Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\setting[3].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\setting[3].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\setting[2].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\setting[2].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\setting[3].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\setting[4].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\setting[4].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\setting[3].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\setting[4].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\setting[2].ini
<SYSTEM32>\autorun.ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\setting[1].ini
<SYSTEM32>\chrome.exe
%WINDIR%\chrome.exe
<SYSTEM32>\_setting.ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\setting[1].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\setting[2].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\setting[1].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\setting[1].ini
Sets the 'hidden' attribute to the following files:
<Drive name for removable media>:\autorun.inf
<SYSTEM32>\autorun.ini
<SYSTEM32>\chrome.exe
Deletes the following files:
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\setting[3].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\setting[3].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\setting[3].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\setting[3].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\setting[4].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\setting[4].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\setting[4].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\setting[2].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\setting[1].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\setting[1].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\setting[1].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\setting[1].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\setting[2].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\setting[2].ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\setting[2].ini
Network activity:
Connects to:
'h1.##pway.com':80
'www.ha##um.info':80
TCP:
HTTP GET requests:
h1.##pway.com/sdb5/setting.ini
h1.##pway.com/sdb4/setting.ini
h1.##pway.com/sdb3/setting.ini
h1.##pway.com/sdb6/setting.ini
h1.##pway.com/sdb9/setting.ini
h1.##pway.com/sdb8/setting.ini
h1.##pway.com/sdb7/setting.ini
h1.##pway.com/sdb2/setting.ini
h1.##pway.com/poojasharma3/setting.ini
h1.##pway.com/poojasharma2/setting.ini
www.ha##um.info/setting.ini
h1.##pway.com/poojasharma4/setting.ini
h1.##pway.com/sdb1/setting.ini
h1.##pway.com/sdb0/setting.ini
h1.##pway.com/poojasharma5/setting.ini
UDP:
DNS ASK h1.##pway.com
DNS ASK www.ha##um.info
Miscellaneous:
Searches for the following windows:
ClassName: 'Indicator' WindowName: '(null)'
Scaricate Dr.Web per Android
Gratis per 3 mesi
Tutti i componenti di protezione
Rinnovo versione di prova tramite AppGallery/Google Pay
Continuando a utilizzare questo sito, l'utente acconsente al nostro utilizzo di file Cookie e di altre tecnologie per la raccolta di informazioni statistiche sui visitatori. Per maggiori informazioni