Library
My library

+ Add to library

Profile

Trojan.DownLoader10.9218

Added to the Dr.Web virus database: 2013-08-25

Virus description added:

Technical Information

To ensure autorun and distribution:
Creates or modifies the following files:
  • %WINDIR%\Tasks\SA.DAT
Creates the following services:
  • [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
  • '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
  • '<SYSTEM32>\urdvxc.exe' /service
  • '<SYSTEM32>\urdvxc.exe' /installservice
  • '<SYSTEM32>\urdvxc.exe' /start
Executes the following:
  • '<SYSTEM32>\svchost.exe' -k netsvcs
  • '<SYSTEM32>\dumprep.exe' 1148 -dm 7 7 %TEMP%\WERc877.dir00\svchost.exe.mdmp 16325836412032492
Modifies file system :
Creates the following files:
  • %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
  • %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
  • %PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
  • %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
  • %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
  • %TEMP%\WERc877.dir00\svchost.exe.mdmp
  • <SYSTEM32>\urdvxc.exe
  • %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
  • %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
Deletes itself.
Network activity:
Connects to:
  • '21#.#0.142.231':139
  • '21#.#0.60.29':139
  • '21#.#0.190.187':139
  • '21#.#0.3.132':139
  • '21#.#0.215.142':139
  • '21#.#0.142.231':445
  • '21#.#0.209.202':139
  • '21#.#0.97.204':139
  • '21#.#0.181.105':139
  • '21#.#0.170.237':139
  • '21#.#0.232.191':139
  • '21#.#0.97.248':139
  • '21#.#0.52.81':139
  • '21#.#0.33.92':139
  • '21#.#0.127.124':139
  • '21#.#0.235.138':139
  • '21#.#0.164.182':445
  • '21#.#0.182.102':445
  • '21#.#0.15.145':139
  • '21#.#0.35.114':139
  • '21#.#0.45.204':139
  • '21#.30.9.86':139
  • '21#.#0.98.252':139
  • '21#.#0.0.109':139
  • '21#.#0.177.186':139
  • '21#.#0.31.60':139
  • '21#.#0.119.74':445
  • '21#.#0.219.200':445
  • '21#.#0.43.161':445
  • '21#.#0.23.231':445
  • '21#.#0.163.159':445
  • '21#.#0.27.97':445
  • '21#.#0.127.251':445
  • '21#.#0.251.41':445
  • '21#.#0.143.237':445
  • '21#.#0.222.158':445
  • '21#.#0.153.83':445
  • '21#.#0.252.127':445
  • '21#.#0.30.146':445
  • '21#.#0.183.157':139
  • '21#.#0.90.195':139
  • '21#.#0.150.185':139
  • '21#.#0.33.166':139
  • '21#.#0.24.251':139
  • '21#.#0.21.100':139
  • '21#.#0.164.182':139
  • '21#.#0.182.102':139
  • '21#.#0.208.123':445
  • '21#.#0.186.69':139
  • '21#.#0.5.104':139
  • '21#.#0.20.24':139
  • '21#.#0.202.180':139
  • '21#.#0.183.248':139
  • '21#.#0.51.113':139
  • '21#.#0.243.115':139
  • '21#.#0.116.136':139
