Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Trojan.DownLoader10.11677

Added to the Dr.Web virus database: 2013-08-30

Virus description added:

Technical Information

To ensure autorun and distribution:
Creates or modifies the following files:
  • %WINDIR%\Tasks\SA.DAT
Malicious functions:
Executes the following:
  • '<SYSTEM32>\svchost.exe' -k netsvcs
  • '<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WER9ba8.dir00\svchost.exe.mdmp 16325836412032336
Modifies file system :
Creates the following files:
  • %WINDIR%\Help\Tours\htmlTour\wwvjntek.exe
  • %WINDIR%\Help\Tours\htmlTour\lhhjrkjk.exe
  • %WINDIR%\Help\Tours\htmlTour\cxjclkkc.exe
  • %WINDIR%\Help\Tours\htmlTour\kzerbzks.exe
  • %WINDIR%\Help\Tours\htmlTour\nleqhveh.exe
  • %WINDIR%\Help\hwexrtne.exe
  • %WINDIR%\Help\bzehxvnz.exe
  • %WINDIR%\Help\jjlenkbt.exe
  • %WINDIR%\Help\Tours\htmlTour\qejnhetj.exe
  • %WINDIR%\Help\tsbjbtvn.exe
  • %WINDIR%\Help\Tours\htmlTour\hjhecvkh.exe
  • %WINDIR%\Help\Tours\htmlTour\trsecbvb.exe
  • %WINDIR%\Help\Tours\htmlTour\lwnssrtv.exe
  • %WINDIR%\Help\Tours\htmlTour\rqkjqjqb.exe
  • %WINDIR%\Help\Tours\htmlTour\ztssweeh.exe
  • %WINDIR%\Help\Tours\htmlTour\ekwlsjzj.exe
  • %WINDIR%\Help\Tours\htmlTour\lrhwxcwk.exe
  • %WINDIR%\Help\Tours\htmlTour\tjxhsker.exe
  • %WINDIR%\Help\Tours\htmlTour\kxkzvszq.exe
  • %WINDIR%\Help\Tours\htmlTour\skersqzb.exe
  • %WINDIR%\Help\Tours\htmlTour\klbvejnk.exe
  • %WINDIR%\Help\jbnshhqj.exe
  • %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
  • %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
  • %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
  • %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
  • %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
  • %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
  • %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
  • %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
  • %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
  • %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
  • %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
  • %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
  • %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
  • %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
  • %PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
  • %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
  • %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
  • %TEMP%\WER9ba8.dir00\svchost.exe.mdmp
  • %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
  • %CommonProgramFiles%\System\ado\tsektjkj.exe
  • %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
Network activity:
Connects to:
  • '21#.#1.81.117':139
  • '21#.#1.187.176':139
  • '21#.#1.160.155':139
  • '21#.#1.170.211':139
  • '21#.#1.242.175':139
  • '21#.#1.25.169':139
  • '21#.#1.88.185':139
  • '21#.#1.85.64':139
  • '21#.#1.132.223':139
