Підтримка
Цілодобова підтримка | Правила звернення

Зателефонуйте

Глобальна підтримка:
+7 (495) 789-45-86

Поширені запитання |  Форум |  Бот самопідтримки Telegram

Ваші запити

  • Всі: -
  • Незакриті: -
  • Останій: -

Зателефонуйте

Глобальна підтримка:
+7 (495) 789-45-86

Зв'яжіться з нами Незакриті запити: 

Профіль

Профіль

Trojan.DownLoader25.16569

Добавлен в вирусную базу Dr.Web: 2017-08-04

Описание добавлено:

Technical Information

To ensure autorun and distribution:
Modifies the following registry keys:
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '{0a8c4e1a-6fb9-48d5-ac33-d5883510d96c}' = '"%ALLUSERSPROFILE%\Application Data\Package Cache\{0a8c4e1a-6fb9-48d5-ac33-d5883510d96c}\HSS-6...
Malicious functions:
Executes the following:
  • '%ProgramFiles%\Hotspot Shield\bin\HssInstaller.exe' -addcfg "startup.cfg" "/config/service_name" "hshld" "config" -product hss
  • '%ProgramFiles%\Hotspot Shield\bin\HssInstaller.exe' -addcfg "startup.cfg" "/config/ui_path" "%ProgramFiles%\Hotspot Shield\bin\hsscp.exe" "config" -product hss
  • '%ProgramFiles%\Hotspot Shield\bin\HssInstaller.exe' -addcfg "startup.cfg" "/config/installer" "HSS-6.5.1-install-hss-805-ext.exe" "config" -product hss
  • '%ProgramFiles%\Hotspot Shield\bin\HssInstaller.exe' -addcfg "startup.cfg" "/config/htdocs_dir" "%ProgramFiles%\Hotspot Shield\htdocs" "config" -product hss
  • '%ProgramFiles%\Hotspot Shield\bin\HssInstaller.exe' -addcfg "startup.cfg" "/config/config_dir" "%ProgramFiles%\Hotspot Shield\config" "config" -product hss
  • '<SYSTEM32>\taskkill.exe' /F /IM cmw_srv.exe
  • '<SYSTEM32>\net1.exe' stop hshld
  • '<SYSTEM32>\rundll32.exe' "%WINDIR%\Installer\MSI18.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_173000 110 Setup.Actions!Setup.Actions.CustomActions.SetEpochTime
  • '%ProgramFiles%\Hotspot Shield\bin\HssInstaller.exe' -addcfg "startup.cfg" "/config/service_path" "%ProgramFiles%\Hotspot Shield\bin\cmw_srv.exe" "config" -product hss
  • '%ProgramFiles%\Hotspot Shield\bin\HssInstaller.exe' -addcfg "startup.cfg" "/config/home_path" "%ProgramFiles%\Hotspot Shield\\" "config" -product hss
  • '%ProgramFiles%\Hotspot Shield\bin\HssInstaller.exe' -addcfg "startup.cfg" "/config/log_path" "%ProgramFiles%\Hotspot Shield\log\oas.log" "config" -product hss
  • '%ProgramFiles%\Hotspot Shield\bin\HssInstaller.exe' -addcfg "startup.cfg" "/config/log_dir" "%ProgramFiles%\Hotspot Shield\log" "config" -product hss
  • '%ProgramFiles%\Hotspot Shield\bin\HssInstaller.exe' -addcfg "startup.cfg" "/config/log_append" "0" "config" -product hss
  • '%ProgramFiles%\Hotspot Shield\bin\HssInstaller.exe' -addcfg "startup.cfg" "/config/dport_end" "56999" "config" -product hss
  • '%ProgramFiles%\Hotspot Shield\bin\HssInstaller.exe' -addcfg "startup.cfg" "/config/dport_start" "56700" "config" -product hss
  • '%ProgramFiles%\Hotspot Shield\bin\HssInstaller.exe' -addcfg "startup.cfg" "/config/config_ext" "hvpn" "config" -product hss
  • '%ProgramFiles%\Hotspot Shield\bin\HssInstaller.exe' -addcfg "startup.cfg" "/config/verify_dir" "%ProgramFiles%\Hotspot Shield\log\verify" "config" -product hss
  • '%ProgramFiles%\Hotspot Shield\bin\HssInstaller.exe' -addcfg "startup.cfg" "/config/exe_path" "%ProgramFiles%\Hotspot Shield\bin\openvpn.exe" "config" -product hss
  • '%ProgramFiles%\Hotspot Shield\bin\HssInstaller.exe' -addcfg "startup.cfg" "/config/priority" "NORMAL_PRIORITY_CLASS" "config" -product hss
  • '%ProgramFiles%\Hotspot Shield\bin\HssInstaller.exe' -addcfg "startup.cfg" "/config/hydra_path" "%ProgramFiles%\Hotspot Shield\bin\hydra.exe" "config" -product hss
  • '<SYSTEM32>\taskkill.exe' /F /IM hsscp.exe
  • '<SYSTEM32>\rundll32.exe' "%WINDIR%\Installer\MSIA.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_154296 5 Setup.Actions!Setup.Actions.CustomActions.ServiceCleanup
  • '<SYSTEM32>\taskkill.exe' /F /IM FBWMgr.exe
  • '<SYSTEM32>\taskkill.exe' /F /IM af_proxy_cmd.exe
  • '<SYSTEM32>\taskkill.exe' /F /IM FBW.exe
  • '%TEMP%\{0a8c4e1a-6fb9-48d5-ac33-d5883510d96c}\.be\HSS-6.5.1-install-hss-805-ext.exe' -q -burn.elevated BurnPipe.{EC98496B-3B76-4FFF-84CB-6A9E54D8B955} {9AAC22F2-A9DF-49FF-BAAA-49C6C8E167E9} 2924
  • '%TEMP%\~phifpfw.tmp' /S
  • '<SYSTEM32>\msiexec.exe' /V
  • '<SYSTEM32>\rundll32.exe' "%WINDIR%\Installer\MSI9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_152234 1 Setup.Actions!Setup.Actions.CustomActions.Disconnect
