Dr.Web Anti-virus - Innovative IT-Security Solutions
Global Sites
Russia (Headquarter)
Estonia Finland France Germany Greece Hungary Italy Iran Israel Japan Kazakhstan Lithuania Poland Portugal Slovakia Spain Taiwan Ukraine


Latest Released Update : (HKT) 2014-04-18 02:01
Virus Database Total Records : 5120563
Home About Dr.Web Products Downloads Purchase FAQ Contact Us  
Dr.Web Anti-virus Video Channel  

‹ How To Remove Virus "Trojan.DownLoader9.21863" ›

Technical Information
Virus Name : Trojan.DownLoader9.21863
Named By : Dr.Web

To ensure autorun and distribution:
Modifies the following registry keys:
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ctfmon32.exe' = '%ALLUSERSPROFILE%\Application Data\rundll32.exe %ALLUSERSPROFILE%\Application Data\vjje0.dat,XFG00'
Creates or modifies the following files:
  • %HOMEPATH%\Start Menu\Programs\Startup\regmonstd.lnk
Malicious functions:
Creates and executes the following:
  • '%ALLUSERSPROFILE%\Application Data\rundll32.exe' Data\rundll32.exe %ALLUSERSPROFILE%\Application Data\vjje0.dat,XFG03
  • '%ALLUSERSPROFILE%\Application Data\rundll32.exe' Data\rundll32.exe %ALLUSERSPROFILE%\Application Data\vjje0.dat,XFG04
  • '%ALLUSERSPROFILE%\Application Data\rundll32.exe' Data\rundll32.exe %ALLUSERSPROFILE%\Application Data\vjje0.dat,XFG06
  • '%ALLUSERSPROFILE%\Application Data\rundll32.exe' Data\rundll32.exe %ALLUSERSPROFILE%\Application Data\vjje0.dat,XFG00
  • '%ALLUSERSPROFILE%\Application Data\rundll32.exe' Data\rundll32.exe %ALLUSERSPROFILE%\Application Data\vjje0.dat,XFG01
  • '%ALLUSERSPROFILE%\Application Data\rundll32.exe' Data\rundll32.exe %ALLUSERSPROFILE%\Application Data\vjje0.dat,XFG02
Modifies settings of Windows Internet Explorer:
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '2500' = '00000003'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '2500' = '00000003'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2500' = '00000003'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '2500' = '00000003'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2500' = '00000003'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1609' = '00000000'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1609' = '00000000'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1609' = '00000000'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1609' = '00000000'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000000'
Modifies file system :
Creates the following files:
  • %ALLUSERSPROFILE%\Application Data\0ejjv.pad
  • %ALLUSERSPROFILE%\Application Data\0ejjv.js
  • %ALLUSERSPROFILE%\Application Data\rundll32.exe
  • %ALLUSERSPROFILE%\Application Data\vjje0.dat
Network activity:
Connects to:
  • '37.##9.53.169':80
Miscellaneous:
Searches for the following windows:
  • ClassName: 'MS_WebcheckMonitor' WindowName: ''
  • ClassName: 'Shell_TrayWnd' WindowName: ''
  • ClassName: 'MS_AutodialMonitor' WindowName: ''
  • ClassName: 'Indicator' WindowName: ''
  • ClassName: '' WindowName: ''
Please note : some of the characters are replaced with symbols in order to prevent improper access to malwares.


Steps to remove "Trojan.DownLoader9.21863" automatically
  • Download Dr.Web CureIt! and save it in desktop.
  • Download Security Space Pro 7.0 (32/64-bit), save it in desktop.
  • Reboot computer to Safe Mode (press F8 before any Microsoft logo appears).
  • Double click "cureit.exe" on desktop, follow on screen instructions to scan hard disk.
    (Wait patiently, it may take 20-60 minutes to perform an express scan.)
  • After scanning is done, select all viruses found and choose "Cure".
    (If some files are not suitable to be cured, choose "Quarantine" or "Delete".)
  • When all viruses found are cured, quarantined, or deleted, reboot to Normal Mode.
  • Uninstall existing anti-virus software which cannot kill the viruses, and then reboot again.
  • Locate the setup file of Security Space Pro on desktop, double click to run it.
    (For step-by-step procedures, please refer to installation video guide.)
  • During setup, choose to obtain a demo key.
  • After first time update, the scanner will be launched again, quit the scanner at this point.
  • Complete the setup by rebooting computer.
  • When time is allowed (may need several hours), perform a full scan in Dr.Web Scanner.

Note :
  • If it is unable to start Windows due to virus infection, try Dr.Web LiveCD or Dr.Web LiveUSB instead of Dr.Web CureIt!
  • Time needed for express scan or full scan relies on many factors, such as system performance, available memory, running processes, number of drives and files, etc.

‹ Dr.Web CureIt! › Select Download Source

Dr.Web Global Servers Google Drive SkyDrive
Released :
2013-11-10 14:43
Released :
2013-08-16 03:25
Released :
2013-11-10 14:43
Download Dr.Web CureIt! from Dr.Web Global Servers Download Dr.Web CureIt! from Google Drive Download Dr.Web CureIt! from SkyDrive

‹ Dr.Web Security Space Pro › Select Download Source

Dropbox Google Drive SkyDrive
Released :
2013-02-07 16:02
Released :
2013-02-07 16:02
Released :
2013-02-07 16:02
Download Dr.Web Security Space Pro from Dropbox Download Dr.Web Security Space Pro from Google Drive Download Dr.Web Security Space Pro from SkyDrive

WINDOWS 7, VISTA, XP
MAC OS X 10.4 OR ABOVE

TOP 5 EMAIL VIRUSES (24HR)
02:01
 
Trojan.PWS.Panda.6971
Trojan.PWS.Panda.6971
 
Trojan.Fraudster.778
Trojan.Fraudster.778
 
Win32.HLLM.MyDoom.33808
Win32.HLLM.MyDoom.33808
 
Trojan.Fogels.2
Trojan.Fogels.2
 
Win32.HLLM.MyDoom.54464
Win32.HLLM.MyDoom.54464

TOP 5 FILE VIRUSES (24HR)
02:01
 
SCRIPT.Virus
SCRIPT.Virus
 
Trojan.InstallMonster.51
Trojan.InstallMonster.51
 
Adware.Spigot.9
Adware.Spigot.9
 
Trojan.Packed.24524
Trojan.Packed.24524
 
JS.Redirector.194
JS.Redirector.194

FREE ANTI-VIRUS TOOLS
  » Dr.Web CureIt!
  » Dr.Web LiveCD
  » Dr.Web LiveUSB
  » Dr.Web Light for Mac OS X
  » LinkChecker for Google Chrome
  » LinkChecker for Internet Explorer
  » LinkChecker for Mozilla Firefox
  » LinkChecker for Opera
  » LinkChecker for Safari

Member of CHKCI

|

Click to Verify Domain Originator
:: Privacy Policy Statement ::