Pour les utilisateurs

Fermer

Bibliothèque
Ma bibliothèque

+ Ajouter à la bibliothèque

Recherche
Recherche

Contacter-nous !
Support 24/24 | Rules regarding submitting

Envoyer un message

Requête à l'aide du formulaire

Nous téléphoner

0 825 300 230

Forum

Vos requêtes

  • Toutes : -
  • Non clôturées : -
  • Dernière : le -
Créer une nouvelle requête

Nous téléphoner

0 825 300 230

Profil

FR

RU CN DE EN ES FR IT JP KZ UZ PL BY
Fermer
Services support
Scanners
Dr.Web vxCube
Démo
Bibliothèque virale
Base documentaire

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Actualités

Trojan.Crossrider.11

Added to the Dr.Web virus database: 2013-10-25

Virus description added:

Technical Information

To ensure autorun and distribution
Creates or modifies the following files
  • %WINDIR%\tasks\shop-up-chromeinstaller.job
  • <SYSTEM32>\tasks\shop-up-chromeinstaller
  • %WINDIR%\tasks\shop-up-firefoxinstaller.job
  • <SYSTEM32>\tasks\shop-up-firefoxinstaller
  • %WINDIR%\tasks\shop-up-codedownloader.job
  • <SYSTEM32>\tasks\shop-up-codedownloader
  • %WINDIR%\tasks\shop-up-enabler.job
  • <SYSTEM32>\tasks\shop-up-enabler
  • %WINDIR%\tasks\temp_shop-up-enabler.job
  • <SYSTEM32>\tasks\temp_shop-up-enabler
  • %WINDIR%\tasks\shop-up-updater.job
  • <SYSTEM32>\tasks\shop-up-updater
Malicious functions
Terminates or attempts to terminate
the following user processes:
  • firefox.exe
Registers BHO
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110411281122}]
Modifies file system
Creates the following files
  • %TEMP%\nsh2118.tmp
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\159_cortica_rollover_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\170_icm1_5_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\4_jquery_1_7_1.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\158_50onred_ads_only_no_fb_m.j...
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\128_superfish_pricora_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\87_ginyas_wrapper.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\91_monetizationloader.js.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\17_jquery.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\116_ads_only_5_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\28_initializer.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\108_icm_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\13_crossriderapputils.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\21_debug.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\xhr.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\175_coolmirage_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\usercode\extension.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\usercode\background.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\options.xul
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\dialog.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\background.html
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\search_dialog.xul
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\baseobject.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\main.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\options.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\browser.xul
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\7_hooks.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\155_ibario_pops_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\125_arcadi2_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\142_intext_fa_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\117_coupons_intext_ads_5_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\171_arcadi2_sourceid_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\101_cortica_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\14_crossriderutils.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\120_luck_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\64_appapimessage.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\126_revizer_ws_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\72_appapivalidation.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\92_superfish_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\47_resources_background.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\105_corticas_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\98_omnicommands.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\102_dealply_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\22_resources.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\138_getdeal_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\174_arcadi_serp_dynamic_id_m.j...
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\127_revizer_p_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\107_coupish_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\1_base.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\104_jollywallet_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\123_intext_adv_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\103_intext_5_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\141_corticas_ru_m.js.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\9_search_engine_hook.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\119_similar_web_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\124_superfish_no_search_no_cou...
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\135_arcadi3_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\searchsettings.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\reloadobserver.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\logfile.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\skin\popup.html
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\skin\update.css
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\skin\button2.png
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\skin\button5.png
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\skin\skin.css
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\skin\icon24.png
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\skin\button3.png
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\skin\button1.png
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\skin\icon16.png
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\skin\panelarrow-up.png
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\skin\icon128.png
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api\dom_bg.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\skin\icon48.png
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\skin\crossrider_statusbar.png
  • %ProgramFiles(x86)%\shop-up\shop-up-helper.exe
  • %ProgramFiles(x86)%\shop-up\shop-up-buttonutil.exe
  • %ProgramFiles(x86)%\shop-up\shop-up-buttonutil64.exe
  • %ProgramFiles(x86)%\shop-up\shop-up-buttonutil.dll
  • %ProgramFiles(x86)%\shop-up\shop-up-buttonutil64.dll
  • %ProgramFiles(x86)%\shop-up\shop-up.ico
  • %ProgramFiles(x86)%\shop-up\shop-up-bho.dll
  • %ProgramFiles(x86)%\shop-up\shop-up-bho64.dll
  • %ProgramFiles(x86)%\shop-up\background.html
  • %ProgramFiles(x86)%\shop-up\shop-up-bg.exe
  • %ProgramFiles(x86)%\shop-up\shop-up-enabler.exe
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\skin\button4.png
  • %ProgramFiles(x86)%\shop-up\shop-up-codedownloader.exe