  • '<SYSTEM32>\msiexec.exe' -Embedding 8529767DDC866E46F3DCA1E118DF3491
  • '<SYSTEM32>\net.exe' stop HssTrayService
  • '<SYSTEM32>\taskkill.exe' /F /IM hsswd.exe
  • '<SYSTEM32>\net1.exe' stop HssTrayService
  • '<SYSTEM32>\net.exe' stop hshld
  • '<SYSTEM32>\taskkill.exe' /F /IM HssTrayService.exe
  • '<SYSTEM32>\taskkill.exe' /F /IM openvpn.exe
  • '<SYSTEM32>\taskkill.exe' /F /IM af_proxy_cmd_rep.exe
  • '<SYSTEM32>\taskkill.exe' /F /IM hydra.exe
  • '<SYSTEM32>\net1.exe' stop HssWd
  • '<SYSTEM32>\net.exe' stop HssWd
Modifies file system:
Creates the following files:
  • %ProgramFiles%\Hotspot Shield\bin\Hss.Common.dll
  • %ProgramFiles%\Hotspot Shield\bin\Hss.Common.Rpc.dll
  • %ProgramFiles%\Hotspot Shield\bin\Hss.Common.Wcf.dll
  • %ProgramFiles%\Hotspot Shield\bin\Hss.Client.UI.Auxiliary.dll
  • %ProgramFiles%\Hotspot Shield\bin\Hss.Client.UI.View.dll
  • %ProgramFiles%\Hotspot Shield\bin\Hss.Client.UI.ViewModel.dll
  • %ProgramFiles%\Hotspot Shield\htdocs\r\img_new\hss.png
  • %ProgramFiles%\Hotspot Shield\bin\Hss.Service.Backend.dll
  • %ProgramFiles%\Hotspot Shield\bin\Hss.Service.Common.dll
  • %ProgramFiles%\Hotspot Shield\hss.ico
  • %ProgramFiles%\Hotspot Shield\bin\Hss.Logger.dll
  • %ProgramFiles%\Hotspot Shield\htdocs\ntf\img\hss.png
  • %ProgramFiles%\Hotspot Shield\bin\lang\gui-spa.dll
  • %ProgramFiles%\Hotspot Shield\bin\lang\gui-tur.dll
  • %ProgramFiles%\Hotspot Shield\bin\lang\gui-vie.dll
  • %ProgramFiles%\Hotspot Shield\bin\lang\gui-per.dll
  • %ProgramFiles%\Hotspot Shield\bin\lang\gui-por.dll
  • %ProgramFiles%\Hotspot Shield\bin\lang\gui-rus.dll
  • %ProgramFiles%\Hotspot Shield\bin\Hss.Client.Framework.dll
  • %ProgramFiles%\Hotspot Shield\bin\Hss.Client.Management.dll
  • %ProgramFiles%\Hotspot Shield\bin\Hss.Client.Services.dll
  • %ProgramFiles%\Hotspot Shield\htdocs\tiles\HBO_Icon.png
  • %ProgramFiles%\Hotspot Shield\htdocs\hover.html
  • %ProgramFiles%\Hotspot Shield\bin\Hss.Client.Common.dll
  • %ProgramFiles%\Hotspot Shield\htdocs\ntf\img\l.png
  • %ProgramFiles%\Hotspot Shield\htdocs\lang.js
  • %ProgramFiles%\Hotspot Shield\bin\libeay32.dll
  • %ProgramFiles%\Hotspot Shield\htdocs\tiles\Instagram_icon.png
  • %ProgramFiles%\Hotspot Shield\htdocs\tiles\ITV_Icon.png
  • %ProgramFiles%\Hotspot Shield\htdocs\tiles\Joy_Game_Icon.png
  • %ProgramFiles%\Hotspot Shield\htdocs\img\loade.gif
  • %ProgramFiles%\Hotspot Shield\htdocs\upgd\loader.gif
  • %ProgramFiles%\Hotspot Shield\htdocs\loading.html
  • %ProgramFiles%\Hotspot Shield\bin\libidn-11.dll
  • %ProgramFiles%\Hotspot Shield\bin\libssl32.dll
  • %ProgramFiles%\Hotspot Shield\license.txt
  • %ProgramFiles%\Hotspot Shield\bin\Hss.Service.Management.dll
  • %ProgramFiles%\Hotspot Shield\bin\Hss.Service.Messaging.dll
  • %ProgramFiles%\Hotspot Shield\bin\Hss.TrayNtf.exe
  • %ProgramFiles%\Hotspot Shield\bin\Hss.Service.Configuration.dll
  • %ProgramFiles%\Hotspot Shield\bin\Hss.Service.Landing.dll
  • %ProgramFiles%\Hotspot Shield\bin\Hss.Service.ManagedAdapter.dll
  • %ProgramFiles%\Hotspot Shield\htdocs\tiles\Hulu_Icon.png
  • %ProgramFiles%\Hotspot Shield\bin\hydra.exe
  • %ProgramFiles%\Hotspot Shield\config\icooff.cfg
  • %ProgramFiles%\Hotspot Shield\bin\hsscp.exe
  • %ProgramFiles%\Hotspot Shield\bin\hsscp.exe.config
  • %ProgramFiles%\Hotspot Shield\bin\HssInstaller.exe
  • %ProgramFiles%\Hotspot Shield\bin\lang\gui-kor.dll
  • %ProgramFiles%\Hotspot Shield\htdocs\icons\disconnected16.bmp
  • %ProgramFiles%\Hotspot Shield\htdocs\disconnected16.png
  • %ProgramFiles%\Hotspot Shield\htdocs\icons\disconnected16.png
  • %ProgramFiles%\Hotspot Shield\htdocs\disconnected12.png
  • %ProgramFiles%\Hotspot Shield\htdocs\icons\disconnected12.png
  • %ProgramFiles%\Hotspot Shield\htdocs\disconnected16.bmp
  • %ProgramFiles%\Hotspot Shield\htdocs\icons\disconnected20.png
  • %ProgramFiles%\Hotspot Shield\htdocs\disconnected24.bmp
  • %ProgramFiles%\Hotspot Shield\htdocs\icons\disconnected24.bmp
  • %ProgramFiles%\Hotspot Shield\htdocs\disconnected20.bmp
  • %ProgramFiles%\Hotspot Shield\htdocs\icons\disconnected20.bmp
  • %ProgramFiles%\Hotspot Shield\htdocs\disconnected20.png
  • %ProgramFiles%\Hotspot Shield\htdocs\icons\connecting24.png
  • %ProgramFiles%\Hotspot Shield\htdocs\r\img_new\country-list.png
  • %ProgramFiles%\Hotspot Shield\bin\crashrpt_lang.ini
  • %ProgramFiles%\Hotspot Shield\htdocs\connecting24.bmp
