FOR CUSTOMERS

Close

Library
My library

+ Add to library

Search
Search

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

A query form

Call us

+7 (495) 789-45-86

Forum

Your tickets

New ticket

Call us

+7 (495) 789-45-86

Profile

EN

RU CN DE EN ES FR IT JP KZ UZ PL BY
Close
Support services
Scanners
Dr.Web vxCube
Trial
VCI investigations
Virus library
Knowledge base

Technologies

Terminology

Training and education

Myths

News

Trojan.DownLoader19.9812

Added to the Dr.Web virus database: 2016-01-26

Virus description added:

Technical Information

Malicious functions:
Creates and executes the following:
  • '%TEMP%\iepv.exe' /stext %TEMP%\ie.txt
  • '%TEMP%\passwordfox.exe' /stext %TEMP%\firefox.txt
Executes the following:
  • '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ilasm.exe' "%APPDATA%\MSBuild.il"
  • '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe'
Injects code into
the following system processes:
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
Searches for registry branches where third party applications store passwords:
  • [<HKLM>\SOFTWARE\CyberLink\PowerProducer\3.0\UserReg]
  • [<HKLM>\SOFTWARE\Valve\Day of Defeat\Settings]
  • [<HKLM>\SOFTWARE\Cyberlink\PowerDVD]
  • [<HKLM>\SOFTWARE\Cyberlink\PowerBar]
  • [<HKLM>\SOFTWARE\Electronic Arts\Electronic Arts\The Battle for Middle-earth II]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Nightlife]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Open For Business]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\The Sims 2]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 University]
  • [<HKLM>\SOFTWARE\Westwood\Red Alert]
  • [<HKLM>\SOFTWARE\Westwood\Tiberian Sun]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Command and Conquer Generals Zero Hour]
  • [<HKLM>\SOFTWARE\Westwood\Red Alert 2]
  • [<HKLM>\SOFTWARE\Electronic Arts\Command and Conquer 3]
  • [<HKLM>\SOFTWARE\Valve\Counter-Strike\Settings]
  • [<HKLM>\SOFTWARE\Electronic Arts\Electronic Arts\Crysis]
  • [<HKLM>\SOFTWARE\Electronic Arts\Electronic Arts\Command and Conquer 3]
  • [<HKLM>\SOFTWARE\THQ\Company of Heroes]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\FIFA 2002]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\FIFA 2003]
  • [<HKLM>\SOFTWARE\F-Secure\BackWeb\iLauncher]
  • [<HKLM>\SOFTWARE\CRYTEK\FARCRY\UBI.COM]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\FIFA 2004]
  • [<HKLM>\SOFTWARE\Electronic Arts\Electronic Arts\FIFA 08]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Distribution\Freedom Force]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\FIFA 2005]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\FIFA 07]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Glamour Life Stuff]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Celebration Stuff]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Pets]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Seasons]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 H M Fashion Stuff]
  • [<HKLM>\SOFTWARE\Sierra\Empire Earth II]
  • [<HKLM>\SOFTWARE\Sierra\CDKey]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Family Fun Stuff]
  • [<HKLM>\SOFTWARE\DVD Audio Extractor\Settings]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Generals]
  • [<HKLM>\SOFTWARE\SEGA\Medieval II Total War]
  • [<HKLM>\SOFTWARE\Adobe\Golive\5.0\Registration]
  • [<HKLM>\SOFTWARE\THQ\Dawn of War]
  • [<HKLM>\SOFTWARE\THQ\Dawn of War - Dark Crusade]
  • [<HKLM>\SOFTWARE\ahead\Installation\BAK\Nero 7\Info]
  • [<HKLM>\SOFTWARE\Adobe\Photoshop\7.0\Registration]
  • [<HKLM>\SOFTWARE\Elcom\Advanced PDF Password Recovery\Registration]
  • [<HKLM>\SOFTWARE\ACD Systems\PicaView]
  • [<HKLM>\SOFTWARE\Eugen Systems\ActOfWar]
  • [<HKLM>\SOFTWARE\Ubisoft\Splinter Cell Pandora Tomorrow]
  • [<HKLM>\SOFTWARE\Ubisoft\Splinter Cell Chaos Theory\Keys]