  • '21#.#1.223.89':139
  • '21#.#1.237.193':139
  • '21#.#1.171.88':139
  • '21#.#1.23.35':139
  • '21#.#1.223.89':445
  • '21#.#1.29.83':445
  • '21#.#1.96.23':139
  • '21#.#1.23.35':445
  • '21#.#1.85.64':445
  • '21#.#1.132.223':445
  • '21#.#1.143.195':139
  • '21#.#1.245.184':139
  • '21#.#1.189.63':139
  • '21#.#1.63.171':139
  • '21#.#1.25.133':139
  • '21#.#1.244.32':139
  • '21#.#1.51.104':139
  • '21#.#1.29.83':139
  • '21#.#1.181.65':445
  • '21#.#1.197.125':445
  • '21#.#1.59.22':445
  • '21#.#1.18.78':445
  • '21#.#1.125.146':445
  • '21#.#1.139.243':445
  • '21#.#1.22.193':445
  • '21#.61.13.4':445
  • '21#.#1.40.79':445
  • '21#.#1.214.63':445
  • '21#.#1.192.161':445
  • '21#.#1.188.177':445
  • '21#.#1.204.183':445
  • '21#.#1.239.182':445
  • '21#.#1.182.220':445
  • '21#.#1.220.5':445
  • '21#.#1.90.124':445
  • '21#.#1.48.62':445
  • '21#.#1.192.239':445
  • '21#.#1.117.121':445
  • '21#.#1.114.194':445
  • '21#.#1.17.45':445
  • '21#.#1.245.68':445
  • '21#.#1.215.178':445
  • '21#.#1.187.5':445
  • '21#.61.6.61':445
  • '21#.#1.247.157':139
  • '21#.#1.114.27':139
  • '21#.#1.112.224':139
  • '21#.#1.148.224':139
  • '21#.#1.18.233':139
  • '21#.#1.147.139':139
  • '21#.#1.44.118':139
  • '21#.#1.65.181':139
  • '21#.#1.164.74':139
  • '21#.#1.249.40':139
  • '21#.#1.225.176':139
  • '21#.#1.37.230':139
  • '21#.#1.175.22':139
  • '21#.#1.218.115':445
  • '21#.#1.116.65':445
  • '21#.#1.11.233':445
  • '21#.#1.111.148':445
  • '21#.#1.66.56':445
  • '21#.#1.42.171':445
  • '21#.#1.128.96':445
  • '21#.#1.68.232':139
  • '21#.#1.232.152':139
  • '21#.#1.157.82':139
  • '21#.#1.247.144':139
  • '21#.#1.228.39':139
  • '21#.#1.39.33':139
  • '21#.#1.217.173':139
  • '21#.#1.189.63':445
  • '21#.#1.63.171':445
  • '21#.#1.170.211':445
  • '21#.#1.244.32':445
  • '21#.#1.51.104':445
  • '21#.#1.245.184':445
  • '21#.#1.242.175':445
  • '21#.#1.88.185':445
  • '21#.#1.237.193':445
  • '21#.#1.171.88':445
  • '21#.#1.25.169':445
  • '21#.#1.81.117':445
  • '21#.#1.187.176':445
  • '21#.#1.111.148':139
  • '21#.#1.66.56':139
  • '21#.#1.42.171':139
  • '21#.#1.77.166':139
  • '21#.#1.14.40':139
  • '21#.#1.33.46':139
  • '21#.#1.218.115':139
  • '21#.#1.96.23':445
  • '21#.#1.143.195':445
  • '21#.#1.25.133':445
  • '21#.#1.116.65':139
  • '21#.#1.11.233':139
  • '21#.#1.128.96':139
  • '21#.#1.1.185':445
  • '21#.#1.85.43':139
  • '21#.#1.243.60':139
  • '21#.#1.58.52':139
  • '21#.#1.100.39':139
  • '21#.#1.16.120':139
  • '21#.#1.111.122':139
  • '21#.#1.246.148':139
  • '21#.#1.135.234':445
  • '21#.61.70.3':445
  • '21#.#1.134.79':445
  • '21#.#1.145.208':139
  • '21#.#1.76.25':139
  • '21#.#1.61.63':445
  • '21#.#1.181.51':139
  • '21#.#1.227.254':139
  • '21#.#1.52.38':139
  • '21#.#1.205.182':139
  • '21#.#1.182.247':139
  • '21#.#1.247.191':139
  • '21#.#1.59.117':139
  • '21#.#1.101.130':139
  • '21#.#1.42.214':139
  • '21#.#1.36.140':139
