Defend what you create

Other Resources

Close

Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Trojan.PWS.Siggen2.33602

Added to the Dr.Web virus database: 2019-10-08

Virus description added:

Technical Information

To ensure autorun and distribution
Modifies the following registry keys
  • [<HKLM>\SYSTEM\CurrentControlSet\Control\Session Manager] 'BootExecute' = 'autocheck autochk *'
Creates the following services
  • [<HKLM>\System\CurrentControlSet\Services\ampa] 'ImagePath' = '<SYSTEM32>\ampa.sys'
Malicious functions
Reads files which store third party applications passwords
  • %HOMEPATH%\desktop\alert.html
  • %HOMEPATH%\desktop\archer.avi
  • %HOMEPATH%\desktop\contoso.cer
  • %HOMEPATH%\desktop\contoso_1.cer
  • %HOMEPATH%\desktop\cveuropeo.doc
  • %HOMEPATH%\desktop\dashborder_120.bmp
  • %HOMEPATH%\desktop\default.bmp
  • %HOMEPATH%\desktop\garden.htm
  • %HOMEPATH%\desktop\hanni_umami_chapter.doc
  • %HOMEPATH%\desktop\holycrosschurchinstructions.docx
  • %HOMEPATH%\desktop\nwfieldnotes1966.docx
  • %HOMEPATH%\desktop\sdksampleunprivdeveloper.cer
  • %HOMEPATH%\desktop\sdszfo.docx
  • %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
Modifies file system
Creates the following files
  • %TEMP%\7zipsfx.000\app\appinfo\appicon.ico
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\bt_normal.bmp
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\bt_hover.bmp
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\bt_click.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\bt_click.bmp
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\bg_top.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\bg.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\bg.jpg
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\allocate-space.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\home.html
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\giveaway.html
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\demo.html
  • %TEMP%\7zipsfx.000\app\partassist\x64\gptbcd.dll
  • %TEMP%\7zipsfx.000\app\partassist\x64\exfat.dll
  • %TEMP%\7zipsfx.000\app\partassist\loaddrv,1.exe
  • %TEMP%\7zipsfx.000\app\partassist\x64\cfg.ini
  • %TEMP%\7zipsfx.000\app\partassist\x64\bcdboot.exe
  • %TEMP%\7zipsfx.000\app\partassist\x64\7z.exe
  • %TEMP%\7zipsfx.000\app\partassist\x64\7z.dll
  • %TEMP%\7zipsfx.000\app\partassist\x64\2mbr_bcd
  • %TEMP%\7zipsfx.000\app\partassist\x64\2gpt_bcd
  • %TEMP%\7zipsfx.000\app\partassist\winpeshl.ini
  • %TEMP%\7zipsfx.000\app\partassist\winchk.exe
  • %TEMP%\7zipsfx.000\app\partassist\wimmgr.dll
  • %TEMP%\7zipsfx.000\app\partassist\wimlib-imagex.exe
  • %TEMP%\7zipsfx.000\app\partassist\wimgapi.dll
  • %TEMP%\7zipsfx.000\app\partassist\webctrl.dll
  • %TEMP%\7zipsfx.000\app\partassist\vhdmgr.dll
  • %TEMP%\7zipsfx.000\app\partassist\uninstallab.dll
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\bt_hover.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\bt_normal.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\icon_3.png
  • %TEMP%\7zipsfx.000\app\partassist\setupgreen64.exe
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\cd16.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\icon_2.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\icon_13.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\icon_12_x.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\icon_12.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\icon_11_x.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\icon_11.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\icon_10.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\icon_1.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\icon-small.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\icon-small.jpg
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\icon-dot.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\icon-block.jpg
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\ic-lean.jpg
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\ic-9.jpg
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\ic-8.jpg
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\ic-7.jpg
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\ic-6.jpg
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\ic-5.jpg
