FOR CUSTOMERS

Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Trojan.PWS.Tibia.2632

Added to the Dr.Web virus database: 2014-05-13

Virus description added:

Technical Information

Malicious functions:
Creates and executes the following:
  • '%HOMEPATH%\Fi31125N2536\Contract_information.exe'
Modifies file system :
Creates the following files:
  • %HOMEPATH%\Fi31125N2536\B50932F91884.MWN
  • %HOMEPATH%\Fi31125N2536\70577.GRF
  • %HOMEPATH%\Fi31125N2536\Z68938E66485.TOD
  • %HOMEPATH%\Fi31125N2536\E13835W71548.GOB
  • %HOMEPATH%\Fi31125N2536\J97439L94028.BYX
  • %HOMEPATH%\Fi31125N2536\H13101N22882.NKF
  • %HOMEPATH%\Fi31125N2536\F52656U41459.AOE
  • %HOMEPATH%\Fi31125N2536\E75565H10864.NPX
  • %HOMEPATH%\Fi31125N2536\82209.SLK
  • %HOMEPATH%\Fi31125N2536\C87630J44697.WBR
  • %HOMEPATH%\Fi31125N2536\96771.KJE
  • %HOMEPATH%\Fi31125N2536\41798.KIX
  • %HOMEPATH%\Fi31125N2536\B19201W92457.GMU
  • %HOMEPATH%\Fi31125N2536\Q15968B68497.SFX
  • %HOMEPATH%\Fi31125N2536\21919.HMH
  • %HOMEPATH%\Fi31125N2536\70818.ODJ
  • %HOMEPATH%\Fi31125N2536\W6266Y19803.COJ
  • %HOMEPATH%\Fi31125N2536\Z34339E27757.XMW
  • %HOMEPATH%\Fi31125N2536\D74603M89662.JYI
  • %HOMEPATH%\Fi31125N2536\D48470O42178.UUG
  • %HOMEPATH%\Fi31125N2536\31778.RLZ
  • %HOMEPATH%\Fi31125N2536\D89026E39425.JWB
  • %HOMEPATH%\Fi31125N2536\M7475B92819.VXQ
  • %HOMEPATH%\Fi31125N2536\85563.HSO
  • %HOMEPATH%\Fi31125N2536\R6032Y59915.SSY
  • %HOMEPATH%\Fi31125N2536\37132.YCA
  • %HOMEPATH%\Fi31125N2536\G63096H7166.ZBB
  • %HOMEPATH%\Fi31125N2536\6981.DEO
  • %HOMEPATH%\Fi31125N2536\47560.IUB
  • %HOMEPATH%\Fi31125N2536\24831.IGO
  • %HOMEPATH%\Fi31125N2536\B31299C21079.HDW
  • %HOMEPATH%\Fi31125N2536\18416.TNW
  • %HOMEPATH%\Fi31125N2536\28604.ZXW
  • %HOMEPATH%\Fi31125N2536\19088.KDL
  • %HOMEPATH%\Fi31125N2536\I48618H66696.OOE
  • %HOMEPATH%\Fi31125N2536\55279.GDV
  • %HOMEPATH%\Fi31125N2536\I23169F36057.IGR
  • %HOMEPATH%\Fi31125N2536\V89873D67737.MIR
  • %HOMEPATH%\Fi31125N2536\Y4195Z15055.NHW
  • %HOMEPATH%\Fi31125N2536\88371.YWV
  • %HOMEPATH%\Fi31125N2536\64959.ZOT
  • %HOMEPATH%\Fi31125N2536\4494.TLD
  • %HOMEPATH%\Fi31125N2536\61715.REV
  • %HOMEPATH%\Fi31125N2536\50756.JOT
  • %HOMEPATH%\Fi31125N2536\X13319X65203.OPU
  • %HOMEPATH%\Fi31125N2536\O27609M37121.IPF
  • %HOMEPATH%\Fi31125N2536\W41496Z21834.WKU
  • %HOMEPATH%\Fi31125N2536\56706.KEI
  • %HOMEPATH%\Fi31125N2536\D14879S59851.GKP
  • %HOMEPATH%\Fi31125N2536\60806.UFJ
  • %HOMEPATH%\Fi31125N2536\Y81999A23047.YMU
  • %HOMEPATH%\Fi31125N2536\76910.KCT
  • %HOMEPATH%\Fi31125N2536\X56519L6818.WUZ
  • %HOMEPATH%\Fi31125N2536\2469.CZH
  • %HOMEPATH%\Fi31125N2536\57531.KNF
  • %HOMEPATH%\Fi31125N2536\48959.JTX
  • %HOMEPATH%\Fi31125N2536\R23464T11314.RWJ
  • %HOMEPATH%\Fi31125N2536\34949.PJP
  • %HOMEPATH%\Fi31125N2536\54584.DWG
  • %HOMEPATH%\Fi31125N2536\W29603W34109.NKL
  • %HOMEPATH%\Fi31125N2536\23264.DJZ
  • %HOMEPATH%\Fi31125N2536\U33554Y66546.QCM
  • %HOMEPATH%\Fi31125N2536\T7748K76268.JWC
  • %HOMEPATH%\Fi31125N2536\D98868I23518.DWF
  • %HOMEPATH%\Fi31125N2536\78601.JZA
  • %HOMEPATH%\Fi31125N2536\71441.IZF
  • %HOMEPATH%\Fi31125N2536\Z3721V34180.DMN
  • %HOMEPATH%\Fi31125N2536\39999.LQV