  • %ProgramFiles%\Hotspot Shield\htdocs\icons\connecting24.bmp
  • %ProgramFiles%\Hotspot Shield\htdocs\connecting24.png
  • %ProgramFiles%\Hotspot Shield\htdocs\tiles\CWTV_Icon.png
  • %ProgramFiles%\Hotspot Shield\htdocs\disconnected12.bmp
  • %ProgramFiles%\Hotspot Shield\htdocs\icons\disconnected12.bmp
  • %ProgramFiles%\Hotspot Shield\bin\CrashRpt1403.dll
  • %ProgramFiles%\Hotspot Shield\bin\CrashSender1403.exe
  • %ProgramFiles%\Hotspot Shield\htdocs\tiles\Crunchyroll_icon.png
  • %ProgramFiles%\Hotspot Shield\htdocs\greenico.png
  • %ProgramFiles%\Hotspot Shield\bin\lang\gui-ara.dll
  • %ProgramFiles%\Hotspot Shield\bin\lang\gui-bur.dll
  • %ProgramFiles%\Hotspot Shield\bin\FxNtfBridge.dll
  • %ProgramFiles%\Hotspot Shield\bin\FxServiceBridge.dll
  • %ProgramFiles%\Hotspot Shield\htdocs\tiles\Google_music_Icon.png
  • %ProgramFiles%\Hotspot Shield\bin\lang\gui-ger.dll
  • %ProgramFiles%\Hotspot Shield\bin\lang\gui-ind.dll
  • %ProgramFiles%\Hotspot Shield\bin\lang\gui-jpn.dll
  • %ProgramFiles%\Hotspot Shield\bin\lang\gui-chi.dll
  • %ProgramFiles%\Hotspot Shield\bin\lang\gui-eng.dll
  • %ProgramFiles%\Hotspot Shield\bin\lang\gui-fre.dll
  • %ALLUSERSPROFILE%\Application Data\Hotspot Shield\config\dnr.cfg
  • %ProgramFiles%\Hotspot Shield\htdocs\tiles\Ebay_Icon.png
  • %ProgramFiles%\Hotspot Shield\htdocs\r\elite_message_style.css
  • %ProgramFiles%\Hotspot Shield\htdocs\disconnected24.png
  • %ProgramFiles%\Hotspot Shield\htdocs\icons\disconnected24.png
  • %ProgramFiles%\Hotspot Shield\htdocs\r\img_new\disconnecting.gif
  • %ProgramFiles%\Hotspot Shield\htdocs\tiles\Facebook_Icon.png
  • %ProgramFiles%\Hotspot Shield\htdocs\faq.html
  • %ALLUSERSPROFILE%\Application Data\Hotspot Shield\config\fbw-info-direct.cfg
  • %ProgramFiles%\Hotspot Shield\htdocs\ntf\enable_unblock.html
  • %ProgramFiles%\Hotspot Shield\htdocs\error.html
  • %ProgramFiles%\Hotspot Shield\htdocs\tiles\Espn_Icon.png
  • %ProgramFiles%\Hotspot Shield\htdocs\img\logo.png
  • %ProgramFiles%\Hotspot Shield\htdocs\ntf\update.html
  • %ProgramFiles%\Hotspot Shield\htdocs\updatestatus.html
  • %ProgramFiles%\Hotspot Shield\htdocs\upgd\upgrading.html
  • %ProgramFiles%\Hotspot Shield\htdocs\ntf\unblock_doms.html
  • %ALLUSERSPROFILE%\Application Data\Hotspot Shield\config\unblock-rules.cfg
  • %ProgramFiles%\Hotspot Shield\htdocs\ntf\unsafe.html
  • %ProgramFiles%\Hotspot Shield\htdocs\tiles\WEIBO_Icon.png
  • %ProgramFiles%\Hotspot Shield\htdocs\ntf\wifi_protected.html
  • %ProgramFiles%\Hotspot Shield\htdocs\ntf\wifisec.html
  • %ProgramFiles%\Hotspot Shield\bin\vccorlib140.dll
  • %ProgramFiles%\Hotspot Shield\bin\vcruntime140.dll
  • %ProgramFiles%\Hotspot Shield\bin\vistahlp.dll
  • %ProgramFiles%\Hotspot Shield\htdocs\ntf\img\temp_banner.png
  • %ProgramFiles%\Hotspot Shield\htdocs\ntf\template_v2.html
  • %ProgramFiles%\Hotspot Shield\htdocs\tooltip.html
  • %ProgramFiles%\Hotspot Shield\driver\taphss.cat
  • %ProgramFiles%\Hotspot Shield\driver\taphss.sys
  • %ProgramFiles%\Hotspot Shield\bin\tapinstall.exe
  • %ProgramFiles%\Hotspot Shield\htdocs\r\img_new\ui-tutorial\ui-tutorial-2.png
  • %ProgramFiles%\Hotspot Shield\htdocs\r\img_new\ui-tutorial\ui-tutorial-3.png
  • %ProgramFiles%\Hotspot Shield\htdocs\r\img_new\ui-tutorial\ui-tutorial-4.png
  • %ProgramFiles%\Hotspot Shield\htdocs\tiles\Twitter_Icon.png
  • %ProgramFiles%\Hotspot Shield\bin\ucrtbase.dll
  • %ProgramFiles%\Hotspot Shield\htdocs\r\img_new\ui-tutorial\ui-tutorial-1.png
  • %WINDIR%\Installer\MSI31.tmp
  • %WINDIR%\Installer\MSI32.tmp
  • %WINDIR%\Installer\MSI33.tmp
  • %WINDIR%\Installer\MSI2E.tmp
  • %WINDIR%\Installer\MSI2F.tmp
  • %WINDIR%\Installer\MSI30.tmp
  • %WINDIR%\Installer\MSI37.tmp
  • %WINDIR%\Installer\MSI38.tmp
  • %WINDIR%\Installer\MSI39.tmp
  • %WINDIR%\Installer\MSI34.tmp
  • %WINDIR%\Installer\MSI35.tmp
  • %WINDIR%\Installer\MSI36.tmp
  • %ProgramFiles%\Hotspot Shield\htdocs\tiles\Yahoo_Screen_Icon.png
  • %ProgramFiles%\Hotspot Shield\htdocs\tiles\Youtube_Icon.png
  • %WINDIR%\Installer\MSI28.tmp
  • %ProgramFiles%\Hotspot Shield\bin\WpfAnimatedGif.dll
  • %ProgramFiles%\Hotspot Shield\HssWPR\wpr.conf
  • %ProgramFiles%\Hotspot Shield\htdocs\tiles\Yahoo_Icon.png
  • %WINDIR%\Installer\MSI2B.tmp
  • %WINDIR%\Installer\MSI2C.tmp
  • %WINDIR%\Installer\MSI2D.tmp
  • %ALLUSERSPROFILE%\Application Data\Hotspot Shield\config\startup.cfg
  • %WINDIR%\Installer\MSI29.tmp