  • [<HKCU>\Software\TuneUp\Utilities\8.0]
  • [<HKCU>\Software\Nullsoft\Winamp]
  • [<HKLM>\SOFTWARE\Activision\Call of Duty]
  • [<HKLM>\SOFTWARE\Activision\Call of Duty 4]
  • [<HKLM>\SOFTWARE\Activision\Call of Duty WAW]
  • [<HKLM>\SOFTWARE\Activision\Call of Duty United Offensive]
  • [<HKLM>\SOFTWARE\Activision\Call of Duty 2]
  • [<HKLM>\Software\Electronic Arts\EA GAMES\Black and White]
  • [<HKLM>\Software\Electronic Arts\Black and White 2]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Battlefield 2142]
  • [<HKLM>\Software\Electronic Arts\EA GAMES\Battlefield Vietnam]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\Boulder Dash Rocks]
  • [<HKLM>\SOFTWARE\Techland\Chrome]
  • [<HKLM>\SOFTWARE\Codec Tweak Tool]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\Burnout Paradise]
  • [<HKLM>\SOFTWARE\TechSmith\Camtasia Studio\4.0]
  • [<HKLM>\SOFTWARE\Sunflowers\Anno 1701]
  • [<HKLM>\SOFTWARE\ashampoo\Ashampoo WinOptimizer Platinum 3]
  • [<HKLM>\SOFTWARE\Elcom\Advanced PDF Password Recovery\Registration Pro]
  • [<HKLM>\SOFTWARE\Elcom\Advanced ZIP Password Recovery\Registration]
  • [<HKLM>\SOFTWARE\@stake\LC5\Registration]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Battlefield 1942 The Road to Rome]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\Battlefield 2]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Battlefield 1942]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Battlefield 1942 Secret Weapons of WWII]
  • [<HKLM>\SOFTWARE\THQ\Frontlines: Fuel of War Beta]
  • [<HKLM>\Software\Passware\Encryption Analyzer\1\Registration,License]
  • [<HKLM>\Software\Passware\Windows Key\7\Registration]
  • [<HKLM>\Software\O&O\O&O Defrag\8.0\Pro\licenses]
  • [<HKLM>\Software\PowerQuest\PartitionMagic\8.0\UserInfo]
  • [<HKLM>\Software\EnTech\PowerStrip]
  • [<HKLM>\Software\Electronic Arts\EA GAMES\Shogun Total War - Warlord Edition]
  • [<HKLM>\Software\Atari\Sid Meier's Pirates!]
  • [<HKLM>\Software\KONAMI\PES2008]
  • [<HKLM>\Software\Red Storm Entertainment\RAVENSHIELD]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Need For Speed Underground 2]
  • [<HKLM>\SOFTWARE\Ahead\Nero - Burning Rom\Info]
  • [<HKLM>\SOFTWARE\Electronic Arts\Electronic Arts\Need for Speed ProStreet]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Need For Speed Underground]
  • [<HKLM>\Software\Nero\Installation\Families\Nero 7\Info]
  • [<HKLM>\Software\NuMega\SmartCheck]
  • [<HKLM>\Software\OnlineTVPlayer\RegInfo]
  • [<HKLM>\SOFTWARE\Nero\Installation\Families\Nero 8\Info]
  • [<HKLM>\Software\Westwood\Nox]
  • [<HKLM>\Software\Electronic Arts\EA Games\The Battle for Middle-earth]
  • [<HKLM>\Software\Electronic Arts\EA Games\The Orange Box]
  • [<HKLM>\Software\TechSmith\SnagIt\8]
  • [<HKLM>\Software\TexasCalc\License]
  • [<HKLM>\Software\Pegasys Inc.\TMPGEnc DVD Author\1.0]
  • [<HKLM>\Software\TuneUp\Utilities\8.0]
  • [<HKLM>\Software\Nullsoft\Winamp]
  • [<HKLM>\Software\TuneUp\Utilities\6.0]
  • [<HKLM>\Software\TuneUp\Utilities\7.0]
  • [<HKLM>\Software\Network Associates, Inc.\Sniffer Pro\4.5\USER]
  • [<HKLM>\Software\Silver Style Entertainment\Soldiers Of Anarchy]
  • [<HKLM>\Software\Ubisoft\SILENT HUNTER III\Keys]
  • [<HKLM>\Software\Electronic Arts\Maxis\ Sim City 4 Deluxe]
  • [<HKLM>\Software\GSC Game World\STALKER-SHOC]
  • [<HKLM>\Software\Steganos\SIAVPN]
  • [<HKLM>\Software\THQ\Gas Powered Games\Supreme Commander]
  • [<HKLM>\Software\LucasArts\Star Wars Battlefront II\1.0]
  • [<HKLM>\Software\LucasArts\Star Wars Battlefront II\1.1]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Need for Speed Most Wanted]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\James Bond 007 Nightfire]
  • [<HKLM>\SOFTWARE\3d0\Status Legends of Might and Magic]
  • [<HKLM>\SOFTWARE\JoWooD\InstalledGames\IG2]
  • [<HKLM>\SOFTWARE\AVConverter\iPod Converter]
