ПОЛЬЗОВАТЕЛЯМ

Закрыть

Поиск

Поиск

Поддержка
Круглосуточная поддержка

Напишите

Запрос через форму

Позвоните

Бесплатно по России:
8-800-333-79-32

ЧаВо | Форум

Напишите

Задать вопрос в поддержку

Ваши запросы

  • Все: -
  • Незакрытые: -
  • Последний: -

Позвоните

Бесплатно по России:
8-800-333-79-32

Свяжитесь с нами Незакрытые запросы: 

Профиль

Профиль

BY

RU CN EN ES FR IT JP KZ UZ BY ID
Закрыть
Сервисы
Сканеры
Dr.Web vxCube
Демо
Вирусная библиотека
База знаний

Технологии

Термины

Обучение и просвещение

Мифы

Новости

Trojan.Siggen13.1256

Добавлен в вирусную базу Dr.Web: 2021-04-04

Описание добавлено:

Technical Information

To ensure autorun and distribution
Modifies the following registry keys
  • [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'kxesc' = '"%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxetray.exe" -autorun'
Sets the following service settings
  • [<HKLM>\System\CurrentControlSet\Services\kxescore] 'Start' = '00000002'
  • [<HKLM>\System\CurrentControlSet\Services\kxescore] 'ImagePath' = '"%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxescore.exe" /service kxescore'
  • [<HKLM>\System\CurrentControlSet\Services\kisknl] 'Start' = '00000002'
  • [<HKLM>\System\CurrentControlSet\Services\kisknl] 'ImagePath' = '<DRIVERS>\kisknl.sys'
  • [<HKLM>\SYSTEM\ControlSet001\services\kisknl] 'ImagePath' = '<DRIVERS>\kisknl.sys'
  • [<HKLM>\SYSTEM\ControlSet001\services\kisknl] 'Start' = '00000002'
  • [<HKLM>\SYSTEM\ControlSet002\services\kisknl] 'ImagePath' = '<DRIVERS>\kisknl.sys'
  • [<HKLM>\SYSTEM\ControlSet002\services\kisknl] 'Start' = '00000002'
  • [<HKLM>\System\CurrentControlSet\Services\kisnetm] 'Start' = '00000001'
  • [<HKLM>\System\CurrentControlSet\Services\kisnetm] 'ImagePath' = '%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\ksnetm\kisnetm64.sys'
  • [<HKLM>\System\CurrentControlSet\Services\ksapi64] 'Start' = '00000002'
  • [<HKLM>\System\CurrentControlSet\Services\ksapi64] 'ImagePath' = '<DRIVERS>\ksapi64.sys'
Creates the following services
  • 'kxescore' "%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxescore.exe" /service kxescore
  • 'kisknl' <DRIVERS>\kisknl.sys
  • 'kisnetm' %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\ksnetm\kisnetm64.sys
  • 'ksapi64' <DRIVERS>\ksapi64.sys
Malicious functions
Registers file system filter
  • [<HKLM>\System\CurrentControlSet\Services\kisknl] 'Group' = 'FSFilter Anti-Virus'
  • [<HKLM>\System\CurrentControlSet\Services\ksapi64] 'Group' = 'FSFilter Anti-Virus'
Modifies file system
Creates the following files
  • %ProgramFiles%\duba_3_133.exe
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kfcuploadinfo.dat-journal
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\floatskin\user.ini
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kfloatwin.log
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\floatwinsetting.ini
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxetray.log
  • %ALLUSERSPROFILE%\kingsoft\kis\hg.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kws_init.log
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kislive.log
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\desktop.ini
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kfcdetect.dll.log
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kfcuploadinfo.dat
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\金山毒霸\访问金山公司网站\金山毒霸官方社区.lnk
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\金山毒霸\访问金山公司网站\金山毒霸官方微博.lnk
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\金山毒霸\日志查看器.lnk
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\金山毒霸\病毒隔离系统.lnk
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\金山毒霸\卸载金山毒霸.lnk
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\金山毒霸\在线升级.lnk
  • %ProgramFiles%\360se_nanaxt9.exe
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\金山毒霸\金山毒霸.lnk
  • C:\users\public\desktop\金山毒霸.lnk
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\金山毒霸\访问金山公司网站\金山公司主页.lnk
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kislive.exe
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kfc_dps.dat-journal
  • %ALLUSERSPROFILE%\kingsoft\kis\kich\3060-d97feb43-606a7c1b-ef.ich
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\update\chupgrade.ini
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\update\kav\indexdata.txt
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\update\kav\indexdata.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\poplog.db
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\poplog.db-journal
  • %ALLUSERSPROFILE%\kingsoft\kis\kich\1038-53e237a5-606a7c1a-333.ich
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\option.ini
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\webui\icon\btbg.gif
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\fdsdcache.db
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\fdsdcache.db-journal
  • %ALLUSERSPROFILE%\kingsoft\kis\kws\dfcache.dat
  • %ALLUSERSPROFILE%\kingsoft\ksbw\kns2.che
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\bootoptcfg.ini
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\floatskin\shrink_skin_history.ini
  • %ALLUSERSPROFILE%\kingsoft\kis\kws\urlcache.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\ksbwdet2.dll.log