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api\tabs.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api\browseraction.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api\asyncdb.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\registry.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\updatemanager.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\console.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\delegate.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\consts.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\progresslistenerobserver.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\reports.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\installer.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\folderiowrapper.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\httpobserver.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\idbwrapper.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\requestobject.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\prefs.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\uninstallobserver.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\utils.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api\request.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api\firefoxnotifications.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api\message.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api\pageaction.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api\firefoxomnibox.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api\dbmanager.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api\background.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api\webrequest.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api\firefox.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api\filemanager.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\api\contextmenu.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome\content\core\extensiondatastore.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\16_ffappapiwrapper.js
  • %ProgramFiles(x86)%\shop-up\shop-up-updater.exe
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\129_widdit_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\93_superfish_no_coupons_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\updatemanager.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\app_api.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\util.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\delegate.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\consts.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\crossriderapi.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\reports.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\installer.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\onbgdocumentload.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\events.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\extensiondatastore.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\storagewrapper.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\api\pageaction.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\93_superfish_no_coupons_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\api\cookie.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\api\chrome.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\api\pageactionbg.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\popup.html
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\background.html
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\icons\icon48.png
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\icons\actions\1.png
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\icons\icon16.png
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\icons\icon128.png
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\manifest.json
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins.json
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\manifest.xml
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\cookie_store.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\api\message.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\bg_app_api.js
  • %TEMP%\nsw2cbc.tmp\md5dll.dll
  • %TEMP%\nsh2119.tmp\system.dll
  • %TEMP%\nsh2119.tmp\pccodkpau.tmp
  • %TEMP%\nsh2119.tmp\wrapperutils.dll
  • %TEMP%\nsh2119.tmp\rmxuq.exe
  • %TEMP%\nsh2119.tmp\stdutils.dll
  • %TEMP%\nsh2cac.tmp
  • %TEMP%\nsw2cbc.tmp\stdutils.dll
  • %TEMP%\nsw2cbc.tmp\system.dll
  • %TEMP%\nsw2cbc.tmp\nsislog.dll
  • %TEMP%\shop-upinstaller_1598743539.log
  • %TEMP%\nsw2cbc.tmp\installerutils.dll
  • %TEMP%\nsw2cbc.tmp\nsisos.dll
  • %TEMP%\nsw2cbc.tmp\userinfo.dll
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\popupresource\newpopup.js
  • %ProgramFiles(x86)%\shop-up\utils.exe
  • %TEMP%\nsw2cbc.tmp\temp_file_before.tmp
  • %TEMP%\nsw2cbc.tmp\temp_file_after.tmp
  • %ProgramFiles(x86)%\shop-up\uninstall.exe
  • %ProgramFiles(x86)%\shop-up\42822.crx
  • %ProgramFiles(x86)%\shop-up\shop-up-chromeinstaller.exe
  • %TEMP%\nsw2cbc.tmp\execdos.dll
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\background.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\main.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\xhr.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\logging.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\popupresource\popup.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\js\lib\logfile.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\78_crossriderinfo.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\129_widdit_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\117_coupons_intext_ads_5_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\158_50onred_ads_only_no_fb_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\128_superfish_pricora_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\87_ginyas_wrapper.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\91_monetizationloader.js.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\17_jquery.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\80_chpopupappapi.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\116_ads_only_5_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\28_initializer.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\108_icm_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\13_crossriderapputils.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\155_ibario_pops_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\170_icm1_5_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\4_jquery_1_7_1.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\21_debug.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\usercode\extension.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\usercode\background.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\crossridermanifest.json
  • %ProgramFiles(x86)%\shop-up\42822.xpi
  • %ProgramFiles(x86)%\shop-up\shop-up-firefoxinstaller.exe
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\install.rdf
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\locale\en-us\translations.dtd
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\defaults\preferences\prefs.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\chrome.manifest
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins.json
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\manifest.xml