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\ic-4.jpg
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\ic-3.jpg
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\ic-2.jpg
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\ic-1.jpg
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\epw_small_normal.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\down.jpg
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\disk-copy.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\default.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\copy-partition.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\convert-mbr-gpt.png
  • %TEMP%\7zipsfx.000\app\partassist\ssdsecurityerase.dll
  • %TEMP%\7zipsfx.000\app\partassist\x64\ambooter.exe
  • %TEMP%\7zipsfx.000\app\partassist\setupgreen32.exe
  • %TEMP%\7zipsfx.000\app\partassist\scanpartition.dll
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\icon_4.png
  • %TEMP%\7zipsfx.000\app\partassist\lang\hu.txt
  • %TEMP%\7zipsfx.000\app\partassist\libgcc_s_sjlj-1.dll
  • %TEMP%\7zipsfx.000\app\partassist\language.ini
  • %TEMP%\7zipsfx.000\app\partassist\lang\zh-tw.txt
  • %TEMP%\7zipsfx.000\app\partassist\lang\vi.txt
  • %TEMP%\7zipsfx.000\app\partassist\lang\tr.txt
  • %TEMP%\7zipsfx.000\app\partassist\lang\ru.txt
  • %TEMP%\7zipsfx.000\app\partassist\lang\pt-br.txt
  • %TEMP%\7zipsfx.000\app\partassist\lang\pl.txt
  • %TEMP%\7zipsfx.000\app\partassist\lang\nl.txt
  • %TEMP%\7zipsfx.000\app\partassist\lang\nl-be.txt
  • %TEMP%\7zipsfx.000\app\partassist\lang\ko.txt
  • %TEMP%\7zipsfx.000\app\partassist\lang\ja.txt
  • %TEMP%\7zipsfx.000\app\partassist\lang\it.txt
  • %TEMP%\7zipsfx.000\app\partassist\lang\fr.txt
  • %TEMP%\7zipsfx.000\app\partassist\libxml2-2.dll
  • %TEMP%\7zipsfx.000\app\partassist\lang\es.txt
  • %TEMP%\7zipsfx.000\app\partassist\lang\en.txt
  • %TEMP%\7zipsfx.000\app\partassist\lang\de.txt
  • %TEMP%\7zipsfx.000\app\partassist\lang\ca.txt
  • %TEMP%\7zipsfx.000\app\partassist\lang\ar.txt
  • %TEMP%\7zipsfx.000\app\partassist\install.bat
  • %TEMP%\7zipsfx.000\app\partassist\iconv.dll
  • %TEMP%\7zipsfx.000\app\partassist\html\reg.html
  • %TEMP%\7zipsfx.000\app\partassist\html\lite.html
  • %TEMP%\7zipsfx.000\app\partassist\html\index2.html
  • %TEMP%\7zipsfx.000\app\partassist\html\index2-jp.html
  • %TEMP%\7zipsfx.000\app\partassist\html\index2-fr.html
  • %TEMP%\7zipsfx.000\app\partassist\license.rtf
  • %TEMP%\7zipsfx.000\app\partassist\html\index.html
  • %TEMP%\7zipsfx.000\app\partassist\loaddrv_win32.exe
  • %TEMP%\7zipsfx.000\app\partassist\manual.pdf
  • %TEMP%\7zipsfx.000\app\partassist\readme.rtf
  • %TEMP%\7zipsfx.000\app\partassist\libwim-15.dll
  • %TEMP%\7zipsfx.000\app\partassist\pthreadgc2.dll
  • %TEMP%\7zipsfx.000\app\partassist\peloaddrv.exe
  • %TEMP%\7zipsfx.000\app\partassist\pe\driver\i386\msahci.sys
  • %TEMP%\7zipsfx.000\app\partassist\pe\driver\amd64\msahci.sys
  • %TEMP%\7zipsfx.000\app\partassist\pe.dll
  • %TEMP%\7zipsfx.000\app\partassist\pathformat.dll
  • %TEMP%\7zipsfx.000\app\partassist\partassist.exe
  • %TEMP%\7zipsfx.000\app\partassist\pacfg.ini
  • %TEMP%\7zipsfx.000\app\partassist\other.ini
  • %TEMP%\7zipsfx.000\app\partassist\ntfs2fat32.exe
  • %TEMP%\7zipsfx.000\app\partassist\native\wnet\amd64\fre\ampa.sys
  • %TEMP%\7zipsfx.000\app\partassist\native\wnet\amd64\fre\ampa.exe
  • %TEMP%\7zipsfx.000\app\partassist\native\wlh\x86\fre\ampa.sys
  • %TEMP%\7zipsfx.000\app\partassist\native\wlh\x86\fre\ampa.exe
  • %TEMP%\7zipsfx.000\app\partassist\native\wlh\amd64\fre\ampa.sys
  • %TEMP%\7zipsfx.000\app\partassist\native\wlh\amd64\fre\ampa.exe
  • %TEMP%\7zipsfx.000\app\partassist\native\w2k\x86\fre\ampa.sys
  • %TEMP%\7zipsfx.000\app\partassist\native\w2k\x86\fre\ampa.exe
  • %TEMP%\7zipsfx.000\app\partassist\msvcr80.dll
  • %TEMP%\7zipsfx.000\app\partassist\msvcp80.dll
  • %TEMP%\7zipsfx.000\app\partassist\msvcm80.dll
  • %TEMP%\7zipsfx.000\app\partassist\microsoft.vc80.mfc.manifest
  • %TEMP%\7zipsfx.000\app\partassist\microsoft.vc80.crt.manifest
  • %TEMP%\7zipsfx.000\app\partassist\mfcm80u.dll
  • %TEMP%\7zipsfx.000\app\partassist\mfcm80.dll
  • %TEMP%\7zipsfx.000\app\partassist\mfc80u.dll
  • %TEMP%\7zipsfx.000\app\partassist\mfc80.dll
  • %TEMP%\7zipsfx.000\app\partassist\loaddrv_x64.exe