  • %HOMEPATH%\Fi31125N2536\F42408J12767.LDM
  • %HOMEPATH%\Fi31125N2536\X99073K35766.FLU
  • %HOMEPATH%\Fi31125N2536\L15576T66708.YZZ
  • %HOMEPATH%\Fi31125N2536\F16981T70844.KCN
  • %HOMEPATH%\Fi31125N2536\T62300G90416.TCQ
  • %HOMEPATH%\Fi31125N2536\B41820L70112.RET
  • %HOMEPATH%\Fi31125N2536\I63329F14055.BAB
  • %HOMEPATH%\Fi31125N2536\82288.PVQ
  • %HOMEPATH%\Fi31125N2536\49433.HNH
  • %HOMEPATH%\Fi31125N2536\32039.LMB
  • %HOMEPATH%\Fi31125N2536\15960.AXS
  • %HOMEPATH%\Fi31125N2536\31516.UGM
  • %HOMEPATH%\Fi31125N2536\53337.JRS
  • %HOMEPATH%\Fi31125N2536\67319.NAV
  • %HOMEPATH%\Fi31125N2536\70069.WHX
  • %HOMEPATH%\Fi31125N2536\14639.YIA
  • %HOMEPATH%\Fi31125N2536\G3443Z75689.AYG
  • %HOMEPATH%\Fi31125N2536\53386.RJF
  • %HOMEPATH%\Fi31125N2536\32472.LFY
  • %HOMEPATH%\Fi31125N2536\81420.AZA
  • %HOMEPATH%\Fi31125N2536\Y64589M23105.UKK
  • %HOMEPATH%\Fi31125N2536\A93422R10318.IFZ
  • %HOMEPATH%\Fi31125N2536\X90508L99124.POD
  • %HOMEPATH%\Fi31125N2536\G6240L59114.KAS
  • %HOMEPATH%\Fi31125N2536\M87673K52426.AAA
  • %HOMEPATH%\Fi31125N2536\26407.OKR
  • %HOMEPATH%\Fi31125N2536\E98552Q93952.ARF
  • %HOMEPATH%\Fi31125N2536\40817.UTM
  • %HOMEPATH%\Fi31125N2536\4922.LCG
  • %HOMEPATH%\Fi31125N2536\B39022R24852.QHS
  • %HOMEPATH%\Fi31125N2536\K52434Q19042.SIZ
  • %HOMEPATH%\Fi31125N2536\H18990K69363.XBQ
  • %HOMEPATH%\Fi31125N2536\15875.WHA
  • %HOMEPATH%\Fi31125N2536\M4005C58358.ZRY
  • %HOMEPATH%\Fi31125N2536\40752.KGS
  • %HOMEPATH%\Fi31125N2536\51775.EQT
  • %HOMEPATH%\Fi31125N2536\T35279D58619.NUC
  • %HOMEPATH%\Fi31125N2536\24415.JZO
  • %HOMEPATH%\Fi31125N2536\N50222S63532.UUY
  • %HOMEPATH%\Fi31125N2536\H93764N39444.HQF
  • %HOMEPATH%\Fi31125N2536\58901.AVU
  • %HOMEPATH%\Fi31125N2536\66245.CYU
  • %HOMEPATH%\Fi31125N2536\19082.JKQ
  • %HOMEPATH%\Fi31125N2536\91736.ESM
  • %HOMEPATH%\Fi31125N2536\J16231A41587.FTI
  • %HOMEPATH%\Fi31125N2536\H25929J43089.XOY
  • %HOMEPATH%\Fi31125N2536\S71834O5334.BGP
  • %HOMEPATH%\Fi31125N2536\Z4541R54750.GGP
  • %HOMEPATH%\Fi31125N2536\61678.RSB
  • %HOMEPATH%\Fi31125N2536\E74819D4493.MXI
  • %HOMEPATH%\Fi31125N2536\N55628G44310.JOO
  • %HOMEPATH%\Fi31125N2536\29934.ARD
  • %HOMEPATH%\Fi31125N2536\O77655B29854.AWZ
  • %HOMEPATH%\Fi31125N2536\C62280J24840.SZW
  • %HOMEPATH%\Fi31125N2536\O21748R96685.XRM
  • %HOMEPATH%\Fi31125N2536\59723.CRZ
  • %HOMEPATH%\Fi31125N2536\N4416C19907.TGD
  • %HOMEPATH%\Fi31125N2536\B56031M65893.JBT
  • %HOMEPATH%\Fi31125N2536\6044.RPZ
  • %HOMEPATH%\Fi31125N2536\21526.FCZ
  • %HOMEPATH%\Fi31125N2536\F22256P83812.XNT
  • %HOMEPATH%\Fi31125N2536\C34055Q46933.JSL
  • %HOMEPATH%\Fi31125N2536\39328.SJY
  • %HOMEPATH%\Fi31125N2536\39118.KCG
  • %HOMEPATH%\Fi31125N2536\N28067R13122.SMD
  • %HOMEPATH%\Fi31125N2536\B96034B78707.MFX
  • %HOMEPATH%\Fi31125N2536\L3092W73582.OYW
  • %HOMEPATH%\Fi31125N2536\B82279K30534.WES
  • %HOMEPATH%\Fi31125N2536\96051.KAW
  • %HOMEPATH%\Fi31125N2536\39002.TKO
  • %HOMEPATH%\Fi31125N2536\P73523I71824.IXF
  • %HOMEPATH%\Fi31125N2536\P8250U67896.ZPK
  • %HOMEPATH%\Fi31125N2536\O19370W70808.ADV
  • %HOMEPATH%\Fi31125N2536\I59830D22280.MGG
  • %HOMEPATH%\Fi31125N2536\35520.OOJ
