  • %HOMEPATH%\Ca63970A50275\23943.CKZ
  • %HOMEPATH%\Ca63970A50275\25363.UUF
  • %HOMEPATH%\Ca63970A50275\9182.TUY
  • %HOMEPATH%\Ca63970A50275\9963.EJV
  • %HOMEPATH%\Ca63970A50275\B83728M81094.FLK
  • %HOMEPATH%\Ca63970A50275\64661.AFX
  • %HOMEPATH%\Ca63970A50275\D38510S26949.CVI
  • %HOMEPATH%\Ca63970A50275\R29310H2906.RLA
  • %HOMEPATH%\Ca63970A50275\D77643Y32911.TTZ
  • %HOMEPATH%\Ca63970A50275\J23724B13603.WPB
  • %HOMEPATH%\Ca63970A50275\86020.QUD
  • %HOMEPATH%\Ca63970A50275\99316.WUB
  • %HOMEPATH%\Ca63970A50275\S35626Q16665.GME
  • %HOMEPATH%\Ca63970A50275\X27780Z46250.FYI
  • %HOMEPATH%\Ca63970A50275\R45299F31675.ZRB
  • %HOMEPATH%\Ca63970A50275\C13786V70359.JKJ
  • %HOMEPATH%\Ca63970A50275\B40536Z4583.MWI
  • %HOMEPATH%\Ca63970A50275\68179.INL
  • %HOMEPATH%\Ca63970A50275\Q83177V17469.PBA
  • %HOMEPATH%\Ca63970A50275\78587.MDF
  • %HOMEPATH%\Ca63970A50275\58066.WQG
  • %HOMEPATH%\Ca63970A50275\30483.LBR
  • %HOMEPATH%\Ca63970A50275\99897.XSD
  • %HOMEPATH%\Ca63970A50275\S42803R87090.RPV
  • %HOMEPATH%\Ca63970A50275\E92110M74212.XJD
  • %HOMEPATH%\Ca63970A50275\81788.NDN
  • %HOMEPATH%\Ca63970A50275\T80645H32652.ZWO
  • %HOMEPATH%\Ca63970A50275\59087.WAK
  • %HOMEPATH%\Ca63970A50275\26709.ARW
  • %HOMEPATH%\Ca63970A50275\V94190S81998.MQL
  • %HOMEPATH%\Ca63970A50275\1642.KUC
  • %HOMEPATH%\Ca63970A50275\64964.EAL
  • %HOMEPATH%\Ca63970A50275\S26528C25036.YUL
  • %HOMEPATH%\Ca63970A50275\65927.IAZ
  • %HOMEPATH%\Ca63970A50275\38131.DZI
  • %HOMEPATH%\Ca63970A50275\U52991F66369.GPG
  • %HOMEPATH%\Ca63970A50275\28409.QCA
  • %HOMEPATH%\Ca63970A50275\62295.WHT
  • %HOMEPATH%\Ca63970A50275\L39801B72996.UVC
  • %HOMEPATH%\Ca63970A50275\Ranga.exe
  • %HOMEPATH%\Ca63970A50275\85635.GKJ
  • %HOMEPATH%\Ca63970A50275\36490.EGH
  • %HOMEPATH%\Ca63970A50275\48128.TSX
  • %HOMEPATH%\Ca63970A50275\S1184G9559.UKI
  • %HOMEPATH%\Ca63970A50275\K15193L82651.VPE
  • %HOMEPATH%\Ca63970A50275\61203.ZNU
  • %HOMEPATH%\Ca63970A50275\32192.PZO
  • %HOMEPATH%\Ca63970A50275\76586.GWP
  • %HOMEPATH%\Ca63970A50275\H63060V47374.GIS
  • %HOMEPATH%\Ca63970A50275\31787.BFM
  • %HOMEPATH%\Ca63970A50275\U75240Y93716.UPR
  • %HOMEPATH%\Ca63970A50275\17145.FWK
  • %HOMEPATH%\Ca63970A50275\41729.EGN
  • %HOMEPATH%\Ca63970A50275\O40024M59943.QAD
  • %HOMEPATH%\Ca63970A50275\R36721C17901.LVS
  • %HOMEPATH%\Ca63970A50275\90731.WCV
  • %HOMEPATH%\Ca63970A50275\A9338C91900.TEA
