Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Trojan.Encoder.38643

Added to the Dr.Web virus database: 2024-02-20

Virus description added:

Technical Information

To ensure autorun and distribution
Creates or modifies the following files
  • %APPDATA%\microsoft\windows\start menu\programs\startup\decrypt-files.txt
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Modifies file system
Creates the following files
  • %ALLUSERSPROFILE%\data1.tmp
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\decrypt-files.txt
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\decrypt-files.txt
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\decrypt-files.txt
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\extensions\decrypt-files.txt
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\decrypt-files.txt
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\decrypt-files.txt
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\minidumps\decrypt-files.txt
  • %APPDATA%\microsoft\windows\start menu\programs\telegram desktop\decrypt-files.txt
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\decrypt-files.txt
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\decrypt-files.txt
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\decrypt-files.txt
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\decrypt-files.txt
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\decrypt-files.txt
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\idb\decrypt-files.txt
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.fil...
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\decrypt-files.txt
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\decrypt-files.txt
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\bookmarkbackups\decrypt-files.txt
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\security_state\decrypt-files.txt
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\crashes\events\decrypt-files.txt
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\crashes\decrypt-files.txt
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\decrypt-files.txt
  • %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\decrypt-files.txt
  • %APPDATA%\microsoft\windows\start menu\decrypt-files.txt
  • %APPDATA%\microsoft\windows\start menu\programs\decrypt-files.txt
  • %APPDATA%\microsoft\windows\start menu\programs\accessories\decrypt-files.txt
  • %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\decrypt-files.txt
  • %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\decrypt-files.txt
  • %APPDATA%\microsoft\windows\start menu\programs\administrative tools\decrypt-files.txt
  • %APPDATA%\microsoft\windows\start menu\programs\google chrome\decrypt-files.txt
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\decrypt-files.txt
  • %APPDATA%\microsoft\windows\start menu\programs\maintenance\decrypt-files.txt
  • %APPDATA%\microsoft\windows\recent\automaticdestinations\decrypt-files.txt
  • %APPDATA%\microsoft\windows\start menu\programs\winrar\decrypt-files.txt
  • %APPDATA%\microsoft\windows\themes\decrypt-files.txt
  • %APPDATA%\mozilla\decrypt-files.txt
  • %APPDATA%\mozilla\extensions\decrypt-files.txt
  • %APPDATA%\mozilla\firefox\decrypt-files.txt
  • %APPDATA%\mozilla\firefox\crash reports\decrypt-files.txt
  • %APPDATA%\mozilla\firefox\crash reports\events\decrypt-files.txt
  • %APPDATA%\mozilla\firefox\pending pings\decrypt-files.txt
  • %APPDATA%\microsoft\windows\recent\customdestinations\decrypt-files.txt
  • %APPDATA%\mozilla\firefox\profiles\decrypt-files.txt
  • %APPDATA%\microsoft\windows\templates\decrypt-files.txt
  • %APPDATA%\microsoft\windows\sendto\decrypt-files.txt
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\decrypt-files.txt
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\decrypt-files.txt
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\decrypt-files.txt
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\temporary\decrypt-files.txt
  • %APPDATA%\thunderbird\profiles\hmz1jddi.default\decrypt-files.txt
  • %HOMEPATH%\contacts\decrypt-files.txt
  • %HOMEPATH%\desktop\decrypt-files.txt
  • %HOMEPATH%\documents\decrypt-files.txt
  • %HOMEPATH%\documents\my music\decrypt-files.txt
  • %HOMEPATH%\documents\my pictures\decrypt-files.txt
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\default\decrypt-files.txt
  • %HOMEPATH%\documents\my videos\decrypt-files.txt
  • %HOMEPATH%\favorites\decrypt-files.txt
  • %HOMEPATH%\favorites\links\decrypt-files.txt
  • %HOMEPATH%\favorites\links for united states\decrypt-files.txt
  • %HOMEPATH%\favorites\microsoft websites\decrypt-files.txt
  • %HOMEPATH%\favorites\msn websites\decrypt-files.txt
  • %HOMEPATH%\favorites\windows live\decrypt-files.txt
  • %HOMEPATH%\links\decrypt-files.txt
  • %HOMEPATH%\saved games\decrypt-files.txt
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\decrypt-files.txt
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\idb\decrypt-files.txt
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\decrypt-files.txt
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\decrypt-files.txt