  • '21#.#1.227.219':139
  • '21#.#1.239.191':139
  • '21#.#1.29.241':139
  • '21#.#1.11.224':445
  • '21#.#1.110.71':445
  • '21#.#1.18.76':445
  • '21#.#1.163.197':445
  • '21#.#1.252.246':445
  • '21#.#1.65.247':445
  • '21#.#1.181.156':445
  • '21#.#1.206.119':445
  • '21#.#1.117.252':445
  • '21#.#1.61.63':139
  • '21#.#1.135.234':139
  • '21#.#1.128.205':445
  • '21#.#1.55.103':445
  • '21#.#1.168.118':445
  • '21#.#1.195.235':445
  • '21#.#1.11.199':445
  • '21#.#1.129.29':445
  • '21#.#1.172.131':445
  • '21#.61.6.60':445
  • '21#.#1.95.226':445
  • '21#.#1.212.178':445
  • '21#.#1.168.97':445
  • '21#.#1.121.13':445
  • '21#.#1.27.24':445
  • '21#.#1.187.129':445
  • '21#.#1.220.170':445
  • '21#.#1.165.216':445
  • '21#.#1.125.146':139
  • '21#.#1.139.243':139
  • '21#.#1.181.65':139
  • '21#.#1.17.45':139
  • '21#.#1.245.68':139
  • '21#.#1.18.78':139
  • '21#.#1.197.125':139
  • '21#.#1.188.177':139
  • '21#.#1.204.183':139
  • '21#.61.13.4':139
  • '21#.#1.59.22':139
  • '21#.#1.22.193':139
  • '21#.#1.192.161':139
  • '21#.#1.48.62':139
  • '21#.#1.192.239':139
  • '21#.#1.239.182':139
  • '21#.#1.109.4':445
  • '21#.#1.3.206':445
  • '21#.#1.90.124':139
  • '21#.#1.182.220':139
  • '21#.#1.187.5':139
  • '21#.61.6.61':139
  • '21#.#1.114.194':139
  • '21#.#1.220.5':139
  • '21#.#1.117.121':139
  • '21#.#1.215.178':139
  • '21#.#1.40.79':139
  • '21#.#1.36.140':445
  • '21#.#1.100.39':445
  • '21#.#1.16.120':445
  • '21#.#1.29.241':445
  • '21#.#1.101.130':445
  • '21#.#1.42.214':445
  • '21#.#1.111.122':445
  • '21#.#1.246.148':445
  • '21#.#1.145.208':445
  • '21#.#1.76.25':445
  • '21#.#1.85.43':445
  • '21#.#1.243.60':445
  • '21#.#1.58.52':445
  • '21#.#1.3.206':139
  • '21#.#1.205.182':445
  • '21#.#1.182.247':445
  • '21#.#1.214.63':139
  • '21#.#1.1.185':139
  • '21#.#1.109.4':139
  • '21#.#1.247.191':445
  • '21#.#1.59.117':445
  • '21#.#1.227.219':445
  • '21#.#1.239.191':445
  • '21#.#1.181.51':445
  • '21#.#1.227.254':445
  • '21#.#1.52.38':445
  • '21#.#1.33.46':445
  • '21#.#1.211.86':139
  • '21#.#1.60.10':139
  • '21#.#1.142.78':139
  • '21#.#1.13.155':445
  • '21#.#1.56.177':445
  • '21#.#1.45.150':139
  • '21#.#1.113.130':139
  • '21#.#1.70.112':139
  • '21#.#1.149.238':139
  • '21#.#1.112.213':139
  • '21#.#1.16.237':139
  • '21#.#1.30.78':139
  • '21#.#1.114.152':139
  • '21#.#1.142.78':445
  • '21#.#1.70.112':445
  • '21#.#1.30.78':445
  • '21#.#1.211.86':445
  • '21#.#1.60.10':445
  • '21#.#1.113.130':445
  • '21#.#1.149.238':445
  • '21#.#1.87.116':445
  • '21#.#1.89.108':445
  • '21#.#1.82.69':445
  • '21#.#1.16.237':445
  • '21#.#1.114.152':445
  • '21#.#1.112.213':445
  • '21#.#1.87.116':139
  • '21#.#1.52.119':445
  • '21#.#1.119.10':445
  • '21#.#1.63.108':445
  • '21#.#1.198.206':445
  • '21#.#1.19.48':445
  • '21#.#1.29.52':445
  • '21#.#1.156.23':445
  • '21#.#1.110.212':445
  • '21#.#1.138.112':445
  • '21#.#1.24.16':445
