Sets the 'hidden' attribute to the following files:
%HOMEPATH%\rmotsu.exe
Deletes the following files:
<SYSTEM32>\PerfStringBackup.TMP
<SYSTEM32>\wbem\Performance\WmiApRpl.ini
Network activity:
UDP:
DNS ASK wo###.rickstudio.ru
DNS ASK ba####.cocolands.su
DNS ASK po####.#oomshowerbord.com
DNS ASK sl###.##fehousenumber.com
DNS ASK mu###.###tal-protection.net.ru
'ba####.cocolands.su':51777
'po####.#oomshowerbord.com':51777
'mu###.###tal-protection.net.ru':51777
'wo###.rickstudio.ru':51777
'sl###.##fehousenumber.com':51777
Download Dr.Web for Android
Free three-month trial
All protection features available
Renew your trial license in AppGallery/on Google Pay
By continuing to use this website, you are consenting to Doctor Web’s use of cookies and other technologies related to the collection of visitor statistics. Learn more