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\19_chappapiwrapper.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\175_coolmirage_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\159_cortica_rollover_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\7_hooks.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\125_arcadi2_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\101_cortica_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\14_crossriderutils.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\120_luck_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\64_appapimessage.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\126_revizer_ws_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\72_appapivalidation.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\92_superfish_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\47_resources_background.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\105_corticas_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\142_intext_fa_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\102_dealply_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\138_getdeal_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\171_arcadi2_sourceid_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\174_arcadi_serp_dynamic_id_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\107_coupish_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\1_base.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\104_jollywallet_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\123_intext_adv_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\97_resourceapiwrapper.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\103_intext_5_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\141_corticas_ru_m.js.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\9_search_engine_hook.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\119_similar_web_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\124_superfish_no_search_no_coupons_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\22_resources.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\135_arcadi3_m.js
  • %LOCALAPPDATA%\google\chrome\user data\default\extensions\kigpmgkoelepakabiliblldhdpnidcod\1.25.17_0\extensiondata\plugins\127_revizer_p_m.js
  • %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\a346f15b-f72e-4205-b29d-52ad46792214@bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com\extensiondata\plugins\78_crossriderinfo.js
  • %ProgramFiles(x86)%\shop-up\installer.log
Deletes the following files
  • %WINDIR%\tasks\temp_shop-up-enabler.job
  • %TEMP%\nsh2119.tmp\stdutils.dll
  • %TEMP%\nsh2119.tmp\rmxuq.exe
  • %TEMP%\nsh2119.tmp\pccodkpau.tmp
  • %TEMP%\nsw2cbc.tmp\userinfo.dll
  • %TEMP%\nsw2cbc.tmp\temp_file_before.tmp
  • %TEMP%\nsw2cbc.tmp\temp_file_after.tmp
  • %TEMP%\nsh2119.tmp\system.dll
  • %TEMP%\nsw2cbc.tmp\system.dll
  • %TEMP%\nsw2cbc.tmp\nsisos.dll
  • %TEMP%\nsw2cbc.tmp\nsislog.dll
  • %TEMP%\nsw2cbc.tmp\md5dll.dll
  • %TEMP%\nsw2cbc.tmp\installerutils.dll
  • %TEMP%\nsw2cbc.tmp\execdos.dll
  • <SYSTEM32>\tasks\temp_shop-up-enabler
  • %TEMP%\nsw2cbc.tmp\stdutils.dll
  • %TEMP%\nsh2119.tmp\wrapperutils.dll
Network activity
TCP
HTTP GET requests
  • http://st###.#rvstatsdata.com/installer.gif?ac###################################################################################################################################################...
  • http://st###.#yncstatsdata.com/monetization.gif?ev###############################################################################################################################################...
  • http://er####.srvstatsdata.com/ie-error.gif?ac###################################################################################################################################################...
  • http://st###.#rvstatsdata.com/stats.gif?ac#######################################################################################################################################################...
  • http://st###.#rvstatsdata.com/apps.gif?ac########################################################################################################################################################...
UDP
  • DNS ASK st###.#rvstatsdata.com
  • DNS ASK st###.#yncstatsdata.com
  • DNS ASK er####.srvstatsdata.com
  • DNS ASK ap######ic.crossrider.com
Miscellaneous
Searches for the following windows
  • ClassName: 'MS_AutodialMonitor' WindowName: ''
  • ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
  • '%TEMP%\nsh2119.tmp\rmxuq.exe'
  • '%ProgramFiles(x86)%\shop-up\shop-up-chromeinstaller.exe' /installcrx /agentregpath='Shop-Up' /extensionfilepath='%ProgramFiles(x86)%\Shop-Up\42822.crx' /appid=42822 /srcid='000478' /subid='0' /zdata='0' /bic=02EC0407AD3B423AA6788926F43F72ABIE /verifi...
  • '%ProgramFiles(x86)%\shop-up\shop-up-firefoxinstaller.exe' /installxpi /agentregpath='Shop-Up' /extensionfilepath='%ProgramFiles(x86)%\Shop-Up\42822.xpi' /appid=42822 /srcid='000478' /subid='0' /zdata='0' /bic=02EC0407AD3B423AA6788926F43F72ABIE /verifi...
  • '%ProgramFiles(x86)%\shop-up\shop-up-codedownloader.exe' /installapp /agentregpath='Shop-Up' /appid=42822 /srcid='000478' /subid='0' /zdata='0' /bic=02EC0407AD3B423AA6788926F43F72ABIE /verifier=fc0b09802f528515ac95ff9331d66c6e /installerversion=1_29_...
  • '%ProgramFiles(x86)%\shop-up\shop-up-helper.exe' /externallog='%TEMP%\Shop-UpInstaller_1598743539.log'
  • '%ProgramFiles(x86)%\shop-up\shop-up-bg.exe' /executebg /externallog='%TEMP%\Shop-UpInstaller_1598743539.log'
  • '%ProgramFiles(x86)%\shop-up\shop-up-enabler.exe' /enablebho /agentregpath='Shop-Up' /appid=42822 /srcid='000478' /subid='0' /zdata='0' /bic=02EC0407AD3B423AA6788926F43F72ABIE /verifier=fc0b09802f528515ac95ff9331d66c6e /installerversion=1_29_1...
  • '%ProgramFiles(x86)%\shop-up\shop-up-chromeinstaller.exe' /installcrx /agentregpath='Shop-Up' /extensionfilepath='%ProgramFiles(x86)%\Shop-Up\42822.crx' /appid=42822 /srcid='000478' /subid='0' /zdata='0' /bic=02EC0407AD3B423AA6788926F43F72ABIE /verifi...' (with hidden window)
  • '%ProgramFiles(x86)%\shop-up\shop-up-firefoxinstaller.exe' /installxpi /agentregpath='Shop-Up' /extensionfilepath='%ProgramFiles(x86)%\Shop-Up\42822.xpi' /appid=42822 /srcid='000478' /subid='0' /zdata='0' /bic=02EC0407AD3B423AA6788926F43F72ABIE /verifi...' (with hidden window)
  • '%ProgramFiles(x86)%\shop-up\shop-up-codedownloader.exe' /installapp /agentregpath='Shop-Up' /appid=42822 /srcid='000478' /subid='0' /zdata='0' /bic=02EC0407AD3B423AA6788926F43F72ABIE /verifier=fc0b09802f528515ac95ff9331d66c6e /installerversion=1_29_...' (with hidden window)
  • '%ProgramFiles(x86)%\shop-up\shop-up-helper.exe' /externallog='%TEMP%\Shop-UpInstaller_1598743539.log'' (with hidden window)
  • '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Shop-Up\Shop-Up-bho.dll"' (with hidden window)
  • '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Shop-Up\Shop-Up-bho64.dll"' (with hidden window)
  • '%ProgramFiles(x86)%\shop-up\shop-up-bg.exe' /executebg /externallog='%TEMP%\Shop-UpInstaller_1598743539.log'' (with hidden window)
  • '%ProgramFiles(x86)%\shop-up\shop-up-enabler.exe' /enablebho /agentregpath='Shop-Up' /appid=42822 /srcid='000478' /subid='0' /zdata='0' /bic=02EC0407AD3B423AA6788926F43F72ABIE /verifier=fc0b09802f528515ac95ff9331d66c6e /installerversion=1_29_1...' (with hidden window)
Executes the following
  • '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Shop-Up\Shop-Up-bho.dll"
  • '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Shop-Up\Shop-Up-bho64.dll"
  • '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\Shop-Up\Shop-Up-bho64.dll"

