Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Adware.Ezoneclick.1

Added to the Dr.Web virus database: 2010-03-23

Virus description added:

Technical Information

To ensure autorun and distribution:
Modifies the following registry keys:
  • [<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{00000112-0349-449c-8CDF-2767E7E6E2FA}] 'Exec' = 'http://yesmoney.co.kr/'
  • [<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{00000112-2461-47fc-A02F-9EB8678B2A5C}] 'Exec' = 'http://%65v%65nt.go.co.kr/nbarcon/11.php?bncode=filemoaup'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ez_oneclick' = '"%PROGRAM_FILES%\ez_oneclick\EzOne_Click.exe" -o'
  • [<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{00000112-78A7-48d9-9094-E214DAB62467}] 'Exec' = 'http://%65v%65nt.go.co.kr/nbarcon/c.php?bncode=filemoaup'
  • [<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{00000112-61C1-4d78-9748-81073EFB1E53}] 'Exec' = 'http://%65v%65nt.go.co.kr/nbarcon/gm.php?bncode=filemoaup'
  • [<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{00000112-25AE-487c-8DD7-1CC9CE85512A}] 'Exec' = 'http://%65v%65nt.go.co.kr/nbarcon/au.php?bncode=filemoaup'
  • [<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{00000112-0386-42ec-9235-AB96A83F7FF1}] 'Exec' = 'http://%65v%65nt.go.co.kr/megapass/event.php?pid=filemoaup'
Malicious functions:
Executes the following:
  • <SYSTEM32>\cmd.exe /c \DelUS.bat
Modifies file system :
Creates the following files:
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\·ФµҐИЁјоЗО.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\ёВВЇґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\µрѕШјҐ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\іујц»кИЁјоЗО NSАМју.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\ґЩїшёфґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\№ДЅєЕёАП.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\їмГј±№ јоЗО.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\їш№ЩАМїш.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\ѕЖЅє№МїА.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\№ЭЗ°јјАПґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\ЅЕјј°иёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\Qook TVјоЗО.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(їојј-є№±З)\ВЇ·О¶З.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(їојј-є№±З)\ЗБё®Б¶ѕЖ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(їојј-є№±З)\їојј»з¶ы.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(їојј-є№±З)\їојј.com.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(їојј-є№±З)\їојјґ©ё®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(АЪµїВч-АЪµїВчїлЗ°)\ё¶АМД«їНґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\CJmall.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\Hmall.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(АЪµїВч-АЪµїВчїлЗ°)\Б¦АПД«іЭ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(АЪµїВч-АЪµїВчїлЗ°)\јјАМєкД«µе іЧєс°ФАМјЗ ЖчАОЖ® ±ёАФ ЗБ·ОёрјЗ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(АЪµїВч-АЪµїВчїлЗ°)\їЈД«БЯ°нВч.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\їшѕоµҐАМ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(Гл№М-ѕЦ°ЯїлЗ°)\·ЇєкЖк.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(Гл№М-ѕЦ°ЯїлЗ°)\ЅєДр№ВБч.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(Гл№М-ѕЦ°ЯїлЗ°)\µµ±ЧёѕѕЦ°ЯїлЗ°.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(Г¤ЖГ-№МЖГ-±іБ¦)\Е·Д«ґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(Гл№М-ѕЦ°ЯїлЗ°)\°ЗґгјҐ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(Гл№М-ѕЦ°ЯїлЗ°)\ДЭ·єЕНёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\eЕ¬ё°.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\°ЧЗГ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\QOOKАОЕНіЭ Аь±№°ЎАФјѕЕН.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(Гл№М-ѕЦ°ЯїлЗ°)\ЖкГчё¶ДП.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\BCД«µе ЅЕїлБ¤єёєёИЈ ј­єсЅє ЅЕГ» АМєҐЖ®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(Г¤ЖГ-№МЖГ-±іБ¦)\ДЈ±ёЕ¬·ґ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\Ж®·»µеЗГ·ЇЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\ЗЗЕж»юїц.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\ДБ№цЅєјҐ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\їшДП.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(БѕЗХјоЗОёф)\АМё¶Ж®АОЕНіЭјоЗОёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(Г¤ЖГ-№МЖГ-±іБ¦)\ё®ѕуЖГ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(Г¤ЖГ-№МЖГ-±іБ¦)\Б¶АМЗеЖГ(ѕуВЇАМєҐЖ®).url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(Г¤ЖГ-№МЖГ-±іБ¦)\Б¶АМЗеЖГ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(Г¤ЖГ-№МЖГ-±іБ¦)\їА·»БцёЮАМЖ®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(Г¤ЖГ-№МЖГ-±іБ¦)\№МЖГ2030.