  • %TEMP%\7zipsfx.000\app\partassist\html\index2-de.html
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\icon_5.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\wintogo-s.png
  • %TEMP%\7zipsfx.000\data\settings\partassisttechportablesettings.ini
  • %TEMP%\7zipsfx.000\data\log\ampa5.log
  • %TEMP%\7zipsfx.000\data\log\ampa4.log
  • %TEMP%\7zipsfx.000\data\log\ampa3.log
  • %TEMP%\7zipsfx.000\data\log\ampa2.log
  • %TEMP%\7zipsfx.000\data\log\ampa1.log
  • %TEMP%\7zipsfx.000\data\log\ampa0.log
  • %TEMP%\7zipsfx.000\data\cfg.ini
  • %TEMP%\7zipsfx.000\data\amtag.bin
  • %TEMP%\7zipsfx.000\app\partassist\x64\winpeshl.ini
  • %TEMP%\7zipsfx.000\app\partassist\x64\winchk.exe
  • %TEMP%\7zipsfx.000\app\partassist\x64\wimmgr.dll
  • %TEMP%\7zipsfx.000\app\partassist\x64\wimgapi.dll
  • %TEMP%\7zipsfx.000\data\win\ampa,1.exe
  • %TEMP%\7zipsfx.000\data\upgrade.ini
  • %TEMP%\7zipsfx.000\app\partassist\x64\setupgreen64.exe
  • %TEMP%\7zipsfx.000\app\partassist\x64\scanpartition.dll
  • %TEMP%\7zipsfx.000\app\partassist\x64\pe.dll
  • %TEMP%\7zipsfx.000\app\partassist\x64\partassist.exe
  • %TEMP%\7zipsfx.000\app\partassist\x64\native\wnet\amd64\fre\ampa.sys
  • %TEMP%\7zipsfx.000\app\partassist\x64\native\wlh\amd64\fre\ampa.sys
  • %TEMP%\7zipsfx.000\app\partassist\x64\msvcr80.dll
  • %TEMP%\7zipsfx.000\app\partassist\x64\msvcp80.dll
  • %TEMP%\7zipsfx.000\app\partassist\x64\msvcm80.dll
  • %TEMP%\7zipsfx.000\app\partassist\x64\microsoft.vc80.mfc.manifest
  • %TEMP%\7zipsfx.000\app\partassist\x64\microsoft.vc80.crt.manifest
  • %TEMP%\7zipsfx.000\app\partassist\x64\mfcm80u.dll
  • %TEMP%\7zipsfx.000\app\partassist\x64\mfcm80.dll
  • %TEMP%\7zipsfx.000\app\partassist\x64\vhdmgr.dll
  • %TEMP%\7zipsfx.000\app\partassist\x64\loaddrv_x64.exe
  • %TEMP%\7zipsfx.000\data\win\ampa,2.exe
  • %WINDIR%\syswow64\ampa.sys
  • %TEMP%\7zipsfx.000\app\partassist\log\ampa6.log
  • %WINDIR%\ga_of.dat
  • %PROGRAMDATA%\aomeibr\comn.ini
  • %TEMP%\7zipsfx.000\app\partassist\cfg.ini
  • %TEMP%\nsd254f.tmp\execdos.dll
  • %TEMP%\nsd254f.tmp\registry.dll
  • %TEMP%\nsd254f.tmp\runtimedata.ini
  • %TEMP%\7zipsfx.000\data\portableapps.comlauncherruntimedata-partassisttechportable.ini
  • <SYSTEM32>\ampa.sys
  • %WINDIR%\ampa.exe
  • %TEMP%\nsd254f.tmp\launcher.ini
  • %TEMP%\nsd254f.tmp\system.dll
  • %TEMP%\nsn253e.tmp
  • %TEMP%\7zipsfx.000\partassisttechportable.exe
  • %TEMP%\7zipsfx.000\data\wnd.ini
  • %TEMP%\7zipsfx.000\data\win\system32\ddmdrv,4.sys
  • %TEMP%\7zipsfx.000\data\win\system32\ddmdrv,3.sys
  • %TEMP%\7zipsfx.000\data\win\system32\ddmdrv,2.sys
  • %TEMP%\7zipsfx.000\data\win\system32\ddmdrv,1.sys
  • %TEMP%\7zipsfx.000\data\win\system32\ampa.sys
  • %TEMP%\7zipsfx.000\data\win\system32\ampa,3.sys
  • %TEMP%\7zipsfx.000\data\win\system32\ampa,2.sys
  • %TEMP%\7zipsfx.000\data\win\system32\ampa,1.sys
  • %TEMP%\7zipsfx.000\data\win\ddmmain,4.exe
  • %TEMP%\7zipsfx.000\data\win\ddmmain,3.exe
  • %TEMP%\7zipsfx.000\data\win\ddmmain,2.exe
  • %TEMP%\7zipsfx.000\data\win\ddmmain,1.exe
  • %TEMP%\7zipsfx.000\data\win\ampa.exe
  • %TEMP%\7zipsfx.000\app\partassist\x64\mfc80u.dll
  • %TEMP%\7zipsfx.000\app\partassist\x64\uninstall.bat
  • %TEMP%\7zipsfx.000\app\partassist\x64\mfc80.dll
  • %TEMP%\7zipsfx.000\app\partassist\x64\loaddrv.exe
  • %TEMP%\7zipsfx.000\app\partassist\doc\resize.html
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\icon_6.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\tb-bg.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\split_small.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\split-partition.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\resize-move.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\rebuild.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\rebuild(1).png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\quick-partition.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\partition-alignment.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\migrate-os.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\merge-partitions.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\logo_pa.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\img_upgrades.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\icon_x.