Defend what you create

Other Resources

Close

Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Trojan.DownLoader9.57172

Added to the Dr.Web virus database: 2013-08-01

Virus description added:

Technical Information

To ensure autorun and distribution:
Modifies the following registry keys:
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'konvibecikiz' = '%HOMEPATH%\konvibecikiz.exe'
Modifies file system :
Creates the following files:
  • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\ec702f375e1b12d218f67ab9ef19ca23_23ef5514-3059-436f-a4a7-4cefaab20eb1
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\telenavis[1].htm
  • %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\bca607a4-87bc-4be7-adce-0a07bdf3afe3
  • %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\Preferred
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\biurimex[1].htm
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\areafor[1].htm
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\pbna[1].htm
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\safetyconnection[1].htm
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\safetyconnection[1].htm
  • %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\72be0620-bd93-4089-b64a-af2b85fd5841
  • %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\30dfb5f6-90b4-477a-82f5-efc633ad1de9
  • %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\a066af98-4a76-4f28-a94d-6bfcb77417c8
  • %HOMEPATH%\konvibecikiz.exe
  • %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\b009b560-19b7-412b-b4dd-393f58a258f1
  • %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\34cef88c-ba80-4638-bf09-5214fd5abb24
  • %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\91c8f50c-de99-4710-b554-c3d043287ec6
  • %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\2297e372-db45-40b7-9ea2-afc07dfd1dcd
  • %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\c4036dbd-b643-480a-bb7d-99a5f1d0589d
Deletes the following files:
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\safetyconnection[1].htm
Network activity:
Connects to:
  • 'sa####connection.ca':80
  • 'ar##for.com':80
  • 'pb##.com':80
  • 'bi##imex.pl':80
  • 'sm##.live.com':25
  • '67.##5.160.76':25
  • 'te###avis.com':80
TCP:
HTTP POST requests:
  • pb##.com/
  • ar##for.com/
  • bi##imex.pl/
UDP:
  • DNS ASK fa#####hofamerica.com
  • DNS ASK co###ne.or.id
  • DNS ASK up###on89.com
  • DNS ASK me###orti.com
  • DNS ASK 4p##p.com
  • DNS ASK wi#####emarketing.com
  • DNS ASK al######ive-aquitaine.co.uk
  • DNS ASK ga###marine.com
  • DNS ASK st#####ldlifeart.com
  • DNS ASK ch####atecovers.com
  • DNS ASK sz###tufi.com
  • DNS ASK co#.#ku.edu.cn
  • DNS ASK sa##s.net
  • DNS ASK co####permarkt.nl
  • DNS ASK sa###david.com
  • DNS ASK wk##.net
  • DNS ASK ho##u.com
  • DNS ASK ma####.us2.mcsv.net
  • DNS ASK ez##di.com
  • DNS ASK go####luecenter.com
  • DNS ASK le###ridica.com
  • DNS ASK co##th.com
  • DNS ASK ws#####rontheweb.com
  • DNS ASK ts#.org
  • DNS ASK ar####esajandek.hu
  • DNS ASK we####dechurch.org
  • DNS ASK ma###egor.co.kr
  • DNS ASK ac#####oambiente.com