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(Г¤ЖГ-№МЖГ-±іБ¦)\ЅМ±ЫЖДАМЖГ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\Г»јЦ ІїІїєф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\ДЙѕојѕЅєёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\БТЕҐ°ЈАе.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\АеёАґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\Бѕ°ЎЗЄµејҐ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\ЗЄµеё¶Ж®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\·ФµҐГјЕ©Д«µе.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\ёЖЅєД«µе.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\ґЩ·зАОЖч.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\GSєёЗ輥.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\±ієё»эён АМєҐЖ®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\єОАЪёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\G7ДїЗЗ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\±Чё°ёрѕЖ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\CJON mart.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\Зп·ОїмЖГ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\AbleMall.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\±Э»кАО»пµµёЕјѕЕН.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\µїїшёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\№Щ·ОБ¶ё® јц»кЅДЗ° ѕѕДо.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\ґЩЗПґ©ёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\±иИс¶у °щ°Ё.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅДЗ°-°З°­-ґЩАМѕоЖ®)\іЧїАЅєА§Ж®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\№М·ЎАОЅґ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ї©јє-°бИҐ-АЇѕЖ)\·№µеИъЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ї©јє-°бИҐ-АЇѕЖ)\ё®ЖІГµАз.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ї©јє-°бИҐ-АЇѕЖ)\µрѕѕєП.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\БѕЅЕєёЗиґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ї©јє-°бИҐ-АЇѕЖ)\°ЎєЈіоАМ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ї©јє-°бИҐ-АЇѕЖ)\ё¶АМєЈАМєс.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(їојј-є№±З)\·О¶Зё®ДЎ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(їојј-є№±З)\»зБЦєкАМґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ї©јє-°бИҐ-АЇѕЖ)\Б¦·ОЕхјјємґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ї©јє-°бИҐ-АЇѕЖ)\єёё®єёё®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ї©јє-°бИҐ-АЇѕЖ)\ѕЖАМГ§ё°Бц.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\АОЅє№лё®ґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\ЅєЗЗµе№рЕ©.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\ЅЕЗСД«µе.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\јјАМєкД«µе №Я±Ю ЅЕГ» АМєҐЖ®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\єёЗи 24.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\»пјєД«µе.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\їГЕ©·№µч №«·бИёїш°ЎАФ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\АОЅґіЭ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\АОЅє·Јµе.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\АМАЇґЩАМ·єЖ®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\їГЕ©·№µч.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЅЕїлД«µе-єёЗи)\їмё®ѕЖєс№Щ»эён АМєҐЖ®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\±вЗБЖјДЬ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ЗГ¶уАМїцДЎ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ЗПЗБЕ¬·ґ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ЗБ·ОїНДЎ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ЖРјЗЅєЕдё®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ЖРјЗЗГ·ЇЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ЗПЗПёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЗШїЬјоЗО-Аь№®ёф)\ё¶АМѕЖё¶Бё.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЗШїЬјоЗО-Аь№®ёф)\ѕЖАМЗПїмЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЗШїЬјоЗО-Аь№®ёф)\OTTO.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ЗгґП№цЕН.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ЗмАМїд.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ЖјДДЖЫґП.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\їА°Ў°Ф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\їАјѕЅє(osense).url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ї§Бцёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\їЈЕНјҐ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\їЈЕНЅДЅєёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\їИ№ЗЅєЖ®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ДЪАМ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ДЪДЪЖЛ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\АПёрЅєЖ®ёґ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\їНїНґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\А§БоЅєЕдё®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЗШїЬјоЗО-Аь№®ёф)\їЈБ¶АМґєїе.url
