Defend what you create

Other Resources

Close

Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Trojan.Encoder.33187

Added to the Dr.Web virus database: 2020-11-21

Virus description added:

Technical Information

To ensure autorun and distribution
Modifies the following registry keys
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'WindowsUpdateCheck' = '<Full path to file>'
Creates or modifies the following files
  • %APPDATA%\microsoft\windows\start menu\programs\hjkdfs\lgfkkiubsdh.exe
  • %HOMEPATH%\start menu\programs\startup\.c4d1664ef40ce18f8d41
Creates the following files on removable media
  • <Drive name for removable media>:\.c4d1664ef40ce18f8d41
  • <Drive name for removable media>:\correct.avi
  • <Drive name for removable media>:\archer.avi
  • <Drive name for removable media>:\dial.bmp
  • <Drive name for removable media>:\dashborder_192.bmp
  • <Drive name for removable media>:\tileimage.bmp
  • <Drive name for removable media>:\dashborder_96.bmp
  • <Drive name for removable media>:\pmd.cer
  • <Drive name for removable media>:\testcertificate.cer
  • <Drive name for removable media>:\sdksampleprivdeveloper.cer
  • <Drive name for removable media>:\contosoroot.cer
Malicious functions
Executes the following
  • '%WINDIR%\syswow64\net.exe' stop U8WorkerService1
  • '%WINDIR%\syswow64\net.exe' stop TPlusStdTaskService1220
  • '%WINDIR%\syswow64\net.exe' stop MSExchangeThrottling
  • '%WINDIR%\syswow64\net.exe' stop 360EntPGSvc
  • '%WINDIR%\syswow64\net.exe' stop TPlusStdAppService1220
  • '%WINDIR%\syswow64\net.exe' stop MSExchangeSubmission
  • '%WINDIR%\syswow64\net.exe' stop ServiceMid
  • '%WINDIR%\syswow64\net.exe' stop MySQL
  • '%WINDIR%\syswow64\net.exe' stop MSExchangeServiceHost
  • '%WINDIR%\syswow64\net.exe' stop tmlisten
  • '%WINDIR%\syswow64\net.exe' stop OracleDBConsoleilas
  • '%WINDIR%\syswow64\net.exe' stop MSExchangeRPC
  • '%WINDIR%\syswow64\net.exe' stop VeeamDistributionSvc
  • '%WINDIR%\syswow64\net.exe' stop "OracleOraDb10g_homeliSQL*Plus"
  • '%WINDIR%\syswow64\net.exe' stop MSExchangeRepl
  • '%WINDIR%\syswow64\net.exe' stop ClickToRunSvc
  • '%WINDIR%\syswow64\net.exe' stop VeeamBrokerSvc
  • '%WINDIR%\syswow64\net.exe' stop MSExchangePOP3BE
  • '%WINDIR%\syswow64\net.exe' stop VeeamMountSvc
  • '%WINDIR%\syswow64\net.exe' stop CASVirtualDiskService
  • '%WINDIR%\syswow64\net.exe' stop MSExchangePop3
  • '%WINDIR%\syswow64\net.exe' stop VeeamCloudSvc
  • '%WINDIR%\syswow64\net.exe' stop VeeamDeploySvc
  • '%WINDIR%\syswow64\net.exe' stop iNethinkSQLBackupSvc
  • '%WINDIR%\syswow64\net.exe' stop MSExchangeNotificationsBroker
  • '%WINDIR%\syswow64\net.exe' stop VeeamNFSSvc
  • '%WINDIR%\syswow64\net.exe' stop DDNSService
  • '%WINDIR%\syswow64\net.exe' stop MSExchangeMailboxReplication
  • '%WINDIR%\syswow64\net.exe' stop TPlusStdWebService1300
  • '%WINDIR%\syswow64\net.exe' stop TPlusStdUpgradeService1300
  • '%WINDIR%\syswow64\net.exe' stop RapService
  • '%WINDIR%\syswow64\net.exe' stop CASMsgSrv
  • '%WINDIR%\syswow64\net.exe' stop OMAILREPORT
  • '%WINDIR%\syswow64\net.exe' stop DFServ
  • '%WINDIR%\syswow64\net.exe' stop RavTask
  • '%WINDIR%\syswow64\net.exe' stop "ABBYY.Licensing.FineReader.Professional.12.0"
  • '%WINDIR%\syswow64\net.exe' stop "Apple Mobile Device Service"
  • '%WINDIR%\syswow64\taskkill.exe' /IM Att.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM httpd.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM mysqld.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM iexplore.exe /F
  • '%WINDIR%\syswow64\net.exe' stop "Bonjour Service"
  • '%WINDIR%\syswow64\net.exe' stop U8SendMailAdmin
  • '%WINDIR%\syswow64\net.exe' stop pcas
  • '%WINDIR%\syswow64\net.exe' stop KugouService
  • '%WINDIR%\syswow64\net.exe' stop ceng_web_svc_d
  • '%WINDIR%\syswow64\net.exe' stop KpService
  • '%WINDIR%\syswow64\net.exe' stop K3MMainSuspendService
  • '%WINDIR%\syswow64\net.exe' stop SupportAssistAgent
  • '%WINDIR%\syswow64\net.exe' stop MSExchangeMailboxAssistants
  • '%WINDIR%\syswow64\net.exe' stop "Dell Hardware Support"
  • '%WINDIR%\syswow64\net.exe' stop RavService
  • '%WINDIR%\syswow64\net.exe' stop AutoUpdatePatchService
  • '%WINDIR%\syswow64\net.exe' stop "NetVault Process Manager"
  • '%WINDIR%\syswow64\net.exe' stop ImtsEventSvr
  • '%WINDIR%\syswow64\net.exe' stop MySQL5_OA
  • '%WINDIR%\syswow64\net.exe' stop NFLicenceServer
  • '%WINDIR%\syswow64\net.exe' stop DDVRulesProcessor
  • '%WINDIR%\syswow64\net.exe' stop MSExchangeUMCR
  • '%WINDIR%\syswow64\net.exe' stop d_safe
  • '%WINDIR%\syswow64\net.exe' stop "FileZilla Server"
  • '%WINDIR%\syswow64\net.exe' stop MSExchangeUM
  • '%WINDIR%\syswow64\net.exe' stop AngelOfDeath
  • '%WINDIR%\syswow64\net.exe' stop K3MobileServiceManage
  • '%WINDIR%\syswow64\net.exe' stop MSExchangeTransportLogSearch
  • '%WINDIR%\syswow64\net.exe' stop MSExchangeTransport
  • '%WINDIR%\syswow64\net.exe' stop TPlusStdUpgradeService1220
  • '%WINDIR%\syswow64\net.exe' stop TPlusStdTaskService1300
  • '%WINDIR%\syswow64\net.exe' stop JWEM3DBAUTORun
  • '%WINDIR%\syswow64\net.exe' stop VMnetDHCP
  • '%WINDIR%\syswow64\net.exe' stop MSExchangeCompliance
  • '%WINDIR%\syswow64\net.exe' stop DellDRLogSvc
  • '%WINDIR%\syswow64\net.exe' stop mysqltransport
  • '%WINDIR%\syswow64\net.exe' stop MSExchangeAntispamUpdate
  • '%WINDIR%\syswow64\net.exe' stop "Synology Drive VSS Service x64"
  • '%WINDIR%\syswow64\net.exe' stop WebAttendServer
  • '%WINDIR%\syswow64\net.exe' stop MSExchangeADTopology