  • %WINDIR%\Installer\MSI2A.tmp
  • %ProgramFiles%\Hotspot Shield\htdocs\r\img_new\t.gif
  • %ProgramFiles%\Hotspot Shield\htdocs\tiles\Netflix_Icon.png
  • %ProgramFiles%\Hotspot Shield\htdocs\ntf\newhs.html
  • %ProgramFiles%\Hotspot Shield\bin\Newtonsoft.Json.dll
  • %ProgramFiles%\Hotspot Shield\bin\msvcp140.dll
  • %ProgramFiles%\Hotspot Shield\htdocs\tiles\MTV_Icon.png
  • %ProgramFiles%\Hotspot Shield\htdocs\tiles\NBC_Icon.png
  • %ProgramFiles%\Hotspot Shield\bin\Ntf.dll
  • %ProgramFiles%\Hotspot Shield\htdocs\oac.html
  • %ProgramFiles%\Hotspot Shield\driver\OemWin2k.inf
  • %ProgramFiles%\Hotspot Shield\bin\Ninject.dll
  • %ProgramFiles%\Hotspot Shield\bin\NLog.config
  • %ProgramFiles%\Hotspot Shield\bin\NLog.dll
  • %ProgramFiles%\Hotspot Shield\htdocs\upgd\logo.png
  • %ProgramFiles%\Hotspot Shield\htdocs\r\img_new\logo_big.png
  • %ProgramFiles%\Hotspot Shield\htdocs\ntf\img\logo_hss.png
  • %ProgramFiles%\Hotspot Shield\htdocs\ntf\img\logo.png
  • %ProgramFiles%\Hotspot Shield\htdocs\r\img_new\logo.png
  • %ProgramFiles%\Hotspot Shield\htdocs\r\img_new\preuninstall\logo.png
  • %ProgramFiles%\Hotspot Shield\htdocs\menu.html
  • %ProgramFiles%\Hotspot Shield\htdocs\message.html
  • %ProgramFiles%\Hotspot Shield\htdocs\tiles\MLB_Icon.png
  • %ProgramFiles%\Hotspot Shield\htdocs\mail.html
  • %ProgramFiles%\Hotspot Shield\htdocs\ntf\mal_rep.html
  • %ProgramFiles%\Hotspot Shield\htdocs\tiles\manifest.json
  • %ProgramFiles%\Hotspot Shield\sdpkg\sdel.cfg
  • %ProgramFiles%\Hotspot Shield\sdpkg\sdpkg_resource.dll
  • %ProgramFiles%\Hotspot Shield\htdocs\r\img_new\preuninstall\search.png
  • %ProgramFiles%\Hotspot Shield\htdocs\ntf\safe.html
  • %ProgramFiles%\Hotspot Shield\config\sd-info-direct.cfg
  • %ProgramFiles%\Hotspot Shield\config\sd-info-main.cfg
  • %ProgramFiles%\Hotspot Shield\htdocs\ntf\styles.css
  • %ProgramFiles%\Hotspot Shield\htdocs\ntf\styles2.css
  • %ProgramFiles%\Hotspot Shield\bin\System.Net.Http.dll
  • %ProgramFiles%\Hotspot Shield\htdocs\tiles\SLICE_Icon.png
  • %ProgramFiles%\Hotspot Shield\bin\speed.gif
  • %ProgramFiles%\Hotspot Shield\htdocs\ntf\style_v2.css
  • %ProgramFiles%\Hotspot Shield\htdocs\r\img_new\pic_ok.png
  • %ProgramFiles%\Hotspot Shield\htdocs\tiles\PPOMPPU_Icon.png
  • %ProgramFiles%\Hotspot Shield\htdocs\preuninstall.html
  • %ProgramFiles%\Hotspot Shield\bin\openvpn.exe
  • %ProgramFiles%\Hotspot Shield\htdocs\tiles\Pandora_Icon.png
  • %ProgramFiles%\Hotspot Shield\htdocs\r\img_new\pic_attention.png
  • %ALLUSERSPROFILE%\Application Data\Hotspot Shield\config\proxy.pac
  • %ProgramFiles%\Hotspot Shield\htdocs\ntf\img\s.png
  • %ProgramFiles%\Hotspot Shield\htdocs\r\img_new\s.png
  • %ProgramFiles%\Hotspot Shield\bin\Prism.dll
  • %ProgramFiles%\Hotspot Shield\bin\Prism.Wpf.dll
  • %ProgramFiles%\Hotspot Shield\htdocs\proxy.js
  • %ProgramFiles%\Hotspot Shield\htdocs\icons\connecting20.png
  • %ProgramFiles%\Hotspot Shield\bin\api-ms-win-core-errorhandling-l1-1-0.dll
  • %ProgramFiles%\Hotspot Shield\bin\api-ms-win-core-libraryloader-l1-1-0.dll
  • %ProgramFiles%\Hotspot Shield\bin\api-ms-win-core-handle-l1-1-0.dll
  • %TEMP%\Cab24.tmp
  • %TEMP%\Cab26.tmp
  • %ProgramFiles%\Hotspot Shield\bin\Microsoft.Practices.ServiceLocation.dll
  • %ProgramFiles%\Hotspot Shield\bin\api-ms-win-crt-private-l1-1-0.dll
  • %ProgramFiles%\Hotspot Shield\bin\api-ms-win-crt-process-l1-1-0.dll
  • %ProgramFiles%\Hotspot Shield\bin\api-ms-win-crt-runtime-l1-1-0.dll
  • %ProgramFiles%\Hotspot Shield\bin\api-ms-win-core-memory-l1-1-0.dll
  • %ProgramFiles%\Hotspot Shield\bin\api-ms-win-core-string-l1-1-0.dll
  • %ProgramFiles%\Hotspot Shield\bin\api-ms-win-crt-convert-l1-1-0.dll
  • %WINDIR%\Installer\MSI19.tmp
  • %WINDIR%\Installer\MSI1A.tmp
  • %WINDIR%\Installer\MSI1B.tmp
  • %WINDIR%\Installer\MSI18.tmp-\Microsoft.Deployment.WindowsInstaller.dll
  • %WINDIR%\Installer\2312a.ipi
  • %TEMP%\~DF9428.tmp
  • C:\Config.Msi\2312b.rbs
  • %TEMP%\Cab20.tmp
  • %TEMP%\Cab22.tmp
  • %WINDIR%\Installer\MSI1C.tmp
  • %WINDIR%\Installer\MSI1D.tmp
  • %WINDIR%\Installer\MSI1E.tmp
  • %ProgramFiles%\Hotspot Shield\bin\api-ms-win-core-interlocked-l1-1-0.dll
  • %ProgramFiles%\Hotspot Shield\bin\api-ms-win-core-console-l1-1-0.dll
  • %ProgramFiles%\Hotspot Shield\bin\api-ms-win-core-profile-l1-1-0.dll
  • %ProgramFiles%\Hotspot Shield\bin\api-ms-win-crt-locale-l1-1-0.dll
