FOR CUSTOMERS

Close

Library
My library

+ Add to library

Search
Search

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

A query form

Call us

+7 (495) 789-45-86

Forum

Your tickets

New ticket

Call us

+7 (495) 789-45-86

Profile

EN

RU CN DE EN ES FR IT JP KZ UZ PL BY
Close
Support services
Scanners
Dr.Web vxCube
Trial
VCI investigations
Virus library
Knowledge base

Technologies

Terminology

Training and education

Myths

News

Trojan.MulDrop3.1872

Added to the Dr.Web virus database: 2011-09-15

Virus description added:

Technical Information

Malicious functions:
Executes the following:
  • %WINDIR%\sleep.exe 5
  • <SYSTEM32>\cmd.exe /c ""<Current directory>\123.bat" "
Modifies file system :
Creates the following files:
  • %ALLUSERSPROFILE%\Favorites\케이티론.url
  • %ALLUSERSPROFILE%\Favorites\코리아에로.url
  • %ALLUSERSPROFILE%\Favorites\킹카닷컴.url
  • %ALLUSERSPROFILE%\Favorites\케이트스페이드뉴욕.url
  • %ALLUSERSPROFILE%\Favorites\지에스홈쇼핑.url
  • %ALLUSERSPROFILE%\Favorites\청솔꼬꼬빌.url
  • %ALLUSERSPROFILE%\Favorites\친구클럽.url
  • %ALLUSERSPROFILE%\Favorites\티머니.url
  • %ALLUSERSPROFILE%\Favorites\피싱로드.url
  • %ALLUSERSPROFILE%\Favorites\하나캐피탈.url
  • %ALLUSERSPROFILE%\Favorites\하이웍스.url
  • %ALLUSERSPROFILE%\Favorites\페이오픈.url
  • %ALLUSERSPROFILE%\Favorites\티머니충전.url
  • %ALLUSERSPROFILE%\Favorites\패션플러스.url
  • %ALLUSERSPROFILE%\Favorites\펀한커플.url
  • %ALLUSERSPROFILE%\Favorites\지에스이숍.url
  • %ALLUSERSPROFILE%\Favorites\운세닷컴.url
  • %ALLUSERSPROFILE%\Favorites\원바이원.url
  • %ALLUSERSPROFILE%\Favorites\웹투어.url
  • %ALLUSERSPROFILE%\Favorites\운세.com.url
  • %ALLUSERSPROFILE%\Favorites\우리캐피탈.url
  • %ALLUSERSPROFILE%\Favorites\우체국쇼핑.url
  • %ALLUSERSPROFILE%\Favorites\운세.url
  • %ALLUSERSPROFILE%\Favorites\위즈위드.url
  • %ALLUSERSPROFILE%\Favorites\지에스샵.url
  • %ALLUSERSPROFILE%\Favorites\지에스숍.url
  • %ALLUSERSPROFILE%\Favorites\지에스이샵.url
  • %ALLUSERSPROFILE%\Favorites\지마켓.url
  • %ALLUSERSPROFILE%\Favorites\이에프클럽.url
  • %ALLUSERSPROFILE%\Favorites\이클린.url
  • %ALLUSERSPROFILE%\Favorites\조이헌트.url
  • %ALLUSERSPROFILE%\Favorites\하하몰.url
  • %ALLUSERSPROFILE%\Favorites\KT론.url
  • %ALLUSERSPROFILE%\Favorites\LG패션샵.url
  • %ALLUSERSPROFILE%\Favorites\SMS피아.url
  • %ALLUSERSPROFILE%\Favorites\Hmall.url
  • %ALLUSERSPROFILE%\Favorites\GS샵.url
  • %ALLUSERSPROFILE%\Favorites\GSSHOP.url
