Pour les utilisateurs

Fermer

Bibliothèque
Ma bibliothèque

+ Ajouter à la bibliothèque

Recherche
Recherche

Contacter-nous !
Support 24/24 | Rules regarding submitting

Envoyer un message

Requête à l'aide du formulaire

Nous téléphoner

0 825 300 230

Forum

Vos requêtes

  • Toutes : -
  • Non clôturées : -
  • Dernière : le -
Créer une nouvelle requête

Nous téléphoner

0 825 300 230

Profil

FR

RU CN EN ES FR IT JP KZ UZ BY ID
Fermer
Services support
Scanners
Dr.Web vxCube
Démo
Bibliothèque virale
Base documentaire

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Actualités

Tool.NirCmd.4

Added to the Dr.Web virus database: 2025-02-13

Virus description added:

Technical Information

Malicious functions
Executes the following
  • '%WINDIR%\syswow64\taskkill.exe' /IM "IDMan.exe" /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM "IEMonitor.exe" /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM "IDMGrHlp.exe" /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM "idmBroker.exe" /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM "IDMMsgHost.exe" /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM "MediumILStart.exe" /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM "IDMIntegrator64.exe" /F
Launches a large number of processes
Modifies file system
Creates the following files
  • %TEMP%\fx.bat
  • %TEMP%\kr.bat
  • %TEMP%\r.reg
  • %TEMP%\r_k.reg
  • %TEMP%\sl.bat
  • %TEMP%\sm.bat
  • %TEMP%\sn.bat
  • %TEMP%\lc.exe
  • %TEMP%\n.exe
  • %TEMP%\tl.exe
  • %TEMP%\wget.exe
  • nul
Miscellaneous
Searches for the following windows
  • ClassName: '' WindowName: ''
Executes the following
  • '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\fx.bat" /S"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{6B9EB066-DA1F-4C0A-AC62-01AC892EF175}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{6B9EB066-DA1F-4C0A-AC62-01AC892EF175}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{C950922F-897A-4E13-BA38-66C8AF2E0BF7}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}"
  • '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{C950922F-897A-4E13-BA38-66C8AF2E0BF7}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{C950922F-897A-4E13-BA38-66C8AF2E0BF7}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}" /f
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}" /f
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{D0FB58BB-2C07-492F-8BD0-A587E4874B4E}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{D0FB58BB-2C07-492F-8BD0-A587E4874B4E}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{0F947660-8606-420A-BAC6-51B84DD22A47}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{0F947660-8606-420A-BAC6-51B84DD22A47}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}"
  • '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{C950922F-897A-4E13-BA38-66C8AF2E0BF7}"
  • '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Internet Download Manager" /f
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{C950922F-897A-4E13-BA38-66C8AF2E0BF7}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{C950922F-897A-4E13-BA38-66C8AF2E0BF7}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{D0FB58BB-2C07-492F-8BD0-A587E4874B4E}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{D0FB58BB-2C07-492F-8BD0-A587E4874B4E}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /f
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{D0FB58BB-2C07-492F-8BD0-A587E4874B4E}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{D0FB58BB-2C07-492F-8BD0-A587E4874B4E}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{0F947660-8606-420A-BAC6-51B84DD22A47}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{0F947660-8606-420A-BAC6-51B84DD22A47}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}"
  • '%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}"
  • '%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{6B9EB066-DA1F-4C0A-AC62-01AC892EF175}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{6B9EB066-DA1F-4C0A-AC62-01AC892EF175}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}" /f
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}" /f
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{6B9EB066-DA1F-4C0A-AC62-01AC892EF175}" /f
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{C950922F-897A-4E13-BA38-66C8AF2E0BF7}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{C950922F-897A-4E13-BA38-66C8AF2E0BF7}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{D0FB58BB-2C07-492F-8BD0-A587E4874B4E}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{0F947660-8606-420A-BAC6-51B84DD22A47}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{0F947660-8606-420A-BAC6-51B84DD22A47}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{D0FB58BB-2C07-492F-8BD0-A587E4874B4E}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}"
  • '%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}"
  • '%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}"
  • '%WINDIR%\syswow64\whoami.exe' /user /fo list
  • '%WINDIR%\syswow64\reg.exe' query HKU\S-1-5-19
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{0F947660-8606-420A-BAC6-51B84DD22A47}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{0F947660-8606-420A-BAC6-51B84DD22A47}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}" /f
  • '%WINDIR%\syswow64\cmd.exe' /c whoami /user /fo list
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{6B9EB066-DA1F-4C0A-AC62-01AC892EF175}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{6B9EB066-DA1F-4C0A-AC62-01AC892EF175}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}"
  • '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Internet Download Manager"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}" /f
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /f
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{0F947660-8606-420A-BAC6-51B84DD22A47}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{0F947660-8606-420A-BAC6-51B84DD22A47}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{D0FB58BB-2C07-492F-8BD0-A587E4874B4E}"
  • '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}"
  • '%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}"
  • '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}"
  • '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{6B9EB066-DA1F-4C0A-AC62-01AC892EF175}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{6B9EB066-DA1F-4C0A-AC62-01AC892EF175}" /f
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{D0FB58BB-2C07-492F-8BD0-A587E4874B4E}" /f
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{6B9EB066-DA1F-4C0A-AC62-01AC892EF175}"
  • '%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}"
  • '%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}" /f
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /f
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}" /f
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{C950922F-897A-4E13-BA38-66C8AF2E0BF7}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{C950922F-897A-4E13-BA38-66C8AF2E0BF7}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}" /f
  • '%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}"
  • '%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}"
  • '%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}"
  • '%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /f
  • '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\fx.bat" /S"' (with hidden window)

