Bibliothèque
Ma bibliothèque

+ Ajouter à la bibliothèque

Contacter-nous !
Support 24/24 | Rules regarding submitting

Nous téléphoner

0 825 300 230

Forum

Vos requêtes

  • Toutes : -
  • Non clôturées : -
  • Dernière : le -

Nous téléphoner

0 825 300 230

Profil

Trojan.PWS.Ibank.566

Added to the Dr.Web virus database: 2012-06-19

Virus description added:

Technical Information

To ensure autorun and distribution:
Modifies the following registry keys:
  • [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'run' = '<Full path to virus>'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'FlashPlayerUpdate' = '<Full path to virus>'
  • [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '<Full path to virus>'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'userinit' = '<SYSTEM32>\userinit.exe,<Full path to virus>,'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'System' = '<Full path to virus>'
Malicious functions:
Injects code into
the following system processes:
  • <SYSTEM32>\cscript.exe
a large number of user processes.
Modifies file system :
Creates the following files:
  • %TEMP%\36.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\search[14].php
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\search[14].php
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\search[14].php
  • %TEMP%\37.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\search[13].php
  • %TEMP%\33.tmp
  • %TEMP%\34.tmp
  • %TEMP%\35.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\search[14].php
  • %TEMP%\3B.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\search[15].php
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\search[15].php
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\search[16].php
  • %TEMP%\3C.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\search[15].php
  • %TEMP%\38.tmp
  • %TEMP%\39.tmp
  • %TEMP%\3A.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\search[15].php
  • %TEMP%\2C.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\search[11].php
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\search[12].php
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\search[12].php
  • %TEMP%\2D.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\search[11].php
  • %TEMP%\29.tmp
  • %TEMP%\2A.tmp
  • %TEMP%\2B.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\search[11].php
  • %TEMP%\31.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\search[13].php
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\search[13].php
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\search[13].php
  • %TEMP%\32.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\search[12].php
  • %TEMP%\2E.tmp
  • %TEMP%\2F.tmp
  • %TEMP%\30.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\search[12].php
  • %TEMP%\3D.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\search[19].php
  • %TEMP%\4A.tmp
  • %TEMP%\4B.tmp
  • %TEMP%\4C.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\search[19].php
  • %TEMP%\48.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\search[18].php
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\search[19].php
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\search[19].php
  • %TEMP%\49.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\search[20].php
  • %TEMP%\4F.tmp
  • %TEMP%\50.tmp
  • %TEMP%\51.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\search[21].php
  • %TEMP%\4D.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\search[20].php
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\search[20].php
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\search[20].php
  • %TEMP%\4E.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\search[17].php
  • %TEMP%\40.tmp
  • %TEMP%\41.tmp
  • %TEMP%\42.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\search[17].php
  • %TEMP%\3E.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\search[16].php
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\search[16].php
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\search[16].php
  • %TEMP%\3F.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\search[18].php
  • %TEMP%\45.tmp
  • %TEMP%\46.tmp
  • %TEMP%\47.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\search[18].php
  • %TEMP%\43.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\search[17].php