  • %ALLUSERSPROFILE%\Favorites\H몰.url
  • %ALLUSERSPROFILE%\Favorites\T-money 충전.url
  • %WINDIR%\tutudisk_ico.ico
  • %ALLUSERSPROFILE%\Desktop\투투디스크.lnk
  • <Current directory>\123.bat
  • %ALLUSERSPROFILE%\Favorites\★★★★★ 멋남 (대한민국 1등 쇼핑몰) ★★★★★.url
  • %ALLUSERSPROFILE%\Favorites\tsloan.url
  • %ALLUSERSPROFILE%\Favorites\wlakzpt.url
  • %WINDIR%\directmanCG.ico
  • %ALLUSERSPROFILE%\Favorites\GS보험샵.url
  • %ALLUSERSPROFILE%\Favorites\해피몰.url
  • %ALLUSERSPROFILE%\Favorites\허니버터.url
  • %ALLUSERSPROFILE%\Favorites\홈플러스상품권몰.url
  • %ALLUSERSPROFILE%\Favorites\핫샷.url
  • %ALLUSERSPROFILE%\Favorites\한국에이수.url
  • %ALLUSERSPROFILE%\Favorites\한국정보인증.url
  • %ALLUSERSPROFILE%\Favorites\한성저축은행.url
  • %ALLUSERSPROFILE%\Favorites\AK몰.url
  • %ALLUSERSPROFILE%\Favorites\G마켓.url
  • %ALLUSERSPROFILE%\Favorites\gmarket.url
  • %ALLUSERSPROFILE%\Favorites\GS SHOP.url
  • %ALLUSERSPROFILE%\Favorites\G마캣.url
  • %ALLUSERSPROFILE%\Favorites\cj쇼핑.url
  • %ALLUSERSPROFILE%\Favorites\CJmall.url
  • %ALLUSERSPROFILE%\Favorites\e클린.url
  • %ALLUSERSPROFILE%\Favorites\완소프렌즈.url
  • %ALLUSERSPROFILE%\Favorites\미래문제연구소.url
  • %ALLUSERSPROFILE%\Favorites\미오디오.url
  • %ALLUSERSPROFILE%\Favorites\바나나몰.url
  • %ALLUSERSPROFILE%\Favorites\문자광.url
  • %ALLUSERSPROFILE%\Favorites\리드코프.url
  • %ALLUSERSPROFILE%\Favorites\명함천사.url
  • %ALLUSERSPROFILE%\Favorites\무인도몰.url
  • %ALLUSERSPROFILE%\Favorites\바람난여우.url
  • %ALLUSERSPROFILE%\Favorites\상도가구.url
  • %ALLUSERSPROFILE%\Favorites\섹시아이돌.url
  • %ALLUSERSPROFILE%\Favorites\슈퍼다운.url
  • %ALLUSERSPROFILE%\Favorites\사랑지기.url
  • %ALLUSERSPROFILE%\Favorites\보리보리.url
  • %ALLUSERSPROFILE%\Favorites\브랜드이사몰.url
  • %ALLUSERSPROFILE%\Favorites\뿌리오.url
  • %ALLUSERSPROFILE%\Favorites\롯데캐피탈.url
  • %ALLUSERSPROFILE%\Favorites\그린샵.url
  • %ALLUSERSPROFILE%\Favorites\기프티콘.url
  • %ALLUSERSPROFILE%\Favorites\나셀라.url
  • %ALLUSERSPROFILE%\Favorites\건담샵.url
  • %ALLUSERSPROFILE%\Favorites\11번가.url
  • %ALLUSERSPROFILE%\Favorites\11qjsrk.url
  • %ALLUSERSPROFILE%\Favorites\11st.url
  • %ALLUSERSPROFILE%\Favorites\남수클럽.url
  • %ALLUSERSPROFILE%\Favorites\러브펫.url
  • %ALLUSERSPROFILE%\Favorites\러시앤캐시.url
  • %ALLUSERSPROFILE%\Favorites\로또리치.url
  • %ALLUSERSPROFILE%\Favorites\러브템.url
  • %ALLUSERSPROFILE%\Favorites\네오스위트.url
