My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets



Added to the Dr.Web virus database: 2014-05-07

Virus description added:

A downloader Trojan that can be distributed via mass mailing. Virus makers call it “Smoke Loader”.

Once this Trojan is launched, it scans the environment for the presence of a “sandbox” or a virtual machine as follows:

  • Runs a search for the virtual, vmware, and qemu substrings in the Windows registry key SYSTEM\CurrentControlSet\Services\Disk\Enum.
  • Checks the name of its executable file for the sample substring.
  • Detects whether the dbghelp and sbiedll libraries are loaded into the process’s memory.
  • Scans PEB.NtGlobalFlag for the presence of the debugger.

The Trojan launches the inactive svchost.exe process and embeds a binary file containing the shellcode into it. The shellcode decrypts, unpacks, and configures the library stored in it. Then it runs a search for the exported Work function within the library and calls it. The Trojan’s payload is implemented in this library.

Using the computer name and the serial number of the C: drive volume, the Trojan generates its identifier, scans the system for its own copy, and decrypts the address of the command and control server. Then the malware attempts to register itself in the following system registry branch:


with the entry

"%progname%"=C:\Documents and Settings\admin\Application Data\A2B4C6.exe

where “%progname%” stands for the name of the application chosen randomly from all keys in the HKCU\Software branch. Otherwise, it registers itself with the default name “Customer Service”.

If the attempt fails, the malware tries to add itself to the following system registry branch:


Then it checks whether there is an established Internet connection by attempting to access If the connection is available, the Trojan sends the data regarding the infected computer to the command and control server and tries to download and launch its main module.

The main purpose of this Trojan is to download and then launch other malicious applications on the infected computer. These applications are saved to the %temp% and %appdata% folders.

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android