  • '21#.#0.44.29':139
  • '21#.#0.127.124':445
  • '21#.#0.235.138':445
  • '21#.#0.98.252':445
  • '21#.#0.194.78':139
  • '21#.#0.15.145':445
  • '21#.#0.33.92':445
  • '21#.#0.91.247':139
  • '21#.#0.194.78':445
  • '21#.#0.226.179':139
  • '21#.#0.231.221':139
  • '21#.#0.202.180':445
  • '21#.#0.183.248':445
  • '21#.#0.51.113':445
  • '21#.#0.105.138':139
  • '21#.#0.138.76':139
  • '21#.#0.47.215':139
  • '21#.#0.140.42':139
  • '21#.#0.75.54':139
  • '21#.#0.209.240':139
  • '21#.#0.0.109':445
  • '21#.#0.33.166':445
  • '21#.#0.24.251':445
  • '21#.#0.21.100':445
  • '21#.#0.97.204':445
  • '21#.#0.181.105':445
  • '21#.#0.31.60':445
  • '21#.#0.186.69':445
  • '21#.#0.5.104':445
  • '21#.#0.20.24':445
  • '21#.#0.183.157':445
  • '21#.#0.90.195':445
  • '21#.#0.150.185':445
  • '21#.#0.209.202':445
  • '21#.30.9.86':445
  • '21#.#0.52.81':445
  • '21#.#0.3.132':445
  • '21#.#0.177.186':445
  • '21#.#0.35.114':445
  • '21#.#0.45.204':445
  • '21#.#0.170.237':445
  • '21#.#0.232.191':445
  • '21#.#0.97.248':445
  • '21#.#0.215.142':445
  • '21#.#0.60.29':445
  • '21#.#0.190.187':445
  • '21#.#0.34.187':139
  • '21#.#0.247.224':139
  • '21#.#0.225.137':139
  • '21#.#0.232.76':139
  • '21#.#0.62.35':139
  • '21#.#0.142.29':139
  • '21#.#0.44.238':139
  • '21#.#0.27.75':139
  • '21#.#0.236.116':139
  • '21#.#0.89.171':139
  • '21#.#0.96.144':139
  • '21#.#0.144.45':139
  • '21#.#0.201.231':139
  • '21#.#0.122.68':139
  • '21#.#0.249.81':139
  • '21#.#0.120.165':139
  • '21#.#0.1.201':445
  • '21#.#0.165.48':139
  • '21#.#0.166.21':139
  • '21#.#0.142.107':139
  • '21#.#0.72.14':139
  • '21#.#0.13.202':139
  • '21#.#0.110.187':139
  • '21#.#0.102.37':139
  • '21#.#0.191.160':139
  • '21#.#0.117.0':139
  • '21#.#0.110.159':445
  • '21#.#0.180.223':445
  • '21#.#0.209.47':445
  • '21#.#0.20.74':445
  • '21#.#0.185.87':445
  • '21#.#0.135.148':445
  • '21#.#0.105.212':445
  • '21#.#0.87.132':445
  • '21#.#0.200.84':139
  • '21#.#0.254.237':445
  • '21#.#0.78.201':445
  • '21#.#0.27.106':445
  • '21#.#0.228.215':445
  • '21#.#0.89.155':139
  • '21#.#0.22.111':139
  • '21#.#0.111.182':139
  • '21#.#0.181.187':139
  • '21#.#0.59.92':139
  • '21#.#0.92.101':139
  • '21#.#0.209.60':445
  • '21#.#0.64.43':445
  • '21#.30.26.9':445
  • '21#.#0.147.234':139
  • '21#.#0.1.201':139
  • '21#.#0.200.84':445
  • '21#.#0.143.237':139
  • '21#.#0.190.110':139
  • '21#.#0.153.52':139
  • '21#.#0.252.127':139
  • '21#.#0.127.251':139
  • '21#.#0.251.41':139
  • '21#.#0.249.81':445
  • '21#.#0.120.165':445
  • '21#.#0.110.187':445
  • '21#.#0.165.48':445
  • '21#.#0.166.21':445
