Dr.Web Anti-virus - Innovative IT-Security Solutions
Global Sites
Russia (Headquarter)
Estonia Finland France Germany Greece Hungary Italy Iran Israel Japan Kazakhstan Lithuania Poland Portugal Slovakia Spain Taiwan Ukraine


Latest Released Update : (HKT) 2014-04-21 03:31
Virus Database Total Records : 5134132
Home About Dr.Web Products Downloads Purchase FAQ Contact Us  
Dr.Web Anti-virus Video Channel  

‹ How To Remove Virus "Trojan.DownLoader8.16780" ›

Technical Information
Virus Name : Trojan.DownLoader8.16780
Named By : Dr.Web

To ensure autorun and distribution:
Modifies the following registry keys:
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'servieca.vbe' = '"%TEMP%\servieca.vbe"'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'servieca.vbe' = '"%TEMP%\servieca.vbe"'
Creates or modifies the following files:
  • %HOMEPATH%\Start Menu\Programs\Startup\servieca.vbe
Creates the following files on removable media:
  • <Drive name for removable media>:\servieca.vbe
Malicious functions:
Creates and executes the following:
  • %TEMP%\systema.exe
  • %TEMP%\systema.exe (downloaded from the Internet)
Executes the following:
  • <SYSTEM32>\wscript.exe "%TEMP%\install.vbe"
Modifies file system :
Creates the following files:
  • %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\systema[1].exe
  • %TEMP%\systema.exe
  • %TEMP%\install.vbe
  • %TEMP%\servieca.vbe
Sets the 'hidden' attribute to the following files:
  • <Drive name for removable media>:\servieca.vbe
Network activity:
Connects to:
  • 'www.da##k.com':80
  • 'localhost':1036
TCP:
HTTP GET requests:
  • www.da##k.com/aviatic/systema.exe
UDP:
  • DNS ASK www.da##k.com
Miscellaneous:
Searches for the following windows:
  • ClassName: 'Indicator' WindowName: ''
Please note : some of the characters are replaced with symbols in order to prevent improper access to malwares.


Steps to remove "Trojan.DownLoader8.16780" automatically
  • Download Dr.Web CureIt! and save it in desktop.
  • Download Security Space Pro 7.0 (32/64-bit), save it in desktop.
  • Reboot computer to Safe Mode (press F8 before any Microsoft logo appears).
  • Double click "cureit.exe" on desktop, follow on screen instructions to scan hard disk.
    (Wait patiently, it may take 20-60 minutes to perform an express scan.)
  • After scanning is done, select all viruses found and choose "Cure".
    (If some files are not suitable to be cured, choose "Quarantine" or "Delete".)
  • When all viruses found are cured, quarantined, or deleted, reboot to Normal Mode.
  • Uninstall existing anti-virus software which cannot kill the viruses, and then reboot again.
  • Locate the setup file of Security Space Pro on desktop, double click to run it.
    (For step-by-step procedures, please refer to installation video guide.)
  • During setup, choose to obtain a demo key.
  • After first time update, the scanner will be launched again, quit the scanner at this point.
  • Complete the setup by rebooting computer.
  • When time is allowed (may need several hours), perform a full scan in Dr.Web Scanner.

Note :
  • If it is unable to start Windows due to virus infection, try Dr.Web LiveCD or Dr.Web LiveUSB instead of Dr.Web CureIt!
  • Time needed for express scan or full scan relies on many factors, such as system performance, available memory, running processes, number of drives and files, etc.

‹ Dr.Web CureIt! › Select Download Source

Dr.Web Global Servers Google Drive SkyDrive
Released :
2013-11-10 14:43
Released :
2013-08-16 03:25
Released :
2013-11-10 14:43
Download Dr.Web CureIt! from Dr.Web Global Servers Download Dr.Web CureIt! from Google Drive Download Dr.Web CureIt! from SkyDrive

‹ Dr.Web Security Space Pro › Select Download Source

Dropbox Google Drive SkyDrive
Released :
2013-02-07 16:02
Released :
2013-02-07 16:02
Released :
2013-02-07 16:02
Download Dr.Web Security Space Pro from Dropbox Download Dr.Web Security Space Pro from Google Drive Download Dr.Web Security Space Pro from SkyDrive

WINDOWS 7, VISTA, XP
MAC OS X 10.4 OR ABOVE

TOP 5 EMAIL VIRUSES (24HR)
03:31
 
Trojan.Fraudster.778
Trojan.Fraudster.778
 
Win32.HLLM.MyDoom.33808
Win32.HLLM.MyDoom.33808
 
Win32.HLLM.MyDoom.54464
Win32.HLLM.MyDoom.54464
 
Win32.HLLM.Beagle
Win32.HLLM.Beagle
 
Trojan.PWS.Panda.2401
Trojan.PWS.Panda.2401

TOP 5 FILE VIRUSES (24HR)
03:31
 
SCRIPT.Virus
SCRIPT.Virus
 
Trojan.LoadMoney.257
Trojan.LoadMoney.257
 
Trojan.InstallMonster.51
Trojan.InstallMonster.51
 
Trojan.Packed.24524
Trojan.Packed.24524
 
Trojan.InstallMonster.120
Trojan.InstallMonster.120

FREE ANTI-VIRUS TOOLS
  » Dr.Web CureIt!
  » Dr.Web LiveCD
  » Dr.Web LiveUSB
  » Dr.Web Light for Mac OS X
  » LinkChecker for Google Chrome
  » LinkChecker for Internet Explorer
  » LinkChecker for Mozilla Firefox
  » LinkChecker for Opera
  » LinkChecker for Safari

Member of CHKCI

|

Click to Verify Domain Originator
:: Privacy Policy Statement ::