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\search[17].php
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\search[18].php
  • %TEMP%\44.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\search[11].php
  • %TEMP%\D.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\search[4].php
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\search[4].php
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\search[4].php
  • %TEMP%\E.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\search[3].php
  • %TEMP%\A.tmp
  • %TEMP%\B.tmp
  • %TEMP%\C.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\search[3].php
  • %TEMP%\12.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\search[5].php
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\search[5].php
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\search[5].php
  • %TEMP%\13.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\search[4].php
  • %TEMP%\F.tmp
  • %TEMP%\10.tmp
  • %TEMP%\11.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\search[5].php
  • %TEMP%\3.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\search[1].php
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\search[1].php
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\search[2].php
  • %TEMP%\4.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\search[1].php
  • %APPDATA%\579F6B5\cmdline.txt
  • %TEMP%\1.tmp
  • %TEMP%\2.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\search[1].php
  • %TEMP%\8.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\search[2].php
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\search[3].php
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\search[3].php
  • %TEMP%\9.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\search[2].php
  • %TEMP%\5.tmp
  • %TEMP%\6.tmp
  • %TEMP%\7.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\search[2].php
  • %TEMP%\14.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\search[9].php
  • %TEMP%\21.tmp
  • %TEMP%\22.tmp
  • %TEMP%\23.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\search[9].php
  • %TEMP%\1F.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\search[8].php
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\search[8].php
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\search[9].php
  • %TEMP%\20.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\search[10].php
  • %TEMP%\26.tmp
  • %TEMP%\27.tmp
  • %TEMP%\28.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\search[10].php
  • %TEMP%\24.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\search[9].php
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\search[10].php
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\search[10].php
  • %TEMP%\25.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\search[6].php
  • %TEMP%\17.tmp
  • %TEMP%\18.tmp
  • %TEMP%\19.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\search[7].php
  • %TEMP%\15.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\search[6].php
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\search[6].php
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\search[6].php
  • %TEMP%\16.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\search[8].php
  • %TEMP%\1C.tmp
  • %TEMP%\1D.tmp
  • %TEMP%\1E.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\search[8].php
  • %TEMP%\1A.tmp
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\search[7].php
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\search[7].php
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\search[7].php
  • %TEMP%\1B.tmp
Sets the 'hidden' attribute to the following files:
  • <Full path to virus>
Deletes the following files:
  • %TEMP%\37.tmp
  • %TEMP%\38.tmp
  • %TEMP%\36.tmp
  • %TEMP%\34.tmp
  • %TEMP%\35.tmp
  • %TEMP%\3C.tmp
  • %TEMP%\3D.tmp
  • %TEMP%\3B.tmp
  • %TEMP%\39.tmp
  • %TEMP%\3A.tmp
  • %TEMP%\2D.tmp
  • %TEMP%\2E.tmp
  • %TEMP%\2C.tmp
  • %TEMP%\2A.tmp
  • %TEMP%\2B.tmp
  • %TEMP%\32.tmp
  • %TEMP%\33.tmp
  • %TEMP%\31.tmp
  • %TEMP%\2F.tmp
  • %TEMP%\30.tmp
  • %TEMP%\4B.tmp
  • %TEMP%\4C.tmp
  • %TEMP%\4A.tmp
  • %TEMP%\48.tmp
  • %TEMP%\49.tmp
  • %TEMP%\50.tmp
  • %TEMP%\51.tmp
  • %TEMP%\4F.tmp
  • %TEMP%\4D.tmp
  • %TEMP%\4E.tmp
  • %TEMP%\41.tmp
  • %TEMP%\42.tmp
  • %TEMP%\40.tmp
  • %TEMP%\3E.tmp
  • %TEMP%\3F.tmp
  • %TEMP%\46.tmp
  • %TEMP%\47.tmp