  • '%WINDIR%\syswow64\net.exe' stop Apache2.2
  • '%WINDIR%\syswow64\net.exe' stop wanxiao-monitor
  • '%WINDIR%\syswow64\net.exe' stop MSComplianceAudit
  • '%WINDIR%\syswow64\net.exe' stop XenSvc
  • '%WINDIR%\syswow64\net.exe' stop VMAuthdService
  • '%WINDIR%\syswow64\net.exe' stop UFIDAWebService
  • '%WINDIR%\syswow64\net.exe' stop FirebirdGuardianDeafaultInstance
  • '%WINDIR%\syswow64\net.exe' stop xenlite
  • '%WINDIR%\syswow64\net.exe' stop Apache2.4
  • '%WINDIR%\syswow64\net.exe' stop Realtek11nSU
  • '%WINDIR%\syswow64\net.exe' stop TeamViewer8
  • '%WINDIR%\syswow64\net.exe' stop "memcached Server"
  • '%WINDIR%\syswow64\net.exe' stop "igfxCUIService2.0.0.0"
  • '%WINDIR%\syswow64\net.exe' stop VMwareHostd
  • '%WINDIR%\syswow64\net.exe' stop U8WorkerService2
  • '%WINDIR%\syswow64\net.exe' stop HaoZipSvc
  • '%WINDIR%\syswow64\taskkill.exe' /IM ThunderPlatform.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM pg_ctl.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM BackupExec.exe /F
  • '%WINDIR%\syswow64\net.exe' stop UIODetect
  • '%WINDIR%\syswow64\taskkill.exe' /IM sqlservr.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM VBoxSDS.exe /F
  • '%WINDIR%\syswow64\net.exe' stop VMUSBArbService
  • '%WINDIR%\syswow64\net.exe' stop CASWebServer
  • '%WINDIR%\syswow64\net.exe' stop MSExchangeIS
  • '%WINDIR%\syswow64\net.exe' stop "VMware NAT Service"
  • '%WINDIR%\syswow64\net.exe' stop TPlusStdAppService1300
  • '%WINDIR%\syswow64\net.exe' stop CASXMLService
  • '%WINDIR%\syswow64\net.exe' stop MSExchangeIMAP4BE
  • '%WINDIR%\syswow64\net.exe' stop VeeamTransportSvc
  • '%WINDIR%\syswow64\net.exe' stop "AliyunService"
  • '%WINDIR%\syswow64\net.exe' stop MSExchangeImap4
  • '%WINDIR%\syswow64\net.exe' stop VeeanBackupSvc
  • '%WINDIR%\syswow64\net.exe' stop "Alibaba Security Aegis Update Service"
  • '%WINDIR%\syswow64\net.exe' stop MSExchangeHMRecovery
  • '%WINDIR%\syswow64\net.exe' stop "Alibaba Security Aegis Detect Service"
  • '%WINDIR%\syswow64\net.exe' stop VeeamCatalogSvc
  • '%WINDIR%\syswow64\net.exe' stop MSSQL$SQL2008
  • '%WINDIR%\syswow64\net.exe' stop AutoUpdateService
  • '%WINDIR%\syswow64\net.exe' stop AdobeARMservice
  • '%WINDIR%\syswow64\net.exe' stop AGSService
  • '%WINDIR%\syswow64\net.exe' stop MSExchangeHM
  • '%WINDIR%\syswow64\net.exe' stop FirebirdServerDefaultInstance
  • '%WINDIR%\syswow64\net.exe' stop MSExchangeFrontEndTransport
  • '%WINDIR%\syswow64\net.exe' stop CASLicenceServer
  • '%WINDIR%\syswow64\net.exe' stop RapidRecoveryAgent
  • '%WINDIR%\syswow64\net.exe' stop MSExchangeFastSearch
  • '%WINDIR%\syswow64\net.exe' stop QPCore
  • '%WINDIR%\syswow64\net.exe' stop Service2
  • '%WINDIR%\syswow64\net.exe' stop MSExchangeEdgeSync
  • '%WINDIR%\syswow64\net.exe' stop TeamViewer
  • '%WINDIR%\syswow64\net.exe' stop JWService
  • '%WINDIR%\syswow64\net.exe' stop MSExchangeDiagnostics
  • '%WINDIR%\syswow64\net.exe' stop Tomcat8
  • '%WINDIR%\syswow64\net.exe' stop JWRinfoClientService
  • '%WINDIR%\syswow64\net.exe' stop MSExchangeDelivery
  • '%WINDIR%\syswow64\net.exe' stop MSExchangeDagMgmt
  • '%WINDIR%\syswow64\net.exe' stop IngressMgr
Modifies file system
Creates the following files
  • %TEMP%\killer.bat
  • %HOMEPATH%\recent\customdestinations\c312e260e424ae76.customdestinations-ms
  • %HOMEPATH%\recent\customdestinations\bf8efb871eda5262.customdestinations-ms
  • %HOMEPATH%\recent\customdestinations\969252ce11249fdd.customdestinations-ms
  • %HOMEPATH%\recent\customdestinations\9027fe24326910d2.customdestinations-ms
  • %HOMEPATH%\recent\customdestinations\7e4dca80246863e3.customdestinations-ms
  • %HOMEPATH%\recent\customdestinations\74d7f43c1561fc1e.customdestinations-ms
  • %HOMEPATH%\recent\customdestinations\5d696d521de238c3.customdestinations-ms
  • %HOMEPATH%\recent\customdestinations\5afe4de1b92fc382.customdestinations-ms
  • %HOMEPATH%\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms
  • %HOMEPATH%\recent\customdestinations\how to back your files.txt
  • %HOMEPATH%\recent\customdestinations\28c8b86deab549a1.customdestinations-ms
  • %HOMEPATH%\recent\customdestinations\10a2479c877ca098.customdestinations-ms
  • %HOMEPATH%\recent\how to back your files.txt
  • %HOMEPATH%\saved games\how to back your files.txt
  • %HOMEPATH%\searches\how to back your files.txt
  • %HOMEPATH%\sendto\how to back your files.txt
  • %HOMEPATH%\sendto\mail recipient.mapimail
  • %HOMEPATH%\sendto\desktop (create shortcut).desklink
  • %HOMEPATH%\sendto\compressed (zipped) folder.zfsendtotarget
  • %HOMEPATH%\start menu\programs\accessories\system tools\how to back your files.txt
  • %HOMEPATH%\recent\customdestinations\1b4dd67f29cb1962.customdestinations-ms
  • %HOMEPATH%\recent\automaticdestinations\1b4dd67f29cb1962.automaticdestinations-ms
  • %HOMEPATH%\recent\automaticdestinations\74d7f43c1561fc1e.automaticdestinations-ms
  • %HOMEPATH%\start menu\programs\accessories\accessibility\how to back your files.txt
  • %HOMEPATH%\local settings\thunderbird\profiles\wjj9aet2.default\cache2\entries\how to back your files.txt
  • %HOMEPATH%\local settings\thunderbird\profiles\wjj9aet2.default\cache2\how to back your files.txt
  • %HOMEPATH%\local settings\thunderbird\profiles\wjj9aet2.default\startupcache\how to back your files.txt
  • %HOMEPATH%\local settings\thunderbird\profiles\wjj9aet2.default\startupcache\startupcache.4.little
  • %HOMEPATH%\local settings\thunderbird\profiles\wjj9aet2.default\how to back your files.txt
