Підтримка
Цілодобова підтримка | Правила звернення

Зателефонуйте

Глобальна підтримка:
+7 (495) 789-45-86

Поширені запитання |  Форум |  Бот самопідтримки Telegram

Ваші запити

  • Всі: -
  • Незакриті: -
  • Останій: -

Зателефонуйте

Глобальна підтримка:
+7 (495) 789-45-86

Зв'яжіться з нами Незакриті запити: 

Профіль

Профіль

Trojan.Encoder.31275

Добавлен в вирусную базу Dr.Web: 2020-03-17

Описание добавлено:

Technical Information

To ensure autorun and distribution
Creates the following files on removable media
  • <Drive name for removable media>:\nemty_8g1x8d9-decrypt.txt
  • <Drive name for removable media>:\split.avi
  • <Drive name for removable media>:\000814251_video_01.avi
  • <Drive name for removable media>:\join.avi
  • <Drive name for removable media>:\dial.bmp
  • <Drive name for removable media>:\dashborder_144.bmp
  • <Drive name for removable media>:\sdksampleprivdeveloper.cer
  • <Drive name for removable media>:\contoso_1.cer
  • <Drive name for removable media>:\sdkfailsafeemulator.cer
  • <Drive name for removable media>:\testcertificate.cer
  • <Drive name for removable media>:\pmd.cer
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Executes the following
  • '%WINDIR%\syswow64\taskkill.exe' /f /im sql.*
  • '%WINDIR%\syswow64\taskkill.exe' /f /im WBGX.*
  • '%WINDIR%\syswow64\taskkill.exe' /f /im QBW32.*
  • '%WINDIR%\syswow64\taskkill.exe' /f /im node.*
  • '%WINDIR%\syswow64\taskkill.exe' /f /im virtualboxvm.*
  • '%WINDIR%\syswow64\taskkill.exe' /f /im onenote.*
  • '%WINDIR%\syswow64\net.exe' stop QBVSS
  • '%WINDIR%\syswow64\taskkill.exe' /f /im excel.*
  • '%WINDIR%\syswow64\net.exe' stop QBCFMontorService
  • '%WINDIR%\syswow64\net.exe' stop cbVSCService11
  • '%WINDIR%\syswow64\taskkill.exe' /f /im oracle.*
  • '%WINDIR%\syswow64\net.exe' stop CobianBackup11
  • '%WINDIR%\syswow64\net.exe' stop SQLBrowser
  • '%WINDIR%\syswow64\net.exe' stop SQLAgent$SQLEXPRESS
  • '%WINDIR%\syswow64\net.exe' stop MongoDB
  • '%WINDIR%\syswow64\taskkill.exe' /f /im thunderbird.*
  • '%WINDIR%\syswow64\net.exe' stop MSSQLServerADHelper100
  • '%WINDIR%\syswow64\net.exe' stop MSSQL$SQLEXPRESS
  • '%WINDIR%\syswow64\taskkill.exe' /f /im outlook.*
  • '%WINDIR%\syswow64\net.exe' stop SQLWriter
  • '%WINDIR%\syswow64\net.exe' stop Apache2.4
  • '%WINDIR%\syswow64\net.exe' stop AcronisAgent
  • '%WINDIR%\syswow64\taskkill.exe' /f /im wordpad.*
  • '%WINDIR%\syswow64\net.exe' stop AcrSch2Svc
  • '%WINDIR%\syswow64\net.exe' stop OracleServiceXE
  • '%WINDIR%\syswow64\net.exe' stop OracleXETNSListener
  • '%WINDIR%\syswow64\taskkill.exe' /f /im winword.*
  • '%WINDIR%\syswow64\net.exe' stop DbxSvc
  • '%WINDIR%\syswow64\taskkill.exe' /f /im Teams.*
  • '%WINDIR%\syswow64\taskkill.exe' /f /im Flow.*
Reads files which store third party applications passwords
  • %HOMEPATH%\desktop\3.jpeg
  • %HOMEPATH%\desktop\sdksampleunprivdeveloper.cer
  • %HOMEPATH%\desktop\pushkin.jpeg
  • %HOMEPATH%\desktop\parnas_01.jpeg
  • %HOMEPATH%\desktop\holycrosschurchinstructions.docx
  • %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
  • %HOMEPATH%\desktop\glidescope_review_rev_010.docx
  • %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
  • %HOMEPATH%\desktop\february_catalogue__2015.doc
  • %HOMEPATH%\desktop\dialmap.bmp
  • %HOMEPATH%\desktop\dial.bmp
  • %HOMEPATH%\desktop\tileimage.bmp
  • %HOMEPATH%\desktop\delete.avi
  • %HOMEPATH%\desktop\dashborder_96.bmp
  • %HOMEPATH%\desktop\correct.avi
  • %HOMEPATH%\desktop\contoso_1.cer
  • %HOMEPATH%\desktop\contosoroot_1.cer
  • %HOMEPATH%\desktop\contosoroot.cer
  • %HOMEPATH%\desktop\coffee.bmp
  • %HOMEPATH%\desktop\browse.html
  • %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
  • %HOMEPATH%\desktop\adhd_and_obesity.docx
  • %HOMEPATH%\desktop\adadsi.html
  • %HOMEPATH%\desktop\default.bmp
  • %HOMEPATH%\desktop\tree_view.html
Modifies file system
Creates the following files
  • %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\917b685c402c569c7ef15953ac01f631_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
  • C:\users\all users\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\packages\vcruntimeminimum_x86\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\package cache\{b55f7208-e02b-4828-ac78-59c73ddf5bc7}\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\package cache\{b55f7208-e02b-4828-ac78-59c73ddf5bc7}\state.rsm
  • C:\users\all users\package cache\{bc958bd2-5dac-3862-bb1a-c1be0790438d}v14.0.23026\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\package cache\{bc958bd2-5dac-3862-bb1a-c1be0790438d}v14.0.23026\packages\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\package cache\{bc958bd2-5dac-3862-bb1a-c1be0790438d}v14.0.23026\packages\vcruntimeadditional_amd64\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\vcruntimeadditional_x86\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\package cache\{ce085a78-074e-4823-8dc1-8a721b94b76d}\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\package cache\{ce085a78-074e-4823-8dc1-8a721b94b76d}\state.rsm
  • C:\users\all users\package cache\{dde2682b-961a-41ea-8d44-6005991b7947}\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\package cache\{dde2682b-961a-41ea-8d44-6005991b7947}\state.rsm