  • %HOMEPATH%\Fi31125N2536\1421.GPR
  • %HOMEPATH%\Fi31125N2536\82302.KUA
  • %HOMEPATH%\Fi31125N2536\K85807J9330.AGN
  • %HOMEPATH%\Fi31125N2536\29775.KMS
  • %HOMEPATH%\Fi31125N2536\33466.KDI
  • %HOMEPATH%\Fi31125N2536\D47011D86930.JSF
  • %HOMEPATH%\Fi31125N2536\16259.MGK
  • %HOMEPATH%\Fi31125N2536\28108.QKI
  • %HOMEPATH%\Fi31125N2536\68048.YWW
  • %HOMEPATH%\Fi31125N2536\89487.GHK
  • %HOMEPATH%\Fi31125N2536\B44696R15381.HJT
  • %HOMEPATH%\Fi31125N2536\85574.WTI
  • %HOMEPATH%\Fi31125N2536\A61679O34556.GUZ
  • %HOMEPATH%\Fi31125N2536\E6444L21110.AXL
  • %HOMEPATH%\Fi31125N2536\Q95897F5275.VVI
  • %HOMEPATH%\Fi31125N2536\70929.CCJ
  • %HOMEPATH%\Fi31125N2536\D41781L37743.XUR
  • %HOMEPATH%\Fi31125N2536\90916.TKQ
  • %HOMEPATH%\Fi31125N2536\V84351H21019.ZGN
  • %HOMEPATH%\Fi31125N2536\A86927S91604.ETB
  • %HOMEPATH%\Fi31125N2536\67666.ASU
  • %HOMEPATH%\Fi31125N2536\M92172Q11923.FZD
  • %HOMEPATH%\Fi31125N2536\O70860M45395.VKS
  • %HOMEPATH%\Fi31125N2536\I26840R97270.UBK
  • %HOMEPATH%\Fi31125N2536\E92252Q91378.ISM
  • %HOMEPATH%\Fi31125N2536\G21602H90694.DMM
  • %HOMEPATH%\Fi31125N2536\4440.BXF
  • %HOMEPATH%\Fi31125N2536\T43091N20723.ETN
  • %HOMEPATH%\Fi31125N2536\30906.IXA
  • %HOMEPATH%\Fi31125N2536\43986.YLE
  • %HOMEPATH%\Fi31125N2536\K2114D62685.YNM
  • %HOMEPATH%\Fi31125N2536\L9774L49366.NTL
  • %HOMEPATH%\Fi31125N2536\Z4588G9236.KLM
  • %HOMEPATH%\Fi31125N2536\V63874T19638.FWR
  • %HOMEPATH%\Fi31125N2536\H65448H1715.KSF
  • %HOMEPATH%\Fi31125N2536\S29549W44075.XVG
  • %HOMEPATH%\Fi31125N2536\95663.FYF
  • %HOMEPATH%\Fi31125N2536\B24179C30858.FVB
  • %HOMEPATH%\Fi31125N2536\62366.NUC
  • %HOMEPATH%\Fi31125N2536\55796.NAL
  • %HOMEPATH%\Fi31125N2536\V24210N41226.RND
  • %HOMEPATH%\Fi31125N2536\26410.OVG
  • %HOMEPATH%\Fi31125N2536\S65819C49102.WVT
  • %HOMEPATH%\Fi31125N2536\J85339F22885.AJH
  • %HOMEPATH%\Fi31125N2536\B39278O66472.GVA
  • %HOMEPATH%\Fi31125N2536\73564.AYJ
  • %HOMEPATH%\Fi31125N2536\48228.CDV
  • %HOMEPATH%\Fi31125N2536\47318.IEB
  • %HOMEPATH%\Fi31125N2536\U84778O28227.FFT
  • %HOMEPATH%\Fi31125N2536\7143.HIX
  • %HOMEPATH%\Gs98406A19019.txt
  • %HOMEPATH%\Fi31125N2536\XI.CWF
  • %HOMEPATH%\Lz59990V9267.XA8
  • %TEMP%\aut1.tmp
  • %HOMEPATH%\Fi31125N2536\S9827V4095.NKH
  • %HOMEPATH%\Fi31125N2536\M23374Y94941.ZNK
  • %HOMEPATH%\Fi31125N2536\63353.RVA
  • %HOMEPATH%\Fi31125N2536\Q71516N87695.EUF
  • %HOMEPATH%\Fi31125N2536\29088.GDY
  • %HOMEPATH%\Fi31125N2536\G31507Q3445.GUD
  • %HOMEPATH%\Fi31125N2536\24281.WIJ
  • %HOMEPATH%\Fi31125N2536\L40688F98945.FDJ
  • %HOMEPATH%\Fi31125N2536\Y69422M92240.RRS
  • %HOMEPATH%\Fi31125N2536\N56029G80623.UTV
  • %HOMEPATH%\Fi31125N2536\M91988P30488.LXD
  • %HOMEPATH%\Fi31125N2536\I86692K16175.PSN
  • %HOMEPATH%\Fi31125N2536\M8345W93082.VGD
  • %HOMEPATH%\Fi31125N2536\57285.IZQ
  • %HOMEPATH%\Fi31125N2536\34433.YYV
  • %HOMEPATH%\Fi31125N2536\O25644J85520.TCF
  • %HOMEPATH%\Fi31125N2536\X89360D27932.OGE
  • %HOMEPATH%\Fi31125N2536\43662.XTD
  • %HOMEPATH%\Fi31125N2536\2804.HNM
  • %HOMEPATH%\Fi31125N2536\59462.RAI
  • %HOMEPATH%\Fi31125N2536\48080.XKW
  • %HOMEPATH%\Fi31125N2536\Z43611J7086.JPR
  • %HOMEPATH%\Fi31125N2536\99802.BTA