  • %ALLUSERSPROFILE%\Favorites\다이소몰.url
  • %ALLUSERSPROFILE%\Favorites\디스카운터.url
  • %ALLUSERSPROFILE%\Favorites\스카우트.url
  • %ALLUSERSPROFILE%\Favorites\엔조이뉴욕.url
  • %ALLUSERSPROFILE%\Favorites\엘리시나.url
  • %ALLUSERSPROFILE%\Favorites\엠플러스데이.url
  • %ALLUSERSPROFILE%\Favorites\엔비룩.url
  • %ALLUSERSPROFILE%\Favorites\알프스론.url
  • %ALLUSERSPROFILE%\Favorites\야디스크.url
  • %ALLUSERSPROFILE%\Favorites\에버에듀.url
  • %ALLUSERSPROFILE%\Favorites\오가게.url
  • %ALLUSERSPROFILE%\Favorites\옥션숙박.url
  • %ALLUSERSPROFILE%\Favorites\와우미팅.url
  • %ALLUSERSPROFILE%\Favorites\완소러브.url
  • %ALLUSERSPROFILE%\Favorites\옥션 스카이프.url
  • %ALLUSERSPROFILE%\Favorites\오버추어.url
  • %ALLUSERSPROFILE%\Favorites\오버추어코리아.url
  • %ALLUSERSPROFILE%\Favorites\옥션.url
  • %ALLUSERSPROFILE%\Favorites\알바위즈.url
  • %ALLUSERSPROFILE%\Favorites\신라면세점.url
  • %ALLUSERSPROFILE%\Favorites\신라인터넷면세점.url
  • %ALLUSERSPROFILE%\Favorites\신세계몰.url
  • %ALLUSERSPROFILE%\Favorites\스피드뱅크.url
  • %ALLUSERSPROFILE%\Favorites\스쿨뮤직.url
  • %ALLUSERSPROFILE%\Favorites\스킨베베.url
  • %ALLUSERSPROFILE%\Favorites\스킨스토어.url
  • %ALLUSERSPROFILE%\Favorites\씨제이몰.url
  • %ALLUSERSPROFILE%\Favorites\아이비북.url
  • %ALLUSERSPROFILE%\Favorites\아이스타일24.url
  • %ALLUSERSPROFILE%\Favorites\아이템매니아.url
  • %ALLUSERSPROFILE%\Favorites\아싸컴.url
  • %ALLUSERSPROFILE%\Favorites\씨제이쇼핑.url
  • %ALLUSERSPROFILE%\Favorites\씨제이오쇼핑.url
  • %ALLUSERSPROFILE%\Favorites\아가씨TV.url
Sets the 'hidden' attribute to the following files:
  • %ALLUSERSPROFILE%\Favorites\지에스홈쇼핑.url
  • %ALLUSERSPROFILE%\Favorites\청솔꼬꼬빌.url
  • %ALLUSERSPROFILE%\Favorites\친구클럽.url
  • %ALLUSERSPROFILE%\Favorites\지에스이숍.url
  • %ALLUSERSPROFILE%\Favorites\지에스샵.url
  • %ALLUSERSPROFILE%\Favorites\지에스숍.url
  • %ALLUSERSPROFILE%\Favorites\지에스이샵.url
  • %ALLUSERSPROFILE%\Favorites\케이트스페이드뉴욕.url
  • %ALLUSERSPROFILE%\Favorites\티머니충전.url
  • %ALLUSERSPROFILE%\Favorites\패션플러스.url
  • %ALLUSERSPROFILE%\Favorites\펀한커플.url
  • %ALLUSERSPROFILE%\Favorites\티머니.url
  • %ALLUSERSPROFILE%\Favorites\케이티론.url
  • %ALLUSERSPROFILE%\Favorites\코리아에로.url
  • %ALLUSERSPROFILE%\Favorites\킹카닷컴.url
  • %ALLUSERSPROFILE%\Favorites\우체국쇼핑.url
  • %ALLUSERSPROFILE%\Favorites\운세.url
  • %ALLUSERSPROFILE%\Favorites\운세.com.url
  • %ALLUSERSPROFILE%\Favorites\우리캐피탈.url
  • %ALLUSERSPROFILE%\Favorites\와우미팅.url