  • %TEMP%\nsb2.tmp\stack.dll
  • %TEMP%\nsb2.tmp\SetHoldData.dll
  • %HOMEPATH%\Desktop\Бс°ЬГЈ±в їБјЗ.url
  • %HOMEPATH%\Favorites\Бс°ЬГЈ±в - јЅЅє-ДЪё®ѕЖ.url
  • %HOMEPATH%\Favorites\Бс°ЬГЈ±в - їБјЗ.url
  • %PROGRAM_FILES%\ez_oneclick\Uninstall.exe
  • %TEMP%\nsb2.tmp\SelfDelete.dll
  • C:\DelUS.bat
  • %TEMP%\nsb2.tmp\DLLWebCount.dll
  • %TEMP%\nsb2.tmp\registry.dll
  • %TEMP%\nsb2.tmp\IEFunctions.dll
  • %HOMEPATH%\Favorites\Бс°ЬГЈ±в - јЅЅє-№«єс.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЗШїЬјоЗО-Аь№®ёф)\ЗПЗБЕ¬·ґґеДД.url
  • %HOMEPATH%\Favorites\Бс°ЬГЈ±в - 11№ш°Ў.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЗШїЬјоЗО-Аь№®ёф)\АЇё®Д«.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЗШїЬјоЗО-Аь№®ёф)\їцДїИъ ёйјјБЎ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЗШїЬјоЗО-Аь№®ёф)\А§БоА§µе.url
  • %HOMEPATH%\Favorites\Бс°ЬГЈ±в - CJmall.url
  • %HOMEPATH%\Favorites\Бс°ЬГЈ±в - d&shop.url
  • %HOMEPATH%\Favorites\Бс°ЬГЈ±в - »пјєёф.url
  • %HOMEPATH%\Favorites\Бс°ЬГЈ±в - NSіујц»кИЁјоЗО.url
  • %HOMEPATH%\Favorites\Бс°ЬГЈ±в - Gё¶ДП.url
  • %HOMEPATH%\Favorites\Бс°ЬГЈ±в - KTmall.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\АЧЕ©»зїд.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\Б¶АМ№®АЪ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\АОЖчё¶ЅєЕН.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\АҐјЦ·зјЗЖЗёЕ CGIMALL.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\АЇµрїҐ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\Б¶АМЗПµе.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ДьґЩїо.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ЖчЅєЖ®ёЗ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ДоЖДАП.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ВЇµрЅєЕ©.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ДДЅє±оЖд.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\їНїмµрЅєЕ©.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ё¶АМЕ©·№µч.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ёЮ°ЎЖДАП.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ё®ѕуЅєДµ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ґПБоДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ґЩїоБо.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\єн·зАҐ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\їўЅєЕ°ЖЫ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\їБјЗ ЅєД«АМЗБ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ѕЖЅОДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\Ѕ¦ѕо№ЪЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ЅґЖЫґЩїо Иёїш°ЎАФ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ЖъґхјјАМЗБ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\єн·ўЖз·Оїм.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\»м·ХіЄАО.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\єн·ўДэ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\єЈіЧЖј.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\єк·Јµе·Їєк.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ј±ґцї©їХ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\їЈєс·и.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\їЈБ¶АМ№Р¶х.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ѕЖАМЅєЕёАП24.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\јј¶уёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ЅєЕёАПїЈБш.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\№Дё®ѕИ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\±Э»уГ·И­.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\іЄјї¶у.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ifumall.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ДДЗ»ЕН-АОЕНіЭ)\ЗС±№Б¤єёАОБх.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\LGЖРјЗјҐ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\іЄАО°Й.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ёнјєЅГ°и.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\№«Е©.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ёБ°нё®є».url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\іЄАОїИ№З.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ЖРјЗАЗ·щ-АвИ­)\ґхЅєЕЧАМБц.