  • '21#.#0.122.68':445
  • '21#.#0.153.83':139
  • '21#.#0.208.123':139
  • '21#.#0.30.146':139
  • '21#.#0.23.231':139
  • '21#.#0.153.52':445
  • '21#.#0.184.165':445
  • '21#.#0.184.165':139
  • '21#.#0.219.200':139
  • '21#.#0.43.161':139
  • '21#.#0.222.158':139
  • '21#.#0.163.159':139
  • '21#.#0.27.97':139
  • '21#.#0.119.74':139
  • '21#.#0.102.37':445
  • '21#.#0.236.116':445
  • '21#.#0.117.0':445
  • '21#.#0.181.187':445
  • '21#.#0.144.45':445
  • '21#.#0.44.238':445
  • '21#.#0.27.75':445
  • '21#.#0.22.111':445
  • '21#.#0.111.182':445
  • '21#.#0.147.234':445
  • '21#.#0.59.92':445
  • '21#.#0.92.101':445
  • '21#.#0.89.155':445
  • '21#.#0.96.144':445
  • '21#.#0.13.202':445
  • '21#.#0.201.231':445
  • '21#.#0.232.76':445
  • '21#.#0.191.160':445
  • '21#.#0.142.107':445
  • '21#.#0.72.14':445
  • '21#.#0.247.224':445
  • '21#.#0.225.137':445
  • '21#.#0.89.171':445
  • '21#.#0.62.35':445
  • '21#.#0.142.29':445
  • '21#.#0.34.187':445
  • '21#.#0.44.29':445
  • '21#.#0.90.223':139
  • '21#.#0.83.240':139
  • '21#.#0.209.248':139
  • '21#.#0.144.195':139
  • '21#.#0.47.64':139
  • '21#.#0.56.205':139
  • '21#.#0.13.65':139
  • '21#.30.30.4':139
  • '21#.#0.139.36':139
  • '21#.#0.165.96':139
  • '21#.#0.72.23':139
  • '21#.#0.237.104':139
  • '21#.#0.201.58':139
  • '21#.#0.126.183':445
  • '21#.#0.31.159':445
  • '21#.#0.79.218':445
  • '21#.#0.136.63':445
  • '21#.#0.237.177':445
  • '21#.#0.177.126':445
  • '21#.#0.193.108':445
  • '21#.#0.16.70':445
  • '21#.#0.139.201':139
  • '21#.#0.66.169':445
  • '21#.30.65.2':445
  • '21#.#0.181.126':445
  • '21#.#0.14.169':139
  • '21#.#0.193.108':139
  • '21#.#0.16.70':139
  • '21#.#0.187.143':445
  • '21#.#0.66.169':139
  • '21#.30.65.2':139
  • '21#.#0.181.126':139
  • '21#.#0.51.107':445
  • '21#.#0.106.117':445
  • '21#.#0.198.168':445
  • '21#.#0.55.150':445
  • '21#.#0.22.248':445
  • '21#.#0.62.112':445
  • '21#.#0.79.218':139
  • '21#.#0.22.92':139
  • '21#.#0.23.64':139
  • '21#.#0.227.10':139
  • '21#.#0.135.155':139
  • '21#.#0.204.64':139
  • '21#.#0.62.212':139
  • '21#.#0.177.126':139
  • '21#.#0.126.183':139
  • '21#.#0.31.159':139
  • '21#.#0.114.235':139
  • '21#.#0.136.63':139
  • '21#.#0.237.177':139
  • '21#.#0.191.77':139
  • '21#.#0.172.236':139
  • '21#.#0.67.64':139
  • '21#.#0.233.145':139
  • '21#.#0.217.82':139
  • '21#.#0.94.223':139
  • '21#.#0.255.97':139
  • '21#.#0.127.123':139
  • '21#.#0.86.17':139
  • '21#.#0.194.228':139
  • '21#.#0.228.209':139
  • '21#.#0.209.192':139
  • '21#.30.18.8':445
  • '21#.#0.194.228':445
  • '21#.#0.228.209':445
  • '21#.#0.209.192':445
  • '21#.#0.191.77':445