  • %ProgramFiles%\Hotspot Shield\bin\api-ms-win-crt-string-l1-1-0.dll
  • %ProgramFiles%\Hotspot Shield\bin\Hss.Client.Notification.Contract.dll
  • %ProgramFiles%\Hotspot Shield\bin\api-ms-win-core-file-l1-2-0.dll
  • %ProgramFiles%\Hotspot Shield\bin\api-ms-win-core-file-l2-1-0.dll
  • %ProgramFiles%\Hotspot Shield\bin\api-ms-win-core-heap-l1-1-0.dll
  • %ProgramFiles%\Hotspot Shield\bin\api-ms-win-core-sysinfo-l1-1-0.dll
  • %ProgramFiles%\Hotspot Shield\bin\api-ms-win-core-localization-l1-2-0.dll
  • %ProgramFiles%\Hotspot Shield\bin\api-ms-win-core-file-l1-1-0.dll
  • %ProgramFiles%\Hotspot Shield\bin\api-ms-win-crt-filesystem-l1-1-0.dll
  • %ProgramFiles%\Hotspot Shield\bin\Hss.Client.Management.Contract.dll
  • %ProgramFiles%\Hotspot Shield\bin\api-ms-win-core-processthreads-l1-1-0.dll
  • %ProgramFiles%\Hotspot Shield\bin\api-ms-win-crt-utility-l1-1-0.dll
  • %ProgramFiles%\Hotspot Shield\bin\api-ms-win-core-processenvironment-l1-1-0.dll
  • %ProgramFiles%\Hotspot Shield\bin\api-ms-win-core-namedpipe-l1-1-0.dll
  • %ProgramFiles%\Hotspot Shield\bin\api-ms-win-core-debug-l1-1-0.dll
  • %ProgramFiles%\Hotspot Shield\bin\api-ms-win-core-synch-l1-1-0.dll
  • %ProgramFiles%\Hotspot Shield\bin\api-ms-win-core-synch-l1-2-0.dll
  • %ProgramFiles%\Hotspot Shield\bin\api-ms-win-core-processthreads-l1-1-1.dll
  • %ProgramFiles%\Hotspot Shield\bin\Hardcodet.Wpf.TaskbarNotification.dll
  • %ProgramFiles%\Hotspot Shield\bin\Microsoft.Expression.Interactions.dll
  • %WINDIR%\Installer\MSI18.tmp-\WixSharp.dll
  • %TEMP%\Cab7.tmp
  • %WINDIR%\Installer\MSI9.tmp
  • %WINDIR%\Installer\MSI9.tmp-\Setup.Actions.dll
  • %APPDATA%\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
  • %TEMP%\Cab3.tmp
  • %TEMP%\Cab5.tmp
  • %WINDIR%\Installer\MSI9.tmp-\WixSharp.dll
  • %WINDIR%\Installer\MSI9.tmp-\Microsoft.Deployment.WindowsInstaller.dll
  • %WINDIR%\Installer\MSIA.tmp
  • %WINDIR%\Installer\MSI9.tmp-\CustomAction.config
  • %WINDIR%\Installer\MSI9.tmp-\Setup.Helper.dll
  • %WINDIR%\Installer\MSI9.tmp-\Setup.Common.dll
  • %TEMP%\~hndoczx.tmp
  • %TEMP%\Hotspot_Shield_6.5.1_20170804000412.log
  • %ALLUSERSPROFILE%\Application Data\Package Cache\{0a8c4e1a-6fb9-48d5-ac33-d5883510d96c}\HSS-6.5.1-install-hss-805-ext.exe
  • %TEMP%\aut1.tmp
  • %TEMP%\~phifpfw.tmp
  • %TEMP%\aut2.tmp
  • %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
  • %APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
  • %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
  • %ALLUSERSPROFILE%\Application Data\Package Cache\{0a8c4e1a-6fb9-48d5-ac33-d5883510d96c}\state.rsm
  • %TEMP%\Hotspot_Shield_6.5.1_20170804000412_000_HotspotShieldPackageId.log
  • %WINDIR%\Installer\23128.msi
  • %WINDIR%\Installer\MSI14.tmp
  • %WINDIR%\Installer\MSI15.tmp
  • %WINDIR%\Installer\MSI16.tmp
  • %WINDIR%\Installer\MSI11.tmp
  • %WINDIR%\Installer\MSI12.tmp
  • %WINDIR%\Installer\MSI13.tmp
  • %WINDIR%\Installer\MSI18.tmp-\CustomAction.config
  • %WINDIR%\Installer\MSI18.tmp-\Setup.Helper.dll
  • %WINDIR%\Installer\MSI18.tmp-\Setup.Common.dll
  • %WINDIR%\Installer\MSI17.tmp
  • %WINDIR%\Installer\MSI18.tmp
  • %WINDIR%\Installer\MSI18.tmp-\Setup.Actions.dll
  • %WINDIR%\Installer\MSIA.tmp-\Setup.Common.dll
  • %WINDIR%\Installer\MSIA.tmp-\WixSharp.dll
  • %WINDIR%\Installer\MSIA.tmp-\Microsoft.Deployment.WindowsInstaller.dll
  • %WINDIR%\Installer\MSIA.tmp-\Setup.Actions.dll
  • %WINDIR%\Installer\MSIA.tmp-\CustomAction.config
  • %WINDIR%\Installer\MSIA.tmp-\Setup.Helper.dll
  • %WINDIR%\Installer\MSIE.tmp
  • %WINDIR%\Installer\MSIF.tmp
  • %WINDIR%\Installer\MSI10.tmp
  • %WINDIR%\Installer\MSIB.tmp
  • %WINDIR%\Installer\MSIC.tmp
  • %WINDIR%\Installer\MSID.tmp
  • %ProgramFiles%\Hotspot Shield\bin\api-ms-win-core-util-l1-1-0.dll
  • %ProgramFiles%\Hotspot Shield\config\config.hvpn
  • %ProgramFiles%\Hotspot Shield\htdocs\connected.png
  • %ProgramFiles%\Hotspot Shield\htdocs\icons\connected.png
  • %ProgramFiles%\Hotspot Shield\htdocs\common.css
  • %ProgramFiles%\Hotspot Shield\htdocs\common.js
  • %ProgramFiles%\Hotspot Shield\bin\concrt140.dll
  • %ProgramFiles%\Hotspot Shield\htdocs\icons\connected12.png
  • %ProgramFiles%\Hotspot Shield\htdocs\connected16.bmp
  • %ProgramFiles%\Hotspot Shield\htdocs\icons\connected16.bmp
  • %ProgramFiles%\Hotspot Shield\htdocs\connected12.bmp
  • %ProgramFiles%\Hotspot Shield\htdocs\icons\connected12.bmp
  • %ProgramFiles%\Hotspot Shield\htdocs\connected12.png