  • %HOMEPATH%\local settings\thunderbird\profiles\wjj9aet2.default\_cache_clean_
  • %HOMEPATH%\local settings\thunderbird\profiles\how to back your files.txt
  • %HOMEPATH%\local settings\thunderbird\updates\8216c80c92c4e828\how to back your files.txt
  • %HOMEPATH%\local settings\thunderbird\updates\how to back your files.txt
  • %HOMEPATH%\local settings\thunderbird\how to back your files.txt
  • %HOMEPATH%\local settings\virtualstore\how to back your files.txt
  • %HOMEPATH%\local settings\how to back your files.txt
  • %HOMEPATH%\local settings\iconcache.db
  • %HOMEPATH%\local settings\gdipfontcachev1.dat
  • %HOMEPATH%\music\how to back your files.txt
  • %HOMEPATH%\my documents\how to back your files.txt
  • %HOMEPATH%\nethood\how to back your files.txt
  • %HOMEPATH%\pictures\how to back your files.txt
  • %HOMEPATH%\recent\automaticdestinations\how to back your files.txt
  • %HOMEPATH%\recent\automaticdestinations\7e4dca80246863e3.automaticdestinations-ms
  • %HOMEPATH%\printhood\how to back your files.txt
  • %HOMEPATH%\start menu\programs\accessories\how to back your files.txt
  • %HOMEPATH%\local settings\thunderbird\profiles\wjj9aet2.default\cache2\doomed\how to back your files.txt
  • %HOMEPATH%\start menu\programs\accessories\accessibility\.c4d1664ef40ce18f8d41
  • %HOMEPATH%\start menu\programs\administrative tools\how to back your files.txt
  • %HOMEPATH%\start menu\.c4d1664ef40ce18f8d41
  • %HOMEPATH%\templates\how to back your files.txt
  • %HOMEPATH%\templates\.c4d1664ef40ce18f8d41
  • %HOMEPATH%\videos\how to back your files.txt
  • %HOMEPATH%\videos\.c4d1664ef40ce18f8d41
  • %HOMEPATH%\voip\how to back your files.txt
  • %HOMEPATH%\voip\.c4d1664ef40ce18f8d41
  • %HOMEPATH%\how to back your files.txt
  • %HOMEPATH%\.c4d1664ef40ce18f8d41
  • %HOMEPATH%\start menu\how to back your files.txt
  • C:\users\how to back your files.txt
  • C:\how to back your files.txt
  • z:\system volume information\.c4d1664ef40ce18f8d41
  • C:\$recycle.bin\.c4d1664ef40ce18f8d41
  • z:\.c4d1664ef40ce18f8d41
  • D:\.c4d1664ef40ce18f8d41
  • C:\.c4d1664ef40ce18f8d41
  • <Current directory>\ids.txt
  • %ALLUSERSPROFILE%\local\.c4d1664ef40ce18f8d41
  • %TEMP%\dvdjfzuwplxcnj.vbs
  • C:\users\.c4d1664ef40ce18f8d41
  • %HOMEPATH%\start menu\programs\.c4d1664ef40ce18f8d41
  • %HOMEPATH%\start menu\programs\how to back your files.txt
  • %HOMEPATH%\start menu\programs\winrar\.c4d1664ef40ce18f8d41
  • %HOMEPATH%\start menu\programs\administrative tools\.c4d1664ef40ce18f8d41
  • %HOMEPATH%\start menu\programs\hjkdfs\how to back your files.txt
  • %HOMEPATH%\start menu\programs\hjkdfs\lgfkkiubsdh.exe
  • %HOMEPATH%\start menu\programs\hjkdfs\.c4d1664ef40ce18f8d41
  • %HOMEPATH%\start menu\programs\icq\how to back your files.txt
  • %HOMEPATH%\start menu\programs\icq\.c4d1664ef40ce18f8d41
  • %HOMEPATH%\start menu\programs\mail.ru\how to back your files.txt
  • %HOMEPATH%\start menu\programs\mail.ru\.c4d1664ef40ce18f8d41
  • %HOMEPATH%\start menu\programs\maintenance\how to back your files.txt
  • %HOMEPATH%\start menu\programs\maintenance\.c4d1664ef40ce18f8d41
  • C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\how to back your files.txt
  • %HOMEPATH%\start menu\programs\telegram desktop\how to back your files.txt
  • C:\$recycle.bin\how to back your files.txt
  • C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\.c4d1664ef40ce18f8d41
  • D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\.c4d1664ef40ce18f8d41
  • %HOMEPATH%\start menu\programs\telegram desktop\.c4d1664ef40ce18f8d41
  • %HOMEPATH%\start menu\programs\total commander\how to back your files.txt
  • D:\system volume information\.c4d1664ef40ce18f8d41
  • D:\$recycle.bin\.c4d1664ef40ce18f8d41
  • %HOMEPATH%\start menu\programs\total commander\.c4d1664ef40ce18f8d41
  • %HOMEPATH%\start menu\programs\winrar\how to back your files.txt
  • %HOMEPATH%\start menu\programs\accessories\.c4d1664ef40ce18f8d41
  • %HOMEPATH%\local settings\thunderbird\profiles\wjj9aet2.default\cache\_cache_001_
Sets the 'hidden' attribute to the following files
  • %ALLUSERSPROFILE%\local\.c4d1664ef40ce18f8d41
  • %HOMEPATH%\start menu\programs\administrative tools\.c4d1664ef40ce18f8d41
  • %HOMEPATH%\start menu\programs\hjkdfs\.c4d1664ef40ce18f8d41
  • %HOMEPATH%\start menu\programs\icq\.c4d1664ef40ce18f8d41
  • %HOMEPATH%\start menu\programs\mail.ru\.c4d1664ef40ce18f8d41
  • %HOMEPATH%\start menu\programs\maintenance\.c4d1664ef40ce18f8d41
  • %HOMEPATH%\start menu\programs\startup\.c4d1664ef40ce18f8d41
  • C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\.c4d1664ef40ce18f8d41
  • D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\.c4d1664ef40ce18f8d41
  • %HOMEPATH%\start menu\programs\telegram desktop\.c4d1664ef40ce18f8d41
  • <Drive name for removable media>:\.c4d1664ef40ce18f8d41
  • D:\system volume information\.c4d1664ef40ce18f8d41
  • D:\$recycle.bin\.c4d1664ef40ce18f8d41
  • %HOMEPATH%\start menu\programs\accessories\.c4d1664ef40ce18f8d41
  • %HOMEPATH%\start menu\programs\total commander\.c4d1664ef40ce18f8d41
  • %HOMEPATH%\start menu\programs\.c4d1664ef40ce18f8d41
  • %HOMEPATH%\start menu\.c4d1664ef40ce18f8d41
  • %HOMEPATH%\templates\.c4d1664ef40ce18f8d41
  • %HOMEPATH%\videos\.c4d1664ef40ce18f8d41
  • %HOMEPATH%\voip\.c4d1664ef40ce18f8d41
  • %HOMEPATH%\.c4d1664ef40ce18f8d41
  • C:\users\.c4d1664ef40ce18f8d41
  • z:\system volume information\.c4d1664ef40ce18f8d41
  • D:\.c4d1664ef40ce18f8d41
  • C:\$recycle.bin\.c4d1664ef40ce18f8d41