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\icon_upgrade.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\icon_unfold.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\icon_trust.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\icon_technical_support.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\icon_support.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\icon_star.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\icon_receive.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\icon_note.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\icon_immediate.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\icon_email.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\icon_d.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\icon_9_x.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\icon_90day.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\icon_9.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\icon_8.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\up.jpg
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\icon_7.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\wipe-disk.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\img\wipe_hard_small_normal.png
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\index-de.html
  • %TEMP%\7zipsfx.000\app\partassist\x64\lang\zh-tw.txt
  • %TEMP%\7zipsfx.000\app\partassist\x64\lang\vi.txt
  • %TEMP%\7zipsfx.000\app\partassist\x64\lang\tr.txt
  • %TEMP%\7zipsfx.000\app\partassist\x64\lang\ru.txt
  • %TEMP%\7zipsfx.000\app\partassist\x64\lang\pt-br.txt
  • %TEMP%\7zipsfx.000\app\partassist\x64\lang\pl.txt
  • %TEMP%\7zipsfx.000\app\partassist\x64\lang\nl.txt
  • %TEMP%\7zipsfx.000\app\partassist\x64\lang\nl-be.txt
  • %TEMP%\7zipsfx.000\app\partassist\x64\lang\ko.txt
  • %TEMP%\7zipsfx.000\app\partassist\x64\lang\ja.txt
  • %TEMP%\7zipsfx.000\app\partassist\x64\lang\it.txt
  • %TEMP%\7zipsfx.000\app\partassist\x64\lang\hu.txt
  • %TEMP%\7zipsfx.000\app\partassist\x64\lang\fr.txt
  • %TEMP%\7zipsfx.000\app\partassist\x64\lang\es.txt
  • %TEMP%\7zipsfx.000\app\partassist\x64\lang\en.txt
  • %TEMP%\7zipsfx.000\app\partassist\x64\lang\de.txt
  • %TEMP%\7zipsfx.000\app\partassist\x64\lang\ca.txt
  • %TEMP%\7zipsfx.000\app\partassist\x64\lang\ar.txt
  • %TEMP%\7zipsfx.000\app\partassist\x64\install.bat
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\reg.html
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\lite.html
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\index2.html
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\index2-jp.html
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\index2-fr.html
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\index2-de.html
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\index.html
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\index-jp.html
  • %TEMP%\7zipsfx.000\app\partassist\x64\html\index-fr.html
  • %TEMP%\7zipsfx.000\app\partassist\x64\language.ini
  • %TEMP%\7zipsfx.000\app\partassist\html\index-jp.html
  • %TEMP%\7zipsfx.000\app\partassist\html\index-fr.html
  • %TEMP%\7zipsfx.000\app\partassist\html\index-de.html
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\operating-process.html
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\move-wizard.html
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\move-slice.html
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\interface.html
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\installation.html
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\initialize-disk.html
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\index.html
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\images\yes.png
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\images\unallocated-space.png
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\images\unallocated-.png
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\images\specify-drive.png
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\images\specify-drive-1.png
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\remove-drive.html
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\resize-move-volume.html
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\images\shrink.png