  • %TEMP%\45.tmp
  • %TEMP%\43.tmp
  • %TEMP%\44.tmp
  • %TEMP%\29.tmp
  • %TEMP%\E.tmp
  • %TEMP%\F.tmp
  • %TEMP%\D.tmp
  • %TEMP%\B.tmp
  • %TEMP%\C.tmp
  • %TEMP%\13.tmp
  • %TEMP%\14.tmp
  • %TEMP%\12.tmp
  • %TEMP%\10.tmp
  • %TEMP%\11.tmp
  • %TEMP%\4.tmp
  • %TEMP%\5.tmp
  • %TEMP%\3.tmp
  • %TEMP%\1.tmp
  • %TEMP%\2.tmp
  • %TEMP%\9.tmp
  • %TEMP%\A.tmp
  • %TEMP%\8.tmp
  • %TEMP%\6.tmp
  • %TEMP%\7.tmp
  • %TEMP%\22.tmp
  • %TEMP%\23.tmp
  • %TEMP%\21.tmp
  • %TEMP%\1F.tmp
  • %TEMP%\20.tmp
  • %TEMP%\27.tmp
  • %TEMP%\28.tmp
  • %TEMP%\26.tmp
  • %TEMP%\24.tmp
  • %TEMP%\25.tmp
  • %TEMP%\18.tmp
  • %TEMP%\19.tmp
  • %TEMP%\17.tmp
  • %TEMP%\15.tmp
  • %TEMP%\16.tmp
  • %TEMP%\1D.tmp
  • %TEMP%\1E.tmp
  • %TEMP%\1C.tmp
  • %TEMP%\1A.tmp
  • %TEMP%\1B.tmp
Network activity:
Connects to:
  • 'go##ra.info':80
  • 'ma##ta.info':80
  • 'pu##ma.info':80
  • 'ke##po.info':80
  • 'vi##qa.info':80
  • 'zy##na.info':80
  • 'di##la.info':80
  • 'we##va.info':80
  • 'ha##ca.info':80
  • 'no##xa.info':80
  • 'zy##xo.info':80
  • 'pu##co.info':80
  • 'go##no.info':80
  • 'vi##bo.info':80
  • 'we##zo.info':80
  • 'ty##do.info':80
  • 'xu##fo.info':80
  • 'no##jo.info':80
  • 'di##ho.info':80
  • 'ha##ko.info':80
  • 'xu##ka.info':80
  • 'xu##xe.info':80
  • 'pu##dy.info':80
  • 'no##be.info':80
  • 'di##ve.info':80
  • 'ke##le.info':80
  • 'ma##je.info':80
  • 'ha##ry.info':80
  • 'go##he.info':80
  • 'zy##sy.info':80
  • 'vi##gy.info':80
  • 'ma##fa.info':80
  • 'vi##pe.info':80
  • 'go##se.info':80
  • 'ke##ga.info':80
  • 'ty##ha.info':80
  • 'zy##we.info':80
  • 'ty##ze.info':80
  • 'ha##me.info':80
  • 'pu##te.info':80
  • 'we##qe.info':80
  • 'ke##wo.info':80
  • 'xu##vu.info':80
  • 'ke##xu.info':80
  • 'ty##cu.info':80
  • 'vi##dy.info':80
  • 'ha##qy.info':80
  • 'pu##gu.info':80
  • 'ma##lu.info':80
  • 'go##ku.info':80
  • 'no##my.info':80
  • 'di##ny.info':80
  • 'go##fy.info':80
  • 'ke##jy.info':80
  • 'ma##hy.info':80
  • 'www.bing.com':80
  • 'no##ce.info':80
  • 'pu##py.info':80
  • 'zy##ty.info':80
  • 'we##ry.info':80
  • 'xu##zy.info':80
  • 'ty##ky.info':80
  • 'vi##hu.info':80
  • 'no##di.info':80
  • 'ha##gi.info':80
  • 'zy##ji.info':80
  • 'go##xi.info':80
  • 'pu##li.info':80
  • 'xu##pi.info':80
  • 'ty##ri.info':80
  • 'ma##mo.info':80
  • 'we##hi.info':80
  • 'di##si.info':80
  • 'we##su.info':80
  • 'no##tu.info':80
  • 'di##wu.info':80
  • 'zy##fu.info':80
  • 'ha##pu.info':80
  • 'ty##mi.info':80
  • 'ma##vi.info':80
  • 'vi##zi.info':80
  • 'xu##qu.info':80
  • 'ke##bi.info':80
TCP:
HTTP GET requests:
  • go##ra.info/search.php
  • ma##ta.info/search.php
  • pu##ma.info/search.php
  • ke##po.info/search.php
  • vi##qa.info/search.php
  • zy##na.info/search.php
  • di##la.info/search.php
  • we##va.info/search.php
  • ha##ca.info/search.php
  • no##xa.info/search.php
  • zy##xo.info/search.php
  • pu##co.info/search.php
  • go##no.info/search.php
  • vi##bo.info/search.php
  • we##zo.info/search.php
  • ty##do.info/search.php
  • xu##fo.info/search.php
  • no##jo.info/search.php
  • di##ho.info/search.php
  • ha##ko.info/search.php
  • xu##ka.info/search.php
  • xu##xe.info/search.php
  • pu##dy.info/search.php
  • no##be.info/search.php
  • di##ve.info/search.php
  • ke##le.info/search.php
  • ma##je.info/search.php
  • ha##ry.info/search.php
  • go##he.info/search.php
  • zy##sy.info/search.php
  • vi##gy.info/search.php
  • ma##fa.info/search.php
  • vi##pe.info/search.php
  • go##se.info/search.php
  • ke##ga.info/search.php
  • ty##ha.info/search.php
  • zy##we.info/search.php
  • ty##ze.info/search.php
  • ha##me.info/search.php
  • pu##te.info/search.php
  • we##qe.info/search.php
  • ke##xu.info/search.php
  • no##my.info/search.php
  • xu##vu.info/search.php
  • ha##qy.info/search.php
  • ty##cu.info/search.php
  • ma##lu.info/search.php
  • vi##hu.info/search.php
  • pu##gu.info/search.php
  • di##ny.info/search.php
  • go##ku.info/search.php
  • ke##jy.info/search.php
  • xu##zy.info/search.php
  • go##fy.info/search.php
  • no##ce.info/search.php
  • ma##hy.info/search.php
  • zy##ty.info/search.php
  • vi##dy.info/search.php
  • pu##py.info/search.php
  • ty##ky.info/search.php
  • we##ry.info/search.php
  • zy##fu.info/search.php
  • ha##gi.info/search.php
  • we##hi.info/search.php
  • no##di.info/search.php
  • pu##li.info/search.php
  • zy##ji.info/search.php