  • z:\.c4d1664ef40ce18f8d41
  • C:\.c4d1664ef40ce18f8d41
  • %HOMEPATH%\start menu\programs\winrar\.c4d1664ef40ce18f8d41
  • %HOMEPATH%\start menu\programs\accessories\accessibility\.c4d1664ef40ce18f8d41
Moves the following files
  • from %HOMEPATH%\start menu\programs\hjkdfs\lgfkkiubsdh.exe to %HOMEPATH%\start menu\programs\hjkdfs\lgfkkiubsdh.exe.globeimposter-alpha865qqz
  • from %HOMEPATH%\local settings\gdipfontcachev1.dat to %HOMEPATH%\local settings\gdipfontcachev1.dat.globeimposter-alpha865qqz
  • from %HOMEPATH%\recent\automaticdestinations\7e4dca80246863e3.automaticdestinations-ms to %HOMEPATH%\recent\automaticdestinations\7e4dca80246863e3.automaticdestinations-ms.globeimposter-alpha865qqz
  • from %HOMEPATH%\recent\automaticdestinations\74d7f43c1561fc1e.automaticdestinations-ms to %HOMEPATH%\recent\automaticdestinations\74d7f43c1561fc1e.automaticdestinations-ms.globeimposter-alpha865qqz
  • from %HOMEPATH%\recent\automaticdestinations\1b4dd67f29cb1962.automaticdestinations-ms to %HOMEPATH%\recent\automaticdestinations\1b4dd67f29cb1962.automaticdestinations-ms.globeimposter-alpha865qqz
  • from %HOMEPATH%\recent\customdestinations\c312e260e424ae76.customdestinations-ms to %HOMEPATH%\recent\customdestinations\c312e260e424ae76.customdestinations-ms.globeimposter-alpha865qqz
  • from %HOMEPATH%\recent\customdestinations\bf8efb871eda5262.customdestinations-ms to %HOMEPATH%\recent\customdestinations\bf8efb871eda5262.customdestinations-ms.globeimposter-alpha865qqz
  • from %HOMEPATH%\recent\customdestinations\969252ce11249fdd.customdestinations-ms to %HOMEPATH%\recent\customdestinations\969252ce11249fdd.customdestinations-ms.globeimposter-alpha865qqz
  • from %HOMEPATH%\recent\customdestinations\9027fe24326910d2.customdestinations-ms to %HOMEPATH%\recent\customdestinations\9027fe24326910d2.customdestinations-ms.globeimposter-alpha865qqz
  • from %HOMEPATH%\recent\customdestinations\7e4dca80246863e3.customdestinations-ms to %HOMEPATH%\recent\customdestinations\7e4dca80246863e3.customdestinations-ms.globeimposter-alpha865qqz
  • from %HOMEPATH%\recent\customdestinations\74d7f43c1561fc1e.customdestinations-ms to %HOMEPATH%\recent\customdestinations\74d7f43c1561fc1e.customdestinations-ms.globeimposter-alpha865qqz
  • from %HOMEPATH%\recent\customdestinations\5d696d521de238c3.customdestinations-ms to %HOMEPATH%\recent\customdestinations\5d696d521de238c3.customdestinations-ms.globeimposter-alpha865qqz
  • from %HOMEPATH%\recent\customdestinations\5afe4de1b92fc382.customdestinations-ms to %HOMEPATH%\recent\customdestinations\5afe4de1b92fc382.customdestinations-ms.globeimposter-alpha865qqz
  • from %HOMEPATH%\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms to %HOMEPATH%\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms.globeimposter-alpha865qqz
  • from %HOMEPATH%\recent\customdestinations\28c8b86deab549a1.customdestinations-ms to %HOMEPATH%\recent\customdestinations\28c8b86deab549a1.customdestinations-ms.globeimposter-alpha865qqz
  • from %HOMEPATH%\recent\customdestinations\1b4dd67f29cb1962.customdestinations-ms to %HOMEPATH%\recent\customdestinations\1b4dd67f29cb1962.customdestinations-ms.globeimposter-alpha865qqz
  • from %HOMEPATH%\recent\customdestinations\10a2479c877ca098.customdestinations-ms to %HOMEPATH%\recent\customdestinations\10a2479c877ca098.customdestinations-ms.globeimposter-alpha865qqz
  • from %HOMEPATH%\sendto\mail recipient.mapimail to %HOMEPATH%\sendto\mail recipient.mapimail.globeimposter-alpha865qqz
  • from %HOMEPATH%\sendto\desktop (create shortcut).desklink to %HOMEPATH%\sendto\desktop (create shortcut).desklink.globeimposter-alpha865qqz
  • from %HOMEPATH%\sendto\compressed (zipped) folder.zfsendtotarget to %HOMEPATH%\sendto\compressed (zipped) folder.zfsendtotarget.globeimposter-alpha865qqz
  • from %HOMEPATH%\local settings\thunderbird\profiles\wjj9aet2.default\_cache_clean_ to %HOMEPATH%\local settings\thunderbird\profiles\wjj9aet2.default\_cache_clean_.globeimposter-alpha865qqz
  • from %HOMEPATH%\local settings\thunderbird\profiles\wjj9aet2.default\startupcache\startupcache.4.little to %HOMEPATH%\local settings\thunderbird\profiles\wjj9aet2.default\startupcache\startupcache.4.little.globeimposter-alpha865qqz
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Searches for the following windows
  • ClassName: '' WindowName: ''
Creates and executes the following
  • '%WINDIR%\syswow64\wscript.exe' "%TEMP%\Dvdjfzuwplxcnj.vbs"
  • '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\killer.bat" "' (with hidden window)
Executes the following
  • '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\killer.bat" "
  • '%WINDIR%\syswow64\sc.exe' delete GPSMysqld
  • '%WINDIR%\syswow64\net1.exe' stop VeeamDeploySvc
  • '%WINDIR%\syswow64\net1.exe' stop iNethinkSQLBackupSvc
  • '%WINDIR%\syswow64\net1.exe' stop MSExchangeNotificationsBroker
  • '%WINDIR%\syswow64\sc.exe' delete Mysoft.Autoupgrade.UpdateService
  • '%WINDIR%\syswow64\sc.exe' delete GPSTomcat6
  • '%WINDIR%\syswow64\net1.exe' stop VeeamNFSSvc
  • '%WINDIR%\syswow64\sc.exe' delete Mysoft.Autoupgrade.DispatchService
  • '%WINDIR%\syswow64\sc.exe' delete Mysoft.Config.WindowsService
  • '%WINDIR%\syswow64\sc.exe' delete GPSLoginSvr
  • '%WINDIR%\syswow64\net1.exe' stop MSExchangeMailboxReplication
  • '%WINDIR%\syswow64\cmd.exe' /c @echo off sc config browser sc config browser start=enabled vssadmin delete shadows /all /quiet sc stop vss sc config vss start=disabled sc stop MongoDB sc config MongoDB start=disabl...