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\images\select-slice.png
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\images\select-raid.png
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\images\select-destination.png
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\images\resize-volume.png
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\images\remove-drive.png
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\images\no.png
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\images\move-volume.png
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\images\move-simple.png
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\images\main.png
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\images\help_bkimg.png
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\images\headfill.png
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\images\figure.png
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\images\shrink-volume.png
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\images\shrink-1.png
  • %TEMP%\7zipsfx.000\app\partassist\doc\cmd.html
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\style.css
  • %TEMP%\7zipsfx.000\app\partassist\doc\bootcd.html
  • %TEMP%\7zipsfx.000\app\partassist\doc\allocate.html
  • %TEMP%\7zipsfx.000\app\partassist\doc\active.html
  • %TEMP%\7zipsfx.000\app\partassist\doc\about.html
  • %TEMP%\7zipsfx.000\app\partassist\ddm\vds.dll
  • %TEMP%\7zipsfx.000\app\partassist\ddm\usermanual.pdf
  • %TEMP%\7zipsfx.000\app\partassist\ddm\readme.rtf
  • %TEMP%\7zipsfx.000\app\partassist\ddm\qtxml4.dll
  • %TEMP%\7zipsfx.000\app\partassist\ddm\qtwebkit4.dll
  • %TEMP%\7zipsfx.000\app\partassist\ddm\qtnetwork4.dll
  • %TEMP%\7zipsfx.000\app\partassist\ddm\qtgui4.dll
  • %TEMP%\7zipsfx.000\app\partassist\ddm\qtcore4.dll
  • %TEMP%\7zipsfx.000\app\partassist\ddm\ntfs.dll
  • %TEMP%\7zipsfx.000\app\partassist\ddm\msvcr90.dll
  • %TEMP%\7zipsfx.000\app\partassist\ddm\msvcr80.dll
  • %TEMP%\7zipsfx.000\app\partassist\ddm\msvcp90.dll
  • %TEMP%\7zipsfx.000\app\partassist\ddm\msvcp80.dll
  • %TEMP%\7zipsfx.000\app\partassist\ddm\msvcm90.dll
  • %TEMP%\7zipsfx.000\app\partassist\ddm\msvcm80.dll
  • %TEMP%\7zipsfx.000\app\partassist\ddm\microsoft.vc90.crt.manifest
  • %TEMP%\7zipsfx.000\app\partassist\ddm\microsoft.vc80.crt.manifest
  • %TEMP%\7zipsfx.000\app\partassist\ddm\logic.dll
  • %TEMP%\7zipsfx.000\app\partassist\ddm\loaddrv.exe
  • %TEMP%\7zipsfx.000\app\partassist\ddm\license.rtf
  • %TEMP%\7zipsfx.000\app\partassist\ddm\ldm.dll
  • %TEMP%\7zipsfx.000\app\partassist\ddm\help.exe
  • %TEMP%\7zipsfx.000\app\partassist\ddm\fat.dll
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\technical-support.html
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\images\figure-5.png
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\images\extend-raid5.png
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\requirements.html
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\images\disk-manager.png
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\images\disk-management.png
  • %TEMP%\7zipsfx.000\app\partassist\7z.dll
  • %TEMP%\7zipsfx.000\app\defaultdata\win\ddmmain,2.exe
  • %TEMP%\7zipsfx.000\app\partassist\2gpt_bcd
  • %TEMP%\7zipsfx.000\app\parta
  • %TEMP%\7zipsfx.000\app\defaultdata\wnd.ini
  • %TEMP%\7zipsfx.000\app\defaultdata\win\system32\ddmdrv,4.sys
  • %TEMP%\7zipsfx.000\app\defaultdata\win\system32\ddmdrv,3.sys
  • %TEMP%\7zipsfx.000\app\defaultdata\win\system32\ddmdrv,2.sys
  • %TEMP%\7zipsfx.000\app\defaultdata\win\system32\ddmdrv,1.sys
  • %TEMP%\7zipsfx.000\app\defaultdata\win\system32\ampa,4.sys
  • %TEMP%\7zipsfx.000\app\defaultdata\win\system32\ampa,3.sys
  • %TEMP%\7zipsfx.000\app\defaultdata\win\system32\ampa,2.sys
  • %TEMP%\7zipsfx.000\app\defaultdata\win\system32\ampa,1.sys
  • %TEMP%\7zipsfx.000\app\defaultdata\win\ddmmain,4.exe
  • %TEMP%\7zipsfx.000\app\defaultdata\win\ddmmain,3.exe
  • %TEMP%\7zipsfx.000\app\defaultdata\win\ddmmain,1.exe
  • %TEMP%\7zipsfx.000\app\partassist\doc\clear.html
  • %TEMP%\7zipsfx.000\app\defaultdata\win\ampa,4.exe
  • %TEMP%\7zipsfx.000\app\defaultdata\win\ampa,3.exe
  • %TEMP%\7zipsfx.000\app\defaultdata\win\ampa,2.exe
  • %TEMP%\7zipsfx.000\app\defaultdata\win\ampa,1.exe