  • C:\users\all users\package cache\{0f12c81f-93ef-46ec-bc94-d952c1a775d4}\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\package cache\{e46eca4f-393b-40df-9f49-076faf788d83}\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\package cache\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\package cache\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\state.rsm
  • C:\users\all users\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\state.rsm
  • C:\users\all users\start menu\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\sun\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\sun\java\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\sun\java\java update\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\sun\java\java update\jaureglist.xml
  • C:\users\all users\templates\nemty_8g1x8d9-decrypt.txt
  • C:\users\default\nemty_8g1x8d9-decrypt.txt
  • C:\users\default\application data\nemty_8g1x8d9-decrypt.txt
  • C:\users\default\cookies\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\packages\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\package cache\{a2199617-3609-410f-a8e8-e8806c73545b}\state.rsm
  • C:\users\all users\package cache\{a2199617-3609-410f-a8e8-e8806c73545b}\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\state.rsm
  • C:\users\all users\oracle\java\installcache_x64\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\oracle\java\installcache_x64\baseimagefam8
  • C:\users\all users\oracle\java\javapath\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\package cache\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\x64\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\x64\windows6.1-kb2999226-x64.msu
  • C:\users\all users\package cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\package cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\state.rsm
  • C:\users\all users\package cache\{0d3e9e15-de7a-300b-96f1-b4af12b96488}v14.0.23026\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\package cache\{0d3e9e15-de7a-300b-96f1-b4af12b96488}v14.0.23026\packages\nemty_8g1x8d9-decrypt.txt
  • C:\users\default\desktop\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\package cache\{e46eca4f-393b-40df-9f49-076faf788d83}\state.rsm
  • C:\users\all users\package cache\{0d3e9e15-de7a-300b-96f1-b4af12b96488}v14.0.23026\packages\vcruntimeminimum_amd64\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\package cache\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\package cache\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\state.rsm
  • C:\users\all users\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm
  • C:\users\all users\package cache\{35459b22-19a6-44ec-8d34-27eb3131acac}\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\package cache\{35459b22-19a6-44ec-8d34-27eb3131acac}\state.rsm
  • C:\users\all users\package cache\{51adbf11-493f-431c-a862-967a0fae2944}\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\package cache\{51adbf11-493f-431c-a862-967a0fae2944}\state.rsm
  • C:\users\all users\package cache\{615bc16d-60f5-482e-91b3-b51d8130963b}\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\package cache\{615bc16d-60f5-482e-91b3-b51d8130963b}\state.rsm
  • C:\users\all users\package cache\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\package cache\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\state.rsm
  • C:\users\all users\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\oracle\java\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\package cache\{0f12c81f-93ef-46ec-bc94-d952c1a775d4}\state.rsm
  • C:\users\default\documents\nemty_8g1x8d9-decrypt.txt
  • C:\users\default\documents\my music\nemty_8g1x8d9-decrypt.txt
  • C:\users\default\documents\my pictures\nemty_8g1x8d9-decrypt.txt
  • %HOMEPATH%\nemty_8g1x8d9-decrypt.txt
  • %HOMEPATH%\application data\nemty_8g1x8d9-decrypt.txt
  • %HOMEPATH%\contacts\nemty_8g1x8d9-decrypt.txt
  • %HOMEPATH%\cookies\nemty_8g1x8d9-decrypt.txt
  • %HOMEPATH%\desktop\nemty_8g1x8d9-decrypt.txt
  • %HOMEPATH%\documents\nemty_8g1x8d9-decrypt.txt
  • %HOMEPATH%\documents\my music\nemty_8g1x8d9-decrypt.txt
  • %HOMEPATH%\documents\my pictures\nemty_8g1x8d9-decrypt.txt
  • %HOMEPATH%\documents\my videos\nemty_8g1x8d9-decrypt.txt
  • %HOMEPATH%\downloads\nemty_8g1x8d9-decrypt.txt
  • %HOMEPATH%\favorites\nemty_8g1x8d9-decrypt.txt
  • %HOMEPATH%\favorites\links\nemty_8g1x8d9-decrypt.txt
  • %HOMEPATH%\favorites\links for united states\nemty_8g1x8d9-decrypt.txt
  • %HOMEPATH%\favorites\microsoft websites\nemty_8g1x8d9-decrypt.txt
  • %HOMEPATH%\favorites\windows live\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\oracle\nemty_8g1x8d9-decrypt.txt
  • %HOMEPATH%\links\nemty_8g1x8d9-decrypt.txt
  • %HOMEPATH%\local settings\nemty_8g1x8d9-decrypt.txt
  • %HOMEPATH%\music\nemty_8g1x8d9-decrypt.txt
  • %HOMEPATH%\my documents\nemty_8g1x8d9-decrypt.txt
  • %HOMEPATH%\nethood\nemty_8g1x8d9-decrypt.txt
  • %HOMEPATH%\pictures\nemty_8g1x8d9-decrypt.txt
  • %HOMEPATH%\printhood\nemty_8g1x8d9-decrypt.txt
  • %HOMEPATH%\recent\nemty_8g1x8d9-decrypt.txt
  • %HOMEPATH%\saved games\nemty_8g1x8d9-decrypt.txt
  • %HOMEPATH%\searches\nemty_8g1x8d9-decrypt.txt
  • %HOMEPATH%\sendto\nemty_8g1x8d9-decrypt.txt
  • %HOMEPATH%\start menu\nemty_8g1x8d9-decrypt.txt