  • '21#.#0.172.236':445
  • '21#.#0.67.64':445
  • '21#.#0.195.225':445
  • '21#.#0.210.247':445
  • '21#.#0.46.134':445
  • '21#.#0.255.97':445
  • '21#.#0.127.123':445
  • '21#.#0.86.17':445
  • '21#.#0.195.225':139
  • '21#.#0.139.36':445
  • '21#.#0.14.169':445
  • '21#.#0.135.155':445
  • '21#.#0.237.104':445
  • '21#.#0.13.65':445
  • '21#.30.30.4':445
  • '21#.#0.23.64':445
  • '21#.#0.227.10':445
  • '21#.#0.114.235':445
  • '21#.#0.204.64':445
  • '21#.#0.62.212':445
  • '21#.#0.22.92':445
  • '21#.#0.72.23':445
  • '21#.#0.139.201':445
  • '21#.#0.201.58':445
  • '21#.#0.144.195':445
  • '21#.#0.210.247':139
  • '21#.#0.46.134':139
  • '21#.30.18.8':139
  • '21#.#0.83.240':445
  • '21#.#0.209.248':445
  • '21#.#0.165.96':445
  • '21#.#0.47.64':445
  • '21#.#0.56.205':445
  • '21#.#0.90.223':445
  • '21#.#0.93.215':139
  • '21#.30.9.83':139
  • '21#.#0.116.110':139
  • '21#.30.79.0':139
  • '21#.#0.103.8':139
  • '21#.#0.171.254':139
  • '21#.#0.71.199':139
  • '21#.#0.42.198':139
  • '21#.#0.58.179':139
  • '21#.#0.15.209':139
  • '21#.#0.24.22':139
  • '21#.#0.106.120':139
  • '21#.#0.149.50':139
  • '21#.#0.175.29':445
  • '21#.#0.100.35':445
  • '21#.#0.237.42':445
  • '21#.#0.72.149':445
  • '21#.#0.228.141':445
  • '21#.#0.240.19':445
  • '21#.#0.66.170':139
  • '21#.#0.183.94':139
  • '21#.#0.94.216':139
  • '21#.#0.213.226':445
  • '21#.#0.200.39':139
  • '21#.#0.123.232':139
  • '21#.#0.62.59':139
  • '21#.#0.140.42':445
  • '21#.#0.75.54':445
  • '21#.#0.209.240':445
  • '21#.#0.213.226':139
  • '21#.#0.226.179':445
  • '21#.#0.231.221':445
  • '21#.#0.91.247':445
  • '21#.#0.243.115':445
  • '21#.#0.116.136':445
  • '21#.#0.105.138':445
  • '21#.#0.138.76':445
  • '21#.#0.47.215':445
  • '21#.#0.237.42':139
  • '21#.#0.166.201':139
  • '21#.30.4.29':139
  • '21#.#0.93.104':139
  • '21#.#0.97.173':139
  • '21#.#0.221.189':139
  • '21#.30.19.5':139
  • '21#.#0.240.19':139
  • '21#.#0.175.29':139
  • '21#.#0.100.35':139
  • '21#.#0.186.120':139
  • '21#.#0.72.149':139
  • '21#.#0.228.141':139
  • '21#.#0.238.195':139
  • '21#.#0.246.18':139
  • '21#.#0.19.57':139
  • '21#.#0.51.107':139
  • '21#.#0.106.117':139
  • '21#.#0.198.168':139
  • '21#.#0.98.131':139
  • '21#.#0.50.179':139
  • '21#.#0.30.31':139
  • '21#.#0.57.138':139
  • '21#.#0.173.87':139
  • '21#.#0.55.100':139
  • '21#.#0.62.112':139
  • '21#.#0.57.138':445
  • '21#.#0.173.87':445
  • '21#.#0.55.100':445
  • '21#.#0.238.195':445
  • '21#.#0.246.18':445
  • '21#.#0.19.57':445
  • '21#.#0.187.143':139
  • '21#.#0.55.150':139
  • '21#.#0.22.248':139
  • '21#.#0.98.131':445
  • '21#.#0.50.179':445
  • '21#.#0.30.31':445