  • ty##ri.info/search.php
  • ke##wo.info/search.php
  • xu##pi.info/search.php
  • di##si.info/search.php
  • ma##mo.info/search.php
  • no##tu.info/search.php
  • xu##qu.info/search.php
  • we##su.info/search.php
  • ha##pu.info/search.php
  • di##wu.info/search.php
  • ma##vi.info/search.php
  • go##xi.info/search.php
  • ty##mi.info/search.php
  • ke##bi.info/search.php
  • vi##zi.info/search.php
UDP:
  • DNS ASK ma##ta.info
  • DNS ASK ha##ca.info
  • DNS ASK go##ra.info
  • DNS ASK vi##qa.info
  • DNS ASK pu##ma.info
  • DNS ASK no##xa.info
  • DNS ASK ke##ga.info
  • DNS ASK xu##ka.info
  • DNS ASK di##la.info
  • DNS ASK we##va.info
  • DNS ASK zy##na.info
  • DNS ASK zy##xo.info
  • DNS ASK pu##co.info
  • DNS ASK go##no.info
  • DNS ASK vi##bo.info
  • DNS ASK we##zo.info
  • DNS ASK di##ho.info
  • DNS ASK xu##fo.info
  • DNS ASK ke##po.info
  • DNS ASK ty##do.info
  • DNS ASK ha##ko.info
  • DNS ASK no##jo.info
  • DNS ASK ty##ha.info
  • DNS ASK vi##gy.info
  • DNS ASK go##he.info
  • DNS ASK pu##dy.info
  • DNS ASK xu##xe.info
  • DNS ASK zy##sy.info
  • DNS ASK ma##je.info
  • DNS ASK di##my.info
  • DNS ASK xu##ny.info
  • DNS ASK we##py.info
  • DNS ASK ha##ry.info
  • DNS ASK no##wy.info
  • DNS ASK pu##te.info
  • DNS ASK we##qe.info
  • DNS ASK vi##pe.info
  • DNS ASK go##se.info
  • DNS ASK ma##fa.info
  • DNS ASK ha##me.info
  • DNS ASK ke##le.info
  • DNS ASK no##be.info
  • DNS ASK ty##ze.info
  • DNS ASK zy##we.info
  • DNS ASK di##ve.info
  • DNS ASK ke##wo.info
  • DNS ASK ha##qy.info
  • DNS ASK vi##dy.info
  • DNS ASK zy##ty.info
  • DNS ASK we##ry.info
  • DNS ASK pu##py.info
  • DNS ASK ty##cu.info
  • DNS ASK di##ny.info
  • DNS ASK pu##gu.info
  • DNS ASK no##my.info
  • DNS ASK xu##vu.info
  • DNS ASK ke##xu.info
  • DNS ASK we##ne.info
  • DNS ASK di##xy.info
  • DNS ASK ha##be.info
  • DNS ASK www.bing.com
  • DNS ASK no##ce.info
  • DNS ASK zy##me.info
  • DNS ASK xu##zy.info
  • DNS ASK ty##ky.info
  • DNS ASK ke##jy.info
  • DNS ASK ma##hy.info
  • DNS ASK go##fy.info
  • DNS ASK go##ku.info
  • DNS ASK zy##ji.info
  • DNS ASK no##di.info
  • DNS ASK pu##li.info
  • DNS ASK ma##vi.info
  • DNS ASK go##xi.info
  • DNS ASK ha##gi.info
  • DNS ASK ma##mo.info
  • DNS ASK xu##pi.info
  • DNS ASK ty##ri.info
  • DNS ASK we##hi.info
  • DNS ASK di##si.info
  • DNS ASK ha##pu.info
  • DNS ASK di##wu.info
  • DNS ASK zy##fu.info
  • DNS ASK ma##lu.info
  • DNS ASK vi##hu.info
  • DNS ASK we##su.info
  • DNS ASK ty##mi.info
  • DNS ASK vi##zi.info
  • DNS ASK ke##bi.info
  • DNS ASK no##tu.info
  • DNS ASK xu##qu.info
Miscellaneous:
Searches for the following windows:
  • ClassName: 'javax.swing.JFrame' WindowName: 'Login Dispositivo'
  • ClassName: 'javax.swing.JFrame' WindowName: 'Identificazione Utente'
  • ClassName: 'javax.swing.JFrame' WindowName: 'Modifica del PIN'
  • ClassName: 'SunAwtFrame' WindowName: 'Modifica del PIN'
  • ClassName: 'SunAwtFrame' WindowName: 'Sblocco del PIN'
  • ClassName: 'javax.swing.JFrame' WindowName: 'Scelta e Login dispositivo'
  • ClassName: 'javax.swing.JFrame' WindowName: 'Sblocco del PIN'
  • ClassName: 'SunAwtDialog' WindowName: 'Modifica del PIN'
  • ClassName: 'SunAwtDialog' WindowName: 'Sblocco del PIN'
  • ClassName: 'Indicator' WindowName: ''
  • ClassName: 'SunAwtDialog' WindowName: 'Scelta e Login dispositivo'
  • ClassName: 'SunAwtDialog' WindowName: 'Login Dispositivo'
  • ClassName: 'SunAwtDialog' WindowName: 'Identificazione Utente'
  • ClassName: 'SunAwtFrame' WindowName: 'Identificazione Utente'
  • ClassName: 'SunAwtFrame' WindowName: '??i? ? ???????'
  • ClassName: 'javax.swing.JFrame' WindowName: '???? ? ???????'
  • ClassName: 'javax.swing.JFrame' WindowName: 'Welcome'
  • ClassName: 'SunAwtFrame' WindowName: '???? ? ???????'
  • ClassName: 'SunAwtFrame' WindowName: 'Welcome'
  • ClassName: 'SunAwtFrame' WindowName: '????????????? ? ??????'
  • ClassName: 'javax.swing.JFrame' WindowName: '??i? ? ???????'
  • ClassName: 'SunAwtDialog' WindowName: '??i? ? ???????'
  • ClassName: 'SunAwtFrame' WindowName: 'Scelta e Login dispositivo'
  • ClassName: 'SunAwtFrame' WindowName: 'Login Dispositivo'
  • ClassName: 'SunAwtDialog' WindowName: 'Synchronization with bank'
  • ClassName: 'SunAwtDialog' WindowName: '???? ? ???????'
  • ClassName: 'SunAwtDialog' WindowName: '????????????? ? ??????'

