Defend what you create

Other Resources

Close

Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Adware.Gexin.11021

Added to the Dr.Web virus database: 2019-03-26

Virus description added:

Technical information

Malicious functions:
Executes code of the following detected threats:
  • Adware.Gexin.3.origin
Accesses the ITelephony private interface.
Network activity:
Connects to:
  • UDP(DNS) <Google DNS>
  • TCP(HTTP/1.1) ti####.c####.l####.####.com:80
  • TCP(HTTP/1.1) c-h####.g####.com:80
  • TCP(HTTP/1.1) and####.b####.qq.com:80
  • TCP(HTTP/1.1) ap####.alm####.net:80
  • TCP(HTTP/1.1) sdk.o####.p####.####.com:80
  • TCP(HTTP/1.1) st####.dc####.net.cn:80
  • TCP(TLS/1.0) ser####.dc####.net.cn:443
  • TCP(TLS/1.0) res####.a####.com:443
  • TCP c####.g####.ig####.com:5227
  • TCP sdk.o####.t####.####.com:5224
DNS requests:
  • and####.b####.qq.com
  • ap####.alm####.net
  • c####.g####.ig####.com
  • c-h####.g####.com
  • res####.a####.com
  • s####.alm####.net
  • sdk.c####.ig####.com
  • sdk.o####.p####.####.com
  • sdk.o####.t####.####.com
  • sdk.o####.t####.####.com
  • sdk.o####.t####.####.net
  • ser####.dc####.net.cn
  • st####.dc####.net.cn
  • www.alm####.com.cn
HTTP GET requests:
  • ap####.alm####.net/index/index/get_banner?access_token=####&pid=####
  • ap####.alm####.net/index/index/get_goods?access_token=####
  • ap####.alm####.net/index/index/get_index_ad?access_token=####
  • ap####.alm####.net/index/index/get_nav?type=####&access_token=####
  • ap####.alm####.net/index/settings/version/app_version?access_token=####&...
  • ap####.alm####.net/index/shops/cats/get_cats2?access_token=####&pid=####
  • ap####.alm####.net/index/shops/cats/get_cats?access_token=####
  • ap####.alm####.net/index/token/get_access_token?appid=####&appsecret=####
  • ap####.alm####.net/uploads/ad/2017/06/20170616/72ed864b7b18c1ee6c27fff2e...
  • ap####.alm####.net/uploads/ad/2017/06/20170616/7b4c5ac384713727c61de2c36...
  • ap####.alm####.net/uploads/ad/2017/06/20170616/9045e3ad0831410a30d4d296b...
  • ap####.alm####.net/uploads/ad/2017/06/20170616/99701a896f702a64de2b12c59...
  • ap####.alm####.net/uploads/ad/2017/06/20170616/9c0ed3b8114f4eef6fb6c5151...
  • ap####.alm####.net/uploads/ad/2017/09/20170926/5ae0b3c2e6c765e688ad33d85...
  • ap####.alm####.net/uploads/ad/2017/09/20170926/68756baab75ec39ee70971dbc...
  • ap####.alm####.net/uploads/ad/2017/09/20170926/9460632fab0e866f7a55324d1...
  • ap####.alm####.net/uploads/ad/2017/09/20170926/dbe4966c7af7167553f877dd3...
  • ap####.alm####.net/uploads/ad/2017/10/20171030/fe373cc4702bb5b8a9262a394...
  • ap####.alm####.net/uploads/ad/2018/02/20180211/b380ff2209f1b2b9265272684...
  • ap####.alm####.net/uploads/ad/2018/04/20180412/be7b7ce5a40a903dca359afd7...
  • ap####.alm####.net/uploads/ad/2019/02/20190213/99553044cee455b874301b633...
  • ap####.alm####.net/uploads/goods/2017/02/20170222/d6d9f0b1c704ec7a97364a...
  • ap####.alm####.net/uploads/goods/2017/02/20170223/31aa326125c67a9144ec24...
  • ap####.alm####.net/uploads/goods/2017/02/20170223/c3d891c2e1ce9cf8be6ccb...
  • ap####.alm####.net/uploads/goods/2017/05/20170517/e64cc595e34ec563f0fc36...
  • ap####.alm####.net/uploads/goods/2017/08/20170802/910828457ae9c5aa969f2f...
  • ap####.alm####.net/uploads/goods/2017/10/20171019/23692b5f75b2fd6a0fb6fd...
  • ap####.alm####.net/uploads/logo/2017/06/20170622/1e5e677e8fdc9b51db46172...
  • ap####.alm####.net/uploads/logo/2017/06/20170622/4cf870b260b63ef0380ec25...
  • ap####.alm####.net/uploads/logo/2017/06/20170622/662c8f5eb7825d07205ebbb...
  • ap####.alm####.net/uploads/logo/2017/06/20170622/a9cf12239896112639521e1...
  • ap####.alm####.net/uploads/logo/2017/06/20170622/cd752efa826d02392cef212...
  • ap####.alm####.net/uploads/logo/2017/06/20170622/db3c20c9b00b33ed175cc65...
  • ap####.alm####.net/uploads/logo/2017/07/20170727/e0a46a5b7e731d7e3902071...
  • ap####.alm####.net/uploads/logo/2018/02/20180211/cb360248ee9fcee23f9f6d5...
  • ap####.alm####.net/uploads/logo/2018/05/20180511/460b6715295baad036b98e8...
  • ap####.alm####.net/uploads/logo/2018/09/20180915/6d2e582fcde51341fd064e1...
  • ti####.c####.l####.####.com/config/hz-hzv3.conf
HTTP POST requests:
  • and####.b####.qq.com/rqd/async
  • c-h####.g####.com/api.php?format=####&t=####
  • sdk.o####.p####.####.com/api.php?format=####&t=####
  • st####.dc####.net.cn/device/location
File system changes:
Creates the following files:
  • /data/data/####/.imei.txt
  • /data/data/####/073928702722.0
  • /data/data/####/1.jpg
  • /data/data/####/1d2b904cbeadfb72ed9546111a231c85.0
  • /data/data/####/2.jpg
  • /data/data/####/3.jpg
  • /data/data/####/4.jpg
  • /data/data/####/5-160914192R6.gif
  • /data/data/####/5.jpg
  • /data/data/####/60x60.gif
  • /data/data/####/Combinationdetail.css
  • /data/data/####/Combinationdetail.html
  • /data/data/####/Combinationdetail.js
  • /data/data/####/H50447E58.xml
  • /data/data/####/H50447E58_storages.xml
  • /data/data/####/HR.png