  • C:\users\public\music\sample music\decrypt-files.txt
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\decrypt-files.txt
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\temporary\decrypt-files.txt
  • %APPDATA%\mozilla\systemextensionsdev\decrypt-files.txt
  • %APPDATA%\telegram desktop\decrypt-files.txt
  • %APPDATA%\thunderbird\decrypt-files.txt
  • %APPDATA%\thunderbird\crash reports\decrypt-files.txt
  • %APPDATA%\thunderbird\crash reports\events\decrypt-files.txt
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.files\decrypt-files.txt
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\decrypt-files.txt
  • %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\decrypt-files.txt
  • %APPDATA%\thunderbird\pending pings\decrypt-files.txt
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\crashes\events\decrypt-files.txt
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\decrypt-files.txt
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\decrypt-files.txt
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\decrypt-files.txt
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extensions\decrypt-files.txt
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\minidumps\decrypt-files.txt
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\decrypt-files.txt
  • %APPDATA%\thunderbird\profiles\decrypt-files.txt
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\decrypt-files.txt
  • %APPDATA%\thunderbird\profiles\chdgbv82.default-release\crashes\decrypt-files.txt
  • %APPDATA%\microsoft\windows\recent\decrypt-files.txt
  • %APPDATA%\microsoft\windows\privacie\low\decrypt-files.txt
  • %APPDATA%\microsoft\windows\privacie\decrypt-files.txt
  • C:\users\default\appdata\roaming\microsoft\windows\decrypt-files.txt
  • C:\users\default\appdata\roaming\microsoft\windows\cookies\decrypt-files.txt
  • C:\users\default\appdata\roaming\microsoft\windows\network shortcuts\decrypt-files.txt
  • C:\users\default\appdata\roaming\microsoft\windows\printer shortcuts\decrypt-files.txt
  • C:\users\default\appdata\roaming\microsoft\windows\recent\decrypt-files.txt
  • C:\users\default\appdata\roaming\microsoft\windows\sendto\decrypt-files.txt
  • C:\users\default\appdata\roaming\microsoft\windows\start menu\decrypt-files.txt
  • C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\decrypt-files.txt
  • C:\users\default\downloads\decrypt-files.txt
  • C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\decrypt-files.txt
  • C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools\decrypt-files.txt
  • C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\maintenance\decrypt-files.txt
  • C:\users\default\appdata\roaming\microsoft\windows\templates\decrypt-files.txt
  • C:\users\default\desktop\decrypt-files.txt
  • C:\users\default\documents\decrypt-files.txt
  • C:\users\default\documents\my music\decrypt-files.txt
  • C:\users\default\documents\my pictures\decrypt-files.txt
  • C:\users\default\appdata\roaming\microsoft\decrypt-files.txt
  • C:\users\default\appdata\roaming\media center programs\decrypt-files.txt
  • C:\users\default\appdata\roaming\microsoft\internet explorer\quick launch\decrypt-files.txt
  • C:\users\default\appdata\roaming\decrypt-files.txt
  • C:\users\default\appdata\decrypt-files.txt
  • C:\decrypt-files.txt
  • C:\$recycle.bin\decrypt-files.txt
  • C:\$recycle.bin\s-1-5-21-3150914307-1777937420-491476919-1000\decrypt-files.txt
  • D:\$recycle.bin\decrypt-files.txt
  • D:\$recycle.bin\s-1-5-21-3150914307-1777937420-491476919-1000\decrypt-files.txt
  • C:\documents and settings\decrypt-files.txt
  • C:\kms\decrypt-files.txt
  • C:\msocache\decrypt-files.txt
  • C:\users\default\documents\my videos\decrypt-files.txt
  • C:\perflogs\decrypt-files.txt
  • C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility\decrypt-files.txt
  • <Current directory>\decrypt-files.txt
  • %ProgramFiles%\microsoft sql server compact edition\decrypt-files.txt
  • %ProgramFiles%\microsoft sql server compact edition\v3.5\decrypt-files.txt
  • %ProgramFiles%\microsoft sql server compact edition\v3.5\desktop\decrypt-files.txt
  • %ProgramFiles(x86)%\decrypt-files.txt
  • C:\recovery\decrypt-files.txt
  • C:\recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\decrypt-files.txt
  • C:\users\default\decrypt-files.txt
  • C:\perflogs\admin\decrypt-files.txt
  • D:\decrypt-files.txt
  • %ProgramFiles%\decrypt-files.txt
  • C:\users\default\appdata\roaming\microsoft\internet explorer\decrypt-files.txt
  • C:\users\default\favorites\decrypt-files.txt
  • %APPDATA%\microsoft\crypto\rsa\decrypt-files.txt
  • %APPDATA%\microsoft\internet explorer\decrypt-files.txt
  • %APPDATA%\microsoft\internet explorer\quick launch\decrypt-files.txt
  • %APPDATA%\microsoft\internet explorer\quick launch\user pinned\decrypt-files.txt
  • %APPDATA%\microsoft\internet explorer\quick launch\user pinned\implicitappshortcuts\decrypt-files.txt
  • %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\decrypt-files.txt
  • %APPDATA%\microsoft\protect\decrypt-files.txt
