Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Trojan.DownLoader7.24983

Added to the Dr.Web virus database: 2012-11-17

Virus description added:

Technical Information

To ensure autorun and distribution:
Modifies the following registry keys:
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'winlogon' = '%WINDIR%\svchost.exe'
Malicious functions:
Creates and executes the following:
  • %WINDIR%\svchost.exe
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\Plugin-Setup.exe
Modifies file system :
Creates the following files:
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Tools\script\window\tasktips.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Tools\script\window\shortcuts.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Tools\script\window\shop.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Tools\script\window\tools.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Tools\script\window\viewfightskill.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Tools\script\window\TuiQuanHuong.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Tools\script\window\Tools1.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Tools\script\window\renascencepanel.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Tools\script\window\new4X.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Tools\script\window\mgr.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Tools\script\window\helpsprite.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Tools\script\window\NoEXPl.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Tools\script\window\playname_ex.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Tools\script\window\playerpray.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Tools\script\window\noPick.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\ui_autosay2\data\hanhua3.txt
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\ui_autosay2\data\hanhua2.txt
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\ui_autosay2\data\hanhua1.txt
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\ui_autosay2\data\hanhua4.txt
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\ui_autosay2\data\reply.txt
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\ui_autosay2\data\msg.wav
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\ui_autosay2\data\hanhua5.txt
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\ui_autosay2\data\hanhua.txt
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\ui_autosay2\AutoReply.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Tools\script\window\xuanjing.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Tools\script\window\worldmap_sub.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\ui_autosay2\autosay.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\ui_autosay2\AutoSay2.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\ui_autosay2\autosay2.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\ui_autosay2\AutoSay.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Tools\script\window\guttalk.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\tool\XiaKe.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\tool\VuotRao.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\tool\tool.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Tools\001a\window\cover.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Tools\001a\window\renascencepanel.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Tools\001a\window\nopick_setting.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Tools\001a\window\jinghuofuliex.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\tool\tool.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\tool\RungGai.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\tool\plugincfg.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\tool\openYaoXiang.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\tool\Supercall.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\tool\Thuthapthaoduoc.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\tool\Thuthapgo.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\tool\TDLT.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Tools\script\window\checkplugin.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Tools\script\window\callback.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Tools\script\window\BuffTC.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Tools\script\window\collection.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Tools\script\window\gutmodel.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Tools\script\window\GetIDNPC.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Tools\script\window\Confirm.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Tools\script\window\books.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Tools\001a\window\viewfightskill.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Tools\001a\window\tools1.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Tools\001a\window\tools.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Tools\plugincfg.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Tools\script\window\autotreasure.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Tools\script\window\AutoCastLeftSkill.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Tools\script\window\AutoAsist.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\ui_autosay2\data\reply2.txt
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\YeuLamCo129\uiSayPanel.txt
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\YeuLamCo129\uiMsgPad.txt
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\YeuLamCo129\Train.txt
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\YeuLamCo129\uiTaskTips.txt
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\YeuLamCo129\VatPhamDauGia.txt
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\YeuLamCo129\UI_TONGHOP.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\YeuLamCo129\UI_HETHONG.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\YeuLamCo129\Train.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\YeuLamCo129\OnTeamApplyAdd.txt
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\YeuLamCo129\NhiemVuChinhTuyen.txt
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\YeuLamCo129\LichHoatDong.txt
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\YeuLamCo129\plugincfg.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\YeuLamCo129\TLHL.txt
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\YeuLamCo129\Tien_ich.txt
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\YeuLamCo129\ReLoad.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\ui\001c\window\cover.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\ui\001b\wndconfig.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\ui\001b\window\cover.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\ui\001c\wndconfig.ini
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\wjxsmartfocus[1].html
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\Uninstall.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\Uninstall.exe
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\ui\001a\wndconfig.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\setting\item\001\other\xuanjing_002_s.spr
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\setting\item\001\other\version.cfg
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\setting\item\001\other\scriptitem.txt
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\setting\item\001\other\xuanjing_lv4.spr
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\ui\001a\window\fightmode.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\ui\001a\window\cover.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\ui\001a\UI_POPBAR=552,518.rar
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\YeuLamCo129\HeThong.txt
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\UI_UnLock\lockaccount.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\UI_PLAYERPANEL\zhenyuan.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\UI_PLAYERPANEL\viewwealthvalue.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\UI_UnLock\lockaccount.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\UI_UnLock\unlock.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\UI_UnLock\unlock.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\UI_UnLock\plugincfg.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\UI_PLAYERPANEL\viewwealthvalue.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\UI_PLAYERPANEL\playerpanel.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\UI_PLAYERPANEL\playerhonor_wealth.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\ui_autosay2\plugincfg.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\UI_PLAYERPANEL\playerpanel.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\UI_PLAYERPANEL\Scrip09.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\UI_PLAYERPANEL\Scrip08.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\UI_PLAYERPANEL\plugincfg.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\YeuLamCo129\AutoThuongHoi.txt
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\YeuLamCo129\AutoHTBT.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\YeuLamCo129\AutoHLVM.txt
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\YeuLamCo129\AutoTruyNa.txt
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\YeuLamCo129\HauPhucNguuSon.txt
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\YeuLamCo129\BeepTimes.txt
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\YeuLamCo129\BachManSon.txt