  • /data/data/####/LuckDraw.css
  • /data/data/####/LuckDraw.html
  • /data/data/####/LuckDraw.js
  • /data/data/####/OA.png
  • /data/data/####/YaoHao.css
  • /data/data/####/YaoHao.html
  • /data/data/####/YaoHao.js
  • /data/data/####/_adio.dcloud.feature.ad.a.a.xml
  • /data/data/####/accelerometer.html
  • /data/data/####/ad.js
  • /data/data/####/add.png
  • /data/data/####/addBtn.png
  • /data/data/####/addCombination.css
  • /data/data/####/addCombination.html
  • /data/data/####/addCombination.js
  • /data/data/####/addGood.css
  • /data/data/####/addGood.html
  • /data/data/####/addGood.js
  • /data/data/####/add_address.css
  • /data/data/####/add_address.html
  • /data/data/####/add_address.js
  • /data/data/####/add_card.css
  • /data/data/####/add_card.html
  • /data/data/####/add_card.js
  • /data/data/####/add_complaint.css
  • /data/data/####/add_complaint.html
  • /data/data/####/add_complaint.js
  • /data/data/####/add_design.css
  • /data/data/####/add_design.html
  • /data/data/####/add_design.js
  • /data/data/####/add_member.css
  • /data/data/####/add_member.html
  • /data/data/####/add_member.js
  • /data/data/####/add_user.css
  • /data/data/####/add_user.html
  • /data/data/####/add_user.js
  • /data/data/####/add_worker.css
  • /data/data/####/add_worker.html
  • /data/data/####/add_worker.js
  • /data/data/####/addr_img.png
  • /data/data/####/address_list.css
  • /data/data/####/address_list.html
  • /data/data/####/address_list.js
  • /data/data/####/alarm.png
  • /data/data/####/alert.png
  • /data/data/####/alipay.png
  • /data/data/####/aliyun-sdk.min.js
  • /data/data/####/all_common.css
  • /data/data/####/amap_web_logo.xml
  • /data/data/####/android.html
  • /data/data/####/app.css
  • /data/data/####/app.js
  • /data/data/####/app_icon.png
  • /data/data/####/apply.css
  • /data/data/####/apply.html
  • /data/data/####/apply.js
  • /data/data/####/apply.png
  • /data/data/####/area.png
  • /data/data/####/arecord.png
  • /data/data/####/article.html
  • /data/data/####/arttmpl.js
  • /data/data/####/astop.png
  • /data/data/####/attend.png
  • /data/data/####/attendance_manage.css
  • /data/data/####/attendance_manage.html
  • /data/data/####/attendance_manage.js
  • /data/data/####/attendance_manage1.css
  • /data/data/####/attendance_manage1.html
  • /data/data/####/attendance_manage1.js
  • /data/data/####/attendance_records.css
  • /data/data/####/attendance_records.html
  • /data/data/####/attendance_records.js
  • /data/data/####/audio-btn.png
  • /data/data/####/audio.css
  • /data/data/####/audio.html
  • /data/data/####/audio.js
  • /data/data/####/audio.png
  • /data/data/####/background.png
  • /data/data/####/background1.png
  • /data/data/####/balance.png
  • /data/data/####/bank_card.css
  • /data/data/####/bank_card.html
  • /data/data/####/bank_card.js
  • /data/data/####/barcode.html
  • /data/data/####/barcode.png
  • /data/data/####/base64.js
  • /data/data/####/base_list.html
  • /data/data/####/become_member.html
  • /data/data/####/become_member.js
  • /data/data/####/become_operator.css
  • /data/data/####/become_operator.html
  • /data/data/####/become_operator.js
  • /data/data/####/beecloud.js
  • /data/data/####/begin.png
  • /data/data/####/beginChange.css
  • /data/data/####/beginChange.html
  • /data/data/####/beginChange.js
  • /data/data/####/beginScan.css
  • /data/data/####/beginScan.html
  • /data/data/####/beginScan.js
  • /data/data/####/beginScanTask.css
  • /data/data/####/beginScanTask.html
  • /data/data/####/beginScanTask.js
  • /data/data/####/bf.png
  • /data/data/####/bg.png
  • /data/data/####/bottom.png
  • /data/data/####/bottom_img.png
  • /data/data/####/bt_part.png
  • /data/data/####/btn_sub.html
  • /data/data/####/bugly_db_legu-journal
  • /data/data/####/button.png
  • /data/data/####/buy.png
  • /data/data/####/buyying.css
  • /data/data/####/buyying.html
  • /data/data/####/buyying.js
  • /data/data/####/calendar.js
  • /data/data/####/camare.png
  • /data/data/####/camera.html
  • /data/data/####/canvas_sign.html
  • /data/data/####/canvas_sign.js
  • /data/data/####/canvas_sign1.html
  • /data/data/####/canvas_sign1.js
  • /data/data/####/capital_details.html
  • /data/data/####/car.gif
  • /data/data/####/car_bak.gif
  • /data/data/####/cart.css
  • /data/data/####/cart.html
  • /data/data/####/cart.js
  • /data/data/####/case_details.css
  • /data/data/####/case_details.html
  • /data/data/####/case_list.css
  • /data/data/####/case_list.html
  • /data/data/####/case_list.js
  • /data/data/####/cash.css
  • /data/data/####/cash.html
  • /data/data/####/cash.js
  • /data/data/####/cats.css
  • /data/data/####/cats.html
  • /data/data/####/cats.js
  • /data/data/####/cbd.jpg
  • /data/data/####/cc.js
  • /data/data/####/certification.css
  • /data/data/####/certification.html
  • /data/data/####/certification.js
  • /data/data/####/changeAdd.css
  • /data/data/####/changeAdd.html