Recommandations pour le traitement

  1. Si le système d'exploitation peut être démarré (en mode normal ou en mode sans échec), téléchargez Dr.Web Security Space et lancez un scan complet de votre ordinateur et de tous les supports amovibles que vous utilisez. En savoir plus sur Dr.Web Security Space.
  2. Si le démarrage du système d'exploitation est impossible, veuillez modifier les paramètres du BIOS de votre ordinateur pour démarrer votre ordinateur via CD/DVD ou clé USB. Téléchargez l'image du disque de secours de restauration du système Dr.Web® LiveDisk ou l'utilitaire pour enregistrer Dr.Web® LiveDisk sur une clé USB, puis préparez la clé USB appropriée. Démarrez l'ordinateur à l'aide de cette clé et lancez le scan complet et le traitement des menaces détectées.

Veuillez lancer le scan complet du système à l'aide de Dr.Web Antivirus pour Mac OS.

Veuillez lancer le scan complet de toutes les partitions du disque à l'aide de Dr.Web Antivirus pour Linux.

  1. Si votre appareil mobile fonctionne correctement, veuillez télécharger et installer sur votre appareil mobile Dr.Web pour Android. Lancez un scan complet et suivez les recommandations sur la neutralisation des menaces détectées.
  2. Si l'appareil mobile est bloqué par le Trojan de la famille Android.Locker (un message sur la violation grave de la loi ou la demande d'une rançon est affiché sur l'écran de l'appareil mobile), procédez comme suit:
    • démarrez votre Smartphone ou votre tablette en mode sans échec (si vous ne savez pas comment faire, consultez la documentation de l'appareil mobile ou contactez le fabricant) ;
    • puis téléchargez et installez sur votre appareil mobile Dr.Web pour Android et lancez un scan complet puis suivez les recommandations sur la neutralisation des menaces détectées ;
    • Débranchez votre appareil et rebranchez-le.

En savoir plus sur Dr.Web pour Android