  • %ALLUSERSPROFILE%\Favorites\완소러브.url
  • %ALLUSERSPROFILE%\Favorites\완소프렌즈.url
  • %ALLUSERSPROFILE%\Favorites\운세닷컴.url
  • %ALLUSERSPROFILE%\Favorites\이클린.url
  • %ALLUSERSPROFILE%\Favorites\조이헌트.url
  • %ALLUSERSPROFILE%\Favorites\지마켓.url
  • %ALLUSERSPROFILE%\Favorites\이에프클럽.url
  • %ALLUSERSPROFILE%\Favorites\원바이원.url
  • %ALLUSERSPROFILE%\Favorites\웹투어.url
  • %ALLUSERSPROFILE%\Favorites\위즈위드.url
  • %ALLUSERSPROFILE%\Favorites\페이오픈.url
  • %ALLUSERSPROFILE%\Favorites\GS보험샵.url
  • %ALLUSERSPROFILE%\Favorites\GS샵.url
  • %ALLUSERSPROFILE%\Favorites\GSSHOP.url
  • %ALLUSERSPROFILE%\Favorites\GS SHOP.url
  • %ALLUSERSPROFILE%\Favorites\G마캣.url
  • %ALLUSERSPROFILE%\Favorites\G마켓.url
  • %ALLUSERSPROFILE%\Favorites\gmarket.url
  • %ALLUSERSPROFILE%\Favorites\H몰.url
  • %ALLUSERSPROFILE%\Favorites\T-money 충전.url
  • %ALLUSERSPROFILE%\Favorites\tsloan.url
  • %ALLUSERSPROFILE%\Favorites\wlakzpt.url
  • %ALLUSERSPROFILE%\Favorites\SMS피아.url
  • %ALLUSERSPROFILE%\Favorites\Hmall.url
  • %ALLUSERSPROFILE%\Favorites\KT론.url
  • %ALLUSERSPROFILE%\Favorites\LG패션샵.url
  • %ALLUSERSPROFILE%\Favorites\한국에이수.url
  • %ALLUSERSPROFILE%\Favorites\한국정보인증.url
  • %ALLUSERSPROFILE%\Favorites\한성저축은행.url
  • %ALLUSERSPROFILE%\Favorites\하하몰.url
  • %ALLUSERSPROFILE%\Favorites\피싱로드.url
  • %ALLUSERSPROFILE%\Favorites\하나캐피탈.url
  • %ALLUSERSPROFILE%\Favorites\하이웍스.url
  • %ALLUSERSPROFILE%\Favorites\핫샷.url
  • %ALLUSERSPROFILE%\Favorites\cj쇼핑.url
  • %ALLUSERSPROFILE%\Favorites\CJmall.url
  • %ALLUSERSPROFILE%\Favorites\e클린.url
  • %ALLUSERSPROFILE%\Favorites\AK몰.url
  • %ALLUSERSPROFILE%\Favorites\해피몰.url
  • %ALLUSERSPROFILE%\Favorites\허니버터.url
  • %ALLUSERSPROFILE%\Favorites\홈플러스상품권몰.url
  • %ALLUSERSPROFILE%\Favorites\문자광.url
  • %ALLUSERSPROFILE%\Favorites\미래문제연구소.url
  • %ALLUSERSPROFILE%\Favorites\미오디오.url
  • %ALLUSERSPROFILE%\Favorites\무인도몰.url
  • %ALLUSERSPROFILE%\Favorites\롯데캐피탈.url
  • %ALLUSERSPROFILE%\Favorites\리드코프.url
  • %ALLUSERSPROFILE%\Favorites\명함천사.url
  • %ALLUSERSPROFILE%\Favorites\바나나몰.url
  • %ALLUSERSPROFILE%\Favorites\사랑지기.url
  • %ALLUSERSPROFILE%\Favorites\상도가구.url
  • %ALLUSERSPROFILE%\Favorites\섹시아이돌.url
  • %ALLUSERSPROFILE%\Favorites\뿌리오.url
  • %ALLUSERSPROFILE%\Favorites\바람난여우.url
  • %ALLUSERSPROFILE%\Favorites\보리보리.url
  • %ALLUSERSPROFILE%\Favorites\브랜드이사몰.url