  • %ALLUSERSPROFILE%\kingsoft\kis\kich\1942-2a5afbb3-606a7c0f-37.ich
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kfc_hfps.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kfc_hfps.dat-journal
  • %ALLUSERSPROFILE%\kingsoft\kis\kich\1942-538418b3-606a7c0f-18.ich
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxescore.exe
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\金山毒霸\访问金山公司网站\金山毒霸网站.lnk
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxetray.exe
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ressrc\chs\extendimg\5.png
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\kxesetting.dat
  • %ALLUSERSPROFILE%\kingsoft\kis\kich\3050-56ce3483-606a7c1b-fe.ich
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\netbuyprot.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\msvcr80.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\msvcp80.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\lblocker.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\lbhelper.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kxesansp.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxereg.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxecore\kxecore.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxebscsp.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxebase.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kwsui64.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kwsui.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kwssp.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kupdatesp.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ktrashscan.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ktoolupd.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ksysopteng.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kswscxex.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kswebshield.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kstools.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\scom.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kfc_dps.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\wfs.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\zlib1.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\bc.sys
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ressrc\chs\extendimg\3.jpg
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ressrc\chs\extendimg\2.jpg
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ressrc\chs\extendimg\1.jpg
  • <DRIVERS>\ksskrpr.sys
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\ksskrpr.sys
  • <DRIVERS>\ksapi64.sys
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ksapi64.sys
  • <DRIVERS>\ksapi.sys
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ksapi.sys
  • <DRIVERS>\kisnetmxp.sys
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\ksnetm\kisnetmxp.sys
  • <DRIVERS>\kisnetm64.sys
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\ksnetm\kisnetm64.sys
  • <DRIVERS>\kisnetm.sys
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\ksnetm\kisnetm.sys
  • <DRIVERS>\kisknl64.sys
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\ksde\kisknl64.sys
  • <DRIVERS>\kisknl.sys
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\ksde\kisknl.sys
  • <DRIVERS>\bc.sys
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ressrc\chs\extendimg\4.png
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\whiteurl.dat
  • %ALLUSERSPROFILE%\kingsoft\kis\kich\1287-81d7d4f7-606a7c1b-13d.ich
  • %ALLUSERSPROFILE%\kingsoft\ksbw\temp\data.fsg
  • %ALLUSERSPROFILE%\kingsoft\ksbw\temp\conf.ini
  • %ALLUSERSPROFILE%\kingsoft\kfc\temp\kuzd931.tmp
  • %ALLUSERSPROFILE%\kingsoft\ksbw\temp\fsgd6fe.tmp
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\ksde\progrule.dat
  • %ALLUSERSPROFILE%\kingsoft\kfc\temp\kdld680.tmp
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\ksde\progrule.dat-journal
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\ksde\ksuset.db
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\ksde\ksuset.db-journal
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\fileuploadinfo.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\fileuploadinfo.dat-journal
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\quarantine.count
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\ksecachecfg.ini
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kfloatmain.log
  • %WINDIR%\temp\uddd1e1.tmp
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\switch.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ktool_update\kdownload\kav\xlmodule\download\download_engine.dll.z
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\update\kav\kav\index.txt
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ktool_update\kdownload\kav\xlmodule\download\dl_peer_id.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ktool_update\kdownload\kav\xlmodule\download\dl_peer_id.dll.z
  • %ALLUSERSPROFILE%\kingsoft\ksbw\ksbwctrl2_1.che
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\deflist.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ktool_update\kdownload\kav\xlmodule\download\atl71.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\ksscore.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ktool_update\kdownload\kav\xlmodule\download\atl71.dll.z