  • %TEMP%\7zipsfx.000\app\defaultdata\cfg.ini
  • %TEMP%\7zipsfx.000\app\appinfo\launcher\partassisttechportable.ini
  • %TEMP%\7zipsfx.000\app\appinfo\launcher\custom.nsh
  • %TEMP%\7zipsfx.000\app\appinfo\appinfo.ini
  • %TEMP%\7zipsfx.000\app\appinfo\appicon_32.png
  • %TEMP%\7zipsfx.000\app\appinfo\appicon_256.png
  • %TEMP%\7zipsfx.000\app\appinfo\appicon_16.png
  • %TEMP%\7zipsfx.000\app\appinfo\appicon_128.png
  • %TEMP%\7zipsfx.000\app\partassist\7z.exe
  • %TEMP%\7zipsfx.000\app\partassist\ambooter.exe
  • %TEMP%\7zipsfx.000\app\partassist\doc\check.html
  • %TEMP%\7zipsfx.000\app\partassist\botva2.dll
  • %TEMP%\7zipsfx.000\app\partassist\bcdboot.exe
  • %TEMP%\7zipsfx.000\app\partassist\2mbr_bcd
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\images\add-drive.png
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\helptree.xml
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\format-volume.html
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\faq.html
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\dynamic-disk-concept.html
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\delete-volume.html
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\create-wizard.html
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\create-volumes.html
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\convert-mbr.html
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\convert-gpt.html
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\convert-dynamic.html
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\convert-basic.html
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\change-letter.html
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\change-label.html
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\case-3.html
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\case-2.html
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\case-1.html
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\add-drive.html
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\about-dynamic-volume.html
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\about-dynamic-disk.html
  • %TEMP%\7zipsfx.000\app\partassist\ddm\device.dll
  • %TEMP%\7zipsfx.000\app\partassist\ddm\ddmmain.exe
  • %TEMP%\7zipsfx.000\app\partassist\ddm\ddmdrv.sys
  • %TEMP%\7zipsfx.000\app\partassist\ddm\ddm.exe
  • %TEMP%\7zipsfx.000\app\partassist\ddm\config.ini
  • %TEMP%\7zipsfx.000\app\partassist\ddm\comn.dll
  • %TEMP%\7zipsfx.000\app\partassist\ddm\basicdisk.html
  • %TEMP%\7zipsfx.000\app\partassist\callbackctrl.dll
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\images\create-volume.png
  • %TEMP%\7zipsfx.000\app\partassist\ddm\doc\related-info.html
  • %TEMP%\7zipsfx.000\app\partassist\doc\configuration.html
  • %TEMP%\7zipsfx.000\app\partassist\html\img\icon_6.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\default.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\icon_5.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\icon_4.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\icon_3.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\icon_2.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\icon_13.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\icon_12_x.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\icon_12.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\icon_11_x.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\icon_11.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\icon_10.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\icon_1.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\icon-small.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\icon-small.jpg
  • %TEMP%\7zipsfx.000\app\partassist\html\img\icon-dot.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\icon-block.jpg
  • %TEMP%\7zipsfx.000\app\partassist\html\img\ic-lean.jpg
  • %TEMP%\7zipsfx.000\app\partassist\html\img\ic-9.jpg
  • %TEMP%\7zipsfx.000\app\partassist\html\img\ic-8.jpg
  • %TEMP%\7zipsfx.000\app\partassist\html\img\ic-7.jpg
  • %TEMP%\7zipsfx.000\app\partassist\html\img\ic-6.jpg
  • %TEMP%\7zipsfx.000\app\partassist\html\img\ic-5.jpg
  • %TEMP%\7zipsfx.000\app\partassist\html\img\ic-4.jpg
  • %TEMP%\7zipsfx.000\app\partassist\html\img\ic-3.jpg