  • '21#.#1.76.103':445
  • '21#.#1.16.155':445
  • '21#.#1.191.237':445
  • '21#.#1.56.177':139
  • '21#.#1.112.46':445
  • '21#.#1.122.190':445
  • '21#.#1.89.108':139
  • '21#.#1.82.69':139
  • '21#.#1.13.155':139
  • '21#.#1.123.85':445
  • '21#.#1.217.53':445
  • '21#.#1.147.72':445
  • '21#.#1.72.199':445
  • '21#.#1.168.175':445
  • '21#.#1.184.161':445
  • '21#.#1.27.172':445
  • '21#.#1.67.144':445
  • '21#.#1.190.22':139
  • '21#.#1.81.131':139
  • '21#.#1.252.218':445
  • '21#.#1.50.113':445
  • '21#.#1.144.101':445
  • '21#.#1.32.238':139
  • '21#.#1.195.234':139
  • '21#.#1.234.6':139
  • '21#.61.7.52':139
  • '21#.#1.144.91':139
  • '21#.#1.149.158':139
  • '21#.#1.158.195':139
  • '21#.#1.41.141':445
  • '21#.#1.61.24':445
  • '21#.#1.58.232':445
  • '21#.#1.243.189':445
  • '21#.#1.189.95':445
  • '21#.#1.154.229':445
  • '21#.#1.66.29':445
  • '21#.#1.240.140':445
  • '21#.#1.76.54':445
  • '21#.#1.141.180':445
  • '21#.#1.29.117':445
  • '21#.#1.29.100':445
  • '21#.#1.100.48':445
  • '21#.#1.57.128':139
  • '21#.#1.240.140':139
  • '21#.#1.76.54':139
  • '21#.#1.54.141':139
  • '21#.#1.29.100':139
  • '21#.#1.100.48':139
  • '21#.61.3.96':139
  • '21#.#1.141.180':139
  • '21#.#1.67.144':139
  • '21#.#1.144.101':139
  • '21#.#1.45.150':445
  • '21#.#1.252.218':139
  • '21#.#1.50.113':139
  • '21#.#1.113.67':139
  • '21#.#1.2.236':139
  • '21#.#1.37.247':139
  • '21#.#1.243.189':139
  • '21#.#1.113.2':139
  • '21#.61.71.6':139
  • '21#.#1.30.23':139
  • '21#.#1.189.95':139
  • '21#.#1.58.232':139
  • '21#.#1.29.117':139
  • '21#.#1.66.29':139
  • '21#.#1.154.229':139
  • '21#.#1.41.141':139
  • '21#.#1.61.24':139
  • '21#.#1.3.248':445
  • '21#.#1.64.220':139
  • '21#.#1.168.86':139
  • '21#.#1.28.64':139
  • '21#.#1.251.248':139
  • '21#.#1.249.48':139
  • '21#.#1.49.157':139
  • '21#.#1.38.133':139
  • '21#.#1.192.34':139
  • '21#.#1.35.23':139
  • '21#.#1.205.196':139
  • '21#.#1.40.250':139
  • '21#.#1.225.5':139
  • '21#.#1.173.191':139
  • '21#.#1.173.191':445
  • '21#.#1.192.34':445
  • '21#.#1.35.23':445
  • '21#.#1.28.64':445
  • '21#.#1.38.133':445
  • '21#.#1.40.250':445
  • '21#.#1.163.149':445
  • '21#.#1.201.53':139
  • '21#.#1.116.3':139
  • '21#.#1.175.251':139
  • '21#.#1.149.181':445
  • '21#.#1.50.198':445
  • '21#.61.4.37':445
  • '21#.#1.206.164':139
  • '21#.#1.44.118':445
  • '21#.#1.225.176':445
  • '21#.#1.37.230':445
  • '21#.#1.247.157':445
  • '21#.#1.114.27':445
  • '21#.#1.112.224':445
  • '21#.#1.175.22':445
  • '21#.#1.217.173':445
  • '21#.#1.77.166':445
  • '21#.#1.14.40':445
  • '21#.#1.65.181':445
  • '21#.#1.164.74':445
  • '21#.#1.249.40':445
  • '21#.61.4.37':139
  • '21#.#1.11.191':139
  • '21#.#1.35.109':139
  • '21#.#1.163.149':139
  • '21#.#1.149.181':139
  • '21#.#1.50.198':139
  • '21#.#1.247.144':445
  • '21#.#1.148.224':445
  • '21#.#1.18.233':445
  • '21#.#1.147.139':445
  • '21#.#1.68.232':445
  • '21#.#1.232.152':445