  • /data/data/####/changeAdd.js
  • /data/data/####/changeDetail.css
  • /data/data/####/changeDetail.html
  • /data/data/####/changeDetail.js
  • /data/data/####/changeList.css
  • /data/data/####/changeList.html
  • /data/data/####/changeList.js
  • /data/data/####/change_pwd.css
  • /data/data/####/change_pwd.html
  • /data/data/####/change_pwd.js
  • /data/data/####/change_username.css
  • /data/data/####/change_username.html
  • /data/data/####/change_username.js
  • /data/data/####/choice_identity.css
  • /data/data/####/choice_identity.html
  • /data/data/####/choice_identity.js
  • /data/data/####/choujiang_bak.jpg
  • /data/data/####/city.data-3.js
  • /data/data/####/city.data.js
  • /data/data/####/client.png
  • /data/data/####/client_apply_records.css
  • /data/data/####/client_apply_records.html
  • /data/data/####/client_apply_records.js
  • /data/data/####/client_cropper.html
  • /data/data/####/client_history_info.css
  • /data/data/####/client_history_info.html
  • /data/data/####/client_history_info.js
  • /data/data/####/client_history_info_detail.css
  • /data/data/####/client_history_info_detail.html
  • /data/data/####/client_history_info_detail.js
  • /data/data/####/client_information.css
  • /data/data/####/client_information.html
  • /data/data/####/client_information.js
  • /data/data/####/client_manage.css
  • /data/data/####/client_manage.html
  • /data/data/####/client_manage.js
  • /data/data/####/clientid_igexin.xml
  • /data/data/####/clock.css
  • /data/data/####/clock.html
  • /data/data/####/clock.js
  • /data/data/####/clock.png
  • /data/data/####/clock_record.css
  • /data/data/####/clock_record.html
  • /data/data/####/clock_record.js
  • /data/data/####/close.png
  • /data/data/####/coin.wav
  • /data/data/####/combination_detail.css
  • /data/data/####/combination_detail.html
  • /data/data/####/combination_detail.js
  • /data/data/####/combination_order.css
  • /data/data/####/combination_order.html
  • /data/data/####/combination_order.js
  • /data/data/####/common.css
  • /data/data/####/common.js
  • /data/data/####/commonUpload.js
  • /data/data/####/company_detail.css
  • /data/data/####/company_detail.html
  • /data/data/####/company_detail.js
  • /data/data/####/company_info.css
  • /data/data/####/company_info.html
  • /data/data/####/company_info.js
  • /data/data/####/company_members.css
  • /data/data/####/company_members.html
  • /data/data/####/company_members.js
  • /data/data/####/company_order.css
  • /data/data/####/company_order.html
  • /data/data/####/company_order.js
  • /data/data/####/complaint_detail.css
  • /data/data/####/complaint_detail.html
  • /data/data/####/complaint_list.css
  • /data/data/####/complaint_list.html
  • /data/data/####/complaint_list.js
  • /data/data/####/config.js
  • /data/data/####/confirm_btn.html
  • /data/data/####/confirm_validata.css
  • /data/data/####/confirm_validata.html
  • /data/data/####/confirm_validata.js
  • /data/data/####/convenient_pay.css
  • /data/data/####/convenient_pay.html
  • /data/data/####/convenient_pay.js
  • /data/data/####/correct.png
  • /data/data/####/create_company.css
  • /data/data/####/create_company.html
  • /data/data/####/create_company.js
  • /data/data/####/cropper.css
  • /data/data/####/cropper.html
  • /data/data/####/cropper.min.js
  • /data/data/####/cropper_bankcard.html
  • /data/data/####/crypto.js
  • /data/data/####/csstranslate_list.html
  • /data/data/####/data_0
  • /data/data/####/data_1
  • /data/data/####/data_2
  • /data/data/####/data_3
  • /data/data/####/date.js
  • /data/data/####/dc_ad_type_key.xml
  • /data/data/####/dealed.png
  • /data/data/####/debtDetail.css
  • /data/data/####/debtDetail.html
  • /data/data/####/debtDetail.js
  • /data/data/####/debtList.css
  • /data/data/####/debtList.html
  • /data/data/####/debtList.js
  • /data/data/####/demo.css
  • /data/data/####/demo_fontclass.html
  • /data/data/####/demo_symbol.html
  • /data/data/####/demo_unicode.html
  • /data/data/####/design_record.css
  • /data/data/####/design_record.html
  • /data/data/####/design_record.js
  • /data/data/####/detail.css
  • /data/data/####/detail.html
  • /data/data/####/detail.js
  • /data/data/####/details.css
  • /data/data/####/details.html
  • /data/data/####/details.js
  • /data/data/####/device.html
  • /data/data/####/dh.png
  • /data/data/####/distributor_edit.css
  • /data/data/####/distributor_edit.html
  • /data/data/####/distributor_edit.js
  • /data/data/####/distributor_list.css
  • /data/data/####/distributor_list.html
  • /data/data/####/distributor_list.js
  • /data/data/####/doc.css
  • /data/data/####/doc.js
  • /data/data/####/downloader.html
  • /data/data/####/drag-loading.js
  • /data/data/####/dw.png
  • /data/data/####/echarts.min.js
  • /data/data/####/edit.css
  • /data/data/####/edit.html
  • /data/data/####/edit.js
  • /data/data/####/edit.png
  • /data/data/####/edit_add.png