Recommandations pour le traitement

  1. Si le système d'exploitation peut être démarré (en mode normal ou en mode sans échec), téléchargez Dr.Web Security Space et lancez un scan complet de votre ordinateur et de tous les supports amovibles que vous utilisez. En savoir plus sur Dr.Web Security Space.
  2. Si le démarrage du système d'exploitation est impossible, veuillez modifier les paramètres du BIOS de votre ordinateur pour démarrer votre ordinateur via CD/DVD ou clé USB. Téléchargez l'image du disque de secours de restauration du système Dr.Web® LiveDisk ou l'utilitaire pour enregistrer Dr.Web® LiveDisk sur une clé USB, puis préparez la clé USB appropriée. Démarrez l'ordinateur à l'aide de cette clé et lancez le scan complet et le traitement des menaces détectées.
Version démo gratuite

 

Télécharger Dr.Web

Par le numéro de série

Veuillez lancer le scan complet du système à l'aide de Dr.Web Antivirus pour Mac OS.

Version démo gratuite

 

Télécharger Dr.Web sur le site

Par le numéro de série

Télécharger Dr.Web sur l'Apple Store

Veuillez lancer le scan complet de toutes les partitions du disque à l'aide de Dr.Web Antivirus pour Linux.

Version démo gratuite

 

Télécharger Dr.Web

Par le numéro de série

  1. Si votre appareil mobile fonctionne correctement, veuillez télécharger et installer sur votre appareil mobile Dr.Web pour Android. Lancez un scan complet et suivez les recommandations sur la neutralisation des menaces détectées.
  2. Si l'appareil mobile est bloqué par le Trojan de la famille Android.Locker (un message sur la violation grave de la loi ou la demande d'une rançon est affiché sur l'écran de l'appareil mobile), procédez comme suit:
    • démarrez votre Smartphone ou votre tablette en mode sans échec (si vous ne savez pas comment faire, consultez la documentation de l'appareil mobile ou contactez le fabricant) ;
    • puis téléchargez et installez sur votre appareil mobile Dr.Web pour Android et lancez un scan complet puis suivez les recommandations sur la neutralisation des menaces détectées ;
    • Débranchez votre appareil et rebranchez-le.

En savoir plus sur Dr.Web pour Android

Free trial

14 days

Download now
Get it on Google Play