  • '21#.#1.157.82':445
  • '21#.#1.184.161':139
  • '21#.#1.27.172':139
  • '21#.#1.217.53':139
  • '21#.#1.122.190':139
  • '21#.#1.123.85':139
  • '21#.#1.168.175':139
  • '21#.#1.147.72':139
  • '21#.#1.29.52':139
  • '21#.#1.52.119':139
  • '21#.#1.119.10':139
  • '21#.#1.72.199':139
  • '21#.#1.198.206':139
  • '21#.#1.19.48':139
  • '21#.#1.207.78':445
  • '21#.#1.35.144':445
  • '21#.#1.73.133':445
  • '21#.#1.20.200':445
  • '21#.#1.13.191':445
  • '21#.#1.230.144':445
  • '21#.61.4.25':445
  • '21#.#1.134.84':445
  • '21#.#1.127.80':445
  • '21#.#1.112.46':139
  • '21#.#1.89.127':445
  • '21#.#1.84.244':445
  • '21#.#1.242.30':445
  • '21#.#1.63.108':139
  • '21#.#1.89.127':139
  • '21#.#1.127.80':139
  • '21#.#1.242.30':139
  • '21#.#1.207.78':139
  • '21#.61.4.25':139
  • '21#.#1.128.166':139
  • '21#.#1.134.84':139
  • '21#.#1.249.48':445
  • '21#.#1.49.157':445
  • '21#.#1.64.220':445
  • '21#.#1.84.244':139
  • '21#.#1.175.251':445
  • '21#.#1.251.248':445
  • '21#.#1.191.237':139
  • '21#.#1.110.212':139
  • '21#.#1.138.112':139
  • '21#.#1.156.23':139
  • '21#.#1.76.103':139
  • '21#.#1.16.155':139
  • '21#.#1.24.16':139
  • '21#.#1.230.144':139
  • '21#.#1.35.144':139
  • '21#.#1.73.133':139
  • '21#.#1.3.248':139
  • '21#.#1.20.200':139
  • '21#.#1.13.191':139
  • '21#.61.70.3':139
  • '21#.#1.254.43':9988
  • '21#.#1.192.64':9988
  • '21#.#1.13.160':9988
  • '21#.#1.83.24':9988
  • '21#.#1.10.248':9988
  • '21#.#1.16.171':9988
  • '21#.#1.254.195':9988
  • '21#.#1.198.48':9988
  • '21#.#1.69.226':9988
  • '21#.#1.48.175':9988
  • '21#.#1.166.195':9988
  • '21#.#1.24.66':9988
  • '21#.#1.132.37':9988
  • '21#.#1.125.233':139
  • '21#.#1.99.253':445
  • '21#.#1.138.178':139
  • '21#.#1.51.45':139
  • '21#.61.2.31':139
  • '21#.#1.33.221':139
  • '21#.#1.83.115':139
  • '21#.#1.96.97':9988
  • '21#.#1.31.198':9988
  • '21#.#1.252.200':9988
  • '21#.#1.62.61':9988
  • '21#.#1.100.47':9988
  • '21#.#1.46.210':9988
  • '21#.#1.35.220':9988
  • '21#.#1.160.16':9988
  • '21#.#1.131.175':9988
  • '21#.#1.55.132':9988
  • '21#.#1.78.20':9988
  • '21#.61.6.65':9988
  • '21#.#1.191.56':9988
  • '21#.#1.218.223':9988
  • '21#.#1.157.197':9988
  • '21#.#1.74.11':9988
  • '21#.#1.102.122':9988
  • '21#.#1.142.183':9988
  • '21#.#1.60.71':9988
  • '21#.#1.124.167':9988
  • '21#.#1.75.13':9988
  • '21#.#1.59.198':9988
  • '21#.#1.4.216':9988
  • '21#.#1.126.137':9988
  • '21#.#1.123.182':9988
  • '21#.#1.49.199':9988
  • '21#.#1.142.106':9988
  • '21#.#1.207.187':9988
  • '21#.#1.48.86':9988
  • '21#.#1.222.170':9988
  • '21#.#1.154.31':9988
  • '21#.#1.227.20':9988
  • '21#.#1.148.63':9988
  • '21#.#1.194.40':139
  • '21#.#1.218.87':139
  • '21#.#1.106.38':445
  • '21#.#1.24.20':139
  • '21#.#1.20.53':445
  • '21#.#1.20.53':139
  • '21#.#1.110.78':139
  • '21#.#1.31.154':445
  • '21#.#1.28.55':445
  • '21#.#1.88.111':445
  • '21#.#1.70.87':445
  • '21#.#1.228.84':445