  • DNS ASK di##d.com
  • DNS ASK th######inghouseltd.co.uk
  • DNS ASK ga######onlinemagazine.com
  • DNS ASK at#####hnologies.com
  • DNS ASK gi###imo.com
  • DNS ASK wl#.##uisiana.gov
  • DNS ASK ic###ain.com
  • DNS ASK re####eretreat.com
  • DNS ASK ge###r.gen.tr
  • DNS ASK vi####agamba.com
  • DNS ASK ko######ireprotection.com
  • DNS ASK au#####ica-travel.com
  • DNS ASK je###atz.com
  • DNS ASK ho###hd.com.br
  • DNS ASK le###riage.com
  • DNS ASK cg###ngland.com
  • DNS ASK sk###r.com.pl
  • DNS ASK re####efield.co.uk
  • DNS ASK ia###obal.or.id
  • DNS ASK th###rgery.com
  • DNS ASK nu###ech.com
  • DNS ASK mi###ech.net
  • DNS ASK et###les.com
  • DNS ASK fr#####high.school.nz
  • DNS ASK na###ngcw.com
  • DNS ASK ib##.com.br
  • DNS ASK ba######ramsevatrust.org
  • DNS ASK be#####odmetalworks.com
  • DNS ASK mi####io-teatras.lt
  • DNS ASK su###france.com
  • DNS ASK au####ansurfing.at
  • DNS ASK ha####ltimedia.com
  • DNS ASK sl##go.org
  • DNS ASK to####sondesign.com
  • DNS ASK d-##b.net
  • DNS ASK gr###train.coop
  • DNS ASK na####ictures.com
  • DNS ASK se###co-ind.com
  • DNS ASK ku###ci.or.jp
  • DNS ASK ma####grimes.co.uk
  • DNS ASK d4###edia.com
  • DNS ASK ya###oto-sr.com
  • DNS ASK sh###ales.co.uk
  • DNS ASK av###-ime.com
  • DNS ASK fr#####entauction.com
  • DNS ASK sz##tka.com
  • DNS ASK we####llsstl.org
  • DNS ASK st##net.de
  • DNS ASK ru###eberg.com
  • DNS ASK ko###-sa.com
  • DNS ASK ca###choice.org
  • DNS ASK ct###rocess.org
  • DNS ASK te##ole.com
  • DNS ASK pe#c.ca
  • DNS ASK bo####ydesign.com
  • DNS ASK ch####-select.com
  • DNS ASK st##om.nl
  • DNS ASK as#.co.jp
  • DNS ASK tv##ra.net
  • DNS ASK ag##rno.ru
  • DNS ASK em###dalia.com
  • DNS ASK fr###spot.co.za
  • DNS ASK nd####nementiel.com
  • DNS ASK or####networks.net
  • DNS ASK x-#####ommunications.de
  • DNS ASK eg##.net
  • DNS ASK ne#####xininstitute.com
  • DNS ASK bo#r.cz
  • DNS ASK pi##mia.com
  • DNS ASK to###ipe.com
  • DNS ASK wo#####dhillwinery.com
  • DNS ASK ea####rmations.net
  • DNS ASK st####ennygames.com
  • DNS ASK vi###ria.com.pl
  • DNS ASK go####rk-moossee.ch
  • DNS ASK so#####rganizing.com
  • DNS ASK co###rprint.nl
  • DNS ASK te####g-video.com
  • DNS ASK to###nmeuse.com
  • DNS ASK ti###urkey.com
  • DNS ASK ch####clothes.com
  • DNS ASK ni###.com.cn
  • DNS ASK av##ay.com
  • DNS ASK de####scueusa.com
  • DNS ASK e-###ami.com
  • DNS ASK ul##dsu.org
  • DNS ASK mo###ophoto.com
  • DNS ASK se##door.pl
  • DNS ASK be#####rebusiness.org
  • DNS ASK xu###iao.com
  • DNS ASK fl####adoubled.com
  • DNS ASK re###echre.com
  • DNS ASK su###le.co.jp
  • DNS ASK fr#####ckallergy.com
  • DNS ASK ni####ictionary.com
  • DNS ASK pc##ds.com
  • DNS ASK bi#####sbeefjerky.com
  • DNS ASK vb##z.com
  • DNS ASK gr###web.net
  • DNS ASK my####center.com
  • DNS ASK mo#####-vacaciones.com
  • DNS ASK es####-hotelier.com
  • DNS ASK sh###yspizza.ph
  • DNS ASK ca####eonline.com
  • DNS ASK na###sklep.pl
  • DNS ASK pr######nsolutionsky.com
  • DNS ASK sm##.#ompuserve.com
  • DNS ASK hi##ken.com
  • DNS ASK ma##.#irmail.net
  • DNS ASK sg###nting.ca