  • %APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\decrypt-files.txt
  • %APPDATA%\microsoft\crypto\decrypt-files.txt
  • C:\users\default\links\decrypt-files.txt
  • %APPDATA%\microsoft\crypto\rsa\s-1-5-21-3150914307-1777937420-491476919-1000\decrypt-files.txt
  • %APPDATA%\microsoft\systemcertificates\decrypt-files.txt
  • %APPDATA%\microsoft\systemcertificates\my\ctls\decrypt-files.txt
  • %APPDATA%\microsoft\windows\decrypt-files.txt
  • %APPDATA%\microsoft\windows\iecompatcache\decrypt-files.txt
  • %APPDATA%\microsoft\windows\iecompatcache\low\decrypt-files.txt
  • %APPDATA%\microsoft\windows\libraries\decrypt-files.txt
  • %APPDATA%\microsoft\windows\network shortcuts\decrypt-files.txt
  • %APPDATA%\microsoft\windows\printer shortcuts\decrypt-files.txt
  • %APPDATA%\microsoft\systemcertificates\my\decrypt-files.txt
  • %APPDATA%\microsoft\systemcertificates\my\certificates\decrypt-files.txt
  • %APPDATA%\microsoft\systemcertificates\my\crls\decrypt-files.txt
  • %HOMEPATH%\downloads\decrypt-files.txt
  • %HOMEPATH%\searches\decrypt-files.txt
  • %APPDATA%\media center programs\decrypt-files.txt
  • C:\users\public\decrypt-files.txt
  • C:\users\public\desktop\decrypt-files.txt
  • C:\users\public\documents\decrypt-files.txt
  • C:\users\public\documents\my music\decrypt-files.txt
  • C:\users\public\documents\my pictures\decrypt-files.txt
  • C:\users\public\documents\my videos\decrypt-files.txt
  • C:\users\public\downloads\decrypt-files.txt
  • C:\users\public\favorites\decrypt-files.txt
  • %APPDATA%\microsoft\decrypt-files.txt
  • %APPDATA%\microsoft\credentials\decrypt-files.txt
  • C:\users\public\libraries\decrypt-files.txt
  • C:\users\public\recorded tv\decrypt-files.txt
  • C:\users\public\recorded tv\sample media\decrypt-files.txt
  • C:\users\public\videos\sample videos\decrypt-files.txt
  • %HOMEPATH%\decrypt-files.txt
  • %HOMEPATH%\appdata\decrypt-files.txt
  • %APPDATA%\decrypt-files.txt
  • %APPDATA%\identities\decrypt-files.txt
  • %APPDATA%\identities\{1bc91121-7903-48ee-bf78-1bc7ca4b5761}\decrypt-files.txt
  • C:\users\default\saved games\decrypt-files.txt
  • C:\users\public\pictures\sample pictures\decrypt-files.txt
  • %TEMP%\000.bmp
Moves the following files
  • from %APPDATA%\microsoft\crypto\rsa\s-1-5-21-3150914307-1777937420-491476919-1000\f58155b4b1d5a524ca0261c3ee99fb50_d99ef00b-ccd3-4f1d-9980-90ac453b0b47 to %APPDATA%\microsoft\crypto\rsa\s-1-5-21-3150914307-1777937420-491476919-1000\f58155b4b1d5a524ca0261c3ee99fb50_d99ef00b-ccd3-4f1d-9980-90ac453b0b47.exjfb
  • from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729926.199a0618-6d48-4205-858d-6b9a8ba9e913.first-shutdown.jsonlz4 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729926.199a0618-6d48-4205-858d-6b9a8ba9e913.first-shutdown.jsonlz4.w5bzf
  • from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729925.d8154144-ac52-40e8-b685-b640783b2c0d.main.jsonlz4 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729925.d8154144-ac52-40e8-b685-b640783b2c0d.main.jsonlz4.0sqs
  • from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729880.22a456d0-5d02-445b-9603-4fe4b9e5c45c.new-profile.jsonlz4 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729880.22a456d0-5d02-445b-9603-4fe4b9e5c45c.new-profile.jsonlz4.ldz7ss3
  • from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\crashes\store.json.mozlz4 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\crashes\store.json.mozlz4.hzqnv6
  • from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\cookies.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\cookies.sqlite.r1zprx
  • from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\compatibility.ini to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\compatibility.ini.r1zprx
  • from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\cert9.db to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\cert9.db.r1zprx
  • from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\blist.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\blist.sqlite.fqfjt
  • from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addonstartup.json.lz4 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addonstartup.json.lz4.pzasohg
  • from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addons.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addons.json.81r6n9p
  • from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\abook.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\abook.sqlite.ngnak
  • from %APPDATA%\thunderbird\crash reports\installtime20210406220621 to %APPDATA%\thunderbird\crash reports\installtime20210406220621.sbwr
  • from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\state.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\state.json.gbtoi
  • from %APPDATA%\telegram desktop\unins000.dat to %APPDATA%\telegram desktop\unins000.dat.otomw1m
  • from %APPDATA%\mozilla\firefox\profiles.ini to %APPDATA%\mozilla\firefox\profiles.ini.yhckfg
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\xulstore.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\xulstore.json.4vge4r