  • '21#.#1.55.137':445
  • '21#.#1.24.143':139
  • '21#.#1.72.190':139
  • '21#.#1.69.104':139
  • '21#.#1.134.172':139
  • '21#.#1.121.11':139
  • '21#.#1.46.141':445
  • '21#.61.10.5':139
  • '21#.#1.61.229':139
  • '21#.#1.165.162':139
  • '21#.#1.208.121':139
  • '21#.#1.127.174':139
  • '21#.#1.174.184':139
  • '21#.#1.104.92':139
  • '21#.#1.3.238':445
  • '21#.#1.31.154':139
  • '21#.#1.28.55':139
  • '21#.#1.88.111':139
  • '21#.#1.55.137':139
  • '21#.#1.228.84':139
  • '21#.#1.70.87':139
  • '21#.#1.3.238':139
  • '21#.#1.232.194':139
  • '21#.#1.171.218':139
  • '21#.#1.62.103':139
  • '21#.#1.238.5':139
  • '21#.#1.33.151':139
  • '21#.#1.132.246':139
  • '21#.#1.232.194':445
  • '21#.#1.171.218':445
  • '21#.#1.62.103':445
  • '21#.#1.238.5':445
  • '21#.#1.33.151':445
  • '21#.#1.132.246':445
  • '21#.#1.51.45':445
  • '21#.#1.138.178':445
  • '21#.#1.125.233':445
  • '21#.#1.106.38':139
  • '21#.#1.33.221':445
  • '21#.61.2.31':445
  • '21#.#1.83.115':445
  • '21#.#1.117.98':9988
  • '21#.#1.131.175':139
  • '21#.#1.62.61':139
  • '21#.#1.83.24':139
  • '21#.#1.132.37':139
  • '21#.#1.123.182':139
  • '21#.#1.31.198':139
  • '21#.#1.24.66':139
  • '21#.#1.227.20':139
  • '21#.#1.142.183':139
  • '21#.#1.60.71':139
  • '21#.#1.254.43':139
  • '21#.#1.192.64':139
  • '21#.#1.166.195':139
  • '21#.#1.69.226':139
  • '21#.#1.46.210':139
  • '21#.#1.142.106':139
  • '21#.#1.6.224':445
  • '21#.#1.211.199':445
  • '21#.#1.126.137':139
  • '21#.#1.96.97':139
  • '21#.#1.16.171':139
  • '21#.#1.254.195':139
  • '21#.#1.55.132':139
  • '21#.#1.35.220':139
  • '21#.#1.13.160':139
  • '21#.#1.160.16':139
  • '21#.#1.191.56':139
  • '21#.61.6.65':139
  • '21#.#1.59.198':139
  • '21#.#1.198.48':139
  • '21#.#1.216.106':139
  • '21#.#1.124.167':139
  • '21#.#1.117.98':139
  • '21#.#1.48.86':139
  • '21#.#1.78.20':139
  • '21#.#1.6.224':139
  • '21#.#1.211.199':139
  • '21#.#1.49.199':139
  • '21#.#1.111.229':139
  • '21#.#1.222.170':139
  • '21#.#1.100.47':139
  • '21#.#1.75.13':139
  • '21#.#1.218.223':139
  • '21#.#1.252.200':139
  • '21#.#1.154.31':139
  • '21#.#1.48.175':139
  • '21#.#1.148.63':139
  • '21#.#1.102.122':139
  • '21#.#1.157.197':139
  • '21#.#1.4.216':139
  • '21#.#1.207.187':139
  • '21#.#1.10.248':139
  • '21#.#1.74.11':139
  • '21#.#1.142.106':445
  • '21#.#1.96.97':445
  • '21#.#1.83.24':445
  • '21#.#1.166.195':445
  • '21#.#1.16.171':445
  • '21#.#1.55.132':445
  • '21#.#1.126.137':445
  • '21#.#1.254.43':445
  • '21#.#1.192.64':445
  • '21#.#1.142.183':445
  • '21#.#1.160.16':445
  • '21#.#1.69.226':445
  • '21#.#1.46.210':445
  • '21#.#1.211.199':9988
  • '21#.#1.13.160':445
  • '21#.#1.123.182':445
  • '21#.#1.216.106':9988
  • '21#.#1.6.224':9988
  • '21#.#1.111.229':9988
  • '21#.#1.131.175':445
  • '21#.#1.132.37':445
  • '21#.#1.35.220':445
  • '21#.#1.62.61':445
  • '21#.#1.31.198':445
  • '21#.#1.24.66':445
  • '21#.#1.254.195':445