  • [<HKLM>\SOFTWARE\Macromedia\Flash\7\Registration]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\Madden NFL 07]
  • [<HKLM>\SOFTWARE\JSG\Matrix Saver V2]
  • [<HKLM>\SOFTWARE\Macromedia\Fireworks\7\Registration]
  • [<HKLM>\SOFTWARE\Macromedia\Dreamweaver\7\Registration]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Global Operations]
  • [<HKLM>\SOFTWARE\Valve\Gunman]
  • [<HKLM>\SOFTWARE\THQ\Frontlines: Fuel of War]
  • [<HKLM>\SOFTWARE\Headlight\GetRight]
  • [<HKLM>\SOFTWARE\Valve\Half-Life\Setting]
  • [<HKLM>\SOFTWARE\IGI 2 Retail\CDKey]
  • [<HKLM>\SOFTWARE\Ahead\InCD]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\Hellgate: London]
  • [<HKLM>\SOFTWARE\Illusion Softworks\Hidden & Dangerous 2]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\NHL 2005]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\NBA LIVE 2003]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\NHL 2003]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\NHL 2004]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\NBA LIVE 2004]
  • [<HKLM>\SOFTWARE\Electronic Arts\Electronic Arts\Need for Speed Carbon]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Need For Speed Hot Pursuit 2]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\NBA LIVE 07]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\NBA Live 08]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Medal of Honor Allied Assault Breakthrough]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Medal of Honor Allied Assault Spearhead]
  • [<HKLM>\SOFTWARE\Electronic Arts\Medal of Honor Airborne]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Medal of Honor Allied Assault]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Games\Medal of Honor: Heroes 2]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\Nascar Racing 2003]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\NHL 2002]
  • [<HKLM>\SOFTWARE\mIRC]
  • [<HKLM>\SOFTWARE\Electronic Arts\EA Sports\Nascar Racing 2002]
  • [<HKCU>\SOFTWARE\Cyberlink\PowerDVD]
  • [<HKCU>\SOFTWARE\Cyberlink\PowerBar]
  • [<HKCU>\SOFTWARE\Valve\Counter-Strike\Settings]
  • [<HKCU>\SOFTWARE\Electronic Arts\Electronic Arts\Crysis]
  • [<HKCU>\SOFTWARE\CyberLink\PowerProducer\3.0\UserReg]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Games\The Sims 2]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 University]
  • [<HKCU>\SOFTWARE\Valve\Day of Defeat\Settings]
  • [<HKCU>\SOFTWARE\Electronic Arts\Electronic Arts\The Battle for Middle-earth II]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA GAMES\Command and Conquer Generals Zero Hour]
  • [<HKCU>\SOFTWARE\Westwood\Red Alert 2]
  • [<HKCU>\SOFTWARE\Codec Tweak Tool]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA GAMES\Generals]
  • [<HKCU>\SOFTWARE\Westwood\Red Alert]
  • [<HKCU>\SOFTWARE\Electronic Arts\Electronic Arts\Command and Conquer 3]
  • [<HKCU>\SOFTWARE\THQ\Company of Heroes]
  • [<HKCU>\SOFTWARE\Westwood\Tiberian Sun]
  • [<HKCU>\SOFTWARE\Electronic Arts\Command and Conquer 3]
  • [<HKCU>\SOFTWARE\F-Secure\BackWeb\iLauncher]
  • [<HKCU>\SOFTWARE\CRYTEK\FARCRY\UBI.COM]
  • [<HKCU>\SOFTWARE\Sierra\Empire Earth II]
  • [<HKCU>\SOFTWARE\Sierra\CDKey]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Sports\FIFA 2002]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Sports\FIFA 2005]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Sports\FIFA 07]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Sports\FIFA 2003]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Sports\FIFA 2004]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Pets]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Seasons]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Nightlife]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Open For Business]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Glamour Life Stuff]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Family Fun Stuff]