Recommandations pour le traitement

  1. Si le système d'exploitation peut être démarré (en mode normal ou en mode sans échec), téléchargez Dr.Web Security Space et lancez un scan complet de votre ordinateur et de tous les supports amovibles que vous utilisez. En savoir plus sur Dr.Web Security Space.
  2. Si le démarrage du système d'exploitation est impossible, veuillez modifier les paramètres du BIOS de votre ordinateur pour démarrer votre ordinateur via CD/DVD ou clé USB. Téléchargez l'image du disque de secours de restauration du système Dr.Web® LiveDisk ou l'utilitaire pour enregistrer Dr.Web® LiveDisk sur une clé USB, puis préparez la clé USB appropriée. Démarrez l'ordinateur à l'aide de cette clé et lancez le scan complet et le traitement des menaces détectées.
Version démo gratuite

 

Télécharger Dr.Web

Par le numéro de série

Veuillez lancer le scan complet du système à l'aide de Dr.Web Antivirus pour Mac OS.

Version démo gratuite

 

Télécharger Dr.Web sur le site

Par le numéro de série

Télécharger Dr.Web sur l'Apple Store

Veuillez lancer le scan complet de toutes les partitions du disque à l'aide de Dr.Web Antivirus pour Linux.

Version démo gratuite

 

Télécharger Dr.Web

Par le numéro de série

  1. Si votre appareil mobile fonctionne correctement, veuillez télécharger et installer sur votre appareil mobile Dr.Web pour Android. Lancez un scan complet et suivez les recommandations sur la neutralisation des menaces détectées.
  2. Si l'appareil mobile est bloqué par le Trojan de la famille Android.Locker (un message sur la violation grave de la loi ou la demande d'une rançon est affiché sur l'écran de l'appareil mobile), procédez comme suit:
    • démarrez votre Smartphone ou votre tablette en mode sans échec (si vous ne savez pas comment faire, consultez la documentation de l'appareil mobile ou contactez le fabricant) ;
    • puis téléchargez et installez sur votre appareil mobile Dr.Web pour Android et lancez un scan complet puis suivez les recommandations sur la neutralisation des menaces détectées ;
    • Débranchez votre appareil et rebranchez-le.

En savoir plus sur Dr.Web pour Android

Free trial

14 days

Download now
Get it on Google Play