  • %HOMEPATH%\templates\nemty_8g1x8d9-decrypt.txt
  • %HOMEPATH%\videos\nemty_8g1x8d9-decrypt.txt
  • C:\users\public\videos\sample videos\nemty_8g1x8d9-decrypt.txt
  • C:\users\default\videos\nemty_8g1x8d9-decrypt.txt
  • C:\users\public\videos\nemty_8g1x8d9-decrypt.txt
  • C:\users\default\templates\nemty_8g1x8d9-decrypt.txt
  • C:\users\default\documents\my videos\nemty_8g1x8d9-decrypt.txt
  • C:\users\default\downloads\nemty_8g1x8d9-decrypt.txt
  • C:\users\default\favorites\nemty_8g1x8d9-decrypt.txt
  • C:\users\default\links\nemty_8g1x8d9-decrypt.txt
  • C:\users\default\local settings\nemty_8g1x8d9-decrypt.txt
  • C:\users\default\music\nemty_8g1x8d9-decrypt.txt
  • C:\users\default\my documents\nemty_8g1x8d9-decrypt.txt
  • C:\users\default\nethood\nemty_8g1x8d9-decrypt.txt
  • C:\users\default\pictures\nemty_8g1x8d9-decrypt.txt
  • C:\users\default\printhood\nemty_8g1x8d9-decrypt.txt
  • C:\users\default\recent\nemty_8g1x8d9-decrypt.txt
  • C:\users\default\saved games\nemty_8g1x8d9-decrypt.txt
  • C:\users\default\sendto\nemty_8g1x8d9-decrypt.txt
  • C:\users\default\start menu\nemty_8g1x8d9-decrypt.txt
  • %HOMEPATH%\voip\nemty_8g1x8d9-decrypt.txt
  • C:\users\public\recorded tv\nemty_8g1x8d9-decrypt.txt
  • C:\users\default user\nemty_8g1x8d9-decrypt.txt
  • C:\users\public\nemty_8g1x8d9-decrypt.txt
  • C:\users\public\desktop\nemty_8g1x8d9-decrypt.txt
  • C:\users\public\documents\nemty_8g1x8d9-decrypt.txt
  • C:\users\public\documents\my music\nemty_8g1x8d9-decrypt.txt
  • C:\users\public\documents\my pictures\nemty_8g1x8d9-decrypt.txt
  • C:\users\public\documents\my videos\nemty_8g1x8d9-decrypt.txt
  • C:\users\public\downloads\nemty_8g1x8d9-decrypt.txt
  • C:\users\public\favorites\nemty_8g1x8d9-decrypt.txt
  • C:\users\public\libraries\nemty_8g1x8d9-decrypt.txt
  • C:\users\public\music\nemty_8g1x8d9-decrypt.txt
  • C:\users\public\music\sample music\nemty_8g1x8d9-decrypt.txt
  • C:\users\public\pictures\nemty_8g1x8d9-decrypt.txt
  • C:\users\public\pictures\sample pictures\nemty_8g1x8d9-decrypt.txt
  • C:\users\public\recorded tv\sample media\nemty_8g1x8d9-decrypt.txt
  • %HOMEPATH%\favorites\msn websites\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\ntuser.pol
  • C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_netsdknamedurls.hxw
  • C:\far2\plugins\network\nemty_8g1x8d9-decrypt.txt
  • C:\far2\plugins\proclist\nemty_8g1x8d9-decrypt.txt
  • C:\far2\plugins\tmppanel\nemty_8g1x8d9-decrypt.txt
  • C:\far2\pluginsdk\nemty_8g1x8d9-decrypt.txt
  • C:\far2\pluginsdk\headers.c\nemty_8g1x8d9-decrypt.txt
  • C:\far2\pluginsdk\headers.pas\nemty_8g1x8d9-decrypt.txt
  • C:\msocache\nemty_8g1x8d9-decrypt.txt
  • C:\msocache\all users\nemty_8g1x8d9-decrypt.txt
  • C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\nemty_8g1x8d9-decrypt.txt
  • C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\nemty_8g1x8d9-decrypt.txt
  • C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\nemty_8g1x8d9-decrypt.txt
  • C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\nemty_8g1x8d9-decrypt.txt
  • C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\nemty_8g1x8d9-decrypt.txt
  • C:\far2\documentation\eng\nemty_8g1x8d9-decrypt.txt
  • C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\nemty_8g1x8d9-decrypt.txt
  • C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\nemty_8g1x8d9-decrypt.txt
  • C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\nemty_8g1x8d9-decrypt.txt
  • C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\nemty_8g1x8d9-decrypt.txt
  • C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\nemty_8g1x8d9-decrypt.txt
  • C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\nemty_8g1x8d9-decrypt.txt
  • C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\nemty_8g1x8d9-decrypt.txt
  • C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\nemty_8g1x8d9-decrypt.txt
  • C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\nemty_8g1x8d9-decrypt.txt
  • C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\nemty_8g1x8d9-decrypt.txt
  • C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\nemty_8g1x8d9-decrypt.txt
  • C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\nemty_8g1x8d9-decrypt.txt
  • C:\perflogs\nemty_8g1x8d9-decrypt.txt
  • C:\perflogs\admin\nemty_8g1x8d9-decrypt.txt
  • C:\far2\plugins\hlfviewer\nemty_8g1x8d9-decrypt.txt
  • C:\far2\plugins\macroview\nemty_8g1x8d9-decrypt.txt
  • C:\far2\plugins\ftp\lib\nemty_8g1x8d9-decrypt.txt
  • C:\far2\plugins\ftp\nemty_8g1x8d9-decrypt.txt
  • C:\far2\plugins\filecase\nemty_8g1x8d9-decrypt.txt
  • D:\nemty_8g1x8d9-decrypt.txt
  • C:\nemty_8g1x8d9-decrypt.txt
  • C:\documents and settings\nemty_8g1x8d9-decrypt.txt
  • C:\far2\nemty_8g1x8d9-decrypt.txt
  • C:\far2\addons\nemty_8g1x8d9-decrypt.txt
  • C:\far2\addons\colors\nemty_8g1x8d9-decrypt.txt
  • C:\far2\addons\colors\custom_highlighting\nemty_8g1x8d9-decrypt.txt
  • C:\far2\addons\colors\default_highlighting\nemty_8g1x8d9-decrypt.txt
  • C:\far2\addons\macros\nemty_8g1x8d9-decrypt.txt
  • C:\far2\addons\setup\nemty_8g1x8d9-decrypt.txt
  • C:\far2\addons\shell\nemty_8g1x8d9-decrypt.txt
  • C:\far2\addons\xlat\nemty_8g1x8d9-decrypt.txt
  • C:\far2\addons\xlat\russian\nemty_8g1x8d9-decrypt.txt
  • C:\recovery\nemty_8g1x8d9-decrypt.txt