  • /data/data/####/edit_administrator.css
  • /data/data/####/edit_administrator.html
  • /data/data/####/edit_administrator.js
  • /data/data/####/edit_apply.css
  • /data/data/####/edit_apply.html
  • /data/data/####/edit_apply.js
  • /data/data/####/edit_client.css
  • /data/data/####/edit_client.html
  • /data/data/####/edit_client.js
  • /data/data/####/edit_code.css
  • /data/data/####/edit_code.html
  • /data/data/####/edit_code.js
  • /data/data/####/edit_company_member.css
  • /data/data/####/edit_company_member.html
  • /data/data/####/edit_company_member.js
  • /data/data/####/edit_enable.css
  • /data/data/####/edit_enable.html
  • /data/data/####/edit_enable.js
  • /data/data/####/edit_enable_task.css
  • /data/data/####/edit_enable_task.html
  • /data/data/####/edit_enable_task.js
  • /data/data/####/edit_festival.css
  • /data/data/####/edit_festival.html
  • /data/data/####/edit_festival.js
  • /data/data/####/edit_order.css
  • /data/data/####/edit_order.html
  • /data/data/####/edit_order.js
  • /data/data/####/edit_sub.html
  • /data/data/####/edit_task.css
  • /data/data/####/edit_task.html
  • /data/data/####/edit_task.js
  • /data/data/####/edit_visit_record.css
  • /data/data/####/edit_visit_record.html
  • /data/data/####/edit_visit_record.js
  • /data/data/####/edit_visit_records.css
  • /data/data/####/edit_visit_records.html
  • /data/data/####/edit_visit_records.js
  • /data/data/####/eje3cnc
  • /data/data/####/electrician.png
  • /data/data/####/enable_detail.css
  • /data/data/####/enable_detail.html
  • /data/data/####/enable_detail.js
  • /data/data/####/enable_detail_task.css
  • /data/data/####/enable_detail_task.html
  • /data/data/####/enable_detail_task.js
  • /data/data/####/enable_list.css
  • /data/data/####/enable_list.html
  • /data/data/####/enable_list.js
  • /data/data/####/envelope_detail.html
  • /data/data/####/envelops.png
  • /data/data/####/envelops_detail.css
  • /data/data/####/envelops_ques.css
  • /data/data/####/envelops_ques.html
  • /data/data/####/envelops_record.css
  • /data/data/####/envelops_record.html
  • /data/data/####/envelops_record.js
  • /data/data/####/envelops_withdraw.css
  • /data/data/####/envelops_withdraw.html
  • /data/data/####/envelops_withdraw.js
  • /data/data/####/erp.png
  • /data/data/####/esign.js
  • /data/data/####/evaluate_detail.css
  • /data/data/####/evaluate_detail.html
  • /data/data/####/evaluate_detail.js
  • /data/data/####/evaluate_order.css
  • /data/data/####/evaluate_order.html
  • /data/data/####/evaluate_order.js
  • /data/data/####/events.html
  • /data/data/####/exif.js
  • /data/data/####/express.css
  • /data/data/####/express.html
  • /data/data/####/express.js
  • /data/data/####/f_000001
  • /data/data/####/f_000002
  • /data/data/####/f_000003
  • /data/data/####/f_000004
  • /data/data/####/f_000005
  • /data/data/####/f_000006
  • /data/data/####/f_000007
  • /data/data/####/f_000008
  • /data/data/####/f_000009
  • /data/data/####/f_00000a
  • /data/data/####/f_00000b
  • /data/data/####/f_00000c
  • /data/data/####/f_00000d
  • /data/data/####/face_recognition.html
  • /data/data/####/face_recognition.js
  • /data/data/####/fastclick.js
  • /data/data/####/fdir.png
  • /data/data/####/fdisk.png
  • /data/data/####/feedback.css
  • /data/data/####/feedback.html
  • /data/data/####/feedback.js
  • /data/data/####/feedback.png
  • /data/data/####/feedback_record.css
  • /data/data/####/feedback_record.html
  • /data/data/####/feedback_record.js
  • /data/data/####/feedback_record_detail.css
  • /data/data/####/feedback_record_detail.html
  • /data/data/####/ffile.png
  • /data/data/####/find_service.css
  • /data/data/####/find_service.html
  • /data/data/####/find_service.js
  • /data/data/####/find_service2.html
  • /data/data/####/fingerprint.png
  • /data/data/####/forget.html
  • /data/data/####/forget.js
  • /data/data/####/friendship.mp3
  • /data/data/####/fup.png
  • /data/data/####/gallery.html
  • /data/data/####/gdaemon_20161017
  • /data/data/####/gdmap.css
  • /data/data/####/geolocation.html
  • /data/data/####/getScan.css
  • /data/data/####/getScan.html
  • /data/data/####/getScan.js
  • /data/data/####/getui_sp.xml
  • /data/data/####/gift7.jpg
  • /data/data/####/gongzhong.png
  • /data/data/####/good_list.css
  • /data/data/####/good_list.html
  • /data/data/####/good_list.js
  • /data/data/####/good_xuan.png
  • /data/data/####/goods_evaluate.css
  • /data/data/####/goods_evaluate.html
  • /data/data/####/goods_evaluate.js
  • /data/data/####/goods_order.css
  • /data/data/####/goods_order.html
  • /data/data/####/goods_order.js
  • /data/data/####/goods_search.css
  • /data/data/####/goods_search.html
  • /data/data/####/goods_search.js
  • /data/data/####/guide.html
  • /data/data/####/guide.png
  • /data/data/####/guide2.html
  • /data/data/####/gx.png
  • /data/data/####/gx_sp.xml
  • /data/data/####/h5p.jpg
  • /data/data/####/header_img.png