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ktool_update\kdownload\kav\data\ksoft_category.dat.z
  • %ALLUSERSPROFILE%\kingsoft\kfc\kfcwsign.dat
  • %ALLUSERSPROFILE%\kingsoft\kfc\kfcwsign.dat-journal
  • %ALLUSERSPROFILE%\kingsoft\kfc\kfcbase.dat
  • %ALLUSERSPROFILE%\kingsoft\kfc\kfcbase.dat-journal
  • %ALLUSERSPROFILE%\kingsoft\kis\kich\2285-598a90b8-606a7c2a-30a.ich
  • %ALLUSERSPROFILE%\kingsoft\kis\kich\2285-c578abd6-606a7c2a-29d.ich
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ktool_update\kdownload\kav\xlmodule\download\id.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ktool_update\kdownload\kav\xlmodule\download\id.dat.z
  • %ALLUSERSPROFILE%\kingsoft\ksbw\temp\kate2b7.tmp
  • %ALLUSERSPROFILE%\kingsoft\ksbw\temp\fsfe287.tmp
  • %ALLUSERSPROFILE%\kingsoft\ksbw\temp\fsfe074.tmp
  • %ALLUSERSPROFILE%\kingsoft\ksbw\ksbw_wib.fsg
  • %ALLUSERSPROFILE%\kingsoft\ksbw\temp\ksbw_apptype_cfg
  • %ALLUSERSPROFILE%\kingsoft\ksbw\temp\fsfe035.tmp
  • %ALLUSERSPROFILE%\kingsoft\ksbw\temp\fsfda89.tmp
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ktool_update\kdownload\kav\xlmodule\download\download_engine.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\softreport.ini
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\ksde\ksantiloaddll.ini
  • %ALLUSERSPROFILE%\kingsoft\kis\kich\514-cef36ffe-606a7c28-38a.ich
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\leakreinforce.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\log\deflog.db-journal
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\log\klengine.log
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\sqlite.dll
  • %ALLUSERSPROFILE%\kingsoft\ksbw\ksbwbase.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\log\defmsg.log
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\krcmdtool.dll.rcmdtmp
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\procinfo.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\autoflux.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\urlmon.cfg
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\ksde\deconfig.ini
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\log\ksdectrl_trace.log
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\update\kav\indexkav.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ktool_update\kdownload\kav\index.txt
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\expand_rule.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\rule.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ktool_update\kdownload\kav\index.dat
  • %TEMP%\kantivirus\kresult.log
  • %ALLUSERSPROFILE%\kingsoft\kis\installtimecfg.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\krcmdmon\updatebin.xml
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\ksysoptak47_tmp.dat_t
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ktool_update\kdownload\indexkav.txt
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ktool_update\kdownload\indexkav.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\update\kav\data\index.txt
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\update\kav\data\index.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\bdmisc.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\fluxstastic.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\update\kav\kav\index.dat
  • %ALLUSERSPROFILE%\kingsoft\kis\kich\1877-2fd01c72-606a7c1c-275.ich
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\fluxcache.dat
  • %ALLUSERSPROFILE%\kingsoft\ksbw\ksbwbase.dat-journal
  • %ALLUSERSPROFILE%\kingsoft\ksbw\ksbwfile.dat
  • %ALLUSERSPROFILE%\kingsoft\ksbw\ksbwfile.dat-journal
  • %ALLUSERSPROFILE%\kingsoft\ksbw\ksbwlog3.dat
  • %ALLUSERSPROFILE%\kingsoft\ksbw\ksbwlog3.dat-journal
  • %ALLUSERSPROFILE%\kingsoft\ksbw\ksbwlog.dat
  • %ALLUSERSPROFILE%\kingsoft\ksbw\ksbwlog.dat-journal
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxescore.exe.0.log
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kse_wfsdata\01c45e18_wfsexa1.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kse_wfsdata\01c45e18_wfsexa1.dat-journal
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kse_wfsdata\01c45e18_wfsexa0.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kse_wfsdata\01c45e18_wfsexa0.dat-journal
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kseexf.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\ksepnf.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kseset.dat
  • %WINDIR%\temp\uddc38e.tmp
  • %WINDIR%\temp\uddc35e.tmp
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ktool_update\kdownload\kav\ksoftmgrindex.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ktool_update\kdownload\kav\ksoftmgrindex.dat.z
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\startupbrowser.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\log\ksdecs_trace.log
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\update\kav\indexkav.txt
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\log\kmctrl_trace.log
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\ksreng3.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kspupwnd.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kskinmgr.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\microsoft.vc80.mfc.manifest
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ressrc\chs\kdock.ini