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\user.js to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\user.js.4vge4r
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\times.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\times.json.4vge4r
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.r6pp5
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.yby4ax
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite.yby4ax
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite.etlv
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite.etlv
  • from %APPDATA%\thunderbird\installs.ini to %APPDATA%\thunderbird\installs.ini.b1olg
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\2a211dea-1f81-457a-9f7c-a174126ff0dd to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\2a211dea-1f81-457a-9f7c-a174126ff0dd.ybzjyt1
  • from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\directorytree.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\directorytree.json.gbtoi
  • from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\xulstore.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\xulstore.json.cr4p
  • from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\webappsstore.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\webappsstore.sqlite.cr4p
  • from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\times.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\times.json.nxiwyn
  • from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage.sqlite.nxiwyn
  • from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.vqxbk
  • from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\.metadata-v2 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage\permanent\chrome\.metadata-v2.vqxbk
  • from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\sessioncheckpoints.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\sessioncheckpoints.json.p8io8
  • from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\search.json.mozlz4 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\search.json.mozlz4.p8io8
  • from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\d8154144-ac52-40e8-b685-b640783b2c0d to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\d8154144-ac52-40e8-b685-b640783b2c0d.ziwh
  • from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\22a456d0-5d02-445b-9603-4fe4b9e5c45c to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\22a456d0-5d02-445b-9603-4fe4b9e5c45c.ugxq
  • from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\199a0618-6d48-4205-858d-6b9a8ba9e913 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\199a0618-6d48-4205-858d-6b9a8ba9e913.ugxq
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.etlv
  • from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\session-state.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\session-state.json.w5bzf
  • from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\pkcs11.txt to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\pkcs11.txt.x5ishhq
  • from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\permissions.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\permissions.sqlite.x5ishhq
  • from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\openpgp.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\openpgp.sqlite.tw1v786
  • from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\mailviews.dat to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\mailviews.dat.worgfk
  • from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\key4.db to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\key4.db.worgfk
  • from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\history.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\history.sqlite.0mju
  • from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\global-messages-db.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\global-messages-db.sqlite.vvr2
  • from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\formhistory.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\formhistory.sqlite.qcb1a
  • from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\favicons.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\favicons.sqlite.nlasj
  • from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extensions.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extensions.json.3dppj3
  • from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extension-preferences.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extension-preferences.json.ui3tcxs
  • from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\places.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\places.sqlite.tcolvs
  • from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\enigmail.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\enigmail.sqlite.jjvj11
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\.metadata-v2 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\permanent\chrome\.metadata-v2.cyyu
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql... to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql...