  • /data/data/####/helloh5.jpg
  • /data/data/####/hezi.png
  • /data/data/####/hh.html
  • /data/data/####/hm.js
  • /data/data/####/hmac.js
  • /data/data/####/hmdb
  • /data/data/####/hmdb-journal
  • /data/data/####/home.css
  • /data/data/####/home.css_old
  • /data/data/####/home.html
  • /data/data/####/home.html_old
  • /data/data/####/home.js
  • /data/data/####/home.js_old
  • /data/data/####/html2canvas.min.js
  • /data/data/####/html5Geo.xml
  • /data/data/####/icon.png
  • /data/data/####/iconfont.css
  • /data/data/####/iconfont.eot
  • /data/data/####/iconfont.js
  • /data/data/####/iconfont.svg
  • /data/data/####/iconfont.ttf
  • /data/data/####/iconfont.woff
  • /data/data/####/iconfont.woff2
  • /data/data/####/icons-extra.css
  • /data/data/####/imgs_main_bike@2x.png
  • /data/data/####/imgs_main_bike@2x2.png
  • /data/data/####/immersed.js
  • /data/data/####/index
  • /data/data/####/index.css
  • /data/data/####/index.css_bak
  • /data/data/####/index.html
  • /data/data/####/index.html_bak
  • /data/data/####/index.js
  • /data/data/####/index.js_bak
  • /data/data/####/indexPageImg.jpg
  • /data/data/####/indexPageImg.png
  • /data/data/####/index_btn.png
  • /data/data/####/init.pid
  • /data/data/####/init_c1.pid
  • /data/data/####/init_every.css
  • /data/data/####/init_every.html
  • /data/data/####/init_every.js
  • /data/data/####/inspiration.css
  • /data/data/####/inspiration.html
  • /data/data/####/inspiration.js
  • /data/data/####/integral.css
  • /data/data/####/integral.html
  • /data/data/####/integral.js
  • /data/data/####/io.html
  • /data/data/####/ios.html
  • /data/data/####/journal
  • /data/data/####/journal.tmp
  • /data/data/####/jquery-1.9.1.min.js
  • /data/data/####/jquery-latest.js
  • /data/data/####/jquery.min.js
  • /data/data/####/k.store
  • /data/data/####/keyer.js
  • /data/data/####/libnfix.so
  • /data/data/####/libshella-2.9.1.2.so
  • /data/data/####/libufix.so
  • /data/data/####/list.css
  • /data/data/####/list.html
  • /data/data/####/list.js
  • /data/data/####/lists.css
  • /data/data/####/lists.html
  • /data/data/####/lists.js
  • /data/data/####/lists_son.html
  • /data/data/####/lists_son.js
  • /data/data/####/lists_style.css
  • /data/data/####/local_crash_lock
  • /data/data/####/location.png
  • /data/data/####/location_detail.html
  • /data/data/####/location_detail.js
  • /data/data/####/location_records.css
  • /data/data/####/location_records.html
  • /data/data/####/location_records.js
  • /data/data/####/log_or_reg.css
  • /data/data/####/log_or_reg.html
  • /data/data/####/log_or_reg.js
  • /data/data/####/logdb.db
  • /data/data/####/logdb.db-journal
  • /data/data/####/login.css
  • /data/data/####/login.html
  • /data/data/####/login.js
  • /data/data/####/loginByPassword.css
  • /data/data/####/loginByPassword.html
  • /data/data/####/loginByPassword.js
  • /data/data/####/login_bak.html
  • /data/data/####/logo.png
  • /data/data/####/logoloading.gif
  • /data/data/####/lookfor.png
  • /data/data/####/lottery1.jpg
  • /data/data/####/manage.png
  • /data/data/####/manage_list.css
  • /data/data/####/manage_list.html
  • /data/data/####/manage_list.js
  • /data/data/####/manager_common.js
  • /data/data/####/manifest.json
  • /data/data/####/map.css
  • /data/data/####/map.html
  • /data/data/####/map.js
  • /data/data/####/maps.css
  • /data/data/####/maps.html
  • /data/data/####/maps.js
  • /data/data/####/maps_bak.css
  • /data/data/####/maps_bak.html
  • /data/data/####/maps_bak.js
  • /data/data/####/maps_map_sub.html
  • /data/data/####/mei11.png
  • /data/data/####/mei2.png
  • /data/data/####/member.css
  • /data/data/####/member.html
  • /data/data/####/member.js
  • /data/data/####/member_details.html
  • /data/data/####/mescroll.min.css
  • /data/data/####/mescroll.min.js
  • /data/data/####/message.html
  • /data/data/####/messaging.html
  • /data/data/####/miaosu.png
  • /data/data/####/mix.dex
  • /data/data/####/money_list.css
  • /data/data/####/money_list.html
  • /data/data/####/money_list.js
  • /data/data/####/more.jpg
  • /data/data/####/mui.dtpicker.css
  • /data/data/####/mui.dtpicker.js
  • /data/data/####/mui.enterfocus.js
  • /data/data/####/mui.imageViewer.js
  • /data/data/####/mui.indexedlist.js
  • /data/data/####/mui.js
  • /data/data/####/mui.lazyload.img.js
  • /data/data/####/mui.lazyload.js
  • /data/data/####/mui.listpicker.css
  • /data/data/####/mui.listpicker.js
  • /data/data/####/mui.locker.js
  • /data/data/####/mui.min.css
  • /data/data/####/mui.min.js
  • /data/data/####/mui.picker.all.css
  • /data/data/####/mui.picker.all.js
  • /data/data/####/mui.picker.css
  • /data/data/####/mui.picker.js
  • /data/data/####/mui.picker.min.css
  • /data/data/####/mui.picker.min.css_bak
  • /data/data/####/mui.picker.min.js
  • /data/data/####/mui.poppicker.css
  • /data/data/####/mui.poppicker.js
  • /data/data/####/mui.previewimage.js
  • /data/data/####/mui.pullToRefresh.js