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ressrc\chs\kcommon.ini
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kae\kaecore.ini
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\installdk.ini
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\ksde\deheurcfg.ini
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\floatskin\config.ini
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\broplugver.ini
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ressrc\chs\web\kingsoft_weibo.htm
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ressrc\chs\web\kingsoft_main.htm
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ressrc\chs\web\kingsoft_duba.htm
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ressrc\chs\web\kingsoft_bbs.htm
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ressrc\chs\weatherconfig.xml
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\speedtest.xml
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\scom.xml
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ksoft.xml
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\install.xml
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ressrc\chs\game.xml
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ressrc\chs\forecastmsg.xml
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\clear.xml
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ressrc\chs\citys.xml
  • %TEMP%\kantivirus\~13427c\install_res\200.bmp
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ressrc\chs\kismain.ini
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\ksbwdt.ini
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\ksecfg.ini
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ksedset.ini
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ressrc\chs\delaydownloader.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\config3a.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\cleanlist.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\bredirect.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\recommendctrl.config
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\liectrl.config
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\cloudctrl.config
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\bro.cfg
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxetray.exe.bak
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxescore.exe.bak
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kislive.exe.bak
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\vinfo.ini
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\uninstall\uninstallcfg.ini
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\signs.ini
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\floatskin\shrink_skin_config.ini
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\quarantine.ini
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ressrc\chs\push_msg_city_list.ini
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\ksscfgx.ini
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kshmpg.ini
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\ksedset.ini
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\deswitch.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ktool_update\kdownload\kav\data\ksoft_category.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\fnsign.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\duba123ienew.ico
  • %TEMP%\kantivirus\~13427c\install_res\504.png
  • %TEMP%\kantivirus\~13427c\install_res\515.png
  • %TEMP%\kantivirus\~13427c\install_res\514.png
  • %TEMP%\kantivirus\~13427c\install_res\512.png
  • %TEMP%\kantivirus\~13427c\install_res\511.png
  • %TEMP%\kantivirus\~13427c\install_res\510.png
  • %TEMP%\kantivirus\~13427c\install_res\509.png
  • %TEMP%\kantivirus\~13427c\install_res\508.png
  • %TEMP%\kantivirus\~13427c\install_res\507.png
  • %TEMP%\kantivirus\~13427c\install_res\506.png
  • %TEMP%\kantivirus\~13427c\install_res\503.png
  • %TEMP%\kantivirus\~13427c\install_res\517.png
  • %TEMP%\kantivirus\~13427c\install_res\502.png
  • %TEMP%\kantivirus\~13427c\install_res\501.png
  • %TEMP%\kantivirus\~13427c\install_res\5.png
  • %TEMP%\kantivirus\~13427c\install_res\4.png
  • %TEMP%\kantivirus\~13427c\install_res\110.png
  • %TEMP%\kantivirus\~13427c\install_res\3.jpg
  • %TEMP%\kantivirus\~13427c\install_res\2.jpg
  • %TEMP%\kantivirus\~13427c\install_res\1.jpg
  • %TEMP%\kantivirus\kavsetup.log
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\duba123new.ico
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\microsoft.vc80.crt.manifest
  • %TEMP%\kantivirus\~13427c\install_res\518.png
  • %TEMP%\kantivirus\~13427c\clear_i.xml
  • %TEMP%\kantivirus\~13427c\install_res\516.png
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\duba123ie.ico
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\duba123.ico
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\floatskin\skinicon\wendujishrink_skin_img.png
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\uninstall\trash_scan.png
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\floatskin\skinicon\tianshizhiyi_skin_img.png
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\uninstall\start_acc.png
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\uninstall\scan_virus.png