  • '%WINDIR%\syswow64\net1.exe' stop TPlusStdWebService1300
  • '%WINDIR%\syswow64\sc.exe' delete ErpEnvSvc
  • '%WINDIR%\syswow64\sc.exe' delete GPSMediaSvr
  • '%WINDIR%\syswow64\net1.exe' stop TPlusStdUpgradeService1300
  • '%WINDIR%\syswow64\net1.exe' stop RapService
  • '%WINDIR%\syswow64\net1.exe' stop MSExchangeMailboxAssistants
  • '%WINDIR%\syswow64\net1.exe' stop DDNSService
  • '%WINDIR%\syswow64\sc.exe' delete Mysoft.Setup.InstallService
  • '%WINDIR%\syswow64\net1.exe' stop OracleDBConsoleilas
  • '%WINDIR%\syswow64\sc.exe' delete Mysoft.DataCenterService
  • '%WINDIR%\syswow64\net1.exe' stop MSExchangeRPC
  • '%WINDIR%\syswow64\sc.exe' delete BackupExecDeviceMediaService
  • '%WINDIR%\syswow64\net1.exe' stop VeeamDistributionSvc
  • '%WINDIR%\syswow64\sc.exe' delete edr_monitor
  • '%WINDIR%\syswow64\net1.exe' stop "OracleOraDb10g_homeliSQL*Plus"
  • '%WINDIR%\syswow64\net1.exe' stop MSExchangeRepl
  • '%WINDIR%\syswow64\sc.exe' delete MysoftUpdate
  • '%WINDIR%\syswow64\sc.exe' delete bedbg
  • '%WINDIR%\syswow64\sc.exe' delete TbossSystem
  • '%WINDIR%\syswow64\net1.exe' stop VeeamBrokerSvc
  • '%WINDIR%\syswow64\sc.exe' delete BackupExecAgentAccelerator
  • '%WINDIR%\syswow64\net1.exe' stop CASMsgSrv
  • '%WINDIR%\syswow64\net1.exe' stop MSExchangePOP3BE
  • '%WINDIR%\syswow64\net1.exe' stop VeeamMountSvc
  • '%WINDIR%\syswow64\sc.exe' delete Mysoft.SchedulingService
  • '%WINDIR%\syswow64\sc.exe' delete "Zabbix Agent"
  • '%WINDIR%\syswow64\net1.exe' stop CASVirtualDiskService
  • '%WINDIR%\syswow64\net1.exe' stop MSExchangePop3
  • '%WINDIR%\syswow64\net1.exe' stop VeeamCloudSvc
  • '%WINDIR%\syswow64\sc.exe' delete GPSFtpd
  • '%WINDIR%\syswow64\sc.exe' delete GPSGatewaySvr
  • '%WINDIR%\syswow64\sc.exe' delete CobianBackup10
  • '%WINDIR%\syswow64\net1.exe' stop VeeanBackupSvc
  • '%WINDIR%\syswow64\net1.exe' stop "Alibaba Security Aegis Update Service"
  • '%WINDIR%\syswow64\net1.exe' stop MSExchangeHMRecovery
  • '%WINDIR%\syswow64\sc.exe' delete RaAutoInstSrv_RT2870
  • '%WINDIR%\syswow64\sc.exe' delete OracleRemExecService
  • '%WINDIR%\syswow64\sc.exe' delete wampapache
  • '%WINDIR%\syswow64\net1.exe' stop VeeamCatalogSvc
  • '%WINDIR%\syswow64\net1.exe' stop "Alibaba Security Aegis Detect Service"
  • '%WINDIR%\syswow64\sc.exe' delete MSSEARCH
  • '%WINDIR%\syswow64\net1.exe' stop MSSQL$SQL2008
  • '%WINDIR%\syswow64\sc.exe' delete QQCertificateService
  • '%WINDIR%\syswow64\sc.exe' delete NFWebServer
  • '%WINDIR%\syswow64\sc.exe' delete "OSP Service"
  • '%WINDIR%\syswow64\net1.exe' stop AutoUpdateService
  • '%WINDIR%\syswow64\net1.exe' stop AdobeARMservice
  • '%WINDIR%\syswow64\net1.exe' stop MSExchangeHM
  • '%WINDIR%\syswow64\sc.exe' delete LPManager
  • '%WINDIR%\syswow64\sc.exe' delete vmware-converter-worker
  • '%WINDIR%\syswow64\sc.exe' delete MediatekRegistryWriter
  • '%WINDIR%\syswow64\net1.exe' stop MSExchangeIMAP4BE
  • '%WINDIR%\syswow64\net1.exe' stop TPlusStdTaskService1300
  • '%WINDIR%\syswow64\sc.exe' delete msftesql
  • '%WINDIR%\syswow64\net1.exe' stop AGSService
  • '%WINDIR%\syswow64\net1.exe' stop MSExchangeIS
  • '%WINDIR%\syswow64\sc.exe' delete semwebsrv
  • '%WINDIR%\syswow64\sc.exe' delete GPSDataProcSvr
  • '%WINDIR%\syswow64\sc.exe' delete SQLService
  • '%WINDIR%\syswow64\sc.exe' delete GPSStorageSvr
  • '%WINDIR%\syswow64\sc.exe' delete OracleDBConcoleorcl
  • '%WINDIR%\syswow64\net1.exe' stop TPlusStdAppService1300
  • '%WINDIR%\syswow64\sc.exe' delete OracleMTSRecoveryService
  • '%WINDIR%\syswow64\net1.exe' stop CASXMLService
  • '%WINDIR%\syswow64\sc.exe' delete CASLicenceServer
  • '%WINDIR%\syswow64\sc.exe' delete GPSDownSvr
  • '%WINDIR%\syswow64\sc.exe' delete "SyncBASE Service"
  • '%WINDIR%\syswow64\net1.exe' stop VeeamTransportSvc
  • '%WINDIR%\syswow64\net1.exe' stop "AliyunService"
  • '%WINDIR%\syswow64\net1.exe' stop MSExchangeImap4
  • '%WINDIR%\syswow64\sc.exe' delete SQLANYs_sem5
  • '%WINDIR%\syswow64\sc.exe' delete GPSUserSvr
  • '%WINDIR%\syswow64\sc.exe' delete GPSDaemon
  • '%WINDIR%\syswow64\sc.exe' delete abs_deployer
  • '%WINDIR%\syswow64\sc.exe' delete BackupExecRPCService
  • '%WINDIR%\syswow64\net1.exe' stop tmlisten
  • '%WINDIR%\syswow64\sc.exe' delete U8SCMPool
  • '%WINDIR%\syswow64\sc.exe' delete RTCASMCU
  • '%WINDIR%\syswow64\sc.exe' delete "U8MPool"
  • '%WINDIR%\syswow64\sc.exe' delete RtcSrv
  • '%WINDIR%\syswow64\net1.exe' stop SupportAssistAgent
  • '%WINDIR%\syswow64\sc.exe' delete U8KeyManagePool
  • '%WINDIR%\syswow64\sc.exe' delete OfficeUpdateService
  • '%WINDIR%\syswow64\net1.exe' stop "Dell Hardware Support"
  • '%WINDIR%\syswow64\sc.exe' delete TurboCRM70
  • '%WINDIR%\syswow64\sc.exe' delete U8GCService
  • '%WINDIR%\syswow64\sc.exe' delete U8EncryptService
  • '%WINDIR%\syswow64\sc.exe' delete "Daemon Service"
  • '%WINDIR%\syswow64\net1.exe' stop OMAILREPORT
  • '%WINDIR%\syswow64\sc.exe' delete U8EISService
  • '%WINDIR%\syswow64\sc.exe' delete "Nuo Update Monitor"
  • '%WINDIR%\syswow64\net1.exe' stop AutoUpdatePatchService
  • '%WINDIR%\syswow64\sc.exe' delete U8DispatchService
  • '%WINDIR%\syswow64\net1.exe' stop "NetVault Process Manager"
  • '%WINDIR%\syswow64\sc.exe' delete asComSvc
  • '%WINDIR%\syswow64\sc.exe' delete OpenFastAssist
  • '%WINDIR%\syswow64\net1.exe' stop K3MMainSuspendService
  • '%WINDIR%\syswow64\net1.exe' stop KugouService
  • '%WINDIR%\syswow64\net1.exe' stop RavService
  • '%WINDIR%\syswow64\net1.exe' stop "Apple Mobile Device Service"
  • '%WINDIR%\syswow64\net1.exe' stop "Bonjour Service"
  • '%WINDIR%\syswow64\net1.exe' stop U8SendMailAdmin
  • '%WINDIR%\syswow64\sc.exe' delete "U8WorkerService1"
  • '%WINDIR%\syswow64\sc.exe' delete UTUService
  • '%WINDIR%\syswow64\net1.exe' stop pcas
  • '%WINDIR%\syswow64\sc.exe' delete UFReportService
  • '%WINDIR%\syswow64\sc.exe' delete U8SLReportService
  • '%WINDIR%\syswow64\sc.exe' delete FTA
