Added to the Dr.Web virus database:
Virus description added:
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'ldp' = '"%APPDATA%\Install\DM6LcnBluRTrGreeNW.com" -launch'
Creates the following files on removable media
- <Drive name for removable media>:\ghost.bat
Modifies file system
Creates the following files
Searches for the following windows
- ClassName: 'MS_WINHELP' WindowName: ''
Creates and executes the following
- '%APPDATA%\drsp\wincmd.exe' -reboot
- '%APPDATA%\install\dm6lcnblurtrgreenw.com' -launch
- '%APPDATA%\drsp\wincmd.exe' -spread
Attempts to shut down the Windows operating system.
© Doctor Web
2003 — 2023
Doctor Web is a cybersecurity company focused on threat detection, prevention and response technologies
Dr.Web for Android
Free three-month trial
All protection features available
Renew your trial license in
AppGallery/on Google Pay