  • %HOMEPATH%\Fi31125N2536\W39421W32246.YIB
  • %HOMEPATH%\Fi31125N2536\79862.CSY
  • %HOMEPATH%\Fi31125N2536\91981.XIK
  • %HOMEPATH%\Fi31125N2536\43097.YEY
  • %HOMEPATH%\Fi31125N2536\V73043D53436.FFM
  • %HOMEPATH%\Fi31125N2536\73469.EKU
  • %HOMEPATH%\Fi31125N2536\53125.CUQ
  • %HOMEPATH%\Fi31125N2536\L31992Y4919.KNX
  • %HOMEPATH%\Fi31125N2536\75753.TMX
  • %HOMEPATH%\Fi31125N2536\E4033S35279.VRA
  • %HOMEPATH%\Fi31125N2536\9720.YKF
  • %HOMEPATH%\Fi31125N2536\L15812F49646.XCL
  • %HOMEPATH%\Fi31125N2536\E21328F43096.TFP
  • %HOMEPATH%\Fi31125N2536\Z57708O54380.GPA
  • %HOMEPATH%\Fi31125N2536\N66168L41342.YYA
  • %HOMEPATH%\Fi31125N2536\G96312B62600.KCW
  • %HOMEPATH%\Fi31125N2536\5058.MNH
  • %HOMEPATH%\Fi31125N2536\56467.IFB
  • %HOMEPATH%\Fi31125N2536\C6877D79863.ZFI
  • %HOMEPATH%\Fi31125N2536\H97444W88332.QBQ
  • %HOMEPATH%\Fi31125N2536\Q28987H13875.LKQ
  • %HOMEPATH%\Fi31125N2536\37426.LZV
  • %HOMEPATH%\Fi31125N2536\52210.OOP
  • %HOMEPATH%\Fi31125N2536\Y67697Z15750.FXW
  • %HOMEPATH%\Fi31125N2536\2907.JGM
  • %HOMEPATH%\Fi31125N2536\20463.IOR
  • %HOMEPATH%\Fi31125N2536\54804.XCM
  • %HOMEPATH%\Fi31125N2536\I22701V20038.ICA
  • %HOMEPATH%\Fi31125N2536\S39797N24724.FDW
  • %HOMEPATH%\Fi31125N2536\S48537F90142.GMF
  • %HOMEPATH%\Fi31125N2536\W63806E70473.EWA
  • %HOMEPATH%\Fi31125N2536\Y51914X84000.QBS
  • %HOMEPATH%\Fi31125N2536\76325.JFI
  • %HOMEPATH%\Fi31125N2536\D72323C26902.SHN
  • %HOMEPATH%\Fi31125N2536\O33734T81127.XOF
  • %HOMEPATH%\Fi31125N2536\16972.QLY
  • %HOMEPATH%\Fi31125N2536\L64366O52525.PHG
  • %HOMEPATH%\Fi31125N2536\D42786M30234.BED
  • %HOMEPATH%\Fi31125N2536\F11671S65697.DTK
  • %HOMEPATH%\Fi31125N2536\C52295H82579.WCA
  • %HOMEPATH%\Fi31125N2536\40311.ORU
  • %HOMEPATH%\Fi31125N2536\D74116M73629.EYU
  • %HOMEPATH%\Fi31125N2536\A83846I73992.IWO
  • %HOMEPATH%\Fi31125N2536\D83481Y75200.KAI
  • %HOMEPATH%\Fi31125N2536\56391.VNE
  • %HOMEPATH%\Fi31125N2536\J7303Z81030.PEC
  • %HOMEPATH%\Fi31125N2536\30076.FVD
  • %HOMEPATH%\Fi31125N2536\A27534D94654.DZO
  • %HOMEPATH%\Fi31125N2536\58049.IGQ
  • %HOMEPATH%\Fi31125N2536\72666.FUA
  • %HOMEPATH%\Fi31125N2536\69774.IHR
  • %HOMEPATH%\Fi31125N2536\16513.JTK
  • %HOMEPATH%\Fi31125N2536\77580.YVH
  • %HOMEPATH%\Fi31125N2536\55736.TMA
  • %HOMEPATH%\Fi31125N2536\F24264S89701.NOC
  • %HOMEPATH%\Fi31125N2536\12472.SNL
  • %HOMEPATH%\Fi31125N2536\99827.ONF
  • %HOMEPATH%\Fi31125N2536\Z82050N69127.QMF
  • %HOMEPATH%\Fi31125N2536\K80135O82061.QZW
  • %HOMEPATH%\Fi31125N2536\F84662W28478.KMW
  • %HOMEPATH%\Fi31125N2536\E31026G1134.GXW
  • %HOMEPATH%\Fi31125N2536\M27577A65495.RAI
  • %HOMEPATH%\Fi31125N2536\12829.YBY
  • %HOMEPATH%\Fi31125N2536\Q38904L52455.RYM
  • %HOMEPATH%\Fi31125N2536\92757.GYX
  • %HOMEPATH%\Fi31125N2536\Q10255X39571.VRP
  • %HOMEPATH%\Fi31125N2536\63316.BJW
  • %HOMEPATH%\Fi31125N2536\N26870X54383.FXZ
  • %HOMEPATH%\Fi31125N2536\12139.YNC
  • %HOMEPATH%\Fi31125N2536\91211.ALA
  • %HOMEPATH%\Fi31125N2536\E19313F48892.MSZ
  • %HOMEPATH%\Fi31125N2536\Z87914W5461.IET
  • %HOMEPATH%\Fi31125N2536\67720.WQL
  • %HOMEPATH%\Fi31125N2536\15576.PEQ
  • %HOMEPATH%\Fi31125N2536\59709.BRZ
  • %HOMEPATH%\Fi31125N2536\V31812P94504.VXF