  • '21#.#0.200.39':445
  • '21#.#0.58.179':445
  • '21#.#0.62.59':445
  • '21#.#0.97.173':445
  • '21#.#0.106.120':445
  • '21#.#0.71.199':445
  • '21#.#0.42.198':445
  • '21#.30.4.29':445
  • '21#.#0.93.104':445
  • '21#.#0.186.120':445
  • '21#.#0.221.189':445
  • '21#.30.19.5':445
  • '21#.#0.166.201':445
  • '21#.#0.24.22':445
  • '21#.#0.94.216':445
  • '21#.#0.149.50':445
  • '21#.30.79.0':445
  • '21#.#0.123.232':445
  • '21#.#0.66.170':445
  • '21#.#0.183.94':445
  • '21#.30.9.83':445
  • '21#.#0.116.110':445
  • '21#.#0.15.209':445
  • '21#.#0.103.8':445
  • '21#.#0.171.254':445
  • '21#.#0.93.215':445
  • '21#.#0.48.135':139
  • '21#.30.9.88':139
  • '21#.#0.42.192':139
  • '21#.#0.93.202':139
  • '21#.#0.174.100':139
  • '21#.#0.155.230':139
  • '21#.#0.100.30':139
  • '21#.#0.30.73':139
  • '21#.#0.73.69':139
  • '21#.#0.192.24':139
  • '21#.#0.249.127':139
  • '21#.#0.218.199':139
  • '21#.#0.58.18':139
  • '21#.#0.112.178':139
  • '21#.#0.235.95':139
  • '21#.#0.51.179':139
  • '21#.#0.245.160':139
  • '21#.#0.208.91':139
  • '21#.#0.100.57':139
  • '21#.#0.13.154':139
  • '21#.#0.40.48':139
  • '21#.#0.179.58':139
  • '21#.#0.179.27':139
  • '21#.#0.48.168':139
  • '21#.#0.104.217':139
  • '21#.#0.69.249':139
  • '21#.#0.10.129':9988
  • '21#.#0.178.186':9988
  • '21#.#0.90.123':9988
  • '21#.#0.18.17':9988
  • '21#.#0.166.22':9988
  • '21#.#0.21.180':9988
  • '21#.#0.189.137':9988
  • '21#.#0.20.88':9988
  • '21#.#0.33.197':9988
  • '21#.#0.59.228':9988
  • '21#.#0.0.166':9988
  • '21#.30.0.66':9988
  • '21#.#0.244.226':139
  • '21#.#0.70.197':139
  • '21#.30.14.2':139
  • '21#.#0.251.234':139
  • '21#.#0.29.101':139
  • '21#.#0.117.193':139
  • '21#.#0.66.185':139
  • '21#.#0.99.155':139
  • '21#.#0.247.186':139
  • '21#.#0.187.140':139
  • '21#.#0.31.130':139
  • '21#.#0.129.80':139
  • '21#.#0.80.31':139
  • '21#.#0.174.100':445
  • '21#.#0.155.230':445
  • '21#.#0.48.135':445
  • '21#.#0.179.58':445
  • '21#.#0.58.18':445
  • '21#.#0.93.202':445
  • '21#.#0.249.127':445
  • '21#.#0.218.199':445
  • '21#.#0.100.30':445
  • '21#.30.9.88':445
  • '21#.#0.42.192':445
  • '21#.#0.192.24':445
  • '21#.#0.40.48':445
  • '21#.#0.208.91':445
  • '21#.#0.100.57':445
  • '21#.#0.112.178':445
  • '21#.#0.249.161':445
  • '21#.#0.137.245':445
  • '21#.#0.245.160':445
  • '21#.#0.48.168':445
  • '21#.#0.104.217':445
  • '21#.#0.13.154':445
  • '21#.#0.235.95':445
  • '21#.#0.51.179':445
  • '21#.#0.179.27':445
  • '21#.#0.30.73':445
  • '21#.#0.19.153':139
  • '21#.#0.102.97':139
  • '21#.#0.32.222':139
  • '21#.#0.187.140':445
  • '21#.#0.244.226':445
  • '21#.#0.0.238':139