  • C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\nemty_8g1x8d9-decrypt.txt
  • C:\far2\documentation\nemty_8g1x8d9-decrypt.txt
  • C:\far2\encyclopedia\nemty_8g1x8d9-decrypt.txt
  • C:\far2\encyclopedia\tap\nemty_8g1x8d9-decrypt.txt
  • C:\far2\fexcept\nemty_8g1x8d9-decrypt.txt
  • C:\far2\plugins\nemty_8g1x8d9-decrypt.txt
  • C:\far2\plugins\align\nemty_8g1x8d9-decrypt.txt
  • C:\far2\plugins\arclite\nemty_8g1x8d9-decrypt.txt
  • C:\far2\plugins\autowrap\nemty_8g1x8d9-decrypt.txt
  • C:\far2\plugins\brackets\nemty_8g1x8d9-decrypt.txt
  • C:\far2\plugins\compare\nemty_8g1x8d9-decrypt.txt
  • C:\far2\plugins\drawline\nemty_8g1x8d9-decrypt.txt
  • C:\far2\plugins\editcase\nemty_8g1x8d9-decrypt.txt
  • C:\far2\plugins\emenu\nemty_8g1x8d9-decrypt.txt
  • C:\far2\plugins\farcmds\nemty_8g1x8d9-decrypt.txt
  • %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\d860c3add425c732002dea04eb2c98f0_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
  • C:\far2\documentation\rus\nemty_8g1x8d9-decrypt.txt
  • C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\nemty_8g1x8d9-decrypt.txt
  • C:\totalcmd\nemty_8g1x8d9-decrypt.txt
  • C:\totalcmd\language\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\microsoft help\ms.groove.14.1033.hxn
  • C:\users\all users\microsoft help\ms.infopath.14.1033.hxn
  • C:\users\all users\microsoft help\ms.infopatheditor.14.1033.hxn
  • C:\users\all users\microsoft help\ms.msaccess.14.1033.hxn
  • C:\users\all users\microsoft help\ms.msaccess.dev.14.1033.hxn
  • C:\users\all users\microsoft help\ms.msouc.14.1033.hxn
  • C:\users\all users\microsoft help\ms.mspub.14.1033.hxn
  • C:\users\all users\microsoft help\ms.mspub.dev.14.1033.hxn
  • C:\users\all users\microsoft help\ms.mstore.14.1033.hxn
  • C:\users\all users\microsoft help\ms.netframeworksdkv1.1.hxn
  • C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_cvalidator.hxd
  • C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_a.hxw
  • C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_f.hxw
  • C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_k.hxw
  • C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mtoc_netsdk.hxh
  • C:\users\all users\mozilla\logs\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mvalidator.hxd
  • C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mvalidator.lck
  • C:\users\all users\microsoft help\ms.ois.14.1033.hxn
  • C:\users\all users\microsoft help\ms.onenote.14.1033.hxn
  • C:\users\all users\microsoft help\ms.outlook.14.1033.hxn
  • C:\users\all users\microsoft help\ms.outlook.dev.14.1033.hxn
  • C:\users\all users\microsoft help\ms.powerpnt.14.1033.hxn
  • C:\users\all users\microsoft help\ms.powerpnt.dev.14.1033.hxn
  • C:\users\all users\microsoft help\ms.setlang.14.1033.hxn
  • C:\users\all users\microsoft help\ms.winword.14.1033.hxn
  • C:\users\all users\microsoft help\ms.winword.dev.14.1033.hxn
  • C:\users\all users\microsoft help\nslist.hxl
  • C:\users\all users\microsoft toolkit\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\microsoft toolkit\settings.xml
  • C:\users\all users\microsoft help\ms.graph.14.1033.hxn
  • C:\users\all users\documents\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\microsoft help\ms.excel.dev.14.1033.hxn
  • C:\users\all users\desktop\nemty_8g1x8d9-decrypt.txt
  • C:\users\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\adobe\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\adobe\arm\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\adobe\arm\reader_15.007.20033\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\adobe\arm\reader_15.007.20033\acrordrdcupd1500920077.msp
  • C:\users\all users\adobe\arm\reader_15.008.20082\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\adobe\arm\s\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\adobe\arm\s\10428\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\adobe\arm\{291aa914-a987-4ce9-bd63-ac0a92d435e5}\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\adobe\setup\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acrordrdcupd1500820082.msp
  • C:\users\all users\application data\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\mozilla\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\microsoft help\ms.dexplore_1033_mvalidator.lck
  • C:\users\all users\favorites\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\microsoft help\nemty_8g1x8d9-decrypt.txt
  • C:\users\all users\microsoft help\hx.hxn
  • C:\users\all users\microsoft help\hx_1033_mkwd_k.hxw
  • C:\users\all users\microsoft help\hx_1033_mkwd_namedurl.hxw
  • C:\users\all users\microsoft help\hx_1033_mtoc_hx.hxh
  • C:\users\all users\microsoft help\hx_1033_mvalidator.hxd
  • C:\users\all users\microsoft help\hx_1033_mvalidator.lck
  • C:\users\all users\microsoft help\ms.dexplore.hxn
  • C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_a.hxw
  • C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_f.hxw
  • C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_k.hxw
  • C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_vs70namedurl.hxw
  • C:\users\all users\microsoft help\ms.dexplore_1033_mvalidator.hxd
  • C:\users\all users\microsoft help\ms.excel.14.1033.hxn
  • <Current directory>\nemty_8g1x8d9-decrypt.txt