  • [<HKCU>\SOFTWARE\DVD Audio Extractor\Settings]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Celebration Stuff]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 H M Fashion Stuff]
  • [<HKCU>\SOFTWARE\Techland\Chrome]
  • [<HKCU>\SOFTWARE\THQ\Dawn of War]
  • [<HKCU>\SOFTWARE\THQ\Dawn of War - Dark Crusade]
  • [<HKCU>\SOFTWARE\Activision\Call of Duty 4]
  • [<HKCU>\SOFTWARE\Activision\Call of Duty WAW]
  • [<HKCU>\SOFTWARE\SEGA\Medieval II Total War]
  • [<HKCU>\SOFTWARE\ACD Systems\PicaView]
  • [<HKCU>\SOFTWARE\Eugen Systems\ActOfWar]
  • [<HKCU>\SOFTWARE\Adobe\Golive\5.0\Registration]
  • [<HKCU>\SOFTWARE\ahead\Installation\BAK\Nero 7\Info]
  • [<HKCU>\Software\IMVU\username]
  • [<HKCU>\Software\Paltalk]
  • [<HKCU>\Software\Microsoft\Internet Explorer\IntelliForms\Storage2]
  • [<HKCU>\Software\Beyluxe Messenger]
  • [<HKCU>\SOFTWARE\Ubisoft\Splinter Cell Pandora Tomorrow]
  • [<HKCU>\SOFTWARE\Activision\Call of Duty United Offensive]
  • [<HKCU>\SOFTWARE\Activision\Call of Duty 2]
  • [<HKCU>\SOFTWARE\Ubisoft\Splinter Cell Chaos Theory\Keys]
  • [<HKCU>\SOFTWARE\Activision\Call of Duty]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA GAMES\Battlefield 2142]
  • [<HKCU>\Software\Electronic Arts\EA GAMES\Battlefield Vietnam]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA GAMES\Battlefield 1942 The Road to Rome]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Games\Battlefield 2]
  • [<HKCU>\Software\Electronic Arts\EA GAMES\Black and White]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Games\Burnout Paradise]
  • [<HKCU>\SOFTWARE\TechSmith\Camtasia Studio\4.0]
  • [<HKCU>\Software\Electronic Arts\Black and White 2]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Games\Boulder Dash Rocks]
  • [<HKCU>\SOFTWARE\Elcom\Advanced PDF Password Recovery\Registration Pro]
  • [<HKCU>\SOFTWARE\Elcom\Advanced ZIP Password Recovery\Registration]
  • [<HKCU>\SOFTWARE\Adobe\Photoshop\7.0\Registration]
  • [<HKCU>\SOFTWARE\Elcom\Advanced PDF Password Recovery\Registration]
  • [<HKCU>\SOFTWARE\Sunflowers\Anno 1701]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA GAMES\Battlefield 1942]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA GAMES\Battlefield 1942 Secret Weapons of WWII]
  • [<HKCU>\SOFTWARE\ashampoo\Ashampoo WinOptimizer Platinum 3]
  • [<HKCU>\SOFTWARE\@stake\LC5\Registration]
  • [<HKCU>\SOFTWARE\Electronic Arts\Electronic Arts\FIFA 08]
  • [<HKCU>\Software\O&O\O&O Defrag\8.0\Pro\licenses]
  • [<HKCU>\Software\PowerQuest\PartitionMagic\8.0\UserInfo]
  • [<HKCU>\Software\NuMega\SmartCheck]
  • [<HKCU>\Software\OnlineTVPlayer\RegInfo]
  • [<HKCU>\Software\Passware\Encryption Analyzer\1\Registration,License]
  • [<HKCU>\Software\KONAMI\PES2008]
  • [<HKCU>\Software\Red Storm Entertainment\RAVENSHIELD]
  • [<HKCU>\Software\Passware\Windows Key\7\Registration]
  • [<HKCU>\Software\EnTech\PowerStrip]
  • [<HKCU>\SOFTWARE\Electronic Arts\Electronic Arts\Need for Speed ProStreet]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA GAMES\Need For Speed Underground]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA GAMES\Need For Speed Hot Pursuit 2]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA GAMES\Need for Speed Most Wanted]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA GAMES\Need For Speed Underground 2]
  • [<HKCU>\SOFTWARE\Nero\Installation\Families\Nero 8\Info]
  • [<HKCU>\Software\Westwood\Nox]
  • [<HKCU>\SOFTWARE\Ahead\Nero - Burning Rom\Info]
  • [<HKCU>\Software\Nero\Installation\Families\Nero 7\Info]
  • [<HKCU>\Software\TechSmith\SnagIt\8]
  • [<HKCU>\Software\TexasCalc\License]
  • [<HKCU>\Software\Steganos\SIAVPN]
  • [<HKCU>\Software\THQ\Gas Powered Games\Supreme Commander]
  • [<HKCU>\Software\Electronic Arts\EA Games\The Battle for Middle-earth]