  • %ProgramFiles%\Hotspot Shield\htdocs\blank.html
  • %ProgramFiles%\Hotspot Shield\htdocs\ntf\cannot_unblock.html
  • %ProgramFiles%\Hotspot Shield\bin\cfghlp.dll
  • %ProgramFiles%\Hotspot Shield\htdocs\tiles\BBC_Icon.png
  • %ProgramFiles%\Hotspot Shield\htdocs\r\img_new\preuninstall\bg.png
  • %ProgramFiles%\Hotspot Shield\htdocs\r\img_new\bg_attention.png
  • %ProgramFiles%\Hotspot Shield\htdocs\upgd\close.png
  • %ProgramFiles%\Hotspot Shield\bin\cmw_srv.exe
  • %ProgramFiles%\Hotspot Shield\bin\cmw_srv.exe.config
  • %ProgramFiles%\Hotspot Shield\bin\cfghlp_cmd64.exe
  • %ProgramFiles%\Hotspot Shield\htdocs\tiles\Chanel4_Icon.png
  • %ProgramFiles%\Hotspot Shield\htdocs\ntf\img\close.png
  • %ProgramFiles%\Hotspot Shield\htdocs\connecting12.png
  • %ProgramFiles%\Hotspot Shield\htdocs\icons\connecting12.png
  • %ProgramFiles%\Hotspot Shield\htdocs\connecting16.bmp
  • %ProgramFiles%\Hotspot Shield\htdocs\icons\connecting.png
  • %ProgramFiles%\Hotspot Shield\htdocs\connecting12.bmp
  • %ProgramFiles%\Hotspot Shield\htdocs\icons\connecting12.bmp
  • %ProgramFiles%\Hotspot Shield\htdocs\connecting20.bmp
  • %ProgramFiles%\Hotspot Shield\htdocs\icons\connecting20.bmp
  • %ProgramFiles%\Hotspot Shield\htdocs\connecting20.png
  • %ProgramFiles%\Hotspot Shield\htdocs\icons\connecting16.bmp
  • %ProgramFiles%\Hotspot Shield\htdocs\connecting16.png
  • %ProgramFiles%\Hotspot Shield\htdocs\icons\connecting16.png
  • %ProgramFiles%\Hotspot Shield\htdocs\icons\connected20.bmp
  • %ProgramFiles%\Hotspot Shield\htdocs\connected20.png
  • %ProgramFiles%\Hotspot Shield\htdocs\icons\connected20.png
  • %ProgramFiles%\Hotspot Shield\htdocs\connected16.png
  • %ProgramFiles%\Hotspot Shield\htdocs\icons\connected16.png
  • %ProgramFiles%\Hotspot Shield\htdocs\connected20.bmp
  • %ProgramFiles%\Hotspot Shield\htdocs\icons\connected24.png
  • %ProgramFiles%\Hotspot Shield\htdocs\r\img_new\connecting.gif
  • %ProgramFiles%\Hotspot Shield\htdocs\connecting.png
  • %ProgramFiles%\Hotspot Shield\htdocs\connected24.bmp
  • %ProgramFiles%\Hotspot Shield\htdocs\icons\connected24.bmp
  • %ProgramFiles%\Hotspot Shield\htdocs\connected24.png
  • %ProgramFiles%\Hotspot Shield\htdocs\ntf\img\bandwidth_fbw_logo.png
  • %ProgramFiles%\Hotspot Shield\bin\System.Windows.Interactivity.dll
  • %ProgramFiles%\Hotspot Shield\htdocs\r\img_new\pic_virtual_location_for_free_user.png
  • %ProgramFiles%\Hotspot Shield\bin\api-ms-win-core-rtlsupport-l1-1-0.dll
  • %ProgramFiles%\Hotspot Shield\bin\api-ms-win-core-datetime-l1-1-0.dll
  • %ProgramFiles%\Hotspot Shield\bin\api-ms-win-core-timezone-l1-1-0.dll
  • %ProgramFiles%\Hotspot Shield\bin\api-ms-win-crt-multibyte-l1-1-0.dll
  • %ProgramFiles%\Hotspot Shield\htdocs\r\img_new\ad.png
  • %ProgramFiles%\Hotspot Shield\driver\af.cer
  • %ProgramFiles%\Hotspot Shield\driver\af16.cer
  • %ProgramFiles%\Hotspot Shield\bin\api-ms-win-crt-environment-l1-1-0.dll
  • %ProgramFiles%\Hotspot Shield\htdocs\r\img_new\a.gif
  • %ProgramFiles%\Hotspot Shield\htdocs\tiles\ABS_Icon.png
  • %ProgramFiles%\Hotspot Shield\bin\de\Hss.Client.UI.View.resources.dll
  • %ProgramFiles%\Hotspot Shield\bin\es\Hss.Client.UI.View.resources.dll
  • %ProgramFiles%\Hotspot Shield\bin\fr\Hss.Client.UI.View.resources.dll
  • %ProgramFiles%\Hotspot Shield\bin\api-ms-win-crt-conio-l1-1-0.dll
  • %ProgramFiles%\Hotspot Shield\bin\api-ms-win-crt-stdio-l1-1-0.dll
  • %ProgramFiles%\Hotspot Shield\bin\ru\Hss.Client.UI.View.resources.dll
  • %ProgramFiles%\Hotspot Shield\bin\pt\Hss.Client.UI.View.resources.dll
  • %ProgramFiles%\Hotspot Shield\bin\ar\Hss.Client.UI.View.resources.dll
  • %ProgramFiles%\Hotspot Shield\bin\tr\Hss.Client.UI.View.resources.dll
  • %ProgramFiles%\Hotspot Shield\bin\id\Hss.Client.UI.View.resources.dll
  • %ProgramFiles%\Hotspot Shield\bin\ja\Hss.Client.UI.View.resources.dll
  • %ProgramFiles%\Hotspot Shield\bin\ko\Hss.Client.UI.View.resources.dll
  • %ProgramFiles%\Hotspot Shield\htdocs\automode16.bmp
  • %ProgramFiles%\Hotspot Shield\htdocs\automode16.png
  • %ProgramFiles%\Hotspot Shield\htdocs\automode20.bmp
  • %ProgramFiles%\Hotspot Shield\htdocs\automode.png
  • %ProgramFiles%\Hotspot Shield\htdocs\automode12.bmp
  • %ProgramFiles%\Hotspot Shield\htdocs\automode12.png
  • %ProgramFiles%\Hotspot Shield\htdocs\ntf\bandwidth_fbw.html
  • %ProgramFiles%\Hotspot Shield\htdocs\ntf\img\bandwidth_fbw_close.png