  • '21#.#1.227.20':445
  • '21#.#1.124.167':445
  • '21#.61.6.65':445
  • '21#.#1.117.98':445
  • '21#.#1.157.197':445
  • '21#.#1.4.216':445
  • '21#.#1.216.106':445
  • '21#.#1.198.48':445
  • '21#.#1.49.199':445
  • '21#.#1.78.20':445
  • '21#.#1.222.170':445
  • '21#.#1.59.198':445
  • '21#.#1.111.229':445
  • '21#.#1.48.86':445
  • '21#.#1.48.175':445
  • '21#.#1.154.31':445
  • '21#.#1.148.63':445
  • '21#.#1.60.71':445
  • '21#.#1.191.56':445
  • '21#.#1.252.200':445
  • '21#.#1.100.47':445
  • '21#.#1.10.248':445
  • '21#.#1.74.11':445
  • '21#.#1.102.122':445
  • '21#.#1.75.13':445
  • '21#.#1.218.223':445
  • '21#.#1.207.187':445
  • '21#.#1.189.41':139
  • '21#.#1.12.139':139
  • '21#.#1.119.182':445
  • '21#.#1.57.207':445
  • '21#.#1.203.158':139
  • '21#.#1.35.221':139
  • '21#.#1.104.143':139
  • '21#.#1.96.10':445
  • '21#.#1.193.207':445
  • '21#.#1.127.2':445
  • '21#.#1.211.16':445
  • '21#.#1.35.216':445
  • '21#.#1.18.79':445
  • '21#.#1.97.81':445
  • '21#.#1.84.41':139
  • '21#.#1.18.206':139
  • '21#.#1.53.41':139
  • '21#.#1.126.249':139
  • '21#.#1.212.123':139
  • '21#.#1.77.183':139
  • '21#.#1.192.180':139
  • '21#.#1.146.217':139
  • '21#.#1.85.131':139
  • '21#.#1.150.203':139
  • '21#.#1.42.94':139
  • '21#.#1.93.248':139
  • '21#.#1.79.176':139
  • '21#.#1.17.50':445
  • '21#.#1.118.227':445
  • '21#.#1.227.59':445
  • '21#.61.60.8':445
  • '21#.#1.210.122':445
  • '21#.#1.37.53':445
  • '21#.#1.53.119':445
  • '21#.#1.119.182':139
  • '21#.#1.18.79':139
  • '21#.#1.97.81':139
  • '21#.#1.193.207':139
  • '21#.#1.57.207':139
  • '21#.#1.96.10':139
  • '21#.#1.35.216':139
  • '21#.#1.169.86':445
  • '21#.#1.247.20':445
  • '21#.#1.8.211':445
  • '21#.#1.198.194':445
  • '21#.#1.39.99':445
  • '21#.#1.122.37':445
  • '21#.#1.58.167':445
  • '21#.#1.147.175':445
  • '21#.#1.122.248':445
  • '21#.#1.20.29':445
  • '21#.#1.217.95':445
  • '21#.#1.127.7':445
  • '21#.#1.4.148':445
  • '21#.#1.65.247':139
  • '21#.#1.181.156':139
  • '21#.#1.110.71':139
  • '21#.#1.121.13':139
  • '21#.#1.27.24':139
  • '21#.#1.252.246':139
  • '21#.#1.18.76':139
  • '21#.#1.55.103':139
  • '21#.#1.168.118':139
  • '21#.#1.117.252':139
  • '21#.#1.163.197':139
  • '21#.#1.206.119':139
  • '21#.#1.128.205':139
  • '21#.61.6.60':139
  • '21#.#1.95.226':139
  • '21#.#1.195.235':139
  • '21#.#1.134.79':139
  • '21#.#1.11.224':139
  • '21#.#1.172.131':139
  • '21#.#1.11.199':139
  • '21#.#1.220.170':139
  • '21#.#1.165.216':139
  • '21#.#1.168.97':139
  • '21#.#1.129.29':139
  • '21#.#1.212.178':139
  • '21#.#1.187.129':139
  • '21#.#1.120.95':445
  • '21#.#1.150.203':445
  • '21#.#1.203.158':445
  • '21#.#1.35.221':445
  • '21#.#1.79.176':445
  • '21#.#1.146.217':445
  • '21#.#1.85.131':445
  • '21#.#1.104.143':445
  • '21#.#1.111.117':139
  • '21#.61.24.5':139
  • '21#.#1.14.153':139
  • '21#.#1.12.139':445
  • '21#.#1.120.95':139
  • '21#.#1.12.205':139