  • %HOMEPATH%\Ca63970A50275\52533.IKH
  • %HOMEPATH%\Ca63970A50275\B3174K68692.LZX
  • %HOMEPATH%\Ca63970A50275\26221.GRR
  • %HOMEPATH%\Ca63970A50275\O45103W75698.QOD
  • %HOMEPATH%\Ca63970A50275\N2439Z36884.JNB
  • %HOMEPATH%\Ca63970A50275\A71638C28759.JYD
  • %HOMEPATH%\Ca63970A50275\1528.QIA
  • %HOMEPATH%\Ca63970A50275\5013.CCR
  • %HOMEPATH%\Ca63970A50275\F85066X19772.KST
  • %HOMEPATH%\Ca63970A50275\J71913A8624.FHS
  • %HOMEPATH%\Ca63970A50275\G57268R22842.VWW
  • %HOMEPATH%\Ca63970A50275\W99382K37450.YWQ
  • %HOMEPATH%\Ca63970A50275\42888.LAD
  • %HOMEPATH%\Ca63970A50275\L23726J86424.WII
  • %HOMEPATH%\Ca63970A50275\D43840N49677.XNM
  • %HOMEPATH%\Ca63970A50275\98599.TDS
  • %HOMEPATH%\Ca63970A50275\B35005U83508.GXR
  • %HOMEPATH%\Ca63970A50275\A39773L69469.OAB
  • %HOMEPATH%\Ca63970A50275\71852.SUT
  • %HOMEPATH%\Ca63970A50275\87130.QPV
  • %HOMEPATH%\Ca63970A50275\E96239R69788.ZYH
  • %HOMEPATH%\Ca63970A50275\55691.AWW
  • %HOMEPATH%\Ca63970A50275\M35337C59021.CGJ
  • %HOMEPATH%\Ca63970A50275\39966.LOQ
  • %HOMEPATH%\Ca63970A50275\M58162K23837.DZO
  • %HOMEPATH%\Ca63970A50275\D27081N9650.AXV
  • %HOMEPATH%\Ca63970A50275\8872.VZJ
  • %HOMEPATH%\Ca63970A50275\F37832S95182.UXH
  • %HOMEPATH%\Ca63970A50275\74552.RHJ
  • %HOMEPATH%\Ca63970A50275\H97051V48356.GKH
  • %HOMEPATH%\Ca63970A50275\C31173J43774.BRO
  • %HOMEPATH%\Ca63970A50275\93731.FWU
  • %HOMEPATH%\Ca63970A50275\B34476C96409.EFS
  • %HOMEPATH%\Ca63970A50275\89315.NMG
  • %HOMEPATH%\Ca63970A50275\3444.EHP
  • %HOMEPATH%\Ca63970A50275\45459.WPS
  • %HOMEPATH%\Ca63970A50275\17737.KYU
  • %HOMEPATH%\Ca63970A50275\6583.QAG
  • %HOMEPATH%\Ca63970A50275\I74931X63053.QKP
  • %HOMEPATH%\Ca63970A50275\O28430S55658.HFQ
  • %HOMEPATH%\Ca63970A50275\8169.YER
  • %HOMEPATH%\Ca63970A50275\F28290U40172.JRH
  • %HOMEPATH%\Ca63970A50275\D21333J72273.XFB
  • %HOMEPATH%\Ca63970A50275\19160.KCG
  • %HOMEPATH%\Ca63970A50275\4769.WGV
  • %HOMEPATH%\Ca63970A50275\L65670V41363.IND
  • %HOMEPATH%\Ca63970A50275\8259.BYB
  • %HOMEPATH%\Ca63970A50275\83616.LCT
  • %HOMEPATH%\Ca63970A50275\39323.FIY
  • %HOMEPATH%\Ca63970A50275\W77407C91446.JNZ
  • %HOMEPATH%\Ca63970A50275\Q75558H29523.EQE
  • %HOMEPATH%\Ca63970A50275\C12106S37723.DOA
  • %HOMEPATH%\Ca63970A50275\46311.APL
  • %HOMEPATH%\Ca63970A50275\R43469V40080.GKO
  • %HOMEPATH%\Ca63970A50275\81968.OOG
  • %HOMEPATH%\Ca63970A50275\88063.ZCH