  • '21#.#0.245.205':139
  • '21#.#0.249.161':139
  • '21#.#0.137.245':139
  • '21#.#0.204.175':139
  • '21#.#0.175.214':139
  • '21#.#0.177.197':139
  • '21#.#0.247.186':445
  • '21#.#0.117.193':445
  • '21#.#0.66.185':445
  • '21#.#0.70.197':445
  • '21#.#0.73.69':445
  • '21#.#0.69.249':445
  • '21#.#0.29.101':445
  • '21#.#0.129.80':445
  • '21#.#0.80.31':445
  • '21#.#0.99.155':445
  • '21#.30.14.2':445
  • '21#.#0.251.234':445
  • '21#.#0.31.130':445
  • '21#.#0.22.185':139
  • '21#.#0.184.139':139
  • '21#.#0.60.207':139
  • '21#.#0.36.202':139
  • '21#.#0.133.206':139
  • '21#.#0.166.22':139
  • '21#.#0.104.47':139
  • '21#.#0.223.100':139
  • '21#.#0.73.155':139
  • '21#.#0.178.190':139
  • '21#.30.3.21':139
  • '21#.#0.18.17':139
  • '21#.#0.175.254':139
  • '21#.#0.116.9':139
  • '21#.#0.131.38':139
  • '21#.#0.159.168':139
  • '21#.#0.115.66':139
  • '21#.#0.140.250':139
  • '21#.#0.175.244':139
  • '21#.#0.37.189':139
  • '21#.#0.66.201':139
  • '21#.#0.230.90':139
  • '21#.#0.111.114':139
  • '21#.#0.114.83':139
  • '21#.#0.84.38':139
  • '21#.#0.6.186':139
  • '21#.#0.189.137':139
  • '21#.#0.136.65':139
  • '21#.#0.28.196':139
  • '21#.#0.124.210':139
  • '21#.#0.10.129':139
  • '21#.#0.129.83':139
  • '21#.#0.59.228':139
  • '21#.#0.90.123':139
  • '21#.#0.0.166':139
  • '21#.#0.108.70':139
  • '21#.#0.240.200':139
  • '21#.30.0.66':139
  • '21#.#0.109.49':139
  • '21#.#0.33.197':139
  • '21#.#0.23.33':139
  • '21#.#0.224.132':139
  • '21#.#0.129.12':139
  • '21#.#0.66.254':139
  • '21#.#0.21.180':139
  • '21#.#0.29.77':139
  • '21#.#0.93.223':139
  • '21#.#0.20.88':139
  • '21#.#0.178.186':139
  • '21#.#0.246.223':139
  • '21#.30.1.69':139
  • '21#.#0.22.185':445
  • '21#.#0.184.139':445
  • '21#.#0.60.207':445
  • '21#.#0.230.90':445
  • '21#.#0.133.206':445
  • '21#.#0.166.22':445
  • '21#.#0.18.17':445
  • '21#.#0.223.100':445
  • '21#.#0.73.155':445
  • '21#.#0.178.190':445
  • '21#.#0.104.47':445
  • '21#.30.3.21':445
  • '21#.#0.175.254':445
  • '21#.#0.114.83':445
  • '21#.#0.116.9':445
  • '21#.#0.37.189':445
  • '21#.#0.140.250':445
  • '21#.#0.175.244':445
  • '21#.#0.115.66':445
  • '21#.#0.66.201':445
  • '21#.#0.84.38':445
  • '21#.#0.36.202':445
  • '21#.#0.131.38':445
  • '21#.#0.159.168':445
  • '21#.#0.111.114':445
  • '21#.#0.6.186':445
  • '21#.#0.129.83':445
  • '21#.#0.136.65':445
  • '21#.#0.28.196':445
  • '21#.#0.124.210':445
  • '21#.#0.10.129':445
  • '21#.#0.189.137':445
  • '21#.#0.0.166':445
  • '21#.#0.59.228':445
  • '21#.#0.90.123':445
  • '21#.#0.108.70':445
  • '21#.#0.240.200':445
  • '21#.30.0.66':445
  • '21#.#0.109.49':445