  • %HOMEPATH%\Fi31125N2536\41394.GFJ
  • %HOMEPATH%\Fi31125N2536\Y77747V38486.PXM
  • %HOMEPATH%\Fi31125N2536\J83928Z79583.CUS
  • %HOMEPATH%\Fi31125N2536\77832.BLT
  • %HOMEPATH%\Fi31125N2536\I90134U67911.ZVC
  • %HOMEPATH%\Fi31125N2536\X32803W24876.OPB
  • %HOMEPATH%\Fi31125N2536\73255.RYW
  • %HOMEPATH%\Fi31125N2536\O90806G18886.JSF
  • %HOMEPATH%\Fi31125N2536\5282.DSZ
  • %HOMEPATH%\Fi31125N2536\43725.NOS
  • %HOMEPATH%\Fi31125N2536\C75874V48532.SSF
  • %HOMEPATH%\Fi31125N2536\18290.DHT
  • %HOMEPATH%\Fi31125N2536\84590.YXL
  • %HOMEPATH%\Fi31125N2536\74163.LKQ
  • %HOMEPATH%\Fi31125N2536\66695.IMX
  • %HOMEPATH%\Fi31125N2536\N26614N78190.UQW
  • %HOMEPATH%\Fi31125N2536\48925.AQI
  • %HOMEPATH%\Fi31125N2536\Q13421A2454.GAH
  • %HOMEPATH%\Fi31125N2536\60794.YQH
  • %HOMEPATH%\Fi31125N2536\X91218T39413.OPV
  • %HOMEPATH%\Fi31125N2536\C60893Q67476.CYO
  • %HOMEPATH%\Fi31125N2536\1962.RAF
  • %HOMEPATH%\Fi31125N2536\J70050S61527.EIC
  • %HOMEPATH%\Fi31125N2536\N19025M26858.ZHQ
  • %HOMEPATH%\Fi31125N2536\A28606V18802.PDM
  • %HOMEPATH%\Fi31125N2536\T63465K41918.BTU
  • %HOMEPATH%\Fi31125N2536\21638.QMO
  • %HOMEPATH%\Fi31125N2536\76538.RUF
  • %HOMEPATH%\Fi31125N2536\V47729I51990.HZC
  • %HOMEPATH%\Fi31125N2536\N29715N16837.ODP
  • %HOMEPATH%\Fi31125N2536\U6203U10049.NUK
  • %HOMEPATH%\Fi31125N2536\Z41759D22354.XPC
  • %HOMEPATH%\Fi31125N2536\50983.HAA
  • %HOMEPATH%\Fi31125N2536\20020.JXZ
  • %HOMEPATH%\Fi31125N2536\90931.SHY
  • %HOMEPATH%\Fi31125N2536\52351.NFF
  • %HOMEPATH%\Fi31125N2536\98374.YQT
  • %HOMEPATH%\Fi31125N2536\J34871J28794.MVS
  • %HOMEPATH%\Fi31125N2536\R27410P6651.TDI
  • %HOMEPATH%\Fi31125N2536\61599.KTO
  • %HOMEPATH%\Fi31125N2536\U67846C24491.EMP
  • %HOMEPATH%\Fi31125N2536\81125.SAN
  • %HOMEPATH%\Fi31125N2536\25759.DFV
  • %HOMEPATH%\Fi31125N2536\A20177V73489.PEC
  • %HOMEPATH%\Fi31125N2536\21076.TBY
  • %HOMEPATH%\Fi31125N2536\91193.QGW
  • %HOMEPATH%\Fi31125N2536\98437.HLY
  • %HOMEPATH%\Fi31125N2536\E26409W63612.VPZ
  • %HOMEPATH%\Fi31125N2536\9530.VIX
  • %HOMEPATH%\Fi31125N2536\P15346C79833.MAP
  • %HOMEPATH%\Fi31125N2536\T19837D42455.GEY
  • %HOMEPATH%\Fi31125N2536\90411.MVR
  • %HOMEPATH%\Fi31125N2536\N25603H22601.DVV
  • %HOMEPATH%\Fi31125N2536\10075.NYW
  • %HOMEPATH%\Fi31125N2536\P27563H49121.FCE
  • %HOMEPATH%\Fi31125N2536\53896.TZR
  • %HOMEPATH%\Fi31125N2536\L29080I61357.ESZ
  • %HOMEPATH%\Fi31125N2536\6208.DHO
  • %HOMEPATH%\Fi31125N2536\Y9724A56210.LSW
  • %HOMEPATH%\Fi31125N2536\97453.JTL
  • %HOMEPATH%\Fi31125N2536\R86325Q22234.YHT
  • %HOMEPATH%\Fi31125N2536\26275.VFU
  • %HOMEPATH%\Fi31125N2536\S69165T13547.HUF
  • %HOMEPATH%\Fi31125N2536\71516.PTD
  • %HOMEPATH%\Fi31125N2536\Y15092T70490.SJV
  • %HOMEPATH%\Fi31125N2536\41394.TVD
  • %HOMEPATH%\Fi31125N2536\13499.FVP
  • %HOMEPATH%\Fi31125N2536\E48032Q42926.FSC
  • %HOMEPATH%\Fi31125N2536\15594.AAZ
  • %HOMEPATH%\Fi31125N2536\T8189O82615.EUS
  • %HOMEPATH%\Fi31125N2536\96075.QUQ
  • %HOMEPATH%\Fi31125N2536\74976.JUG
  • %HOMEPATH%\Fi31125N2536\C41211G38702.OPP
  • %HOMEPATH%\Fi31125N2536\35875.PDP
  • %HOMEPATH%\Fi31125N2536\M24393Z89766.NJW
  • %HOMEPATH%\Fi31125N2536\98130.ZVG
  • %HOMEPATH%\Fi31125N2536\59819.MTU