Moves the following files
  • from C:\users\all users\adobe\arm\reader_15.007.20033\acrordrdcupd1500920077.msp to C:\users\all users\adobe\arm\reader_15.007.20033\acrordrdcupd1500920077.msp.nemty_8g1x8d9
  • from C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mvalidator.lck to C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mvalidator.lck.nemty_8g1x8d9
  • from C:\users\all users\microsoft help\ms.ois.14.1033.hxn to C:\users\all users\microsoft help\ms.ois.14.1033.hxn.nemty_8g1x8d9
  • from C:\users\all users\microsoft help\ms.onenote.14.1033.hxn to C:\users\all users\microsoft help\ms.onenote.14.1033.hxn.nemty_8g1x8d9
  • from C:\users\all users\microsoft help\ms.outlook.14.1033.hxn to C:\users\all users\microsoft help\ms.outlook.14.1033.hxn.nemty_8g1x8d9
  • from C:\users\all users\microsoft help\ms.outlook.dev.14.1033.hxn to C:\users\all users\microsoft help\ms.outlook.dev.14.1033.hxn.nemty_8g1x8d9
  • from C:\users\all users\microsoft help\ms.powerpnt.14.1033.hxn to C:\users\all users\microsoft help\ms.powerpnt.14.1033.hxn.nemty_8g1x8d9
  • from C:\users\all users\microsoft help\ms.powerpnt.dev.14.1033.hxn to C:\users\all users\microsoft help\ms.powerpnt.dev.14.1033.hxn.nemty_8g1x8d9
  • from C:\users\all users\microsoft help\ms.setlang.14.1033.hxn to C:\users\all users\microsoft help\ms.setlang.14.1033.hxn.nemty_8g1x8d9
  • from C:\users\all users\microsoft help\ms.winword.14.1033.hxn to C:\users\all users\microsoft help\ms.winword.14.1033.hxn.nemty_8g1x8d9
  • from C:\users\all users\microsoft help\ms.winword.dev.14.1033.hxn to C:\users\all users\microsoft help\ms.winword.dev.14.1033.hxn.nemty_8g1x8d9
  • from C:\users\all users\microsoft help\nslist.hxl to C:\users\all users\microsoft help\nslist.hxl.nemty_8g1x8d9
  • from C:\users\all users\microsoft toolkit\settings.xml to C:\users\all users\microsoft toolkit\settings.xml.nemty_8g1x8d9
  • from C:\users\all users\ntuser.pol to C:\users\all users\ntuser.pol.nemty_8g1x8d9
  • from C:\users\all users\oracle\java\installcache_x64\baseimagefam8 to C:\users\all users\oracle\java\installcache_x64\baseimagefam8.nemty_8g1x8d9
  • from C:\users\all users\package cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\state.rsm to C:\users\all users\package cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\state.rsm.nemty_8g1x8d9
  • from C:\users\all users\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\state.rsm to C:\users\all users\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\state.rsm.nemty_8g1x8d9
  • from C:\users\all users\package cache\{0f12c81f-93ef-46ec-bc94-d952c1a775d4}\state.rsm to C:\users\all users\package cache\{0f12c81f-93ef-46ec-bc94-d952c1a775d4}\state.rsm.nemty_8g1x8d9
  • from C:\users\all users\package cache\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\state.rsm to C:\users\all users\package cache\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\state.rsm.nemty_8g1x8d9
  • from C:\users\all users\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm to C:\users\all users\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm.nemty_8g1x8d9
  • from C:\users\all users\package cache\{35459b22-19a6-44ec-8d34-27eb3131acac}\state.rsm to C:\users\all users\package cache\{35459b22-19a6-44ec-8d34-27eb3131acac}\state.rsm.nemty_8g1x8d9
  • from C:\users\all users\package cache\{51adbf11-493f-431c-a862-967a0fae2944}\state.rsm to C:\users\all users\package cache\{51adbf11-493f-431c-a862-967a0fae2944}\state.rsm.nemty_8g1x8d9
  • from C:\users\all users\package cache\{615bc16d-60f5-482e-91b3-b51d8130963b}\state.rsm to C:\users\all users\package cache\{615bc16d-60f5-482e-91b3-b51d8130963b}\state.rsm.nemty_8g1x8d9
  • from C:\users\all users\package cache\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\state.rsm to C:\users\all users\package cache\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\state.rsm.nemty_8g1x8d9
  • from C:\users\all users\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\state.rsm to C:\users\all users\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\state.rsm.nemty_8g1x8d9
  • from C:\users\all users\package cache\{a2199617-3609-410f-a8e8-e8806c73545b}\state.rsm to C:\users\all users\package cache\{a2199617-3609-410f-a8e8-e8806c73545b}\state.rsm.nemty_8g1x8d9
  • from C:\users\all users\package cache\{b55f7208-e02b-4828-ac78-59c73ddf5bc7}\state.rsm to C:\users\all users\package cache\{b55f7208-e02b-4828-ac78-59c73ddf5bc7}\state.rsm.nemty_8g1x8d9
  • from C:\users\all users\package cache\{ce085a78-074e-4823-8dc1-8a721b94b76d}\state.rsm to C:\users\all users\package cache\{ce085a78-074e-4823-8dc1-8a721b94b76d}\state.rsm.nemty_8g1x8d9
  • from C:\users\all users\package cache\{dde2682b-961a-41ea-8d44-6005991b7947}\state.rsm to C:\users\all users\package cache\{dde2682b-961a-41ea-8d44-6005991b7947}\state.rsm.nemty_8g1x8d9
  • from C:\users\all users\package cache\{e46eca4f-393b-40df-9f49-076faf788d83}\state.rsm to C:\users\all users\package cache\{e46eca4f-393b-40df-9f49-076faf788d83}\state.rsm.nemty_8g1x8d9
  • from C:\users\all users\package cache\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\state.rsm to C:\users\all users\package cache\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\state.rsm.nemty_8g1x8d9