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\uninstall\reinstall_duba.png
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\uninstall\pop.png
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\uninstall\lockpage.png
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\floatskin\skinicon\kongqizhiliang_skin_img.png
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\floatskin\skinicon\jijian_skin_img.png
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\uninstall\forbidmobile.png
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\floatskin\skinicon\dudubao_skin_img.png
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\floatskin\skinicon\defaultshrink_skin_img.png
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\uninstall\computer_doctor.png
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\uninstall\computer_acc.png
  • %TEMP%\kantivirus\~13427c\setup.xml
  • %TEMP%\kantivirus\~13427c\product.xml
  • %TEMP%\kantivirus\~13427c\ksoft.xml
  • %TEMP%\kantivirus\~13427c\install_res\201.bmp
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\log\deflog.db
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\gamesdb_dc_mini.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kae\kaearcha.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\operation\cas\kinfoc.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\khistory.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\khandler.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kfloatwin.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kfloatmain.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kfcdetect.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\keasyipcn.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kdgui2.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kdefendpop.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kclearpanel.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kcctrl.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kavquara.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kavmenu64.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kavmenu.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kavevent.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\jsonv6.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\defendmon.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\uni0nst.exe
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kwsprotect64.exe
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kupdata.exe
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kslaunch.exe
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\inject.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ksetupwiz.exe
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kscan.exe
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\ksde\klengine.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kisfdpro64.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kshmpgext.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kshmpg.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kseutil.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\ksesscan.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kseescan.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ksdectrl.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\ksde\ksdecs.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kscanner.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\ksbwdet2.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ksapi64.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ksapi.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ks3rdhmpg64.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ks3rdhmpg.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\krcmdutils.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kpopsvr.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kpopclt.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kpassport.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\knetworkpanel.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\ksnetm\kmonstat.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\ksde\kmctrl.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kismain.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\kaccclear.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\ksde\kislog.dll
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\khistory.ini
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\softicon.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\se.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\safeurl.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\productinfo.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\netmodeconfig.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\netbank.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\lpolicy.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kwsu.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kwnp.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\ksfilter.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\config\ksesysfiles.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\krcmddb.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kqsccfg.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kpretend.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\kpld.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\kplc.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kdh.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\operation\cas\kctrl.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kae\karchive.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kae\kaecore.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kae\kaearchb.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kdrvmgr.exe