  • /data/data/####/mui.pullToRefresh.material.js
  • /data/data/####/mui.ttf
  • /data/data/####/mui.view.js
  • /data/data/####/mui.zoom.js
  • /data/data/####/multicontainer_multilist.html
  • /data/data/####/multidex.version.xml
  • /data/data/####/muwu.jpg
  • /data/data/####/my_collection.css
  • /data/data/####/my_collection.html
  • /data/data/####/my_collection.js
  • /data/data/####/my_footprint.css
  • /data/data/####/my_footprint.html
  • /data/data/####/my_footprint.js
  • /data/data/####/my_luck.png
  • /data/data/####/native.js.html
  • /data/data/####/nativeUI.html
  • /data/data/####/native_record_lock
  • /data/data/####/nativeobj.html
  • /data/data/####/navigator.html
  • /data/data/####/no_search_result.png
  • /data/data/####/notice_message.css
  • /data/data/####/notice_message.html
  • /data/data/####/notice_message.js
  • /data/data/####/number_bak.png
  • /data/data/####/oauth.html
  • /data/data/####/onecontainer_multilist.html
  • /data/data/####/operator_detail.css
  • /data/data/####/operator_detail.html
  • /data/data/####/operator_detail.js
  • /data/data/####/operator_type.html
  • /data/data/####/options_list.html
  • /data/data/####/order-loading.js
  • /data/data/####/order_detail.css
  • /data/data/####/order_detail.html
  • /data/data/####/order_detail.js
  • /data/data/####/orientation.html
  • /data/data/####/orientationa.png
  • /data/data/####/orientationb.png
  • /data/data/####/orientationbg.png
  • /data/data/####/orientationc.png
  • /data/data/####/orientationl.png
  • /data/data/####/pay.js
  • /data/data/####/pay_complete.css
  • /data/data/####/pay_complete.html
  • /data/data/####/pay_complete.js
  • /data/data/####/pay_order.css
  • /data/data/####/pay_order.html
  • /data/data/####/pay_order.js
  • /data/data/####/payment.html
  • /data/data/####/pdr.xml
  • /data/data/####/person_top.png
  • /data/data/####/phone.png
  • /data/data/####/photo.png
  • /data/data/####/picture.png
  • /data/data/####/playAudio.js
  • /data/data/####/player.png
  • /data/data/####/position-picker2.png
  • /data/data/####/pref.xml
  • /data/data/####/prettify.js
  • /data/data/####/prettify.sons.css
  • /data/data/####/previewimg.css
  • /data/data/####/privacy.png
  • /data/data/####/profile.css
  • /data/data/####/profile.html
  • /data/data/####/profile.js
  • /data/data/####/proximity.html
  • /data/data/####/prviewImage.css
  • /data/data/####/publish_circle.css
  • /data/data/####/publish_circle.html
  • /data/data/####/publish_circle.js
  • /data/data/####/pull_arrow.png
  • /data/data/####/pull_fresh.png
  • /data/data/####/pullrefresh_sub.html
  • /data/data/####/push.html
  • /data/data/####/push.pid
  • /data/data/####/pushext.db-journal
  • /data/data/####/pushg.db-journal
  • /data/data/####/pushsdk.db-journal
  • /data/data/####/qidian.png
  • /data/data/####/qr.png
  • /data/data/####/question_tovali.css
  • /data/data/####/question_tovali.html
  • /data/data/####/question_tovali.js
  • /data/data/####/real_name.css
  • /data/data/####/real_name.html
  • /data/data/####/real_name.js
  • /data/data/####/rebateApply.css
  • /data/data/####/rebateApply.html
  • /data/data/####/rebateApply.js
  • /data/data/####/rebateDetail.css
  • /data/data/####/rebateDetail.html
  • /data/data/####/rebateDetail.js
  • /data/data/####/rebateList.css
  • /data/data/####/rebateList.html
  • /data/data/####/rebateList.js
  • /data/data/####/receipt.css
  • /data/data/####/receipt.html
  • /data/data/####/receipt.js
  • /data/data/####/receipt_details.html
  • /data/data/####/receipt_wx_withdraw.css
  • /data/data/####/receipt_wx_withdraw.html
  • /data/data/####/receipt_wx_withdraw.js
  • /data/data/####/receive_detail.css
  • /data/data/####/receive_detail.html
  • /data/data/####/receive_detail.js
  • /data/data/####/receive_order.css
  • /data/data/####/receive_order.html
  • /data/data/####/receive_order.js
  • /data/data/####/receive_order.png
  • /data/data/####/recharge.css
  • /data/data/####/recharge.html
  • /data/data/####/recharge.js
  • /data/data/####/record.png
  • /data/data/####/records.html
  • /data/data/####/records_son.html
  • /data/data/####/records_son.js
  • /data/data/####/records_style.css
  • /data/data/####/red_envelops.css
  • /data/data/####/red_envelops.html
  • /data/data/####/red_envelops.js
  • /data/data/####/redactive.css
  • /data/data/####/redactive.html
  • /data/data/####/redactive.js
  • /data/data/####/reddetail.css
  • /data/data/####/reddetail.html
  • /data/data/####/register.css
  • /data/data/####/register.html
  • /data/data/####/register.js
  • /data/data/####/reimbursement_apply.css
  • /data/data/####/reimbursement_apply.html
  • /data/data/####/reimbursement_apply.js
  • /data/data/####/reimbursement_records.css
  • /data/data/####/reimbursement_records.html
  • /data/data/####/reimbursement_records.js
  • /data/data/####/reply.css
  • /data/data/####/reply.html
  • /data/data/####/reply.js