  • from C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mvalidator.hxd to C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mvalidator.hxd.nemty_8g1x8d9
  • from C:\users\all users\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\x64\windows6.1-kb2999226-x64.msu to C:\users\all users\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\x64\windows6.1-kb2999226-x64.msu.nemty_8g1x8d9
  • from C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mtoc_netsdk.hxh to C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mtoc_netsdk.hxh.nemty_8g1x8d9
  • from C:\users\all users\microsoft help\ms.excel.14.1033.hxn to C:\users\all users\microsoft help\ms.excel.14.1033.hxn.nemty_8g1x8d9
  • from C:\users\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acrordrdcupd1500820082.msp to C:\users\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acrordrdcupd1500820082.msp.nemty_8g1x8d9
  • from C:\users\all users\microsoft help\hx.hxn to C:\users\all users\microsoft help\hx.hxn.nemty_8g1x8d9
  • from C:\users\all users\microsoft help\hx_1033_mkwd_k.hxw to C:\users\all users\microsoft help\hx_1033_mkwd_k.hxw.nemty_8g1x8d9
  • from C:\users\all users\microsoft help\hx_1033_mkwd_namedurl.hxw to C:\users\all users\microsoft help\hx_1033_mkwd_namedurl.hxw.nemty_8g1x8d9
  • from C:\users\all users\microsoft help\hx_1033_mtoc_hx.hxh to C:\users\all users\microsoft help\hx_1033_mtoc_hx.hxh.nemty_8g1x8d9
  • from C:\users\all users\microsoft help\hx_1033_mvalidator.hxd to C:\users\all users\microsoft help\hx_1033_mvalidator.hxd.nemty_8g1x8d9
  • from C:\users\all users\microsoft help\hx_1033_mvalidator.lck to C:\users\all users\microsoft help\hx_1033_mvalidator.lck.nemty_8g1x8d9
  • from C:\users\all users\microsoft help\ms.dexplore.hxn to C:\users\all users\microsoft help\ms.dexplore.hxn.nemty_8g1x8d9
  • from C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_a.hxw to C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_a.hxw.nemty_8g1x8d9
  • from C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_f.hxw to C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_f.hxw.nemty_8g1x8d9
  • from C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_k.hxw to C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_k.hxw.nemty_8g1x8d9
  • from C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_vs70namedurl.hxw to C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_vs70namedurl.hxw.nemty_8g1x8d9
  • from C:\users\all users\microsoft help\ms.dexplore_1033_mvalidator.hxd to C:\users\all users\microsoft help\ms.dexplore_1033_mvalidator.hxd.nemty_8g1x8d9
  • from C:\users\all users\microsoft help\ms.dexplore_1033_mvalidator.lck to C:\users\all users\microsoft help\ms.dexplore_1033_mvalidator.lck.nemty_8g1x8d9
  • from C:\users\all users\microsoft help\ms.excel.dev.14.1033.hxn to C:\users\all users\microsoft help\ms.excel.dev.14.1033.hxn.nemty_8g1x8d9
  • from C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_k.hxw to C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_k.hxw.nemty_8g1x8d9
  • from C:\users\all users\microsoft help\ms.graph.14.1033.hxn to C:\users\all users\microsoft help\ms.graph.14.1033.hxn.nemty_8g1x8d9
  • from C:\users\all users\microsoft help\ms.groove.14.1033.hxn to C:\users\all users\microsoft help\ms.groove.14.1033.hxn.nemty_8g1x8d9
  • from C:\users\all users\microsoft help\ms.infopath.14.1033.hxn to C:\users\all users\microsoft help\ms.infopath.14.1033.hxn.nemty_8g1x8d9
  • from C:\users\all users\microsoft help\ms.infopatheditor.14.1033.hxn to C:\users\all users\microsoft help\ms.infopatheditor.14.1033.hxn.nemty_8g1x8d9
  • from C:\users\all users\microsoft help\ms.msaccess.14.1033.hxn to C:\users\all users\microsoft help\ms.msaccess.14.1033.hxn.nemty_8g1x8d9
  • from C:\users\all users\microsoft help\ms.msaccess.dev.14.1033.hxn to C:\users\all users\microsoft help\ms.msaccess.dev.14.1033.hxn.nemty_8g1x8d9
  • from C:\users\all users\microsoft help\ms.msouc.14.1033.hxn to C:\users\all users\microsoft help\ms.msouc.14.1033.hxn.nemty_8g1x8d9
  • from C:\users\all users\microsoft help\ms.mspub.14.1033.hxn to C:\users\all users\microsoft help\ms.mspub.14.1033.hxn.nemty_8g1x8d9
  • from C:\users\all users\microsoft help\ms.mspub.dev.14.1033.hxn to C:\users\all users\microsoft help\ms.mspub.dev.14.1033.hxn.nemty_8g1x8d9
  • from C:\users\all users\microsoft help\ms.mstore.14.1033.hxn to C:\users\all users\microsoft help\ms.mstore.14.1033.hxn.nemty_8g1x8d9
  • from C:\users\all users\microsoft help\ms.netframeworksdkv1.1.hxn to C:\users\all users\microsoft help\ms.netframeworksdkv1.1.hxn.nemty_8g1x8d9
  • from C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_cvalidator.hxd to C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_cvalidator.hxd.nemty_8g1x8d9
  • from C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_a.hxw to C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_a.hxw.nemty_8g1x8d9
  • from C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_f.hxw to C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_f.hxw.nemty_8g1x8d9
  • from C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_netsdknamedurls.hxw to C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_netsdknamedurls.hxw.nemty_8g1x8d9