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\.metadata-v2 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\.metadata-v2.yhqgonc
  • from %APPDATA%\microsoft\windows\themes\transcodedwallpaper.jpg to %APPDATA%\microsoft\windows\themes\transcodedwallpaper.jpg.q7gyi
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\crashes\store.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\crashes\store.json.mozlz4.qzq4a
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\containers.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\containers.json.nqoc
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\compatibility.ini to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\compatibility.ini.nqoc
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\broadcast-listeners.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\broadcast-listeners.json.nqoc
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\bookmarkbackups\bookmarks-2023-10-02_11_w-7ab47btxtewdh4a2yehg==.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\bookmarkbackups\bookmarks-2023-10-02_11_w-7ab47btxtewdh4a2yehg==.jsonlz4.nqoc
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\addonstartup.json.lz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\addonstartup.json.lz4.cjci0fn
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\addons.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\addons.json.cjci0fn
  • from %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\user.js to %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\user.js.plg3h7d
  • from %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\times.json to %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\times.json.z2o0j8
  • from %APPDATA%\mozilla\firefox\installs.ini to %APPDATA%\mozilla\firefox\installs.ini.un2xv
  • from %APPDATA%\thunderbird\profiles\hmz1jddi.default\times.json to %APPDATA%\thunderbird\profiles\hmz1jddi.default\times.json.bvjkj
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729047.dc35f7c9-5b80-4042-a301-e84d8619b27e.event.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729047.dc35f7c9-5b80-4042-a301-e84d8619b27e.event.jsonlz4.tqrnep7
  • from %APPDATA%\microsoft\windows\sendto\mail recipient.mapimail to %APPDATA%\microsoft\windows\sendto\mail recipient.mapimail.oxnqdw
  • from %APPDATA%\microsoft\windows\sendto\desktop (create shortcut).desklink to %APPDATA%\microsoft\windows\sendto\desktop (create shortcut).desklink.lqlsf
  • from %APPDATA%\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget to %APPDATA%\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget.ywyvz
  • from %APPDATA%\microsoft\windows\recent\automaticdestinations\1b4dd67f29cb1962.automaticdestinations-ms to %APPDATA%\microsoft\windows\recent\automaticdestinations\1b4dd67f29cb1962.automaticdestinations-ms.ywhzpyp
  • from %APPDATA%\microsoft\windows\libraries\videos.library-ms to %APPDATA%\microsoft\windows\libraries\videos.library-ms.jhhvu
  • from %APPDATA%\microsoft\windows\libraries\pictures.library-ms to %APPDATA%\microsoft\windows\libraries\pictures.library-ms.qnar
  • from %APPDATA%\microsoft\windows\libraries\music.library-ms to %APPDATA%\microsoft\windows\libraries\music.library-ms.qnar
  • from %APPDATA%\microsoft\windows\libraries\documents.library-ms to %APPDATA%\microsoft\windows\libraries\documents.library-ms.qnar
  • from %APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\preferred to %APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\preferred.kdjumvx
  • from %APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\51da22b7-9513-4885-adb9-cd2e72f47f0a to %APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\51da22b7-9513-4885-adb9-cd2e72f47f0a.kdjumvx
  • from %APPDATA%\microsoft\protect\credhist to %APPDATA%\microsoft\protect\credhist.tf02ys
  • from %APPDATA%\mozilla\firefox\crash reports\installtime20200708170202 to %APPDATA%\mozilla\firefox\crash reports\installtime20200708170202.un2xv
  • from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\prefs.js to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\prefs.js.ugxq
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729067.9cd37e15-817f-4044-81be-e43af1dfc595.main.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729067.9cd37e15-817f-4044-81be-e43af1dfc595.main.jsonlz4.tqrnep7
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\state.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\state.json.qzju
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729070.71d7d59d-5451-4f15-bb9e-420e88a3061f.first-shutdown.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729070.71d7d59d-5451-4f15-bb9e-420e88a3061f.first-shutdown.jsonlz4.qzju
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sitesecurityservicestate.txt to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sitesecurityservicestate.txt.yhqgonc
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\shield-preference-experiments.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\shield-preference-experiments.json.zvzmhfh
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\upgrade.jsonlz4-20200708170202 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\upgrade.jsonlz4-20200708170202.zvzmhfh
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\recovery.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\recovery.jsonlz4.zvzmhfh
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\recovery.baklz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\recovery.baklz4.zvzmhfh
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\previous.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessionstore-backups\previous.jsonlz4.r6fujl