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\krecycle.exe
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kismain.exe
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\operation\cas\kfmt.datx
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ressrc\chs\upcfg.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kdf.exe
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kcleaner.exe
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kavlog2.exe
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxescore_sp.xcf
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ressrc\chs\uplive.svr
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\floatskin\wenduji.skin
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\floatskin\tianshizhiyi.skin
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\floatskin\kongqizhiliang.skin
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\floatskin\jijian.skin
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\floatskin\dudubao.skin
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\sp3a.nlb
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\rule.krf
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\krmcdm.krf
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\denyip.krf
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxeksgpid.kid
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kwifitool.kid
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kvmpid2.kid
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\khackfix.kid
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kcommonpid.kid
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kavpid.kid
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\winesystem001.dat
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\ktool_update\kdownload\kav\ksoftmgr.exe.z
Deletes the following files
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kislive.exe.bak
  • %TEMP%\kantivirus\~13427c\install_res\516.png
  • %TEMP%\kantivirus\~13427c\install_res\517.png
  • %TEMP%\kantivirus\~13427c\install_res\518.png
  • %TEMP%\kantivirus\~13427c\ksoft.xml
  • %WINDIR%\temp\uddc35e.tmp
  • %WINDIR%\temp\uddc38e.tmp
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kse_wfsdata\01c45e18_wfsexa0.dat-journal
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kse_wfsdata\01c45e18_wfsexa1.dat-journal
  • %ALLUSERSPROFILE%\kingsoft\ksbw\ksbwlog.dat-journal
  • %ALLUSERSPROFILE%\kingsoft\ksbw\ksbwlog3.dat-journal
  • %ALLUSERSPROFILE%\kingsoft\ksbw\ksbwfile.dat-journal
  • %ALLUSERSPROFILE%\kingsoft\ksbw\ksbwbase.dat-journal
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\fileuploadinfo.dat-journal
  • %ALLUSERSPROFILE%\kingsoft\kfc\kfcwsign.dat-journal
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\ksde\ksuset.db-journal
  • %ALLUSERSPROFILE%\kingsoft\kfc\temp\kdld680.tmp
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\ksde\progrule.dat-journal
  • %ALLUSERSPROFILE%\kingsoft\ksbw\temp\fsgd6fe.tmp
  • %ALLUSERSPROFILE%\kingsoft\ksbw\temp\conf.ini
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\log\deflog.db-journal
  • %ALLUSERSPROFILE%\kingsoft\ksbw\temp\fsfda89.tmp
  • %ALLUSERSPROFILE%\kingsoft\ksbw\temp\fsfe035.tmp
  • %ALLUSERSPROFILE%\kingsoft\ksbw\temp\ksbw_apptype_cfg
  • %ALLUSERSPROFILE%\kingsoft\ksbw\temp\fsfe074.tmp
  • %ALLUSERSPROFILE%\kingsoft\ksbw\temp\fsfe287.tmp
  • %ALLUSERSPROFILE%\kingsoft\kfc\kfcbase.dat-journal
  • %TEMP%\kantivirus\~13427c\install_res\515.png
  • %WINDIR%\temp\uddd1e1.tmp
  • %TEMP%\kantivirus\~13427c\install_res\514.png
  • %TEMP%\kantivirus\~13427c\install_res\200.bmp
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxetray.exe.bak
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxescore.exe.bak
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kfcuploadinfo.dat-journal
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kfc_dps.dat-journal
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kfc_hfps.dat-journal
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\fdsdcache.db-journal
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\poplog.db-journal
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kwifitool.kid
  • %TEMP%\kantivirus\~13427c\clear_i.xml
  • %TEMP%\kantivirus\~13427c\install_res\1.jpg
  • %TEMP%\kantivirus\~13427c\install_res\110.png
  • %TEMP%\kantivirus\~13427c\install_res\2.jpg
  • %TEMP%\kantivirus\~13427c\install_res\201.bmp
  • %TEMP%\kantivirus\~13427c\install_res\511.png
  • %TEMP%\kantivirus\~13427c\install_res\3.jpg
  • %TEMP%\kantivirus\~13427c\install_res\4.png
  • %TEMP%\kantivirus\~13427c\install_res\5.png
  • %TEMP%\kantivirus\~13427c\install_res\501.png
  • %TEMP%\kantivirus\~13427c\install_res\502.png
  • %TEMP%\kantivirus\~13427c\install_res\503.png