  • '%WINDIR%\syswow64\sc.exe' delete UFAllNet
  • '%WINDIR%\syswow64\sc.exe' delete MSCRMUnzipService
  • '%WINDIR%\syswow64\net1.exe' stop ceng_web_svc_d
  • '%WINDIR%\syswow64\sc.exe' delete "U8WebPool"
  • '%WINDIR%\syswow64\sc.exe' delete NscAuthService
  • '%WINDIR%\syswow64\sc.exe' delete U8TaskService
  • '%WINDIR%\syswow64\sc.exe' delete MASTER
  • '%WINDIR%\syswow64\net1.exe' stop KpService
  • '%WINDIR%\syswow64\sc.exe' delete MSCRMAsyncService$maintenance
  • '%WINDIR%\syswow64\net1.exe' stop ImtsEventSvr
  • '%WINDIR%\syswow64\net1.exe' stop MySQL5_OA
  • '%WINDIR%\syswow64\sc.exe' delete "Rpc Monitor"
  • '%WINDIR%\syswow64\sc.exe' delete "U8WorkerService2"
  • '%WINDIR%\syswow64\sc.exe' delete MDM
  • '%WINDIR%\syswow64\net1.exe' stop TPlusStdTaskService1220
  • '%WINDIR%\syswow64\net1.exe' stop MSExchangeThrottling
  • '%WINDIR%\syswow64\sc.exe' delete CloudExchangeService
  • '%WINDIR%\syswow64\net1.exe' stop 360EntPGSvc
  • '%WINDIR%\syswow64\sc.exe' delete BackupExecManagementService
  • '%WINDIR%\syswow64\sc.exe' delete TxQBService
  • '%WINDIR%\syswow64\sc.exe' delete ShareBoxService
  • '%WINDIR%\syswow64\net1.exe' stop MSExchangeSubmission
  • '%WINDIR%\syswow64\sc.exe' delete BackupExecJobEngine
  • '%WINDIR%\syswow64\net1.exe' stop ServiceMid
  • '%WINDIR%\syswow64\sc.exe' delete ShareBoxMonitorService
  • '%WINDIR%\syswow64\sc.exe' delete BackupExecAgentBrowser
  • '%WINDIR%\syswow64\net1.exe' stop MySQL
  • '%WINDIR%\syswow64\net1.exe' stop MSExchangeServiceHost
  • '%WINDIR%\syswow64\sc.exe' delete savsvc
  • '%WINDIR%\syswow64\net1.exe' stop TPlusStdAppService1220
  • '%WINDIR%\syswow64\net1.exe' stop MSExchangeTransport
  • '%WINDIR%\syswow64\net1.exe' stop ClickToRunSvc
  • '%WINDIR%\syswow64\net1.exe' stop TPlusStdUpgradeService1220
  • '%WINDIR%\syswow64\net1.exe' stop NFLicenceServer
  • '%WINDIR%\syswow64\net1.exe' stop MSExchangeUM
  • '%WINDIR%\syswow64\sc.exe' delete OfficeClearCache
  • '%WINDIR%\syswow64\sc.exe' delete "EasyFZS Server"
  • '%WINDIR%\syswow64\net1.exe' stop DDVRulesProcessor
  • '%WINDIR%\syswow64\net1.exe' stop MSExchangeUMCR
  • '%WINDIR%\syswow64\sc.exe' delete U8SmsSrv
  • '%WINDIR%\syswow64\net1.exe' stop d_safe
  • '%WINDIR%\syswow64\sc.exe' delete Serv-U
  • '%WINDIR%\syswow64\net1.exe' stop "FileZilla Server"
  • '%WINDIR%\syswow64\sc.exe' delete YunService
  • '%WINDIR%\syswow64\sc.exe' delete CIS
  • '%WINDIR%\syswow64\net1.exe' stop AngelOfDeath
  • '%WINDIR%\syswow64\sc.exe' delete KICkSvr
  • '%WINDIR%\syswow64\sc.exe' delete RemoteAssistService
  • '%WINDIR%\syswow64\net1.exe' stop K3MobileServiceManage
  • '%WINDIR%\syswow64\net1.exe' stop MSExchangeTransportLogSearch
  • '%WINDIR%\syswow64\sc.exe' delete EASService
  • '%WINDIR%\syswow64\net1.exe' stop RavTask
  • '%WINDIR%\syswow64\sc.exe' delete Gailun_Downloader
  • '%WINDIR%\syswow64\sc.exe' delete 360EntClientSvc
  • '%WINDIR%\syswow64\net1.exe' stop "ABBYY.Licensing.FineReader.Professional.12.0"
  • '%WINDIR%\syswow64\sc.exe' delete "FontCache3.0.0.0"
  • '%WINDIR%\syswow64\sc.exe' delete vmware-converter-server
  • '%WINDIR%\syswow64\sc.exe' delete ImeDictUpdateService
  • '%WINDIR%\syswow64\sc.exe' delete VMTools
  • '%WINDIR%\syswow64\net1.exe' stop Realtek11nSU
  • '%WINDIR%\syswow64\net1.exe' stop TeamViewer8
  • '%WINDIR%\syswow64\sc.exe' delete RTCDATAMCU
  • '%WINDIR%\syswow64\sc.exe' delete "ZTE USBIP Client Guard"
  • '%WINDIR%\syswow64\sc.exe' delete WebAttendServer
  • '%WINDIR%\syswow64\net1.exe' stop "memcached Server"
  • '%WINDIR%\syswow64\sc.exe' delete UIODetect
  • '%WINDIR%\syswow64\sc.exe' delete JhTask
  • '%WINDIR%\syswow64\sc.exe' delete RTCIMMCU
  • '%WINDIR%\syswow64\sc.exe' delete ftusbrdsrv
  • '%WINDIR%\syswow64\sc.exe' delete TCPIDDAService
  • '%WINDIR%\syswow64\net1.exe' stop "igfxCUIService2.0.0.0"
  • '%WINDIR%\syswow64\net1.exe' stop VMwareHostd
  • '%WINDIR%\syswow64\sc.exe' delete QcSoftService
  • '%WINDIR%\syswow64\net1.exe' stop U8WorkerService2
  • '%WINDIR%\syswow64\sc.exe' delete RTCMEETINGMCU
  • '%WINDIR%\syswow64\sc.exe' delete MSSQLServerOLAPService
  • '%WINDIR%\syswow64\sc.exe' delete MCService
  • '%WINDIR%\syswow64\sc.exe' delete SPAdminV4
  • '%WINDIR%\syswow64\net1.exe' stop Apache2.4
  • '%WINDIR%\syswow64\sc.exe' delete qemu-ga
  • '%WINDIR%\syswow64\sc.exe' delete VMUSBArbService
  • '%WINDIR%\syswow64\sc.exe' delete TeamViewer
  • '%WINDIR%\syswow64\net1.exe' stop XenSvc
  • '%WINDIR%\syswow64\net1.exe' stop VMAuthdService
  • '%WINDIR%\syswow64\sc.exe' delete ProjectQueueService16
  • '%WINDIR%\syswow64\sc.exe' delete wwbizsrv
  • '%WINDIR%\syswow64\sc.exe' delete VMAuthdService
  • '%WINDIR%\syswow64\sc.exe' delete ftusbrdwks
  • '%WINDIR%\syswow64\net1.exe' stop UFIDAWebService
  • '%WINDIR%\syswow64\sc.exe' delete MSDTC
  • '%WINDIR%\syswow64\sc.exe' delete ProjectEventService16
  • '%WINDIR%\syswow64\sc.exe' delete "ZTE FileTranS"
  • '%WINDIR%\syswow64\sc.exe' delete "wanxiao-monitor"
  • '%WINDIR%\syswow64\net1.exe' stop xenlite
  • '%WINDIR%\syswow64\net1.exe' stop VMUSBArbService
  • '%WINDIR%\syswow64\sc.exe' delete XT800Service_Personal
  • '%WINDIR%\syswow64\sc.exe' delete VGAuthService
  • '%WINDIR%\syswow64\sc.exe' delete "ZTE USBIP Client"
  • '%WINDIR%\syswow64\sc.exe' delete RTCCDR
  • '%WINDIR%\syswow64\sc.exe' delete K3MobileService
  • '%WINDIR%\syswow64\sc.exe' delete SQLSERVERAGENT
  • '%WINDIR%\syswow64\net1.exe' stop U8WorkerService1
  • '%WINDIR%\syswow64\sc.exe' delete "UWS LoPriv Services"
  • '%WINDIR%\syswow64\sc.exe' delete MSCRMAsyncService
  • '%WINDIR%\syswow64\sc.exe' delete "DAService_TCP"
  • '%WINDIR%\syswow64\sc.exe' delete "XT800Service_Personal"
  • '%WINDIR%\syswow64\cmd.exe' /c "color e & @taskkill /IM VBoxSDS.exe /F & @taskkill /IM mysqld.exe /F & @taskkill /IM TeamViewer_Service.exe /F & @taskkill /IM TeamViewer.exe /F & @taskkill /IM CasLicenceServer.exe /F & @t...