  • %TEMP%\7zipsfx.000\app\partassist\html\img\ic-2.jpg
  • %TEMP%\7zipsfx.000\app\partassist\html\img\ic-1.jpg
  • %TEMP%\7zipsfx.000\app\partassist\html\img\epw_small_normal.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\down.jpg
  • %TEMP%\7zipsfx.000\app\partassist\html\img\disk-copy.png
  • %TEMP%\7zipsfx.000\app\partassist\doc\convert.html
  • %TEMP%\7zipsfx.000\app\partassist\html\img\icon_7.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\icon_8.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\icon_9.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\icon_90day.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\wipe-disk.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\wintogo-s.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\up.jpg
  • %TEMP%\7zipsfx.000\app\partassist\html\img\tb-bg.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\split_small.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\split-partition.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\resize-move.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\rebuild.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\rebuild(1).png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\quick-partition.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\partition-alignment.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\migrate-os.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\merge-partitions.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\logo_pa.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\img_upgrades.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\icon_x.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\icon_upgrade.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\icon_unfold.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\icon_trust.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\icon_technical_support.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\icon_support.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\icon_star.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\icon_receive.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\icon_note.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\icon_immediate.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\icon_email.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\icon_d.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\icon_9_x.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\wipe_hard_small_normal.png
  • %TEMP%\7zipsfx.000\data\win\ampa,3.exe
  • %WINDIR%\temp\udda9a0.tmp
  • %TEMP%\7zipsfx.000\app\partassist\html\img\cd16.png
  • %TEMP%\7zipsfx.000\app\partassist\doc\index.html
  • %TEMP%\7zipsfx.000\app\partassist\doc\properties.html
  • %TEMP%\7zipsfx.000\app\partassist\doc\prilog.html
  • %TEMP%\7zipsfx.000\app\partassist\doc\password.html
  • %TEMP%\7zipsfx.000\app\partassist\doc\partrecovery.html
  • %TEMP%\7zipsfx.000\app\partassist\doc\partalign.html
  • %TEMP%\7zipsfx.000\app\partassist\doc\n2f.html
  • %TEMP%\7zipsfx.000\app\partassist\doc\migrate.html
  • %TEMP%\7zipsfx.000\app\partassist\doc\merge.html
  • %TEMP%\7zipsfx.000\app\partassist\doc\main.html
  • %TEMP%\7zipsfx.000\app\partassist\doc\letter.html
  • %TEMP%\7zipsfx.000\app\partassist\doc\label.html
  • %TEMP%\7zipsfx.000\app\partassist\doc\integratetorecoveryenv.html
  • %TEMP%\7zipsfx.000\app\partassist\doc\initdisk.html
  • %TEMP%\7zipsfx.000\app\partassist\doc\images\headfill.png
  • %TEMP%\7zipsfx.000\app\partassist\doc\rebootmode.html
  • %TEMP%\7zipsfx.000\app\partassist\doc\hide.html
  • %TEMP%\7zipsfx.000\app\partassist\doc\helptree.html
  • %TEMP%\7zipsfx.000\app\partassist\doc\gptmbr.html
  • %TEMP%\7zipsfx.000\app\partassist\doc\format.html
  • %TEMP%\7zipsfx.000\app\partassist\doc\faq.html
  • %TEMP%\7zipsfx.000\app\partassist\doc\extend.html
  • %TEMP%\7zipsfx.000\app\partassist\doc\delete.html
  • %TEMP%\7zipsfx.000\app\partassist\doc\ddc.html
  • %TEMP%\7zipsfx.000\app\partassist\doc\create.html
  • %TEMP%\7zipsfx.000\app\partassist\doc\copypartwizard.html
  • %TEMP%\7zipsfx.000\app\partassist\doc\copypart.html
  • %TEMP%\7zipsfx.000\app\partassist\doc\copydiskwizard.html
  • %TEMP%\7zipsfx.000\app\partassist\doc\copydisk.html