  • %TEMP%\kantivirus\~13427c\install_res\504.png
  • %TEMP%\kantivirus\~13427c\install_res\506.png
  • %TEMP%\kantivirus\~13427c\install_res\507.png
  • %TEMP%\kantivirus\~13427c\install_res\508.png
  • %TEMP%\kantivirus\~13427c\install_res\509.png
  • %TEMP%\kantivirus\~13427c\install_res\510.png
  • %TEMP%\kantivirus\~13427c\install_res\512.png
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\ksysoptak47_tmp.dat
Moves the following files
  • from %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\ksysoptak47_tmp.dat_t to %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\ksysoptak47_tmp.dat
  • from <DRIVERS>\kisknl.sys to <DRIVERS>\kisknl_del.sys
  • from %ALLUSERSPROFILE%\kingsoft\kfc\temp\kuzd931.tmp to %ALLUSERSPROFILE%\kingsoft\kfc\kfcdyncfg.ini
  • from %ALLUSERSPROFILE%\kingsoft\ksbw\temp\data.fsg to %ALLUSERSPROFILE%\kingsoft\ksbw\ksbw_wi.fsg
  • from %ALLUSERSPROFILE%\kingsoft\ksbw\temp\kate2b7.tmp to %ALLUSERSPROFILE%\kingsoft\ksbw\ksbw_appt.che
Substitutes the following files
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kfcuploadinfo.dat-journal
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\poplog.db-journal
  • <DRIVERS>\kisknl.sys
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kse_wfsdata\01c45e18_wfsexa0.dat-journal
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\kxescan\kse_wfsdata\01c45e18_wfsexa1.dat-journal
  • %ALLUSERSPROFILE%\kingsoft\ksbw\ksbwlog.dat-journal
  • %ALLUSERSPROFILE%\kingsoft\ksbw\ksbwfile.dat-journal
  • %ALLUSERSPROFILE%\kingsoft\ksbw\ksbwbase.dat-journal
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\security\ksde\progrule.dat-journal
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\log\deflog.db-journal
  • %ALLUSERSPROFILE%\kingsoft\kfc\kfcbase.dat-journal
  • %ProgramFiles(x86)%\kingsoft\kingsoft antivirus\data\ksysoptak47_tmp.dat
Network activity
Connects to
  • 'up####.zchon.net':80
  • 'kn###.#loud.duba.net':8080
  • 'fs###s.duba.net':80
  • 'dl.###.www.duba.net':80
  • 'b.###.pc120.com':80
  • 'cl####q.duba.net':80
  • 'cv.#uba.net':80
  • 'rc##.##p.ijinshan.com':80
  • '12#.#2.183.150':80
  • 'hu###.www.duba.net':80
  • '11#.#3.89.14':80
  • 'in###2.duba.net':80
  • '11#.#12.36.195':80
  • 'kn#.#uba.net':80
  • 'tj.####n.ijinshan.com':80
  • 'wq.###ud.duba.net':80
  • 'cu###.www.duba.net':80
  • '11#.#12.93.166':8080
  • 'rq.#####de.cloud.duba.net':80
  • 'in###0.duba.net':80
  • 'di#.##inshan.com':80
  • 'do##.#60safe.com':80
  • 'ct.#uba.net':80
  • 'cd###.www.duba.net':80
  • 'rq.###.cloud.duba.net':80
  • 'microsoft.com':80
TCP
HTTP GET requests
  • http://cu###.www.duba.net/kcs/kfsg/fsgs/kswfsign
  • http://11#.#3.89.14/
HTTP POST requests
  • http://ct.#uba.net/itid
  • http://tj.####n.ijinshan.com/c/
  • http://in###2.duba.net/c/
  • http://in###0.duba.net/c/
  • http://kn#.#uba.net/kns-query?12#####
  • http://kn###.##oud.duba.net:8080/kurl_query?13##### via kn###.#loud.duba.net
UDP
  • DNS ASK pc.##hqbw.com
  • DNS ASK rq.###.cloud.duba.net
  • DNS ASK fs###s.duba.net
  • DNS ASK pc##0.com
  • DNS ASK dl.###.www.duba.net
  • DNS ASK b.###.pc120.com
  • DNS ASK rc##.##p.ijinshan.com
  • DNS ASK hu###.www.duba.net
  • DNS ASK in###2.duba.net
  • DNS ASK kn#.#uba.net
  • DNS ASK cl####q.duba.net
  • DNS ASK tj.####n.ijinshan.com
  • DNS ASK ta##ao.com
  • DNS ASK cu###.www.duba.net
  • DNS ASK kn###.#loud.duba.net
  • DNS ASK cv.#uba.net
  • DNS ASK rq.#####de.cloud.duba.net
  • DNS ASK in###0.duba.net
  • DNS ASK di#.##inshan.com
  • DNS ASK do##.#60safe.com
  • DNS ASK ct.#uba.net
  • DNS ASK do##.zxcv12.net
  • DNS ASK cd###.www.duba.net
  • DNS ASK so##.kunjun.org
  • DNS ASK up####.zchon.net
  • DNS ASK wq.###ud.duba.net
  • DNS ASK microsoft.com
Miscellaneous
Searches for the following windows
  • ClassName: 'Progman' WindowName: 'Program Manager'
  • ClassName: 'SHELLDLL_DefView' WindowName: ''
  • ClassName: 'SysListView32' WindowName: 'FolderView'
  • ClassName: '' WindowName: '{677B9715-5692-49f6-979F-CD11EC963EFE}'
  • ClassName: '{677B9715-5692-49f6-979F-CD11EC963EFE}' WindowName: ''
  • ClassName: 'kingsoft antivirus package win' WindowName: '金山毒霸-安装向导'
Creates and executes the following
  • '%ProgramFiles%\duba_3_133.exe'
  • '%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kavlog2.exe' -install
  • '%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxetray.exe' /autorun /hidefloatwin /silentinstrcmd
  • '%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxescore.exe' /start kxescore
  • '%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kislive.exe' /autorun /std /skipcs3
  • '%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxescore.exe' /service kxescore
  • '%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kwsprotect64.exe' (null)
  • '%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kavlog2.exe' -install' (with hidden window)
  • '%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxetray.exe' /autorun /hidefloatwin /silentinstrcmd' (with hidden window)
  • '%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxescore.exe' /start kxescore' (with hidden window)
  • '%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kislive.exe' /autorun /std /skipcs3' (with hidden window)
  • '%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kwsprotect64.exe' (null)' (with hidden window)