  • '%WINDIR%\syswow64\cmd.exe' /c "color e & @taskkill /IM BackupExec.exe /F & @taskkill /IM Att.exe /F & @taskkill /IM mdm.exe /F & @taskkill /IM BackupExecManagementService.exe /F & @taskkill /IM bengine.exe /F & @taskkill...
  • '%WINDIR%\syswow64\cmd.exe' /c "color e & @taskkill /IM pg_ctl.exe /F & @taskkill /IM rcrelay.exe /F & @taskkill /IM SogouImeBroker.exe /F & @taskkill /IM CCenter.exe /F & @taskkill /IM ScanFrm.exe /F & @taskkill /IM d_ma...
  • '%WINDIR%\syswow64\net1.exe' stop UIODetect
  • '%WINDIR%\syswow64\cmd.exe' /c "color e & @taskkill /IM ThunderPlatform.exe /F & @taskkill /IM iexplore.exe /F & @taskkill /IM vm-agent.exe /F & @taskkill /IM vm-agent-daemon.exe /F & @taskkill /IM eSightService.exe /F & ...
  • '%WINDIR%\syswow64\cmd.exe' /c "color a & @net stop UIODetect & @net stop VMwareHostd & @net stop TeamViewer8 & @net stop VMUSBArbService & @net stop VMAuthdService & @net stop wanxiao-monitor & @net stop WebAttendServer ...
  • '%WINDIR%\syswow64\cmd.exe' /c "color a & @net stop HaoZipSvc & @net stop "igfxCUIService2.0.0.0" & @net stop Realtek11nSU & @net stop xenlite & @net stop XenSvc & @net stop Apache2.2 & @net stop "Synology Drive VSS Servi...
  • '%WINDIR%\syswow64\cmd.exe' /c "color a & @net stop U8WorkerService1 & @net stop U8WorkerService2 & @net stop "memcached Server" & @net stop Apache2.4 & @net stop UFIDAWebService & @net stop MSComplianceAudit & @net stop ...
  • '%WINDIR%\syswow64\cmd.exe' /c "@color b & sc delete MSCRMAsyncService & @sc delete REPLICA & @sc delete RTCATS & @sc delete RTCAVMCU & @sc delete RtcQms & @sc delete RTCMEETINGMCU & @sc delete RTCIMMCU & @sc delete RTCDA...
  • '%WINDIR%\syswow64\cmd.exe' /c "color b & @sc delete "UWS LoPriv Services" & @sc delete ftnlsv3 & @sc delete ftnlses3 & @sc delete FxService & @sc delete "UtilDev Web Server Pro" & @sc delete ftusbrdwks & @sc delete ftusb...
  • '%WINDIR%\syswow64\cmd.exe' /c "color b & @sc delete OracleOraDb11g_home1ClrAgent & @sc delete OracleOraDb11g_home1TNSListener & @sc delete OracleVssWriterORCL & @sc delete OracleServiceORCL & @sc delete aspnet_state @sc ...
  • '%WINDIR%\syswow64\cmd.exe' /c "color b & @sc delete "DAService_TCP" & @sc delete "eCard-TTransServer" & @sc delete eCardMPService & @sc delete EnergyDataService & @sc delete UI0Detect & @sc delete K3MobileService & @sc d...
  • '%WINDIR%\syswow64\cmd.exe' /c "color b & @sc delete "XT800Service_Personal" & @sc delete SQLSERVERAGENT & @sc delete SQLWriter & @sc delete SQLBrowser & @sc delete MSSQLFDLauncher & @sc delete MSSQLSERVER & @sc delete Qc...
  • '%WINDIR%\syswow64\cmd.exe' /c "color e & @taskkill /IM sqlservr.exe /F & @taskkill /IM httpd.exe /F & @taskkill /IM java.exe /F & @taskkill /IM fdhost.exe /F & @taskkill /IM fdlauncher.exe /F & @taskkill /IM reportingser...