  • /data/data/####/retailer_edit.css
  • /data/data/####/retailer_edit.html
  • /data/data/####/retailer_edit.js
  • /data/data/####/retailerlist.css
  • /data/data/####/retailerlist.html
  • /data/data/####/retailerlist.js
  • /data/data/####/reward.png
  • /data/data/####/reward_bg.jpg
  • /data/data/####/reward_edit.html
  • /data/data/####/reward_edit.js
  • /data/data/####/reward_list.css
  • /data/data/####/reward_list.html
  • /data/data/####/reward_list.js
  • /data/data/####/reward_view.css
  • /data/data/####/reward_view.html
  • /data/data/####/reward_view.js
  • /data/data/####/run.pid
  • /data/data/####/runtime.html
  • /data/data/####/salesman.png
  • /data/data/####/scan.css
  • /data/data/####/scan.html
  • /data/data/####/scan.js
  • /data/data/####/scan.png
  • /data/data/####/scan_code.png
  • /data/data/####/scan_enable.css
  • /data/data/####/scan_enable.html
  • /data/data/####/scan_enable.js
  • /data/data/####/scan_login.css
  • /data/data/####/scan_login.html
  • /data/data/####/scan_login.js
  • /data/data/####/scan_record_detail.css
  • /data/data/####/scan_record_detail.html
  • /data/data/####/scan_record_detail.js
  • /data/data/####/scan_records.css
  • /data/data/####/scan_records.html
  • /data/data/####/scan_records.js
  • /data/data/####/scancode.css
  • /data/data/####/scancode.html
  • /data/data/####/scancode.js
  • /data/data/####/scancode_1.html
  • /data/data/####/scancode_1.js
  • /data/data/####/scancode_details.html
  • /data/data/####/scantest.html
  • /data/data/####/scantest.js
  • /data/data/####/scantest.png
  • /data/data/####/security_info
  • /data/data/####/select_type.css
  • /data/data/####/select_type.html
  • /data/data/####/select_type.js
  • /data/data/####/selected.png
  • /data/data/####/selecting.png
  • /data/data/####/service.png
  • /data/data/####/service_detail.css
  • /data/data/####/service_detail.html
  • /data/data/####/service_detail.js
  • /data/data/####/service_evaluate.css
  • /data/data/####/service_evaluate.html
  • /data/data/####/service_evaluate.js
  • /data/data/####/service_order.css
  • /data/data/####/service_order.html
  • /data/data/####/service_order.js
  • /data/data/####/service_xuan.png
  • /data/data/####/setcode.css
  • /data/data/####/setcode.html
  • /data/data/####/setcode.js
  • /data/data/####/setting.html
  • /data/data/####/setting.png
  • /data/data/####/sha1.js
  • /data/data/####/shake.wav
  • /data/data/####/shakedown.png
  • /data/data/####/shakeup.png
  • /data/data/####/share.html
  • /data/data/####/shopping.png
  • /data/data/####/shortcut.js
  • /data/data/####/shoukuan.png
  • /data/data/####/shuijiao.jpg
  • /data/data/####/sms_tologin.css
  • /data/data/####/sms_tologin.html
  • /data/data/####/sms_tologin.js
  • /data/data/####/speech.html
  • /data/data/####/start_statistics_data.xml
  • /data/data/####/status.png
  • /data/data/####/storage.html
  • /data/data/####/store.png
  • /data/data/####/stream_permission.xml
  • /data/data/####/style.css
  • /data/data/####/submit.png
  • /data/data/####/successanim_list.html
  • /data/data/####/swiper-3.4.2.jquery.min.js
  • /data/data/####/swiper.min.css
  • /data/data/####/system_message.css
  • /data/data/####/system_message.html
  • /data/data/####/system_message.js
  • /data/data/####/task.css
  • /data/data/####/task.html
  • /data/data/####/task.js
  • /data/data/####/task.png
  • /data/data/####/task_manage.css
  • /data/data/####/task_manage.html
  • /data/data/####/task_manage.js
  • /data/data/####/taskdetail.css
  • /data/data/####/taskdetail.html
  • /data/data/####/taskdetail.js
  • /data/data/####/tax.png
  • /data/data/####/tel_directory.html
  • /data/data/####/tel_directory.js
  • /data/data/####/test.html
  • /data/data/####/test.js
  • /data/data/####/test.wav
  • /data/data/####/test_app
  • /data/data/####/tester_apply.css
  • /data/data/####/tester_apply.html
  • /data/data/####/tester_apply.js
  • /data/data/####/tester_manage.css
  • /data/data/####/tester_manage.html
  • /data/data/####/tester_manage.js
  • /data/data/####/tester_manage_operate.css
  • /data/data/####/tester_manage_operate.html
  • /data/data/####/tester_manage_operate.js
  • /data/data/####/timg.png
  • /data/data/####/toolpoint.png
  • /data/data/####/top_banner.jpg
  • /data/data/####/top_part.png
  • /data/data/####/trans.png
  • /data/data/####/ui.png
  • /data/data/####/update.js
  • /data/data/####/update_check.js
  • /data/data/####/upload.js
  • /data/data/####/uploadConfig.js
  • /data/data/####/uploader.html
  • /data/data/####/user_app.js
  • /data/data/####/user_list.css
  • /data/data/####/user_list.html
  • /data/data/####/user_list.js
  • /data/data/####/user_photo.png
  • /data/data/####/utils.js
  • /data/data/####/version.css
  • /data/data/####/version.html
  • /data/data/####/version.js
  • /data/data/####/video.html
  • /data/data/####/video_play.html
  • /data/data/####/view.css