  • %ProgramFiles%\Hotspot Shield\htdocs\ntf\img\bandwidth_fbw_graf.png
  • %ProgramFiles%\Hotspot Shield\htdocs\automode20.png
  • %ProgramFiles%\Hotspot Shield\htdocs\automode24.bmp
  • %ProgramFiles%\Hotspot Shield\htdocs\automode24.png
  • %ProgramFiles%\Hotspot Shield\htdocs\tiles\AmazonPrime_Icon.png
  • %ProgramFiles%\Hotspot Shield\htdocs\tiles\AMC_Icon.png
  • %ProgramFiles%\Hotspot Shield\htdocs\ntf\anim.js
  • %ProgramFiles%\Hotspot Shield\driver\af2.cer
  • %ProgramFiles%\Hotspot Shield\bin\afvpn.dll
  • %ProgramFiles%\Hotspot Shield\htdocs\tiles\Amazon_Icon.png
  • %ProgramFiles%\Hotspot Shield\bin\api-ms-win-crt-time-l1-1-0.dll
  • %ProgramFiles%\Hotspot Shield\htdocs\applaunch.html
  • %ProgramFiles%\Hotspot Shield\htdocs\ntf\auto_connect_template.html
  • %ProgramFiles%\Hotspot Shield\htdocs\ntf\anim_v2.js
  • %ProgramFiles%\Hotspot Shield\bin\api-ms-win-crt-heap-l1-1-0.dll
  • %ProgramFiles%\Hotspot Shield\bin\api-ms-win-crt-math-l1-1-0.dll
Sets the 'hidden' attribute to the following files:
  • %TEMP%\~hndoczx.tmp
  • %TEMP%\~phifpfw.tmp
Deletes the following files:
  • %WINDIR%\Installer\MSI1E.tmp
  • %TEMP%\Cab20.tmp
  • %WINDIR%\Installer\MSI1C.tmp
  • %WINDIR%\Installer\MSI1D.tmp
  • %TEMP%\Cab26.tmp
  • %WINDIR%\Installer\MSI28.tmp
  • %TEMP%\Cab22.tmp
  • %TEMP%\Cab24.tmp
  • %WINDIR%\Installer\MSI18.tmp-\Setup.Common.dll
  • %WINDIR%\Installer\MSI18.tmp-\Setup.Helper.dll
  • %WINDIR%\Installer\MSI18.tmp-\Microsoft.Deployment.WindowsInstaller.dll
  • %WINDIR%\Installer\MSI18.tmp-\Setup.Actions.dll
  • %WINDIR%\Installer\MSI1A.tmp
  • %WINDIR%\Installer\MSI1B.tmp
  • %WINDIR%\Installer\MSI18.tmp-\WixSharp.dll
  • %WINDIR%\Installer\MSI18.tmp
  • %WINDIR%\Installer\MSI33.tmp
  • %WINDIR%\Installer\MSI34.tmp
  • %WINDIR%\Installer\MSI31.tmp
  • %WINDIR%\Installer\MSI32.tmp
  • %WINDIR%\Installer\MSI37.tmp
  • %WINDIR%\Installer\MSI38.tmp
  • %WINDIR%\Installer\MSI35.tmp
  • %WINDIR%\Installer\MSI36.tmp
  • %WINDIR%\Installer\MSI2B.tmp
  • %WINDIR%\Installer\MSI2C.tmp
  • %WINDIR%\Installer\MSI29.tmp
  • %WINDIR%\Installer\MSI2A.tmp
  • %WINDIR%\Installer\MSI2F.tmp
  • %WINDIR%\Installer\MSI30.tmp
  • %WINDIR%\Installer\MSI2D.tmp
  • %WINDIR%\Installer\MSI2E.tmp
  • %WINDIR%\Installer\MSI18.tmp-\CustomAction.config
  • %WINDIR%\Installer\MSI9.tmp-\WixSharp.dll
  • %WINDIR%\Installer\MSI9.tmp
  • %WINDIR%\Installer\MSI9.tmp-\Setup.Common.dll
  • %WINDIR%\Installer\MSI9.tmp-\Setup.Helper.dll
  • %WINDIR%\Installer\MSIA.tmp-\Setup.Actions.dll
  • %WINDIR%\Installer\MSIA.tmp-\Setup.Common.dll
  • %WINDIR%\Installer\MSIA.tmp-\CustomAction.config
  • %WINDIR%\Installer\MSIA.tmp-\Microsoft.Deployment.WindowsInstaller.dll
  • %TEMP%\Cab3.tmp
  • %TEMP%\Cab5.tmp
  • %TEMP%\aut1.tmp
  • %TEMP%\aut2.tmp
  • %WINDIR%\Installer\MSI9.tmp-\Microsoft.Deployment.WindowsInstaller.dll
  • %WINDIR%\Installer\MSI9.tmp-\Setup.Actions.dll
  • %TEMP%\Cab7.tmp
  • %WINDIR%\Installer\MSI9.tmp-\CustomAction.config
  • %WINDIR%\Installer\MSI12.tmp
  • %WINDIR%\Installer\MSI13.tmp
  • %WINDIR%\Installer\MSI10.tmp
  • %WINDIR%\Installer\MSI11.tmp
  • %WINDIR%\Installer\MSI16.tmp
  • %WINDIR%\Installer\MSI17.tmp
  • %WINDIR%\Installer\MSI14.tmp
  • %WINDIR%\Installer\MSI15.tmp
  • %WINDIR%\Installer\MSIA.tmp
  • %WINDIR%\Installer\MSIB.tmp
  • %WINDIR%\Installer\MSIA.tmp-\Setup.Helper.dll
  • %WINDIR%\Installer\MSIA.tmp-\WixSharp.dll
  • %WINDIR%\Installer\MSIE.tmp
  • %WINDIR%\Installer\MSIF.tmp
  • %WINDIR%\Installer\MSIC.tmp
  • %WINDIR%\Installer\MSID.tmp
Moves the following files:
  • from %ALLUSERSPROFILE%\Application Data\Package Cache\.unverified\HotspotShieldPackageId to %ALLUSERSPROFILE%\Application Data\Package Cache\{AF599C42-A2E5-4251-B7EE-4925B177BB96}v6.5.1.10355\HSS-6.5.1-install-hss-805-ext.msi
  • from %TEMP%\{0a8c4e1a-6fb9-48d5-ac33-d5883510d96c}\HotspotShieldPackageId to %ALLUSERSPROFILE%\Application Data\Package Cache\.unverified\HotspotShieldPackageId
Network activity:
Connects to:
  • 'www.download.windowsupdate.com':80
  • 'wp#d':80
TCP:
HTTP GET requests:
  • http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
  • http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
  • http://11#.#11.111.1/wpad.dat via wp#d
UDP:
  • DNS ASK www.download.windowsupdate.com
  • DNS ASK wp#d
Miscellaneous:
Searches for the following windows:
  • ClassName: '' WindowName: ''
  • ClassName: 'Shell_TrayWnd' WindowName: ''