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\XemTruocCuongHoa\PreViewMgr.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\unreal_tester\plugincfg.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\unreal_tester\cuonghoa_setting.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\unreal_tester\cuonghoa.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\XemTruocCuongHoa\base.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\XemTruocCuongHoa\preview.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\XemTruocCuongHoa\preview.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\XemTruocCuongHoa\plugincfg.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\tool\Input0.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\CauCa\diaoyu.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\CauCa\diaoyu.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\CauCa\AutoJiaoYu.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\CauCa\diaoyu.txt
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\CauCa\plugincfg.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\CauCa\diaoyu1.txt
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\CauCa\diaoyu1.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\btssl_class\plugincfg.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\btssl_autoFollow\plugincfg.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\btssl_autoFollow\main.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\btssl_autoFollow\key.txt
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\btssl_autoFollow\selecttnpc.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\btssl_class\item.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\btssl_class\equip.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\btssl_class\enhance.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Hanhtrang_Ruong\orderbag_compare.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Hanhtrang_Ruong\orderbag.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Hanhtrang_Ruong\itembox.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Hanhtrang_Ruong\orderbag_logic.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Hanhtrang_Ruong\repository.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Hanhtrang_Ruong\repository.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Hanhtrang_Ruong\plugincfg.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Hanhtrang_Ruong\itembox.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Detector\jingying.wav
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Detector\enemy.wav
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Detector\Detector.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Detector\plugincfg.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\GhepHT\plugincfg.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\GhepHT\Compose.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\GhepHT\compose.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\btssl_autoFollow\key.dll
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\AutoAnswer\Hoadang.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\AutoAnswer\AutoAnswer.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\Plugin-Setup.exe
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\AutoAnswer\plugincfg.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Auto_Mail\auto_mail.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\AutoAnswer\Titi.txt
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\AutoAnswer\tiku.txt
  • %WINDIR%\svchost.exe
  • %TEMP%\$inst\5.tmp
  • %TEMP%\$inst\4.tmp
  • %TEMP%\$inst\2.tmp
  • %TEMP%\$inst\temp_0.tmp
  • %TEMP%\ie2.a3x
  • %TEMP%\ie1.a3x
  • %TEMP%\down.a3x
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\btssl_autofight\script\window\auto_fight.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\btssl_autofight\script\window\autoMedicine.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\btssl_autofight\script\window\autofight_setting.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\btssl_autofight\script\window\backtrack.rar
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\btssl_autoFollow\autoFollow.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\btssl_autoFollow\autoFollow.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\btssl_autofight\script\window\skilltree.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\btssl_autofight\script\window\autofightdata.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Auto_Mail\plugincfg.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Auto_Mail\mail_client.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Auto_Mail\mail.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Auto_Mail\Tools_mail.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\btssl_autofight\script\window\autofight.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\btssl_autofight\plugincfg.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\btssl_autofight\001a\window\autofight.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Hanhtrang_Ruong\throwAway.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\supermaplink\supermaplink.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\supermaplink\ReloadCH.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\supermaplink\plugincfg.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\ThanhTung\AutoLV.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\ThanhTung\partner.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\ThanhTung\NangDong.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\ThanhTung\AutoPartner.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\supermaplink\myui.dll
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\sprTrade\msgsellelem.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\sprTrade\itembox.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\sprTrade\extbagmodify.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\sprTrade\plugincfg.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\supermaplink\maplink_ui.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\supermaplink\maplink_ui.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\sprTrade\trade.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\tool\auctionroom.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\ToDoiNangCao\team_modify.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\ToDoiNangCao\teamportrait.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\tool\AutoChiLing.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\tool\Fishing.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\tool\AutoQuanDoanh.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\tool\AutoQuanDoanh.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\ToDoiNangCao\teamportrait.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\ThanhTung\plugincfg.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\ThanhTung\partner_setting.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\ThanhTung\partner.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\ThanhTung\skillprogress.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\ToDoiNangCao\plugincfg.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\ThanhTung\Tool_Tung.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\ThanhTung\Tool_Tung.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\sprBao\SprBao_setting.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Recipe\BuyCointVSV.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Recipe\BuyCointTDLT.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Recipe\BuyCointTDC.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Recipe\CheckPhucLoi.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Recipe\CheckPhucLoiVSV.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Recipe\CheckPhucLoiTDLT.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Recipe\CheckPhucLoiTDC.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Recipe\BuyCoint.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\interfacemanagercfg.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Hanhtrang_Ruong\zhanhunbag.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Hanhtrang_Ruong\zhanhunbag.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\MiniClock\miniclock.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\MiniClock\sidesysbar.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\MiniClock\plugincfg.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\MiniClock\miniclock.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\setting\map\wanted_killnpc.txt
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\setting\map\treasuremap_pos.txt
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\setting\map\transmit.txt
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\setting\map\worldmap.txt
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\sprBao\SprBao_setting.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\sprBao\Remote.dll
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\sprBao\plugincfg.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\setting\map\maplist.txt
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Recipe\Reload.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Recipe\plugincfg.ini
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Recipe\NAT.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Recipe\TDC.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\setting\ct_enemys.wav
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Recipe\VSV.lua
  • %PROGRAM_FILES%\Company\Plugin 4.09 (800x600)\interface2\Recipe\TDLT.lua
Deletes the following files:
  • %TEMP%\$inst\4.tmp
  • %TEMP%\$inst\5.tmp
  • %TEMP%\$inst\temp_0.tmp
  • %TEMP%\$inst\2.tmp
Network activity:
Connects to:
  • 'www.au###iemthe.net':80
  • 'localhost':1036
TCP:
HTTP GET requests:
  • www.au###iemthe.net/2009/11/wjxsmartfocus.html
UDP:
  • DNS ASK www.au###iemthe.net
Miscellaneous:
Searches for the following windows:
  • ClassName: 'IEFrame' WindowName: ''
  • ClassName: 'MS_AutodialMonitor' WindowName: ''
  • ClassName: 'MS_WebcheckMonitor' WindowName: ''
  • ClassName: 'Shell_TrayWnd' WindowName: ''
  • ClassName: '' WindowName: 'GINA Logon'
  • ClassName: '' WindowName: ''

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android