  • %HOMEPATH%\Fi31125N2536\B94609Z68247.SKA
  • %HOMEPATH%\Fi31125N2536\I91093Y60628.RHA
  • %HOMEPATH%\Fi31125N2536\Y54060N25293.KMQ
  • %HOMEPATH%\Fi31125N2536\H1445F58994.JOU
  • %HOMEPATH%\Fi31125N2536\F49620O65517.EST
  • %HOMEPATH%\Fi31125N2536\44352.LEE
  • %HOMEPATH%\Fi31125N2536\20907.CRG
  • %HOMEPATH%\Fi31125N2536\85402.OSL
  • %HOMEPATH%\Fi31125N2536\B67454L74150.HTJ
  • %HOMEPATH%\Fi31125N2536\34423.ODK
  • %HOMEPATH%\Fi31125N2536\8255.YGI
  • %HOMEPATH%\Fi31125N2536\6099.PLS
  • %HOMEPATH%\Fi31125N2536\N32360K64552.DJE
  • %HOMEPATH%\Fi31125N2536\A86555U14318.JVP
  • %HOMEPATH%\Fi31125N2536\52356.INL
  • %HOMEPATH%\Fi31125N2536\73774.LXW
  • %HOMEPATH%\Fi31125N2536\22302.SPN
  • %HOMEPATH%\Fi31125N2536\Contract_information.exe
  • %HOMEPATH%\Fi31125N2536\V61245S77773.AYG
  • %HOMEPATH%\Fi31125N2536\39834.PXM
  • %HOMEPATH%\Fi31125N2536\26529.KOQ
  • %HOMEPATH%\Fi31125N2536\S72946V16431.GLO
  • %HOMEPATH%\Fi31125N2536\42888.LHC
  • %HOMEPATH%\Fi31125N2536\D54554T63590.PGH
  • %HOMEPATH%\Fi31125N2536\J6072K41399.OXW
  • %HOMEPATH%\Fi31125N2536\82314.GKQ
  • %HOMEPATH%\Fi31125N2536\63431.SLB
  • %HOMEPATH%\Fi31125N2536\A8430X42100.MCH
  • %HOMEPATH%\Fi31125N2536\H16215Y92174.LLD
  • %HOMEPATH%\Fi31125N2536\Q37777I54521.UJS
  • %HOMEPATH%\Fi31125N2536\17266.ATT
  • %HOMEPATH%\Fi31125N2536\69212.RYU
  • %HOMEPATH%\Fi31125N2536\12471.XDH
  • %HOMEPATH%\Fi31125N2536\23204.SBE
  • %HOMEPATH%\Fi31125N2536\I31612J6017.ZYS
  • %HOMEPATH%\Fi31125N2536\13473.TLD
  • %HOMEPATH%\Fi31125N2536\L19209X73846.AAO
  • %HOMEPATH%\Fi31125N2536\H83983S60611.RYC
  • %HOMEPATH%\Fi31125N2536\L69752L21257.YKV
  • %HOMEPATH%\Fi31125N2536\H48078I18699.EPW
  • %HOMEPATH%\Fi31125N2536\61710.DWI
  • %HOMEPATH%\Fi31125N2536\E79087U46111.IJT
  • %HOMEPATH%\Fi31125N2536\S95785U74521.TCE
  • %HOMEPATH%\Fi31125N2536\F99508R95398.BYP
  • %HOMEPATH%\Fi31125N2536\Z58991O91616.JYM
  • %HOMEPATH%\Fi31125N2536\90761.ZFA
  • %HOMEPATH%\Fi31125N2536\52348.DIM
  • %HOMEPATH%\Fi31125N2536\66547.ISQ
  • %HOMEPATH%\Fi31125N2536\S98790L32106.BYO
  • %HOMEPATH%\Fi31125N2536\33536.MCD
  • %HOMEPATH%\Fi31125N2536\12908.IUN
  • %HOMEPATH%\Fi31125N2536\I34343C72476.THA
  • %HOMEPATH%\Fi31125N2536\82331.PUJ
  • %HOMEPATH%\Fi31125N2536\N51345G69872.UVO
  • %HOMEPATH%\Fi31125N2536\26511.DHZ
  • %HOMEPATH%\Fi31125N2536\I66508J96028.TIR
  • %HOMEPATH%\Fi31125N2536\9046.ATA
  • %HOMEPATH%\Fi31125N2536\54557.AVE
  • %HOMEPATH%\Fi31125N2536\23579.RBG
  • %HOMEPATH%\Fi31125N2536\86697.JTI
  • %HOMEPATH%\Fi31125N2536\F41833Z6860.VRS
  • %HOMEPATH%\Fi31125N2536\75255.RFB
  • %HOMEPATH%\Fi31125N2536\62725.JHW
  • %HOMEPATH%\Fi31125N2536\4099.YRJ
  • %HOMEPATH%\Fi31125N2536\48378.DEQ
  • %HOMEPATH%\Fi31125N2536\G50560Q33238.VTN
  • %HOMEPATH%\Fi31125N2536\F42887P35080.FHH
  • %HOMEPATH%\Fi31125N2536\S36626O63138.XGC
  • %HOMEPATH%\Fi31125N2536\F11632S27298.LFA
  • %HOMEPATH%\Fi31125N2536\O13070G4994.ZWF
  • %HOMEPATH%\Fi31125N2536\85121.NUZ
  • %HOMEPATH%\Fi31125N2536\46389.TDF
  • %HOMEPATH%\Fi31125N2536\X72847C96121.TIC
  • %HOMEPATH%\Fi31125N2536\O95554S33558.EXV
  • %HOMEPATH%\Fi31125N2536\G43647F76642.JEN
  • %HOMEPATH%\Fi31125N2536\T11342H73265.TDY