  • from C:\users\all users\sun\java\java update\jaureglist.xml to C:\users\all users\sun\java\java update\jaureglist.xml.nemty_8g1x8d9
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Network activity
TCP
HTTP GET requests
  • http://ap#.#pify.org/
  • http://ap#.#b-ip.com/v2/free/95.211.190.198/countryName
  • 'ne##y10.biz':80
  • UDP
    • DNS ASK ap#.#pify.org
    • DNS ASK ap#.#b-ip.com
    • DNS ASK ne##y10.biz
    Miscellaneous
    Searches for the following windows
    • ClassName: '' WindowName: ''
    Creates and executes the following
    • '%WINDIR%\syswow64\cmd.exe' /c vssadmin resize shadowstorage /for=A: /on=A: /maxsize=401MB' (with hidden window)
    • '%WINDIR%\syswow64\cmd.exe' /c vssadmin resize shadowstorage /for=A: /on=A: /maxsize=unbounded' (with hidden window)
    • '%WINDIR%\syswow64\cmd.exe' /c vssadmin resize shadowstorage /for=C: /on=C: /maxsize=401MB' (with hidden window)
    • '%WINDIR%\syswow64\cmd.exe' /c vssadmin resize shadowstorage /for=C: /on=C: /maxsize=unbounded' (with hidden window)
    • '%WINDIR%\syswow64\cmd.exe' /c vssadmin resize shadowstorage /for=D: /on=D: /maxsize=401MB' (with hidden window)
    • '%WINDIR%\syswow64\cmd.exe' /c vssadmin resize shadowstorage /for=D: /on=D: /maxsize=unbounded' (with hidden window)
    • '%WINDIR%\syswow64\cmd.exe' /c vssadmin resize shadowstorage /for=F: /on=F: /maxsize=401MB' (with hidden window)
    • '%WINDIR%\syswow64\cmd.exe' /c vssadmin resize shadowstorage /for=F: /on=F: /maxsize=unbounded' (with hidden window)
    • '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im sql.* & taskkill /f /im winword.* & taskkill /f /im wordpad.* & taskkill /f /im outlook.* & taskkill /f /im thunderbird.* & taskkill /f /im oracle.* & taskkill /f /im excel.*...' (with hidden window)
    • '%WINDIR%\syswow64\cmd.exe' /c net stop DbxSvc & net stop OracleXETNSListener & net stop OracleServiceXE & net stop AcrSch2Svc & net stop AcronisAgent & net stop Apache2.4 & net stop SQLWriter & net stop MSSQL$SQLEXPRESS ...' (with hidden window)
    • '%WINDIR%\syswow64\cmd.exe' /c bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet & wmic shadowcopy delete' (with hidden window)
    • '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==' (with hidden window)
    Executes the following
    • '%WINDIR%\syswow64\cmd.exe' /c vssadmin resize shadowstorage /for=A: /on=A: /maxsize=401MB
    • '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
    • '%WINDIR%\syswow64\net1.exe' stop DbxSvc
    • '%WINDIR%\syswow64\net1.exe' stop OracleXETNSListener
    • '%WINDIR%\syswow64\net1.exe' stop OracleServiceXE
    • '%WINDIR%\syswow64\net1.exe' stop AcrSch2Svc
    • '%WINDIR%\syswow64\net1.exe' stop AcronisAgent
    • '%WINDIR%\syswow64\net1.exe' stop Apache2.4
    • '%WINDIR%\syswow64\net1.exe' stop SQLWriter
    • '%WINDIR%\syswow64\net1.exe' stop MSSQL$SQLEXPRESS
    • '%WINDIR%\syswow64\net1.exe' stop MSSQLServerADHelper100
    • '%WINDIR%\syswow64\net1.exe' stop MongoDB
    • '%WINDIR%\syswow64\net1.exe' stop SQLAgent$SQLEXPRESS
    • '%WINDIR%\syswow64\net1.exe' stop SQLBrowser
    • '%WINDIR%\syswow64\net1.exe' stop CobianBackup11
    • '%WINDIR%\syswow64\net1.exe' stop cbVSCService11
    • '%WINDIR%\syswow64\cmd.exe' /c bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet & wmic shadowcopy delete
    • '%WINDIR%\syswow64\net1.exe' stop QBCFMontorService
    • '%WINDIR%\syswow64\cmd.exe' /c net stop DbxSvc & net stop OracleXETNSListener & net stop OracleServiceXE & net stop AcrSch2Svc & net stop AcronisAgent & net stop Apache2.4 & net stop SQLWriter & net stop MSSQL$SQLEXPRESS ...
    • '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=F: /on=F: /maxsize=unbounded
    • '%WINDIR%\syswow64\cmd.exe' /c vssadmin resize shadowstorage /for=A: /on=A: /maxsize=unbounded
    • '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=A: /on=A: /maxsize=401MB
    • '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=A: /on=A: /maxsize=unbounded
    • '%WINDIR%\syswow64\cmd.exe' /c vssadmin resize shadowstorage /for=C: /on=C: /maxsize=401MB
    • '%WINDIR%\syswow64\cmd.exe' /c vssadmin resize shadowstorage /for=C: /on=C: /maxsize=unbounded
    • '%WINDIR%\syswow64\cmd.exe' /c vssadmin resize shadowstorage /for=D: /on=D: /maxsize=401MB
    • '%WINDIR%\syswow64\cmd.exe' /c vssadmin resize shadowstorage /for=D: /on=D: /maxsize=unbounded
    • '%WINDIR%\syswow64\cmd.exe' /c vssadmin resize shadowstorage /for=F: /on=F: /maxsize=401MB
    • '%WINDIR%\syswow64\cmd.exe' /c vssadmin resize shadowstorage /for=F: /on=F: /maxsize=unbounded
    • '<SYSTEM32>\vssvc.exe'
    • '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=D: /on=D: /maxsize=unbounded
    • '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=C: /on=C: /maxsize=unbounded
    • '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=C: /on=C: /maxsize=401MB
    • '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=D: /on=D: /maxsize=401MB
    • '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=F: /on=F: /maxsize=401MB
    • '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im sql.* & taskkill /f /im winword.* & taskkill /f /im wordpad.* & taskkill /f /im outlook.* & taskkill /f /im thunderbird.* & taskkill /f /im oracle.* & taskkill /f /im excel.*...
    • '%WINDIR%\syswow64\net1.exe' stop QBVSS