  • '21#.#0.33.197':445
  • '21#.#0.23.33':445
  • '21#.#0.224.132':445
  • '21#.#0.66.254':445
  • '21#.#0.129.12':445
  • '21#.#0.21.180':445
  • '21#.#0.29.77':445
  • '21#.#0.93.223':445
  • '21#.#0.20.88':445
  • '21#.#0.178.186':445
  • '21#.#0.246.223':445
  • '21#.30.1.69':445
  • '21#.#0.245.205':445
  • '21#.#0.33.152':139
  • '21#.#0.74.50':139
  • '21#.#0.177.71':139
  • '21#.#0.36.229':139
  • '21#.#0.229.170':139
  • '21#.#0.171.33':139
  • '21#.#0.139.31':139
  • '21#.#0.43.39':139
  • '21#.#0.98.142':139
  • '21#.#0.238.218':139
  • '21#.#0.32.126':139
  • '21#.#0.232.19':139
  • '21#.#0.74.36':139
  • '21#.#0.31.29':139
  • '21#.#0.36.176':139
  • '21#.#0.176.32':139
  • '21#.#0.99.75':139
  • '21#.#0.39.74':139
  • '21#.#0.56.144':139
  • '21#.#0.185.27':139
  • '21#.#0.26.231':139
  • '21#.#0.231.74':139
  • '21#.#0.22.179':139
  • '21#.#0.237.49':139
  • '21#.#0.165.215':139
  • '21#.#0.62.77':139
  • '21#.#0.221.38':445
  • '21#.#0.50.173':445
  • '21#.30.69.2':445
  • '21#.#0.85.221':139
  • '21#.#0.66.173':139
  • '21#.#0.49.138':445
  • '21#.#0.49.138':139
  • '21#.#0.87.128':139
  • '21#.#0.221.38':139
  • '21#.#0.19.65':445
  • '21#.#0.221.41':445
  • '21#.#0.69.43':445
  • '21#.#0.212.7':139
  • '21#.#0.243.183':139
  • '21#.#0.208.6':139
  • '21#.#0.58.144':139
  • '21#.#0.179.76':139
  • '21#.#0.11.253':139
  • '21#.#0.60.153':139
  • '21#.#0.229.95':139
  • '21#.#0.96.15':139
  • '21#.#0.15.212':139
  • '21#.#0.50.125':139
  • '21#.#0.111.103':139
  • '21#.#0.12.240':139
  • '21#.#0.99.75':445
  • '21#.#0.56.144':445
  • '21#.#0.31.29':445
  • '21#.#0.105.212':139
  • '21#.#0.87.132':139
  • '21#.#0.118.59':445
  • '21#.#0.165.215':445
  • '21#.#0.185.27':445
  • '21#.#0.26.231':445
  • '21#.#0.36.176':445
  • '21#.#0.176.32':445
  • '21#.#0.237.49':445
  • '21#.#0.27.106':139
  • '21#.#0.228.215':139
  • '21#.#0.20.74':139
  • '21#.#0.185.87':139
  • '21#.#0.209.60':139
  • '21#.#0.64.43':139
  • '21#.30.26.9':139
  • '21#.#0.209.47':139
  • '21#.#0.254.237':139
  • '21#.#0.78.201':139
  • '21#.#0.135.148':139
  • '21#.#0.110.159':139
  • '21#.#0.180.223':139
  • '21#.#0.231.74':445
  • '21#.#0.50.125':445
  • '21#.#0.111.103':445
  • '21#.#0.229.95':445
  • '21#.#0.243.183':445
  • '21#.#0.208.6':445
  • '21#.#0.58.144':445
  • '21#.#0.85.221':445
  • '21#.#0.66.173':445
  • '21#.#0.118.59':139
  • '21#.#0.96.15':445
  • '21#.#0.15.212':445
  • '21#.#0.212.7':445
  • '21#.#0.60.153':445
  • '21#.#0.33.152':445
  • '21#.#0.238.218':445
  • '21#.#0.32.126':445
  • '21#.#0.74.36':445
  • '21#.#0.36.229':445
  • '21#.#0.229.170':445
  • '21#.#0.62.77':445