Рекомендации по лечению

  1. В случае если операционная система способна загрузиться (в штатном режиме или режиме защиты от сбоев), скачайте лечащую утилиту Dr.Web CureIt! и выполните с ее помощью полную проверку вашего компьютера, а также используемых вами переносных носителей информации.
  2. Если загрузка операционной системы невозможна, измените настройки BIOS вашего компьютера, чтобы обеспечить возможность загрузки ПК с компакт-диска или USB-накопителя. Скачайте образ аварийного диска восстановления системы Dr.Web® LiveDisk или утилиту записи Dr.Web® LiveDisk на USB-накопитель, подготовьте соответствующий носитель. Загрузив компьютер с использованием данного носителя, выполните его полную проверку и лечение обнаруженных угроз.
Демо бесплатно

 

Скачать Dr.Web

По серийному номеру

Выполните полную проверку системы с использованием Антивируса Dr.Web Light для macOS. Данный продукт можно загрузить с официального сайта Apple App Store.

Демо бесплатно

 

Скачать Dr.Web

По серийному номеру

Скачать Dr.Web с Apple Store

На загруженной ОС выполните полную проверку всех дисковых разделов с использованием продукта Антивирус Dr.Web для Linux.

Демо бесплатно

 

Скачать Dr.Web

По серийному номеру

  1. Если мобильное устройство функционирует в штатном режиме, загрузите и установите на него бесплатный антивирусный продукт Dr.Web для Android Light. Выполните полную проверку системы и используйте рекомендации по нейтрализации обнаруженных угроз.
  2. Если мобильное устройство заблокировано троянцем-вымогателем семейства Android.Locker (на экране отображается обвинение в нарушении закона, требование выплаты определенной денежной суммы или иное сообщение, мешающее нормальной работе с устройством), выполните следующие действия:
    • загрузите свой смартфон или планшет в безопасном режиме (в зависимости от версии операционной системы и особенностей конкретного мобильного устройства эта процедура может быть выполнена различными способами; обратитесь за уточнением к инструкции, поставляемой вместе с приобретенным аппаратом, или напрямую к его производителю);
    • после активации безопасного режима установите на зараженное устройство бесплатный антивирусный продукт Dr.Web для Android Light и произведите полную проверку системы, выполнив рекомендации по нейтрализации обнаруженных угроз;
    • выключите устройство и включите его в обычном режиме.

Подробнее о Dr.Web для Android

Демо бесплатно на 14 дней

Выдаётся при установке

Скачать с сайта
Скачать с Google Play