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\ДЪ№Н19.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµј­-АЅ№Э-°шї¬)\»з¶ыБц±в.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµј­-АЅ№Э-°шї¬)\»пјєєПЅєґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµј­-АЅ№Э-°шї¬)\№ЭµрѕШ·зґПЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµј­-АЅ№Э-°шї¬)\µµј­11№ш°Ў.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµј­-АЅ№Э-°шї¬)\µрБцЕР±ієё№®°н.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµј­-АЅ№Э-°шї¬)\ѕѕіЧБ¶АМ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµј­-АЅ№Э-°шї¬)\ЖјДПёµЕ©.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\KALИЈЕЪ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµј­-АЅ№Э-°шї¬)\АОЕНіЭј­БЎ ё®єк·О.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµј­-АЅ№Э-°шї¬)\ѕЖАМєсєП.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµј­-АЅ№Э-°шї¬)\їҐіЭґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµј­-АЅ№Э-°шї¬)\ґл±ієПЅєДµ(Bookscan).url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\ЅЕЗС±ЭА¶Б¤єё.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\ѕЛЗБЅє·Р.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\ЅєЕё»уИЈАъГаАєЗа ЗПАМ·Р.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\№МБо»з¶ы.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\»кїНёУґП.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\АМБц·Р.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµёЮАО-ИЈЅєЖГ)\ј­ДЎѕИ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµёЮАО-ИЈЅєЖГ)\їА№цГЯѕо ДЪё®ѕЖ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµёЮАО-ИЈЅєЖГ)\ёфјоЗО.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµёЮАО-ИЈЅєЖГ)\°ЎєсѕЖ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(µµёЮАО-ИЈЅєЖГ)\іЭЗЗѕЖґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\¶ЇГіё®ґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёёИ­-їµИ­-°ФАУ)\ёЮ°ЎЖРЅєБё.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёёИ­-їµИ­-°ФАУ)\јјАМ№ВБч.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёёИ­-їµИ­-°ФАУ)\·к·з°ФАУ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёёИ­-їµИ­-°ФАУ)\µµіКГчїµИ­.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёёИ­-їµИ­-°ФАУ)\·°Е°ЅєґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёёИ­-їµИ­-°ФАУ)\ЅЙЅЙЕёЖДTV.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёёИ­-їµИ­-°ФАУ)\БсБЄ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёёИ­-їµИ­-°ФАУ)\ДЪ°ФАУ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёёИ­-їµИ­-°ФАУ)\ѕЖАМЕЫёЕґПѕЖ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёёИ­-їµИ­-°ФАУ)\ѕѕіЧЕл АЇ·бёв№цЅ± °ЎАФ АМєҐЖ®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёёИ­-їµИ­-°ФАУ)\ѕѕіЧЖшЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\ИЩ¶уДЪё®ѕЖ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\їВ¶уАОДЬµµ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\їВ¶уАОЕхѕо.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\їБјЗјч№Ъ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\єсДЎ№лё® ё®Б¶Ж® АМєҐЖ®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\єсДЎ№лё® ё®Б¶Ж®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\АҐЕхѕо.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\ИЈЕЪЖ®ё®Ѕє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\ИЁЖ®·Ўєн.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\ЕхѕоАНЅєЗБ·№Ѕє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\Д«ЖчАЇ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(·№Аъ-ї©За-ЅєЖчГч)\ДієуЅєЕдё®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\ѕЛ№ЩА§Бо.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\АОЕ©·зЖ®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\ѕЖё®јц.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\»х·ТїЎµа.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\јј»уА» ї­ѕо°ЎґВ їµѕоДЈ±ё їЎµа№ЪЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\Б¤Г¶ »зАМ№ц ЅєДр.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±вЕёј­єсЅє)\TNS °Ў±ёЖРіОёрБэ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±вЕёј­єсЅє)\TNS ·№АМµр ЖРіО.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\ИЮіЭ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\ЖдАМїАЗВ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\ЗС±№ЗРјъБ¤єё.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\єёД«ЗБ·О.url
  • %PROGRAM_FILES%\ez_oneclick\url2.dll
  • %PROGRAM_FILES%\ez_oneclick\EzOne_Click.exe
  • %TEMP%\nsb2.tmp\Locate.dll
  • %TEMP%\nsb2.tmp\KillProcDLL.dll
  • %TEMP%\nsb2.tmp\DLLWaitForKillProgram.dll