  • '21#.#0.179.76':445
  • '21#.#0.11.253':445
  • '21#.#0.232.19':445
  • '21#.#0.139.31':445
  • '21#.#0.43.39':445
  • '21#.#0.182.46':139
  • '21#.#0.119.168':139
  • '21#.#0.168.200':139
  • '21#.#0.50.58':139
  • '21#.#0.47.232':139
  • '21#.#0.98.178':445
  • '21#.#0.31.243':139
  • '21#.#0.163.119':139
  • '21#.#0.144.110':139
  • '21#.#0.82.170':139
  • '21#.#0.193.233':139
  • '21#.#0.233.210':139
  • '21#.#0.73.97':139
  • '21#.#0.40.182':139
  • '21#.#0.152.214':139
  • '21#.#0.97.218':139
  • '21#.#0.107.233':139
  • '21#.#0.233.102':139
  • '21#.#0.30.53':139
  • '21#.#0.75.192':139
  • '21#.#0.134.126':139
  • '21#.#0.60.73':139
  • '21#.#0.218.100':139
  • '21#.#0.25.207':139
  • '21#.#0.40.75':139
  • '21#.#0.82.238':139
  • '21#.#0.193.103':139
  • '21#.#0.43.73':139
  • '21#.#0.0.238':445
  • '21#.#0.157.206':139
  • '21#.30.79.4':139
  • '21#.#0.223.193':139
  • '21#.#0.204.175':445
  • '21#.#0.175.214':445
  • '21#.#0.177.197':445
  • '21#.#0.19.153':445
  • '21#.#0.102.97':445
  • '21#.#0.32.222':445
  • '21#.#0.135.59':445
  • '21#.#0.83.248':139
  • '21#.#0.17.214':139
  • '21#.#0.41.73':139
  • '21#.#0.250.182':139
  • '21#.#0.23.216':139
  • '21#.#0.62.43':139
  • '21#.#0.142.71':139
  • '21#.#0.13.213':139
  • '21#.#0.82.192':139
  • '21#.#0.95.120':139
  • '21#.#0.7.253':139
  • '21#.#0.89.39':139
  • '21#.#0.25.207':445
  • '21#.#0.40.75':445
  • '21#.#0.75.192':445
  • '21#.#0.152.214':445
  • '21#.#0.97.218':445
  • '21#.#0.218.100':445
  • '21#.#0.182.46':445
  • '21#.#0.119.168':445
  • '21#.#0.168.200':445
  • '21#.#0.134.126':445
  • '21#.#0.73.97':445
  • '21#.#0.47.232':445
  • '21#.#0.40.182':445
  • '21#.#0.19.65':139
  • '21#.#0.221.41':139
  • '21#.#0.100.252':139
  • '21#.#0.38.131':139
  • '21#.#0.50.173':139
  • '21#.30.69.2':139
  • '21#.#0.167.58':445
  • '21#.#0.77.253':445
  • '21#.#0.233.102':445
  • '21#.#0.69.43':139
  • '21#.30.65.3':445
  • '21#.#0.210.14':445
  • '21#.#0.82.170':445
  • '21#.30.79.4':445
  • '21#.#0.223.193':445
  • '21#.#0.193.103':445
  • '21#.#0.13.213':445
  • '21#.#0.82.192':445
  • '21#.#0.157.206':445
  • '21#.#0.167.58':139
  • '21#.#0.198.17':139
  • '21#.#0.77.253':139
  • '21#.#0.43.73':445
  • '21#.30.65.3':139
  • '21#.#0.210.14':139
  • '21#.#0.142.71':445
  • '21#.#0.163.119':445
  • '21#.#0.144.110':445
  • '21#.#0.82.238':445
  • '21#.#0.193.233':445
  • '21#.#0.233.210':445
  • '21#.#0.31.243':445
  • '21#.#0.41.73':445
  • '21#.#0.95.120':445
  • '21#.#0.7.253':445
  • '21#.#0.23.216':445
  • '21#.#0.62.43':445
  • '21#.#0.83.248':445

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android