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessioncheckpoints.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessioncheckpoints.json.jrukqi
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\security_state\data.safe.bin to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\security_state\data.safe.bin.tqmeu
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\search.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\search.json.mozlz4.gpzf
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\dc35f7c9-5b80-4042-a301-e84d8619b27e to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\dc35f7c9-5b80-4042-a301-e84d8619b27e.wku5
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\session-state.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\session-state.json.qzju
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\9cd37e15-817f-4044-81be-e43af1dfc595 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\9cd37e15-817f-4044-81be-e43af1dfc595.s17ymse
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729016.2a211dea-1f81-457a-9f7c-a174126ff0dd.new-profile.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729016.2a211dea-1f81-457a-9f7c-a174126ff0dd.new-profile.jsonlz4.dnkb
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\prefs.js to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\prefs.js.lnewslc
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\pluginreg.dat to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\pluginreg.dat.eo8odn
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\pkcs11.txt to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\pkcs11.txt.eo8odn
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\handlers.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\handlers.json.eo8odn
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll.sig to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll.sig.hyj4bd
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll.lib to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll.lib.mhaqn
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\manifest.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\manifest.json.mhaqn
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\license.txt to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\license.txt.mhaqn
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\extensions.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\extensions.json.mhaqn
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\extension-preferences.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\extension-preferences.json.fvrc
  • from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\71d7d59d-5451-4f15-bb9e-420e88a3061f to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\71d7d59d-5451-4f15-bb9e-420e88a3061f.s17ymse
  • from %APPDATA%\thunderbird\profiles.ini to %APPDATA%\thunderbird\profiles.ini.bvjkj
Modifies the following files
  • %APPDATA%\microsoft\protect\credhist
  • %APPDATA%\microsoft\crypto\rsa\s-1-5-21-3150914307-1777937420-491476919-1000\f58155b4b1d5a524ca0261c3ee99fb50_d99ef00b-ccd3-4f1d-9980-90ac453b0b47
  • C:\users\public\videos\sample videos\wildlife.wmv
  • C:\users\public\recorded tv\sample media\win7_scenic-demoshort_raw.wtv
  • C:\users\public\pictures\sample pictures\tulips.jpg
  • C:\users\public\pictures\sample pictures\penguins.jpg
  • C:\users\public\pictures\sample pictures\lighthouse.jpg
  • C:\users\public\pictures\sample pictures\koala.jpg
  • C:\users\public\pictures\sample pictures\jellyfish.jpg
  • C:\users\public\pictures\sample pictures\hydrangeas.jpg
  • C:\users\public\pictures\sample pictures\desert.jpg
  • C:\users\public\pictures\sample pictures\chrysanthemum.jpg
  • C:\users\public\music\sample music\sleep away.mp3
  • %APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\51da22b7-9513-4885-adb9-cd2e72f47f0a
  • C:\users\public\music\sample music\maid with the flaxen hair.mp3
  • C:\users\public\libraries\recordedtv.library-ms
  • C:\users\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms
  • C:\users\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms
  • C:\users\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf
  • C:\users\default\ntuser.dat.log1
  • C:\users\default\appdata\roaming\microsoft\windows\sendto\mail recipient.mapimail
  • C:\users\default\appdata\roaming\microsoft\windows\sendto\desktop (create shortcut).desklink
  • C:\users\default\appdata\roaming\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget
  • C:\recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\winre.wim
  • C:\recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\boot.sdi
  • C:\kms\kms_vl_all_aio_debug.log
  • C:\kms\kms_vl_all_aio.cmd
  • D:\install.log
  • C:\users\public\music\sample music\kalimba.mp3
  • %APPDATA%\microsoft\protect\s-1-5-21-3150914307-1777937420-491476919-1000\preferred
Modifies multiple files.
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Network activity
Connects to
  • '91.##8.114.4':80
  • '91.##8.114.11':80
  • '91.##8.114.25':80
  • '91.##8.114.26':80
TCP
HTTP POST requests
  • http://91.##8.114.4/edit/rnqd.do?ri#########
  • http://91.##8.114.11/gdmretubq.html?a=#########################
  • http://91.##8.114.4/katmrokd.do?nv#####################
  • http://91.##8.114.11/adqheqvdu.cgi?hl##########################
Miscellaneous
Searches for the following windows
  • ClassName: 'SystemTray_Main' WindowName: ''
Creates and executes the following
  • '<SYSTEM32>\wbem\wmic.exe' shadowcopy delete' (with hidden window)

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android