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(°жёЕ-їАЗВё¶ДП)\11№ш°Ў.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\°ъїЬїАДЙАМ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\ёЮАМДїЅєЕНµр.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±іА°-Глѕч-ѕЛ№Щ)\(БЦ)ЅєД«їмЖ®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(°жёЕ-їАЗВё¶ДП)\Gё¶ДП.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(°жёЕ-їАЗВё¶ДП)\їБјЗ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±вЕёј­єсЅє)\°іАОБ¤єёµµїлВчґЬј­єсЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\114Е©·№µрЖ®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\kt·Р.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\ЗС±№ІЙ№иґЮјѕЕё.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\Аь±№ ІЙ№иґЮ іЭ114.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\Аь±№ІЙ№иґЮј­єсЅє 119ЗГ¶уїц.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\іЄАМЅєёУґП.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\ё®µеДЪЗБ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\ёУґПїБјЗ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\·ФµҐДіЗЗЕ».url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\¶уАМЗБ·Р.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ґліі-ґлГв)\·ЇЅГѕШДіЅГ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\А±БѕЅЕІЙ№иґЮ ЗГ¶уїц365.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\(БЦ)ЗГ·ЇЅєЗГ¶уїц.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\1300k.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±вЕёј­єсЅє)\јҐЖчЕ».url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±вЕёј­єсЅє)\іЄАМЅєёУґП.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(±вЕёј­єсЅє)\ёµЕ©ЗБ¶уАМЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\1566flower.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\ї№јЫДЪё®ѕЖ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\АЇґП·и.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\ѕЖё¶¶хЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\ўЯ99ЗГ¶уїц.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ІЙ№иґЮ-ЖТЅГ)\±Чё°јҐ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\LGT °ЎБ·А§ДЎѕИЅЙ ј­єсЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\·№µеucc.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\·№µеёБ°Ў.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\¶уАМєк69tv.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\іІјцЕ¬·ґ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\µыАЪґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\·№ёуTV.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\№д°шАЇ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\єёXїд.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\№Щ¶чі­ї©їм.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\№«АОµµёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\№ЩіЄіЄёф јєАОїлЗ° ЗТАОБЎ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\X-°ЙЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\ЗШЗЗёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\2010ЖДАП.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\ЗПАМё¶Ж®јоЗОёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\ДЪЅєЅєЕІ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\ЗПїмїГё°.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\3000їшјЅЅєAV.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\69ЕЧАМЗБ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\ClubSex.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\69јЅЅєДЪё®ѕЖ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\3000їшјЅЅєЖДАП.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\3000їшѕЯµї.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\єь±ёё®ѕЯµї.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\їЈЕНЗГ·№АМ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\їН№ЩД·.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\їЈБ¶АМ№«єс.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\їЎ·ОЅєАзЖТ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\їЎ·ОЕдАМёфґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\Б¤·ВёЗ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\Гµїшґ©µе.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\ДЪё®ѕЖїЎ·О.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\БсјЅЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\Б¶АМЗЦЖјєс.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\Б¶АМЗеЖ®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\ѕЯЗСД«Жд.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\јЅЅєДЪё®ѕЖ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\јЅЅєДЪё®ѕЖAV.