  • %ALLUSERSPROFILE%\Favorites\그린샵.url
  • %ALLUSERSPROFILE%\Favorites\기프티콘.url
  • %ALLUSERSPROFILE%\Favorites\나셀라.url
  • %ALLUSERSPROFILE%\Favorites\건담샵.url
  • %ALLUSERSPROFILE%\Favorites\11번가.url
  • %ALLUSERSPROFILE%\Favorites\11qjsrk.url
  • %ALLUSERSPROFILE%\Favorites\11st.url
  • %ALLUSERSPROFILE%\Favorites\남수클럽.url
  • %ALLUSERSPROFILE%\Favorites\러브펫.url
  • %ALLUSERSPROFILE%\Favorites\러시앤캐시.url
  • %ALLUSERSPROFILE%\Favorites\로또리치.url
  • %ALLUSERSPROFILE%\Favorites\러브템.url
  • %ALLUSERSPROFILE%\Favorites\네오스위트.url
  • %ALLUSERSPROFILE%\Favorites\다이소몰.url
  • %ALLUSERSPROFILE%\Favorites\디스카운터.url
  • %ALLUSERSPROFILE%\Favorites\슈퍼다운.url
  • %ALLUSERSPROFILE%\Favorites\에버에듀.url
  • %ALLUSERSPROFILE%\Favorites\엔비룩.url
  • %ALLUSERSPROFILE%\Favorites\엔조이뉴욕.url
  • %ALLUSERSPROFILE%\Favorites\야디스크.url
  • %ALLUSERSPROFILE%\Favorites\아이템매니아.url
  • %ALLUSERSPROFILE%\Favorites\알바위즈.url
  • %ALLUSERSPROFILE%\Favorites\알프스론.url
  • %ALLUSERSPROFILE%\Favorites\엘리시나.url
  • %ALLUSERSPROFILE%\Favorites\옥션.url
  • %ALLUSERSPROFILE%\Favorites\옥션 스카이프.url
  • %ALLUSERSPROFILE%\Favorites\옥션숙박.url
  • %ALLUSERSPROFILE%\Favorites\오버추어코리아.url
  • %ALLUSERSPROFILE%\Favorites\엠플러스데이.url
  • %ALLUSERSPROFILE%\Favorites\오가게.url
  • %ALLUSERSPROFILE%\Favorites\오버추어.url
  • %ALLUSERSPROFILE%\Favorites\스피드뱅크.url
  • %ALLUSERSPROFILE%\Favorites\신라면세점.url
  • %ALLUSERSPROFILE%\Favorites\신라인터넷면세점.url
  • %ALLUSERSPROFILE%\Favorites\스킨스토어.url
  • %ALLUSERSPROFILE%\Favorites\스카우트.url
  • %ALLUSERSPROFILE%\Favorites\스쿨뮤직.url
  • %ALLUSERSPROFILE%\Favorites\스킨베베.url
  • %ALLUSERSPROFILE%\Favorites\신세계몰.url
  • %ALLUSERSPROFILE%\Favorites\아싸컴.url
  • %ALLUSERSPROFILE%\Favorites\아이비북.url
  • %ALLUSERSPROFILE%\Favorites\아이스타일24.url
  • %ALLUSERSPROFILE%\Favorites\아가씨TV.url
  • %ALLUSERSPROFILE%\Favorites\씨제이몰.url
  • %ALLUSERSPROFILE%\Favorites\씨제이쇼핑.url
  • %ALLUSERSPROFILE%\Favorites\씨제이오쇼핑.url
Deletes itself.

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Free trial

 

Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

Free trial

 

Download Dr.Web

Download by serial number

Download on App Store

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

 

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android

Free trial

14 days

Download now
Get it on Google Play