  • /data/data/####/view.html
  • /data/data/####/view.js
  • /data/data/####/view_card.html
  • /data/data/####/view_design.html
  • /data/data/####/view_record.html
  • /data/data/####/view_video.html
  • /data/data/####/views.css
  • /data/data/####/views.png
  • /data/data/####/visit_records.css
  • /data/data/####/visit_records.html
  • /data/data/####/visit_records.js
  • /data/data/####/vod-sdk-upload-1.0.6.min.js
  • /data/data/####/waiting.png
  • /data/data/####/warehouse_search.js
  • /data/data/####/warehouse_search_bak.js
  • /data/data/####/warm.png
  • /data/data/####/web_extend.js
  • /data/data/####/webview.db-journal
  • /data/data/####/webview.html
  • /data/data/####/webviewCookiesChromium.db-journal
  • /data/data/####/webviewCookiesChromiumPrivate.db-journal
  • /data/data/####/webviewGroup.js
  • /data/data/####/webview_embed.css
  • /data/data/####/webview_embed.html
  • /data/data/####/webview_embed1.css
  • /data/data/####/webview_embed1.html
  • /data/data/####/weixin.html
  • /data/data/####/weixin.js
  • /data/data/####/weixin.png
  • /data/data/####/welcome.html
  • /data/data/####/whetpay.png
  • /data/data/####/withdraw.css
  • /data/data/####/withdraw.html
  • /data/data/####/withdraw.js
  • /data/data/####/worker.css
  • /data/data/####/worker.html
  • /data/data/####/worker.js
  • /data/data/####/wx_withdraw.css
  • /data/data/####/wx_withdraw.html
  • /data/data/####/wx_withdraw.js
  • /data/data/####/xhr.html
  • /data/data/####/yinping.wav
  • /data/data/####/yuantiao.jpg
  • /data/data/####/zepto.min.js
  • /data/data/####/zhongdian.png
  • /data/data/####/zip.html
  • /data/media/####/.imei.txt
  • /data/media/####/1553592308597.db
  • /data/media/####/AdEnable.dat
  • /data/media/####/alsn20170807.db
  • /data/media/####/alsn20170807.db-journal
  • /data/media/####/app.db
  • /data/media/####/com.igexin.sdk.deviceId.db
  • /data/media/####/io.dcloud.H50447E58.bin
  • /data/media/####/io.dcloud.H50447E58.db
  • /data/media/####/journal.tmp
  • /data/media/####/test.log
Miscellaneous:
Executes the following shell scripts:
  • /system/bin/sh -c getprop ro.aa.romver
  • /system/bin/sh -c getprop ro.board.platform
  • /system/bin/sh -c getprop ro.build.fingerprint
  • /system/bin/sh -c getprop ro.build.nubia.rom.name
  • /system/bin/sh -c getprop ro.build.rom.id
  • /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
  • /system/bin/sh -c getprop ro.build.version.emui
  • /system/bin/sh -c getprop ro.build.version.opporom
  • /system/bin/sh -c getprop ro.gn.gnromvernumber
  • /system/bin/sh -c getprop ro.lenovo.series
  • /system/bin/sh -c getprop ro.lewa.version
  • /system/bin/sh -c getprop ro.meizu.product.model
  • /system/bin/sh -c getprop ro.miui.ui.version.name
  • /system/bin/sh -c getprop ro.vivo.os.build.display.id
  • /system/bin/sh -c type su
  • <Package Folder>/files/gdaemon_20161017 0 <Package>/io.dcloud.feature.apsGt.GTNormalPushService 24453 300 0
  • chmod 700 <Package Folder>/files/gdaemon_20161017
  • chmod 700 <Package Folder>/tx_shell/libnfix.so
  • chmod 700 <Package Folder>/tx_shell/libshella-2.9.1.2.so
  • chmod 700 <Package Folder>/tx_shell/libufix.so
  • getprop ro.aa.romver
  • getprop ro.board.platform
  • getprop ro.build.fingerprint
  • getprop ro.build.nubia.rom.name
  • getprop ro.build.rom.id
  • getprop ro.build.tyd.kbstyle_version
  • getprop ro.build.version.emui
  • getprop ro.build.version.opporom
  • getprop ro.gn.gnromvernumber
  • getprop ro.lenovo.series
  • getprop ro.lewa.version
  • getprop ro.meizu.product.model
  • getprop ro.miui.ui.version.name
  • getprop ro.vivo.os.build.display.id
  • getprop ro.yunos.version
  • logcat -d -v threadtime
  • sh <Package Folder>/files/gdaemon_20161017 0 <Package>/io.dcloud.feature.apsGt.GTNormalPushService 24453 300 0
Loads the following dynamic libraries:
  • Bugly
  • getuiext2
  • libnfix
  • libshella-2.9.1.2
  • libufix
  • nfix
  • ufix
Uses the following algorithms to encrypt data:
  • AES-CBC-PKCS5Padding
  • AES-GCM-NoPadding
  • RSA-ECB-PKCS1Padding
  • RSA-NONE-OAEPWithSHA1AndMGF1Padding
Uses the following algorithms to decrypt data:
  • AES-CBC-PKCS5Padding
  • AES-GCM-NoPadding
Uses special library to hide executable bytecode.
Gets information about location.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
Gets information about running apps.
Adds tasks to the system scheduler.
Displays its own windows over windows of other apps.

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android

The Russian developer of Dr.Web anti-viruses

Doctor Web has been developing anti-virus software since 1992

Dr.Web is trusted by users around the world in 200+ countries

The company has delivered an anti-virus as a service since 2007

24/7 tech support

© Doctor Web
2003 — 2019

Doctor Web is the Russian developer of Dr.Web anti-virus software. Dr.Web anti-virus software has been developed since 1992.

2-12А, 3rd street Yamskogo polya, Moscow, Russia, 125040