  • %TEMP%\7zipsfx.000\app\partassist\html\img\convert-mbr-gpt.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\copy-partition.png
  • %TEMP%\7zipsfx.000\app\partassist\doc\rebuildmbr.html
  • %TEMP%\7zipsfx.000\app\partassist\doc\split.html
  • %TEMP%\7zipsfx.000\app\partassist\doc\quick-partition.html
  • %TEMP%\7zipsfx.000\app\partassist\html\img\bt_normal.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\bt_normal.bmp
  • %TEMP%\7zipsfx.000\app\partassist\html\img\bt_hover.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\bt_hover.bmp
  • %TEMP%\7zipsfx.000\app\partassist\html\img\bt_click.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\bt_click.bmp
  • %TEMP%\7zipsfx.000\app\partassist\html\img\bg_top.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\bg.png
  • %TEMP%\7zipsfx.000\app\partassist\html\img\bg.jpg
  • %TEMP%\7zipsfx.000\app\partassist\html\img\allocate-space.png
  • %TEMP%\7zipsfx.000\app\partassist\html\home.html
  • %TEMP%\7zipsfx.000\app\partassist\html\giveaway.html
  • %TEMP%\7zipsfx.000\app\partassist\html\demo.html
  • %TEMP%\7zipsfx.000\app\partassist\help.exe
  • %TEMP%\7zipsfx.000\app\partassist\gptbcd.dll
  • %TEMP%\7zipsfx.000\app\partassist\garunonce.exe
  • %TEMP%\7zipsfx.000\app\partassist\exfat.dll
  • %TEMP%\7zipsfx.000\app\partassist\epw.exe
  • %TEMP%\7zipsfx.000\app\partassist\dyndiskconverter.exe
  • %TEMP%\7zipsfx.000\app\partassist\doc\wtg.html
  • %TEMP%\7zipsfx.000\app\partassist\doc\wipepart.html
  • %TEMP%\7zipsfx.000\app\partassist\doc\wipedisk.html
  • %TEMP%\7zipsfx.000\app\partassist\doc\wipe.html
  • %TEMP%\7zipsfx.000\app\partassist\doc\typeid.html
  • %TEMP%\7zipsfx.000\app\partassist\doc\surface.html
  • %TEMP%\7zipsfx.000\app\partassist\doc\support.html
  • %TEMP%\7zipsfx.000\app\partassist\doc\style.css
  • %TEMP%\7zipsfx.000\app\partassist\doc\ssdsecureerase.html
  • %TEMP%\7zipsfx.000\app\partassist\doc\serial.html
  • C:\amtag.bin
Sets the 'hidden' attribute to the following files
  • %TEMP%\7zipsfx.000\data\amtag.bin
  • C:\amtag.bin
Deletes the following files
  • %TEMP%\7zipsfx.000\app\partassist\x64\cfg.ini
  • %WINDIR%\ampa.exe
  • <SYSTEM32>\ampa.sys
  • %WINDIR%\syswow64\ampa.sys
  • %WINDIR%\temp\udda9a0.tmp
Moves the following files
  • from %TEMP%\7zipsfx.000\data\win\ampa.exe to %TEMP%\7zipsfx.000\data\win\ampa,2.exe
  • from %TEMP%\7zipsfx.000\data\win\system32\ampa.sys to %TEMP%\7zipsfx.000\data\win\system32\ampa,2.sys
  • from %TEMP%\7zipsfx.000\data\amtag.bin to C:\amtag.bin
  • from %TEMP%\7zipsfx.000\data\upgrade.ini to %TEMP%\7zipsfx.000\app\partassist\upgrade.ini
  • from %TEMP%\7zipsfx.000\data\wnd.ini to %TEMP%\7zipsfx.000\app\partassist\wnd.ini
  • from %TEMP%\7zipsfx.000\data\cfg.ini to %TEMP%\7zipsfx.000\app\partassist\cfg.ini
Substitutes the following files
  • %TEMP%\7zipsfx.000\app\partassist\x64\cfg.ini
  • %WINDIR%\ampa.exe
  • <SYSTEM32>\ampa.sys
  • %WINDIR%\syswow64\ampa.sys
Network activity
UDP
  • DNS ASK go#####analytics.com
  • DNS ASK di####artition.com
Miscellaneous
Creates and executes the following
  • '%TEMP%\7zipsfx.000\partassisttechportable.exe'
  • '%TEMP%\7zipsfx.000\app\partassist\partassist.exe'
  • '%TEMP%\7zipsfx.000\app\partassist\setupgreen64.exe' -u
  • '%TEMP%\7zipsfx.000\app\partassist\loaddrv_x64.exe' -u
  • '%TEMP%\7zipsfx.000\app\partassist\setupgreen64.exe'
  • '%TEMP%\7zipsfx.000\app\partassist\loaddrv_x64.exe'
  • '%TEMP%\7zipsfx.000\app\partassist\partassist.exe' ' (with hidden window)
  • '%TEMP%\7zipsfx.000\app\partassist\setupgreen64.exe' -u' (with hidden window)
  • '%TEMP%\7zipsfx.000\app\partassist\loaddrv_x64.exe' -u' (with hidden window)
  • '%TEMP%\7zipsfx.000\app\partassist\setupgreen64.exe' ' (with hidden window)
  • '%TEMP%\7zipsfx.000\app\partassist\loaddrv_x64.exe' ' (with hidden window)

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android

The Russian developer of Dr.Web anti-viruses

Doctor Web has been developing anti-virus software since 1992

Dr.Web is trusted by users around the world in 200+ countries

The company has delivered an anti-virus as a service since 2007

24/7 tech support

© Doctor Web
2003 — 2019

Doctor Web is the Russian developer of Dr.Web anti-virus software. Dr.Web anti-virus software has been developed since 1992.

2-12А, 3rd street Yamskogo polya, Moscow, Russia, 125040