Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Trojan.Siggen6.21063

Added to the Dr.Web virus database: 2014-07-20

Virus description added:

Technical Information

Malicious functions:
Creates and executes the following:
  • '%TEMP%\sysupd32\7za.exe' x sys32.7z -p7locacocacaaaadgjdgnfdklgp7locacocacaaaadgjdgnfdklgp7locacocacaaaadgjdgnfdklgp7locacocacaaaadgjdgnfdklgp7locacocacaaaadgjdgnfdklg -aoa
  • '%TEMP%\sysupd32\gzip.exe' -d 7za.exe.gz
Executes the following:
  • '<SYSTEM32>\taskkill.exe' /f /im chrome.exe
  • '<SYSTEM32>\attrib.exe' +S +H %TEMP%\sysupd32
  • '<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\protorype.bat" "
Terminates or attempts to terminate
the following user processes:
  • chrome.exe
Modifies file system :
Creates the following files:
  • %TEMP%\sysupd32\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\_locales\fi\messages.json
  • %TEMP%\sysupd32\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\_locales\it\messages.json
  • %TEMP%\sysupd32\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\_locales\lt\messages.json
  • %TEMP%\sysupd32\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\_locales\ca\messages.json
  • %TEMP%\sysupd32\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\_locales\ko\messages.json
  • %TEMP%\sysupd32\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\_locales\ro\messages.json
  • %TEMP%\sysupd32\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\_locales\fr\messages.json
  • %TEMP%\sysupd32\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\_locales\zh_CN\messages.json
  • %TEMP%\sysupd32\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\_locales\pl\messages.json
  • %TEMP%\sysupd32\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\_locales\tr\messages.json
  • %TEMP%\sysupd32\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\_locales\da\messages.json
  • %TEMP%\sysupd32\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\_locales\fil\messages.json
  • %TEMP%\sysupd32\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\_locales\sl\messages.json
  • %TEMP%\sysupd32\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\_locales\lv\messages.json
  • %TEMP%\sysupd32\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\_locales\cs\messages.json
  • %TEMP%\sysupd32\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\_locales\zh_TW\messages.json
  • %TEMP%\sysupd32\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\_locales\de\messages.json
  • %TEMP%\sysupd32\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\_locales\id\messages.json
  • %TEMP%\sysupd32\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\_locales\zh_CN\messages.json
  • %TEMP%\sysupd32\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\_locales\hr\messages.json
  • %TEMP%\sysupd32\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\_locales\el\messages.json
  • %TEMP%\sysupd32\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\_locales\fi\messages.json
  • %TEMP%\sysupd32\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\_locales\it\messages.json
  • %TEMP%\sysupd32\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\_locales\de\messages.json
  • %TEMP%\sysupd32\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\_locales\sv\messages.json
  • %TEMP%\sysupd32\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\_locales\zh_TW\messages.json
  • %TEMP%\sysupd32\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\_locales\nl\messages.json
  • %TEMP%\sysupd32\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\_locales\ru\messages.json
  • %TEMP%\sysupd32\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\_locales\hi\messages.json
  • %TEMP%\sysupd32\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\_locales\es\messages.json
  • %TEMP%\sysupd32\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\_locales\ja\messages.json
  • %TEMP%\sysupd32\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\_locales\bg\messages.json
  • %TEMP%\sysupd32\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\_locales\ar\messages.json
  • %TEMP%\sysupd32\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\_locales\th\messages.json
  • %TEMP%\sysupd32\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\_locales\sr\messages.json
  • %TEMP%\sysupd32\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\_locales\uk\messages.json
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\_locales\tr\messages.json
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\_locales\zh_CN\messages.json
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\_locales\zh_TW\messages.json
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\_locales\sl\messages.json
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\_locales\sk\messages.json
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\_locales\vi\messages.json
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\_locales\ko\messages.json
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\_locales\ar\messages.json
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\_locales\he\messages.json
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\_locales\es_419\messages.json
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\_locales\fil\messages.json
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\_locales\cs\messages.json
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\_locales\es\messages.json
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\_locales\id\messages.json
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\_locales\pt_PT\messages.json
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\_locales\ca\messages.json
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\_locales\hr\messages.json
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\_locales\hu\messages.json
  • %TEMP%\sysupd32\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\_locales\pt_BR\messages.json
  • %TEMP%\sysupd32\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\_locales\sk\messages.json
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\_locales\th\messages.json
  • %TEMP%\sysupd32\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\_locales\en\messages.json
  • %TEMP%\sysupd32\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\_locales\pt_PT\messages.json
  • %TEMP%\sysupd32\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\_locales\nl\messages.json
  • %TEMP%\sysupd32\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\_locales\vi\messages.json
  • %TEMP%\sysupd32\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\_locales\hu\messages.json
  • %TEMP%\sysupd32\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\_locales\hr\messages.json
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\_locales\sr\messages.json
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\_locales\ja\messages.json
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\_locales\ro\messages.json
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\_locales\lt\messages.json
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\_locales\bg\messages.json
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\_locales\hi\messages.json
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\_locales\uk\messages.json
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\_locales\el\messages.json
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\_locales\ru\messages.json
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\et\messages.json
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\fi\messages.json
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\fr\messages.json
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\da\messages.json
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\de\messages.json
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\sl\messages.json
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\fil\messages.json
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\nl\messages.json
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\ko\messages.json
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\pt_PT\messages.json
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\en_US\messages.json
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\ms\messages.json