Рекомендации по лечению

  1. В случае если операционная система способна загрузиться (в штатном режиме или режиме защиты от сбоев), скачайте лечащую утилиту Dr.Web CureIt! и выполните с ее помощью полную проверку вашего компьютера, а также используемых вами переносных носителей информации.
  2. Если загрузка операционной системы невозможна, измените настройки BIOS вашего компьютера, чтобы обеспечить возможность загрузки ПК с компакт-диска или USB-накопителя. Скачайте образ аварийного диска восстановления системы Dr.Web® LiveDisk или утилиту записи Dr.Web® LiveDisk на USB-накопитель, подготовьте соответствующий носитель. Загрузив компьютер с использованием данного носителя, выполните его полную проверку и лечение обнаруженных угроз.
Скачать Dr.Web

По серийному номеру

Выполните полную проверку системы с использованием Антивируса Dr.Web Light для macOS. Данный продукт можно загрузить с официального сайта Apple App Store.

На загруженной ОС выполните полную проверку всех дисковых разделов с использованием продукта Антивирус Dr.Web для Linux.

Скачать Dr.Web

По серийному номеру

  1. Если мобильное устройство функционирует в штатном режиме, загрузите и установите на него бесплатный антивирусный продукт Dr.Web для Android Light. Выполните полную проверку системы и используйте рекомендации по нейтрализации обнаруженных угроз.
  2. Если мобильное устройство заблокировано троянцем-вымогателем семейства Android.Locker (на экране отображается обвинение в нарушении закона, требование выплаты определенной денежной суммы или иное сообщение, мешающее нормальной работе с устройством), выполните следующие действия:
    • загрузите свой смартфон или планшет в безопасном режиме (в зависимости от версии операционной системы и особенностей конкретного мобильного устройства эта процедура может быть выполнена различными способами; обратитесь за уточнением к инструкции, поставляемой вместе с приобретенным аппаратом, или напрямую к его производителю);
    • после активации безопасного режима установите на зараженное устройство бесплатный антивирусный продукт Dr.Web для Android Light и произведите полную проверку системы, выполнив рекомендации по нейтрализации обнаруженных угроз;
    • выключите устройство и включите его в обычном режиме.

Подробнее о Dr.Web для Android

Демо бесплатно на 14 дней

Выдаётся при установке