  • DNS ASK au####ce-web.net
  • DNS ASK eu##sia.it
  • DNS ASK ea##gen.com
  • DNS ASK zi####rbatului.ro
  • DNS ASK gu###man.com.br
  • DNS ASK xn########h8abch1g1b0ap6a9vxa.com
  • DNS ASK pb##.com
  • DNS ASK bu####ss-edge.com
  • DNS ASK ja#####sallamerican.com
  • DNS ASK pa###enna.com
  • DNS ASK co##tney.ca
  • DNS ASK sm##.###global.yahoo.com
  • DNS ASK sm##.#ail.yahoo.com
  • DNS ASK sm##.live.com
  • DNS ASK te###avis.com
  • DNS ASK ar##for.com
  • DNS ASK sa####connection.ca
  • DNS ASK bi##imex.pl
  • DNS ASK sm##.#irectcon.net
  • DNS ASK ar###2aa.org
  • DNS ASK sa##y.com
  • DNS ASK sd#p.ie
  • DNS ASK an###ervice.com
  • DNS ASK ra######ckwarehouse.com.au
  • DNS ASK tr####y-works.com
  • DNS ASK th#####ldsongroup.com
  • DNS ASK na####ecurtiss.com
  • DNS ASK sp##i.org
  • DNS ASK el##ys.com
  • DNS ASK ge####isions.com
  • DNS ASK no###uroya.com
  • DNS ASK cs##c.org
  • DNS ASK ma###acorp.com
  • DNS ASK si####etalsinc.com
  • DNS ASK ch####supplies.net
  • DNS ASK hi###nwiese.de
  • DNS ASK os####-school.com
  • DNS ASK op###er.com.au
  • DNS ASK en####odrigo.com.br
  • DNS ASK au##ma.it
  • DNS ASK ae##ora.com
  • DNS ASK br###ndia.com
  • DNS ASK ro#####cintyre.com.au
  • DNS ASK ac###ctory.net
  • DNS ASK bi#####ultimedia.com
  • DNS ASK br####arm.com.au
  • DNS ASK e-###rming.com
  • DNS ASK ar#####turadigital.com
  • DNS ASK ma#####siecologia.com
  • DNS ASK dj###taro.com
  • DNS ASK pa###ball.be
  • DNS ASK ap###farm.org
  • DNS ASK db####onents.com
  • DNS ASK do####ntasies.com
  • DNS ASK ag#####des-druides.com
  • DNS ASK al###wared.com
  • DNS ASK gl###otels.com
  • DNS ASK ca#####citytuxedo.com
  • DNS ASK di##ro.se
  • DNS ASK sh###zil.com
  • DNS ASK ch###scope.com
  • DNS ASK tu####-saitama.com
  • DNS ASK th###tospas.com
  • DNS ASK bu####llmedia.com
  • DNS ASK sc####inpeach.com
  • DNS ASK ma####grp-spb.ru
  • DNS ASK un###.edu.bo
  • DNS ASK mi###stga.com
  • DNS ASK ta##on.com
  • DNS ASK tr###alau.com
  • DNS ASK ch####ybarry.com
  • DNS ASK me#####-jacquelin.com
  • DNS ASK ai##.co.nz
  • DNS ASK na###gurus.com
  • DNS ASK pe####sion.co.in
  • DNS ASK ma###-man.com
  • DNS ASK de##ille.ca
  • DNS ASK un#####arthgroup.com
  • DNS ASK to#####rthcare.com.au
  • DNS ASK re###dhits.com
  • DNS ASK is####arnataka.org
  • DNS ASK va###ardpkg.com
  • DNS ASK me###ies.org
  • DNS ASK ad####ivechat.us
  • DNS ASK ge###ermusa.com
  • DNS ASK ac###a.com.br
  • DNS ASK li####ist-uk.com
  • DNS ASK hp####rvices.com
  • DNS ASK cb####nting.com.au
Miscellaneous:
Searches for the following windows:
  • ClassName: 'Indicator' WindowName: '(null)'

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android

The Russian developer of Dr.Web anti-viruses

Doctor Web has been developing anti-virus software since 1992

Dr.Web is trusted by users around the world in 200+ countries

The company has delivered an anti-virus as a service since 2007

24/7 tech support

© Doctor Web
2003 — 2019

Doctor Web is the Russian developer of Dr.Web anti-virus software. Dr.Web anti-virus software has been developed since 1992.

2-12А, 3rd street Yamskogo polya, Moscow, Russia, 125040