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\en_GB\messages.json
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\id\messages.json
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\ro\messages.json
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\sv\messages.json
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\it\messages.json
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\pl\messages.json
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\th\messages.json
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\el\messages.json
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\ar\messages.json
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\sr\messages.json
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\bg\messages.json
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\hi\messages.json
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_metadata\verified_contents.json
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\uk\messages.json
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\ru\messages.json
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\sk\messages.json
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\cs\messages.json
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\he\messages.json
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\ja\messages.json
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\lv\messages.json
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\lt\messages.json
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\hu\messages.json
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\vi\messages.json
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\tr\messages.json
  • %TEMP%\sysupd32\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\_locales\ca\messages.json
  • %TEMP%\sysupd32\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\_locales\fil\messages.json
  • %TEMP%\sysupd32\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\_locales\pt_PT\messages.json
  • %TEMP%\sysupd32\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\_locales\pt_BR\messages.json
  • %TEMP%\sysupd32\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\_locales\ro\messages.json
  • %TEMP%\sysupd32\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\_locales\lt\messages.json
  • %TEMP%\sysupd32\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\_locales\pl\messages.json
  • %TEMP%\sysupd32\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\_locales\fr\messages.json
  • %TEMP%\sysupd32\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\_locales\sl\messages.json
  • %TEMP%\sysupd32\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\_locales\lv\messages.json
  • %TEMP%\sysupd32\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\_locales\sk\messages.json
  • %TEMP%\sysupd32\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\_locales\en\messages.json
  • %TEMP%\sysupd32\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\_locales\hu\messages.json
  • %TEMP%\sysupd32\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\_locales\da\messages.json
  • %TEMP%\sysupd32\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\_locales\tr\messages.json
  • %TEMP%\sysupd32\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\_locales\es\messages.json
  • %TEMP%\sysupd32\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\_locales\cs\messages.json
  • %TEMP%\sysupd32\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\_locales\id\messages.json
  • %TEMP%\sysupd32\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\_locales\hi\messages.json
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\es\messages.json
  • %TEMP%\sysupd32\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\_locales\th\messages.json
  • %TEMP%\sysupd32\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\_locales\el\messages.json
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\es_419\messages.json
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\zh_TW\messages.json
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\ca\messages.json
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\pt_BR\messages.json
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\zh_CN\messages.json
  • %TEMP%\sysupd32\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\_locales\ar\messages.json
  • %TEMP%\sysupd32\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\_locales\he\messages.json
  • %TEMP%\sysupd32\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\_locales\ko\messages.json
  • %TEMP%\sysupd32\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\_locales\ru\messages.json
  • %TEMP%\sysupd32\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\_locales\vi\messages.json
  • %TEMP%\sysupd32\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\_locales\sr\messages.json
  • %TEMP%\sysupd32\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\_locales\uk\messages.json
  • %TEMP%\sysupd32\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\_locales\bg\messages.json
  • %TEMP%\sysupd32\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\_locales\ja\messages.json
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\_locales\no\messages.json
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\zh_CN\messages.json
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\_locales\no\messages.json
  • %TEMP%\sysupd32\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\_locales\no\messages.json
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\et\messages.json
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\en_GB\messages.json
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\id\messages.json
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\zh_TW\messages.json
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\en\messages.json
  • %TEMP%\sysupd32\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\manifest.json
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\manifest.json
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\manifest.json
  • %TEMP%\sysupd32\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\manifest.json
  • %TEMP%\sysupd32\Extensions\ljdhjpmbnkbengahefamnhmegbdifhlb\0.3_0\manifest.json
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\_locales\no\messages.json
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\_locales\eu\messages.json
  • %TEMP%\sysupd32\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\_locales\no\messages.json
  • %TEMP%\sysupd32\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\_locales\se\messages.json
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\lt\messages.json
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\pt_PT\messages.json
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\ro\messages.json
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\es_419\messages.json
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\cs\messages.json
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\sk\messages.json
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\ko\messages.json
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\lv\messages.json
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\ca\messages.json
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\sl\messages.json
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\nl\messages.json
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\it\messages.json
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\hr\messages.json
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\da\messages.json
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\tr\messages.json
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\pl\messages.json
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\nb\messages.json
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\sv\messages.json
  • %TEMP%\sysupd32\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\128.png
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\16.png
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\128.png
  • %TEMP%\sysupd32\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\128.png
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\32.png
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\icon_128.png