  • [<HKCU>\Software\TuneUp\Utilities\6.0]
  • [<HKCU>\Software\TuneUp\Utilities\7.0]
  • [<HKCU>\Software\Electronic Arts\EA Games\The Orange Box]
  • [<HKCU>\Software\Pegasys Inc.\TMPGEnc DVD Author\1.0]
  • [<HKCU>\Software\Ubisoft\SILENT HUNTER III\Keys]
  • [<HKCU>\Software\Electronic Arts\Maxis\ Sim City 4 Deluxe]
  • [<HKCU>\Software\Electronic Arts\EA GAMES\Shogun Total War - Warlord Edition]
  • [<HKCU>\Software\Atari\Sid Meier's Pirates!]
  • [<HKCU>\Software\Network Associates, Inc.\Sniffer Pro\4.5\USER]
  • [<HKCU>\Software\LucasArts\Star Wars Battlefront II\1.0]
  • [<HKCU>\Software\LucasArts\Star Wars Battlefront II\1.1]
  • [<HKCU>\Software\Silver Style Entertainment\Soldiers Of Anarchy]
  • [<HKCU>\Software\GSC Game World\STALKER-SHOC]
  • [<HKCU>\SOFTWARE\Electronic Arts\Electronic Arts\Need for Speed Carbon]
  • [<HKCU>\SOFTWARE\JoWooD\InstalledGames\IG2]
  • [<HKCU>\SOFTWARE\AVConverter\iPod Converter]
  • [<HKCU>\SOFTWARE\IGI 2 Retail\CDKey]
  • [<HKCU>\SOFTWARE\Ahead\InCD]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA GAMES\James Bond 007 Nightfire]
  • [<HKCU>\SOFTWARE\Macromedia\Fireworks\7\Registration]
  • [<HKCU>\SOFTWARE\Macromedia\Dreamweaver\7\Registration]
  • [<HKCU>\SOFTWARE\3d0\Status Legends of Might and Magic]
  • [<HKCU>\SOFTWARE\Macromedia\Flash\7\Registration]
  • [<HKCU>\SOFTWARE\THQ\Frontlines: Fuel of War]
  • [<HKCU>\SOFTWARE\Headlight\GetRight]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Distribution\Freedom Force]
  • [<HKCU>\SOFTWARE\THQ\Frontlines: Fuel of War Beta]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA GAMES\Global Operations]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Games\Hellgate: London]
  • [<HKCU>\SOFTWARE\Illusion Softworks\Hidden & Dangerous 2]
  • [<HKCU>\SOFTWARE\Valve\Gunman]
  • [<HKCU>\SOFTWARE\Valve\Half-Life\Setting]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Sports\NHL 2003]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Sports\NHL 2004]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Sports\Nascar Racing 2003]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Sports\NHL 2002]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Sports\NHL 2005]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Sports\NBA LIVE 07]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Sports\NBA Live 08]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Sports\NBA LIVE 2003]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Sports\NBA LIVE 2004]
  • [<HKCU>\SOFTWARE\Electronic Arts\Medal of Honor Airborne]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA GAMES\Medal of Honor Allied Assault]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Sports\Madden NFL 07]
  • [<HKCU>\SOFTWARE\JSG\Matrix Saver V2]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA GAMES\Medal of Honor Allied Assault Breakthrough]
  • [<HKCU>\SOFTWARE\mIRC]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Sports\Nascar Racing 2002]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA GAMES\Medal of Honor Allied Assault Spearhead]
  • [<HKCU>\SOFTWARE\Electronic Arts\EA Games\Medal of Honor: Heroes 2]
Modifies file system:
Creates the following files:
  • %TEMP%\passwordfox.exe
  • %TEMP%\firefox.txt
  • %TEMP%\iepv.exe
  • %APPDATA%\MSBuild.il
  • %APPDATA%\MSBuild.pdb
  • %APPDATA%\MSBuild.exe
Deletes the following files:
  • %APPDATA%\MSBuild.pdb
Network activity:
Connects to:
  • 'sm##.gmail.com':587
UDP:
  • DNS ASK sm##.gmail.com

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Free trial

 

Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

Free trial

 

Download Dr.Web

Download by serial number

Download on App Store

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

 

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android

Free trial

14 days

Download now
Get it on Google Play