Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
<SYSTEM32>\autorun.ini
<SYSTEM32>_.exe
<SYSTEM32>\system32_.exe
Sets the 'hidden' attribute to the following files:
<Drive name for removable media>:\autorun.inf
<SYSTEM32>\autorun.ini
<SYSTEM32>\system32_.exe
Network activity:
Connects to:
'h1.##pway.com':80
TCP:
HTTP GET requests:
h1.##pway.com/sbalu034/setting.ini
h1.##pway.com/sbalu033/setting.ini
h1.##pway.com/sbalu032/setting.ini
h1.##pway.com/sbalu037/setting.ini
h1.##pway.com/sbalu036/setting.ini
h1.##pway.com/sbalu035/setting.ini
h1.##pway.com/sbalu028/setting.ini
h1.##pway.com/sbalu027/setting.ini
h1.##pway.com/sbalu026/setting.ini
h1.##pway.com/sbalu031/setting.ini
h1.##pway.com/sbalu030/setting.ini
h1.##pway.com/sbalu029/setting.ini
h1.##pway.com/sbalu038/setting.ini
h1.##pway.com/sbalu047/setting.ini
h1.##pway.com/sbalu046/setting.ini
h1.##pway.com/sbalu045/setting.ini
h1.##pway.com/sbalu050/setting.ini
h1.##pway.com/sbalu049/setting.ini
h1.##pway.com/sbalu048/setting.ini
h1.##pway.com/sbalu041/setting.ini
h1.##pway.com/sbalu040/setting.ini
h1.##pway.com/sbalu039/setting.ini
h1.##pway.com/sbalu044/setting.ini
h1.##pway.com/sbalu043/setting.ini
h1.##pway.com/sbalu042/setting.ini
h1.##pway.com/sbalu025/setting.ini
h1.##pway.com/sbalu008/setting.ini
h1.##pway.com/sbalu007/setting.ini
h1.##pway.com/sbalu006/setting.ini
h1.##pway.com/sbalu011/setting.ini
h1.##pway.com/sbalu010/setting.ini
h1.##pway.com/sbalu009/setting.ini
h1.##pway.com/sbalu002/setting.ini
h1.##pway.com/sbalu001/setting.ini
h1.##pway.com/sbalu000/setting.ini
h1.##pway.com/sbalu005/setting.ini
h1.##pway.com/sbalu004/setting.ini
h1.##pway.com/sbalu003/setting.ini
h1.##pway.com/sbalu012/setting.ini
h1.##pway.com/sbalu021/setting.ini
h1.##pway.com/sbalu020/setting.ini
h1.##pway.com/sbalu019/setting.ini
h1.##pway.com/sbalu024/setting.ini
h1.##pway.com/sbalu023/setting.ini
h1.##pway.com/sbalu022/setting.ini
h1.##pway.com/sbalu015/setting.ini
h1.##pway.com/sbalu014/setting.ini
h1.##pway.com/sbalu013/setting.ini
h1.##pway.com/sbalu018/setting.ini
h1.##pway.com/sbalu017/setting.ini
h1.##pway.com/sbalu016/setting.ini
UDP:
DNS ASK h1.##pway.com
Miscellaneous:
Searches for the following windows:
ClassName: 'Indicator' WindowName: '(null)'
Download Dr.Web for Android
Free three-month trial
All protection features available
Renew your trial license in AppGallery/on Google Pay
By continuing to use this website, you are consenting to Doctor Web’s use of cookies and other technologies related to the collection of visitor statistics. Learn more