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\images\icon_16.png
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\48.png
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\images\icon_128.png
  • %TEMP%\1.tmp\7za.exe.gz
  • %TEMP%\1.tmp\sys32.7z
  • %TEMP%\1.tmp\protorype.bat
  • %TEMP%\1.tmp\gzip.exe
  • %TEMP%\1.tmp\sysopera32.7z
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\images\flapper.gif
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\128.png
  • %TEMP%\sysupd32\7za.exe
  • %TEMP%\sysupd32\Preferences
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\craw_window.js
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\main.js
  • %TEMP%\sysupd32\Extensions\ljdhjpmbnkbengahefamnhmegbdifhlb\0.3_0\my-style.css
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\craw_background.js
  • %TEMP%\sysupd32\Extensions\ljdhjpmbnkbengahefamnhmegbdifhlb\0.3_0\my-style.js
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\manifest.json
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\manifest.json
  • %TEMP%\sysupd32\Extensions\ljdhjpmbnkbengahefamnhmegbdifhlb\.DS_Store
  • %TEMP%\sysupd32\Extensions\.DS_Store
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\images\topbar_floating_button_close.png
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\images\topbar_floating_button_hover.png
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\icon_16.png
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\images\topbar_floating_button.png
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\images\topbar_floating_button_maximize.png
  • %TEMP%\sysupd32\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\main.html
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\css\craw_window.css
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\images\topbar_floating_button_pressed.png
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\html\craw_window.html
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\_locales\ja\messages.json
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\_locales\vi\messages.json
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\_locales\ko\messages.json
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\_locales\cs\messages.json
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\_locales\lt\messages.json
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\_locales\ru\messages.json
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\_locales\sr\messages.json
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\_locales\fil\messages.json
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\_locales\he\messages.json
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\_locales\ar\messages.json
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\_locales\pt_PT\messages.json
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\_locales\ro\messages.json
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\_locales\fr\messages.json
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\_locales\es\messages.json
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\_locales\pt_BR\messages.json
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\_locales\es_419\messages.json
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\_locales\lv\messages.json
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\_locales\pl\messages.json
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\_locales\sv\messages.json
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\_locales\ms\messages.json
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\_locales\et\messages.json
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\_locales\fr\messages.json
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\_locales\de\messages.json
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\_locales\it\messages.json
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\_locales\lv\messages.json
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\_locales\fi\messages.json
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\_locales\pl\messages.json
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\_locales\th\messages.json
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\_locales\el\messages.json
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\_locales\uk\messages.json
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\_locales\bg\messages.json
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\_locales\nl\messages.json
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\_locales\en_GB\messages.json
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\_locales\en_US\messages.json
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\_locales\da\messages.json
  • %TEMP%\sysupd32\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\_locales\pt_BR\messages.json
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\ja\messages.json
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\bg\messages.json
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\uk\messages.json
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\sr\messages.json
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\el\messages.json
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\_locales\fi\messages.json
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\_locales\de\messages.json
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\hi\messages.json
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\th\messages.json
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\fil\messages.json
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\hu\messages.json
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\pt_BR\messages.json
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\fi\messages.json
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\vi\messages.json
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\de\messages.json
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\ru\messages.json
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\es\messages.json
  • %TEMP%\sysupd32\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\_locales\fr\messages.json
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\_locales\id\messages.json
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\_locales\it\messages.json
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\_locales\sk\messages.json
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\_locales\tr\messages.json
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\_locales\sl\messages.json
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\_locales\hr\messages.json
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\_locales\hu\messages.json
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\_locales\ca\messages.json
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\_locales\nl\messages.json
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\_locales\en\messages.json
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\_locales\en_GB\messages.json
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\_locales\zh_CN\messages.json
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\_locales\zh_TW\messages.json
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\_locales\en_US\messages.json
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\_locales\hi\messages.json
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\_locales\sv\messages.json
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\_locales\et\messages.json
  • %TEMP%\sysupd32\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\_locales\da\messages.json
Sets the 'hidden' attribute to the following files:
  • %TEMP%\sysupd32\Extensions\.DS_Store
  • %TEMP%\sysupd32\Extensions\ljdhjpmbnkbengahefamnhmegbdifhlb\.DS_Store
Deletes the following files:
  • %TEMP%\sysupd32\7za.exe.gz
Moves the following files:
  • from %TEMP%\1.tmp\sys32.7z to %TEMP%\sysupd32\sys32.7z
  • from %TEMP%\1.tmp\sysopera32.7z to %TEMP%\sysupd32\sysopera32.7z
  • from %TEMP%\1.tmp\gzip.exe to %TEMP%\sysupd32\gzip.exe
  • from %TEMP%\1.tmp\7za.exe.gz to %TEMP%\sysupd32\7za.exe.gz
Miscellaneous:
Searches for the following windows:
  • ClassName: '(null)' WindowName: '(null)'

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android