  • '%WINDIR%\syswow64\sc.exe' delete SQLBrowser
  • '%WINDIR%\syswow64\sc.exe' delete MSSQLSERVER
  • '%WINDIR%\syswow64\sc.exe' delete OracleOraDb11g_home1ClrAgent
  • '%WINDIR%\syswow64\sc.exe' delete "UtilDev Web Server Pro"
  • '%WINDIR%\syswow64\sc.exe' delete RtcQms
  • '%WINDIR%\syswow64\sc.exe' delete UI0Detect
  • '%WINDIR%\syswow64\sc.exe' delete OracleServiceORCL
  • '%WINDIR%\syswow64\sc.exe' delete MSSQLFDLauncher
  • '%WINDIR%\syswow64\sc.exe' delete FxService
  • '%WINDIR%\syswow64\sc.exe' delete RTCAVMCU
  • '%WINDIR%\syswow64\sc.exe' delete EnergyDataService
  • '%WINDIR%\syswow64\sc.exe' delete aspnet_state @sc delete Redis
  • '%WINDIR%\syswow64\sc.exe' delete OracleVssWriterORCL
  • '%WINDIR%\syswow64\sc.exe' delete ftnlses3
  • '%WINDIR%\syswow64\sc.exe' delete RTCATS
  • '%WINDIR%\syswow64\sc.exe' delete eCardMPService
  • '%WINDIR%\syswow64\sc.exe' delete OracleOraDb11g_home1TNSListener
  • '%WINDIR%\syswow64\sc.exe' delete SQLWriter
  • '%WINDIR%\syswow64\sc.exe' delete ftnlsv3
  • '%WINDIR%\syswow64\sc.exe' delete REPLICA
  • '%WINDIR%\syswow64\sc.exe' delete "eCard-TTransServer"
  • '%WINDIR%\syswow64\net1.exe' stop HaoZipSvc
  • '%WINDIR%\syswow64\net1.exe' stop MSComplianceAudit
  • '%WINDIR%\syswow64\sc.exe' delete ReportServer
  • '%WINDIR%\syswow64\net1.exe' stop wanxiao-monitor
  • '%WINDIR%\syswow64\net1.exe' stop MSExchangeEdgeSync
  • '%WINDIR%\syswow64\sc.exe' delete TPlusStdUpgradeService1300
  • '%WINDIR%\syswow64\sc.exe' delete MotionBoardRCService57
  • '%WINDIR%\syswow64\sc.exe' delete btPanel
  • '%WINDIR%\syswow64\sc.exe' delete MSMQ
  • '%WINDIR%\syswow64\sc.exe' delete TPlusStdTaskService1300
  • '%WINDIR%\syswow64\net1.exe' stop TeamViewer
  • '%WINDIR%\syswow64\net1.exe' stop JWService
  • '%WINDIR%\syswow64\sc.exe' delete MSSQL$SQL2008
  • '%WINDIR%\syswow64\net1.exe' stop MSExchangeDiagnostics
  • '%WINDIR%\syswow64\sc.exe' delete KMSELDI
  • '%WINDIR%\syswow64\sc.exe' delete SQLTELEMETRY
  • '%WINDIR%\syswow64\sc.exe' delete SQLAgent$SQL2008
  • '%WINDIR%\syswow64\sc.exe' delete ADWS
  • '%WINDIR%\syswow64\sc.exe' delete KuaiYunTools
  • '%WINDIR%\syswow64\sc.exe' delete secbizsrv
  • '%WINDIR%\syswow64\net1.exe' stop Tomcat8
  • '%WINDIR%\syswow64\net1.exe' stop JWRinfoClientService
  • '%WINDIR%\syswow64\sc.exe' delete MotionBoard57
  • '%WINDIR%\syswow64\net1.exe' stop MSExchangeDelivery
  • '%WINDIR%\syswow64\net1.exe' stop Service2
  • '%WINDIR%\syswow64\net1.exe' stop CASLicenceServer
  • '%WINDIR%\syswow64\sc.exe' delete 360EntSvc
  • '%WINDIR%\syswow64\net1.exe' stop CASWebServer
  • '%WINDIR%\syswow64\net1.exe' stop FirebirdServerDefaultInstance
  • '%WINDIR%\syswow64\net1.exe' stop MSExchangeFrontEndTransport
  • '%WINDIR%\syswow64\sc.exe' delete LMS
  • '%WINDIR%\syswow64\sc.exe' delete "FlexNet Licensing Service 64"
  • '%WINDIR%\syswow64\sc.exe' delete vmware-converter-agent
  • '%WINDIR%\syswow64\sc.exe' delete 360EntHttpServer
  • '%WINDIR%\syswow64\sc.exe' delete smtpsvrJT
  • '%WINDIR%\syswow64\net1.exe' stop QPCore
  • '%WINDIR%\syswow64\net1.exe' stop RapidRecoveryAgent
  • '%WINDIR%\syswow64\net1.exe' stop MSExchangeFastSearch
  • '%WINDIR%\syswow64\sc.exe' delete VisualSVNServer
  • '%WINDIR%\syswow64\sc.exe' delete 2345PicSvc
  • '%WINDIR%\syswow64\sc.exe' delete zyb_sync
  • '%WINDIR%\syswow64\sc.exe' delete VirboxWebServer
  • '%WINDIR%\syswow64\sc.exe' delete vsvnjobsvc
  • '%WINDIR%\syswow64\sc.exe' delete Protect_2345Explorer
  • '%WINDIR%\syswow64\sc.exe' delete jhi_service
  • '%WINDIR%\syswow64\sc.exe' delete AppFabricCachingService
  • '%WINDIR%\syswow64\sc.exe' delete MsDtsServer100
  • '%WINDIR%\syswow64\sc.exe' delete Jenkins
  • '%WINDIR%\syswow64\sc.exe' delete kbasesrv
  • '%WINDIR%\syswow64\sc.exe' delete VmAgentDaemon
  • '%WINDIR%\syswow64\sc.exe' delete "Kiwi Syslog Server"
  • '%WINDIR%\syswow64\sc.exe' delete "AHS SERVICE"
  • '%WINDIR%\syswow64\net1.exe' stop "Synology Drive VSS Service x64"
  • '%WINDIR%\syswow64\net1.exe' stop WebAttendServer
  • '%WINDIR%\syswow64\sc.exe' delete SPTimerV4
  • '%WINDIR%\syswow64\net1.exe' stop MSExchangeAntispamUpdate
  • '%WINDIR%\syswow64\sc.exe' delete ZTEVdservice
  • '%WINDIR%\syswow64\net1.exe' stop MSExchangeADTopology
  • '%WINDIR%\syswow64\sc.exe' delete "Flash Helper Service"
  • '%WINDIR%\syswow64\sc.exe' delete RabbitMQ
  • '%WINDIR%\syswow64\sc.exe' delete SPSearchHostController
  • '%WINDIR%\syswow64\sc.exe' delete AlibabaProtect
  • '%WINDIR%\syswow64\sc.exe' delete VMwareHostd
  • '%WINDIR%\syswow64\sc.exe' delete allpass_redisservice_port21160
  • '%WINDIR%\syswow64\net1.exe' stop Apache2.2
  • '%WINDIR%\syswow64\sc.exe' delete "vm-agent"
  • '%WINDIR%\syswow64\sc.exe' delete "Sense Shield Service"
  • '%WINDIR%\syswow64\sc.exe' delete SPTraceV4
  • '%WINDIR%\syswow64\net1.exe' stop mysqltransport
  • '%WINDIR%\syswow64\sc.exe' delete TPlusStdAppService1300
  • '%WINDIR%\syswow64\sc.exe' delete OracleJobSchedulerORCL
  • '%WINDIR%\syswow64\net1.exe' stop "VMware NAT Service"
  • '%WINDIR%\syswow64\net1.exe' stop JWEM3DBAUTORun
  • '%WINDIR%\syswow64\net1.exe' stop MSExchangeDagMgmt
  • '%WINDIR%\syswow64\sc.exe' delete c2wts
  • '%WINDIR%\syswow64\sc.exe' delete IpOverUsbSvc
  • '%WINDIR%\syswow64\sc.exe' delete apachezt
  • '%WINDIR%\syswow64\sc.exe' delete SSSyncService
  • '%WINDIR%\syswow64\sc.exe' delete ProjectCalcService16
  • '%WINDIR%\syswow64\sc.exe' delete eSightService
  • '%WINDIR%\syswow64\net1.exe' stop DellDRLogSvc
  • '%WINDIR%\syswow64\net1.exe' stop VMnetDHCP
  • '%WINDIR%\syswow64\net1.exe' stop FirebirdGuardianDeafaultInstance
  • '%WINDIR%\syswow64\net1.exe' stop MSExchangeCompliance
  • '%WINDIR%\syswow64\sc.exe' delete SSMonitorService
  • '%WINDIR%\syswow64\sc.exe' delete OSearch16
  • '%WINDIR%\syswow64\sc.exe' delete MMRHookService
  • '%WINDIR%\syswow64\sc.exe' delete OpenSSHd
  • '%WINDIR%\syswow64\sc.exe' delete "UWS HiPriv Services"
  • '%WINDIR%\syswow64\sc.exe' delete BestSyncSvc
  • '%WINDIR%\syswow64\net1.exe' stop DFServ

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android

The Russian developer of Dr.Web anti-viruses
Doctor Web has been developing anti-virus software since 1992
Dr.Web is trusted by users around the world in 200+ countries
The company has delivered an anti-virus as a service since 2007
24/7 tech support

Dr.Web © Doctor Web
2003 — 2020

Doctor Web is the Russian developer of Dr.Web anti-virus software. Dr.Web anti-virus software has been developed since 1992.

2-12А, 3rd street Yamskogo polya, Moscow, Russia, 125124