  • %HOMEPATH%\Ca63970A50275\U93513N16035.HXE
  • %HOMEPATH%\Ca63970A50275\U36087R25075.KZL
  • %HOMEPATH%\Ca63970A50275\87022.DZA
  • %HOMEPATH%\Ca63970A50275\D66951E83624.QCU
  • %HOMEPATH%\Ca63970A50275\59460.MKZ
  • %HOMEPATH%\Ca63970A50275\D24887G95060.SSB
  • %HOMEPATH%\Ca63970A50275\88203.ZUA
  • %HOMEPATH%\Ca63970A50275\J12201E43127.BHM
  • %HOMEPATH%\Ca63970A50275\R95296S29088.BCM
  • %HOMEPATH%\Ca63970A50275\V34390T69751.KIQ
  • %HOMEPATH%\Ca63970A50275\Y67603V21468.HPQ
  • %HOMEPATH%\Ca63970A50275\28371.YXW
  • %HOMEPATH%\Ca63970A50275\36109.QXB
  • %HOMEPATH%\Ca63970A50275\58873.VAB
  • %HOMEPATH%\Ca63970A50275\P19046M90576.XTG
  • %HOMEPATH%\Ca63970A50275\O40813B68898.UVD
  • %HOMEPATH%\Ca63970A50275\H56660F37814.TIY
  • %HOMEPATH%\Ca63970A50275\6672.FMK
  • %HOMEPATH%\Ca63970A50275\K4455F29123.GGZ
  • %HOMEPATH%\Ca63970A50275\X36305M49730.POT
  • %HOMEPATH%\Ca63970A50275\E46927O14918.IWH
  • %HOMEPATH%\Ca63970A50275\A68024U98059.IEZ
  • %HOMEPATH%\Ca63970A50275\84405.NVC
  • %HOMEPATH%\Ca63970A50275\B46519U85141.XEP
  • %HOMEPATH%\Ca63970A50275\62017.RDS
  • %HOMEPATH%\Ca63970A50275\27975.NGI
  • %HOMEPATH%\Ca63970A50275\33115.DJB
  • %HOMEPATH%\Ca63970A50275\16490.UTN
  • %HOMEPATH%\Ca63970A50275\86201.ICO
  • %HOMEPATH%\Ca63970A50275\31702.POL
  • %HOMEPATH%\Ca63970A50275\89846.QGY
  • %HOMEPATH%\Ca63970A50275\R22684Y5018.REX
  • %HOMEPATH%\Ca63970A50275\Z39642V56471.MLR
  • %HOMEPATH%\Ca63970A50275\28686.SBM
  • %HOMEPATH%\Ca63970A50275\O11012A33394.LKW
  • %HOMEPATH%\Ca63970A50275\35026.JDZ
  • %HOMEPATH%\Ca63970A50275\J9807H70951.BTN
  • %HOMEPATH%\Ca63970A50275\K92516Q53539.RFK
  • %HOMEPATH%\Ca63970A50275\5739.AMV
  • %HOMEPATH%\Ca63970A50275\1397.SHU
  • %HOMEPATH%\Ca63970A50275\X6358A58753.YVB
  • %HOMEPATH%\Ca63970A50275\64552.URS
  • %HOMEPATH%\Ca63970A50275\O97892L11829.ESC
  • %HOMEPATH%\Ca63970A50275\U80420Q64333.IAV
  • %HOMEPATH%\Ca63970A50275\36562.DSG
  • %HOMEPATH%\Ca63970A50275\77777.VZD
  • %HOMEPATH%\Ca63970A50275\29695.TUB
  • %HOMEPATH%\Ca63970A50275\87057.WTR
  • %HOMEPATH%\Ca63970A50275\11721.GPN
  • %HOMEPATH%\Ca63970A50275\4239.JQA
  • %HOMEPATH%\Ca63970A50275\G87837K62487.JBK
  • %HOMEPATH%\Ca63970A50275\73293.JHI
  • %HOMEPATH%\Ca63970A50275\W2518E45904.JQD
  • %HOMEPATH%\Ca63970A50275\4984.LLP
  • %HOMEPATH%\Ca63970A50275\D68301S54180.NMT
  • %HOMEPATH%\Ca63970A50275\37118.YIU
  • %HOMEPATH%\Ca63970A50275\P33637M7187.SHI