  • %HOMEPATH%\Fi31125N2536\M25517S6330.YYC
  • %HOMEPATH%\Fi31125N2536\B81769I15045.BPG
  • %HOMEPATH%\Fi31125N2536\80450.SAI
  • %HOMEPATH%\Fi31125N2536\20197.ZRZ
  • %HOMEPATH%\Fi31125N2536\V32276G10135.RAI
  • %HOMEPATH%\Fi31125N2536\G95411D1566.GJP
  • %HOMEPATH%\Fi31125N2536\42788.JYF
  • %HOMEPATH%\Fi31125N2536\Z33066B2547.RTW
  • %HOMEPATH%\Fi31125N2536\X25736E47612.WVK
  • %HOMEPATH%\Fi31125N2536\Y88660H79735.GVN
  • %HOMEPATH%\Fi31125N2536\T67271A71344.LQD
  • %HOMEPATH%\Fi31125N2536\Y15862Q24414.ZUF
  • %HOMEPATH%\Fi31125N2536\28855.IML
  • %HOMEPATH%\Fi31125N2536\N64557Q98399.LGO
  • %HOMEPATH%\Fi31125N2536\T2465D49063.TYY
  • %HOMEPATH%\Fi31125N2536\96279.NYV
  • %HOMEPATH%\Fi31125N2536\45006.ZPV
  • %HOMEPATH%\Fi31125N2536\24900.ATM
  • %HOMEPATH%\Fi31125N2536\X16574H39811.IMN
  • %HOMEPATH%\Fi31125N2536\A24402I82267.IZM
  • %HOMEPATH%\Fi31125N2536\35892.IZV
  • %HOMEPATH%\Fi31125N2536\W59235U90105.GGW
  • %HOMEPATH%\Fi31125N2536\59046.DSR
  • %HOMEPATH%\Fi31125N2536\45274.FUC
  • %HOMEPATH%\Fi31125N2536\42907.ELL
  • %HOMEPATH%\Fi31125N2536\9272.RUR
  • %HOMEPATH%\Fi31125N2536\28336.YPT
  • %HOMEPATH%\Fi31125N2536\97543.ICG
  • %HOMEPATH%\Fi31125N2536\59614.XJP
  • %HOMEPATH%\Fi31125N2536\X74134W55005.MTH
  • %HOMEPATH%\Fi31125N2536\M39349A64838.BQS
  • %HOMEPATH%\Fi31125N2536\E14176Q91320.SGH
  • %HOMEPATH%\Fi31125N2536\I66358G61851.DUZ
  • %HOMEPATH%\Fi31125N2536\67225.RNQ
  • %HOMEPATH%\Fi31125N2536\81349.YNK
  • %HOMEPATH%\Fi31125N2536\W72599R91484.BLZ
  • %HOMEPATH%\Fi31125N2536\U92721O26317.HSJ
  • %HOMEPATH%\Fi31125N2536\97950.ULF
  • %HOMEPATH%\Fi31125N2536\61905.IVV
  • %HOMEPATH%\Fi31125N2536\Y42838T64314.DAO
  • %HOMEPATH%\Fi31125N2536\88548.GIZ
  • %HOMEPATH%\Fi31125N2536\R99073F19157.UBF
  • %HOMEPATH%\Fi31125N2536\96481.GJY
  • %HOMEPATH%\Fi31125N2536\51580.GOD
  • %HOMEPATH%\Fi31125N2536\Q56706I57580.VYA
  • %HOMEPATH%\Fi31125N2536\64862.TFT
  • %HOMEPATH%\Fi31125N2536\27489.KYH
  • %HOMEPATH%\Fi31125N2536\L63420T95243.CHB
  • %HOMEPATH%\Fi31125N2536\W92856O59941.DJA
  • %HOMEPATH%\Fi31125N2536\K90449C92407.YDI
  • %HOMEPATH%\Fi31125N2536\74481.KMD
  • %HOMEPATH%\Fi31125N2536\60067.NDJ
  • %HOMEPATH%\Fi31125N2536\99323.MBY
  • %HOMEPATH%\Fi31125N2536\30675.QUJ
  • %HOMEPATH%\Fi31125N2536\38717.ITL
  • %HOMEPATH%\Fi31125N2536\50384.CKU
  • %HOMEPATH%\Fi31125N2536\S86064H41316.VNI
  • %HOMEPATH%\Fi31125N2536\Z38947S56905.AHI
  • %HOMEPATH%\Fi31125N2536\D7780W35406.MEN
  • %HOMEPATH%\Fi31125N2536\M82119N8081.BMR
  • %HOMEPATH%\Fi31125N2536\54916.HXU
  • %HOMEPATH%\Fi31125N2536\45856.ZBN
  • %HOMEPATH%\Fi31125N2536\87295.GFI
  • %HOMEPATH%\Fi31125N2536\I37223L74638.AJO
  • %HOMEPATH%\Fi31125N2536\4350.TAQ
  • %HOMEPATH%\Fi31125N2536\N28849L77010.OAB
  • %HOMEPATH%\Fi31125N2536\H67658O13791.AVT
  • %HOMEPATH%\Fi31125N2536\C51064H9630.RKB
  • %HOMEPATH%\Fi31125N2536\23598.TLU
  • %HOMEPATH%\Fi31125N2536\82666.ASK
  • %HOMEPATH%\Fi31125N2536\19295.GNS
  • %HOMEPATH%\Fi31125N2536\90837.CWI
  • %HOMEPATH%\Fi31125N2536\50513.RTQ
  • %HOMEPATH%\Fi31125N2536\B23331H69342.RKJ
  • %HOMEPATH%\Fi31125N2536\M63933U61970.SMS
  • %HOMEPATH%\Fi31125N2536\S54007F23497.BHB