    Рекомендации по лечению

    1. В случае если операционная система способна загрузиться (в штатном режиме или режиме защиты от сбоев), скачайте лечащую утилиту Dr.Web CureIt! и выполните с ее помощью полную проверку вашего компьютера, а также используемых вами переносных носителей информации.
    2. Если загрузка операционной системы невозможна, измените настройки BIOS вашего компьютера, чтобы обеспечить возможность загрузки ПК с компакт-диска или USB-накопителя. Скачайте образ аварийного диска восстановления системы Dr.Web® LiveDisk или утилиту записи Dr.Web® LiveDisk на USB-накопитель, подготовьте соответствующий носитель. Загрузив компьютер с использованием данного носителя, выполните его полную проверку и лечение обнаруженных угроз.
    Скачать Dr.Web

    По серийному номеру

    Выполните полную проверку системы с использованием Антивируса Dr.Web Light для macOS. Данный продукт можно загрузить с официального сайта Apple App Store.

    На загруженной ОС выполните полную проверку всех дисковых разделов с использованием продукта Антивирус Dr.Web для Linux.

    Скачать Dr.Web

    По серийному номеру

    1. Если мобильное устройство функционирует в штатном режиме, загрузите и установите на него бесплатный антивирусный продукт Dr.Web для Android Light. Выполните полную проверку системы и используйте рекомендации по нейтрализации обнаруженных угроз.
    2. Если мобильное устройство заблокировано троянцем-вымогателем семейства Android.Locker (на экране отображается обвинение в нарушении закона, требование выплаты определенной денежной суммы или иное сообщение, мешающее нормальной работе с устройством), выполните следующие действия:
      • загрузите свой смартфон или планшет в безопасном режиме (в зависимости от версии операционной системы и особенностей конкретного мобильного устройства эта процедура может быть выполнена различными способами; обратитесь за уточнением к инструкции, поставляемой вместе с приобретенным аппаратом, или напрямую к его производителю);
      • после активации безопасного режима установите на зараженное устройство бесплатный антивирусный продукт Dr.Web для Android Light и произведите полную проверку системы, выполнив рекомендации по нейтрализации обнаруженных угроз;
      • выключите устройство и включите его в обычном режиме.

    Подробнее о Dr.Web для Android

    Демо бесплатно на 14 дней

    Выдаётся при установке