  • '21#.#1.14.153':445
  • '21#.#1.126.249':445
  • '21#.#1.212.123':445
  • '21#.#1.12.205':445
  • '21#.#1.111.117':445
  • '21#.61.24.5':445
  • '21#.#1.77.183':445
  • '21#.#1.192.180':445
  • '21#.#1.42.94':445
  • '21#.#1.93.248':445
  • '21#.#1.84.41':445
  • '21#.#1.18.206':445
  • '21#.#1.53.41':445
  • '21#.#1.127.2':139
  • '21#.61.8.12':445
  • '21#.#1.183.27':445
  • '21#.#1.175.52':445
  • '21#.#1.136.118':445
  • '21#.#1.81.155':445
  • '21#.#1.229.67':445
  • '21#.61.2.71':445
  • '21#.#1.99.189':445
  • '21#.#1.189.41':445
  • '21#.#1.134.172':445
  • '21#.#1.121.175':445
  • '21#.#1.34.35':445
  • '21#.#1.78.217':445
  • '21#.#1.131.57':139
  • '21#.#1.177.61':139
  • '21#.#1.66.144':139
  • '21#.#1.177.121':139
  • '21#.#1.72.101':139
  • '21#.#1.134.38':139
  • '21#.#1.200.1':139
  • '21#.#1.77.65':139
  • '21#.#1.93.73':445
  • '21#.#1.101.19':139
  • '21#.#1.31.201':139
  • '21#.#1.77.50':139
  • '21#.#1.164.77':139
  • '21#.#1.121.11':445
  • '21#.#1.81.155':139
  • '21#.#1.229.67':139
  • '21#.61.8.12':139
  • '21#.#1.110.78':445
  • '21#.#1.93.73':139
  • '21#.#1.136.118':139
  • '21#.#1.121.175':139
  • '21#.61.2.71':139
  • '21#.#1.78.217':139
  • '21#.#1.99.189':139
  • '21#.#1.175.52':139
  • '21#.#1.183.27':139
  • '21#.#1.34.35':139
  • '21#.61.10.5':445
  • '21#.#1.127.174':445
  • '21#.#1.174.184':445
  • '21#.#1.24.143':445
  • '21#.#1.72.190':445
  • '21#.#1.69.104':445
  • '21#.#1.104.92':445
  • '21#.#1.24.20':445
  • '21#.#1.194.40':445
  • '21#.#1.218.87':445
  • '21#.#1.61.229':445
  • '21#.#1.165.162':445
  • '21#.#1.208.121':445
  • '21#.#1.37.53':139
  • '21#.#1.53.119':139
  • '21#.#1.118.227':139
  • '21#.#1.122.248':139
  • '21#.#1.20.29':139
  • '21#.#1.210.122':139
  • '21#.#1.227.59':139
  • '21#.#1.99.209':445
  • '21#.#1.236.1':445
  • '21#.#1.55.216':445
  • '21#.61.60.8':139
  • '21#.#1.8.116':445
  • '21#.61.22.6':445
  • '21#.#1.39.99':139
  • '21#.#1.122.37':139
  • '21#.#1.169.86':139
  • '21#.#1.211.16':139
  • '21#.#1.17.50':139
  • '21#.#1.198.194':139
  • '21#.#1.247.20':139
  • '21#.#1.127.7':139
  • '21#.#1.4.148':139
  • '21#.#1.147.175':139
  • '21#.#1.8.211':139
  • '21#.#1.58.167':139
  • '21#.#1.217.95':139
  • '21#.#1.63.138':445
  • '21#.#1.8.116':139
  • '21#.61.22.6':139
  • '21#.#1.99.209':139
  • '21#.#1.164.77':445
  • '21#.#1.77.65':445
  • '21#.#1.101.19':445
  • '21#.#1.236.1':139
  • '21#.#1.234.170':139
  • '21#.#1.221.197':139
  • '21#.#1.111.118':139
  • '21#.#1.55.216':139
  • '21#.#1.63.138':139
  • '21#.#1.59.151':139
  • '21#.#1.111.118':445
  • '21#.#1.177.121':445
  • '21#.#1.72.101':445
  • '21#.#1.59.151':445
  • '21#.#1.234.170':445
  • '21#.#1.221.197':445
  • '21#.#1.134.38':445
  • '21#.#1.200.1':445
  • '21#.#1.31.201':445
  • '21#.#1.77.50':445
  • '21#.#1.131.57':445
  • '21#.#1.177.61':445
  • '21#.#1.66.144':445

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android