  • %HOMEPATH%\Fi31125N2536\Z85097Q99098.IPF
  • %HOMEPATH%\Fi31125N2536\P59325Y1729.IGT
  • %HOMEPATH%\Fi31125N2536\X12178T46410.IGN
  • %HOMEPATH%\Fi31125N2536\G61038S7581.WQO
  • %HOMEPATH%\Fi31125N2536\W52682C54337.APR
  • %HOMEPATH%\Fi31125N2536\L89449X85049.LGE
  • %HOMEPATH%\Fi31125N2536\E64154M49494.EQJ
  • %HOMEPATH%\Fi31125N2536\E3310P81303.PWB
  • %HOMEPATH%\Fi31125N2536\37534.CXU
  • %HOMEPATH%\Fi31125N2536\53028.RDG
  • %HOMEPATH%\Fi31125N2536\92507.PCK
  • %HOMEPATH%\Fi31125N2536\Z89641H20013.YBP
  • %HOMEPATH%\Fi31125N2536\12509.HWL
  • %HOMEPATH%\Fi31125N2536\71635.EWW
  • %HOMEPATH%\Fi31125N2536\D53099M78099.PBC
  • %HOMEPATH%\Fi31125N2536\U42274U99180.JPB
  • %HOMEPATH%\Fi31125N2536\P99835S18441.VQI
  • %HOMEPATH%\Fi31125N2536\95448.ZCS
  • %HOMEPATH%\Fi31125N2536\10938.LQR
  • %HOMEPATH%\Fi31125N2536\Y57334K84459.KYU
  • %HOMEPATH%\Fi31125N2536\Z9712X13798.DJY
  • %HOMEPATH%\Fi31125N2536\M28281U68277.TAT
  • %HOMEPATH%\Fi31125N2536\P6634K51515.ZYM
  • %HOMEPATH%\Fi31125N2536\K29055N86909.CQD
  • %HOMEPATH%\Fi31125N2536\B49375G19174.HTO
  • %HOMEPATH%\Fi31125N2536\J97952T64234.LRI
  • %HOMEPATH%\Fi31125N2536\A71217I35426.UKC
  • %HOMEPATH%\Fi31125N2536\E13817U64838.CJI
  • %HOMEPATH%\Fi31125N2536\B92203C98050.QEK
  • %HOMEPATH%\Fi31125N2536\75249.YPQ
  • %HOMEPATH%\Fi31125N2536\V83522L28512.KHV
  • %HOMEPATH%\Fi31125N2536\60879.EYW
  • %HOMEPATH%\Fi31125N2536\74029.LNO
  • %HOMEPATH%\Fi31125N2536\48178.JHF
  • %HOMEPATH%\Fi31125N2536\R64401A94706.VFK
  • %HOMEPATH%\Fi31125N2536\M76862G56174.CTR
  • %HOMEPATH%\Fi31125N2536\72899.QJL
  • %HOMEPATH%\Fi31125N2536\42350.YDU
  • %HOMEPATH%\Fi31125N2536\E48243B7775.AHT
  • %HOMEPATH%\Fi31125N2536\I79931F52021.BTC
  • %HOMEPATH%\Fi31125N2536\P84394V6817.HLU
  • %HOMEPATH%\Fi31125N2536\49873.ZYE
  • %HOMEPATH%\Fi31125N2536\T64930L11644.XOL
  • %HOMEPATH%\Fi31125N2536\10402.FZC
  • %HOMEPATH%\Fi31125N2536\D73445R82925.AMK
  • %HOMEPATH%\Fi31125N2536\M80517T76885.PVY
  • %HOMEPATH%\Fi31125N2536\57847.NAJ
  • %HOMEPATH%\Fi31125N2536\44621.MIG
  • %HOMEPATH%\Fi31125N2536\55090.EEY
  • %HOMEPATH%\Fi31125N2536\93027.DKD
  • %HOMEPATH%\Fi31125N2536\97764.YQE
  • %HOMEPATH%\Fi31125N2536\57728.TJL
  • %HOMEPATH%\Fi31125N2536\Q4091K96849.WNH
  • %HOMEPATH%\Fi31125N2536\W51132W24780.DQG
  • %HOMEPATH%\Fi31125N2536\H44182O23146.SMR
  • %HOMEPATH%\Fi31125N2536\48622.JXG
  • %HOMEPATH%\Fi31125N2536\I69583L11930.WVA
  • %HOMEPATH%\Fi31125N2536\K66628P84421.CRO
  • %HOMEPATH%\Fi31125N2536\66874.OTK
  • %HOMEPATH%\Fi31125N2536\U29695P59189.LWM
  • %HOMEPATH%\Fi31125N2536\77013.XXT
Sets the 'hidden' attribute to the following files:
  • %HOMEPATH%\Lz59990V9267.XA8
  • %HOMEPATH%\Gs98406A19019.txt
Deletes the following files:
  • %HOMEPATH%\Lz59990V9267.XA8
  • %TEMP%\aut1.tmp
Miscellaneous:
Searches for the following windows:
  • ClassName: 'Indicator' WindowName: '(null)'
  • ClassName: 'Shell_TrayWnd' WindowName: '(null)'
  • ClassName: 'EDIT' WindowName: '(null)'

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android

Dr.Web © Doctor Web
2003 — 2022

Doctor Web is a Russian cybersecurity company focused on threat detection, prevention and response technologies.