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\јЅЅєѕШЅГЖј.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\»пГµїшјЅЅєЖјєс.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\јЅЅє-ДЪё®ѕЖ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\јЅЅГµрД«.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\ѕЖ°ЎѕѕTV.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\ѕЖё®јц№МЖГ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\јТ¶уЕ¬·ґ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\јЅЅГ№«єс.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(јєАО)\јЅЅГѕЖАМµ№.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\іЧАМГіё®ЖЫєнёЇ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\ґхЖдАМЅєјҐ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\±Чё°ДЪЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\±ВѕЖАМЖд·Оёу.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\±Ч·№АМЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\¶уілЕ©ёІ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\ЅєЕІRX.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\ЅєЕІєЈєЈ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\єсґхЅєЕІ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\ё®ЅєЕІ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\ё®їАї¤ё®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\BRTC.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\ёр№ЩАП°ФАУБё.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\ёр№ЩАП№МЖГ АЇ·б°ЎАФ (ѕЦАОёёµй±в).url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\mylg070.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\SKT Аъ°ЎБ¤ѕЧБ¦ АМєҐЖ®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\SMSЗЗѕЖ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\»Сё®їА.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\ГЦЅЕіЭєП №«·бБхБ¤АМєҐЖ®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\Жщјї.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\їЈЖСЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\јоѕШѕЖАМ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(ёр№ЩАП-ЕлЅЕ)\ѕѕїЈЕх.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\ЅєЖ®·ОєЈё®іЭ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\ґЩАМјТёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\ё®µејѕЅєёф.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\Papel Stationery.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\007єёАМЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\2001ѕЖїп·ї.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\№МїАµрїА.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\Б¦АПБё.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\ГµА̹鿥.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\їВµрЅєЕ©.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\єЈµщ·Јµе.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\ѕЖАМёрё®.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»эИ°-°ЎАь-БЦ№ж)\(БЦ)»уµµ°Ў±ё.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\Еёё¶ґП Гµї¬ ёнЗ° И­»кАзЖС.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\ЕВ№ЭДЪё®ѕЖ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\ДЪЅє№МИ­АеЗ°.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\їЎДЪДЙѕо.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\їЎЖЅЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\ЖдАМЅєµеёІ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»з№«їлЗ°-°ЈЗа№°)\ёнЗФГµ»з.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»з№«їлЗ°-°ЈЗа№°)\АЧЕ©ѕЖАМ ґеДД.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»з№«їлЗ°-°ЈЗа№°)\µрѕѕїўЅє.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(№Мїл-И­АеЗ°)\ЗГ·ЇЅєГµ.url
  • %HOMEPATH%\Favorites\№Щ·О°Ў±в(»з№«їлЗ°-°ЈЗа№°)\µр№ЪЅє.url
Deletes the following files:
  • %TEMP%\nsb2.tmp\SelfDelete.dll
  • %TEMP%\nsb2.tmp\registry.dll
  • %TEMP%\nsb2.tmp\stack.dll
  • %TEMP%\nsb2.tmp\SetHoldData.dll
  • %TEMP%\nsb2.tmp\Locate.dll
  • %TEMP%\nsb2.tmp\DLLWebCount.dll
  • %TEMP%\nsb2.tmp\DLLWaitForKillProgram.dll
  • %TEMP%\nsb2.tmp\KillProcDLL.dll
  • %TEMP%\nsb2.tmp\IEFunctions.dll
Deletes itself.
Network activity:
Connects to:
  • 'lo#.##sence.co.kr':80
TCP:
HTTP GET requests:
  • lo#.##sence.co.kr/logexp.php?ai####################################
UDP:
  • DNS ASK lo#.##sence.co.kr
Miscellaneous:
Searches for the following windows:
  • ClassName: 'MS_AutodialMonitor' WindowName: ''
  • ClassName: 'MS_WebcheckMonitor' WindowName: ''
  • ClassName: 'Shell_TrayWnd' WindowName: ''
  • ClassName: 'Indicator' WindowName: ''
  • ClassName: '' WindowName: ''

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android