  • %HOMEPATH%\Ca63970A50275\37317.SSE
  • %HOMEPATH%\Ca63970A50275\49691.JKX
  • %HOMEPATH%\Ca63970A50275\20742.PFS
  • %HOMEPATH%\Ca63970A50275\87891.OIX
  • %HOMEPATH%\Ca63970A50275\V73215Q58759.IVE
  • %HOMEPATH%\Ca63970A50275\S75363G74004.WDL
  • %HOMEPATH%\Ca63970A50275\95168.QRP
  • %HOMEPATH%\Ca63970A50275\G64571P39420.WIT
  • %HOMEPATH%\Ca63970A50275\F61118K50726.SEY
  • %HOMEPATH%\Ca63970A50275\9562.PDC
  • %HOMEPATH%\Ca63970A50275\L64580C87320.TYL
  • %HOMEPATH%\Ca63970A50275\90995.FFE
  • %HOMEPATH%\Ca63970A50275\18777.DMH
  • %HOMEPATH%\Ca63970A50275\44257.IXO
  • %HOMEPATH%\Ca63970A50275\43313.IFT
  • %HOMEPATH%\Ca63970A50275\H52830V33001.NYE
  • %HOMEPATH%\Ca63970A50275\K20238N46129.VSE
  • %HOMEPATH%\Ca63970A50275\T44255T48263.POB
  • %HOMEPATH%\Ca63970A50275\7556.FII
  • %HOMEPATH%\Ca63970A50275\14902.JDU
  • %HOMEPATH%\Ca63970A50275\B51159N14207.NXE
  • %HOMEPATH%\Ca63970A50275\W48668S66628.POA
  • %HOMEPATH%\Ca63970A50275\H73929G94794.VHP
  • %HOMEPATH%\Ca63970A50275\F95385A63977.IAY
  • %HOMEPATH%\Ca63970A50275\D34939R7218.ACF
  • %HOMEPATH%\Ca63970A50275\99251.UOK
  • %HOMEPATH%\Ca63970A50275\P69733K89091.LCM
  • %HOMEPATH%\Ca63970A50275\75774.ODM
  • %HOMEPATH%\Ca63970A50275\65745.TVU
  • %HOMEPATH%\Ca63970A50275\Y70991A76152.MCI
  • %HOMEPATH%\Ca63970A50275\Y52297U11713.WHW
  • %HOMEPATH%\Ca63970A50275\T5558R44373.GEG
  • %HOMEPATH%\Ca63970A50275\U57477Q41241.BEZ
  • %HOMEPATH%\Ca63970A50275\76341.KGL
  • %HOMEPATH%\Ca63970A50275\63494.GDD
  • %HOMEPATH%\Ca63970A50275\53369.TKA
  • %HOMEPATH%\Ca63970A50275\M98551E26643.LFJ
  • %HOMEPATH%\Ca63970A50275\M2381U76471.UIE
  • %HOMEPATH%\Ca63970A50275\77186.UTY
  • %HOMEPATH%\Ca63970A50275\74810.DHA
  • %HOMEPATH%\Ca63970A50275\72988.LRL
  • %HOMEPATH%\Ca63970A50275\D24073S93879.JWU
  • %HOMEPATH%\Ca63970A50275\O27950Q44118.ZTA
  • %HOMEPATH%\Ca63970A50275\44973.KVV
  • %HOMEPATH%\Ca63970A50275\K54987K38552.AYH
  • %HOMEPATH%\Ca63970A50275\5794.SJZ
  • %HOMEPATH%\Ca63970A50275\Y72617R60940.TUH
  • %HOMEPATH%\Ca63970A50275\62486.DSN
Sets the 'hidden' attribute to the following files:
  • %HOMEPATH%\Od94928J79164.TC1
Deletes the following files:
  • %TEMP%\aut1.tmp
Miscellaneous:
Searches for the following windows:
  • ClassName: 'Shell_TrayWnd' WindowName: '(null)'
  • ClassName: 'EDIT' WindowName: '(null)'

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android