Trojan.Encoder.12158

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%HOMEPATH%\Start Menu\Programs\Startup\!READ.htm
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\!READ.htm

Creates the following files on removable media:

<Drive name for removable media>:\!READ.htm

Malicious functions:

Executes the following:

'<SYSTEM32>\ping.exe' -n 1 127.0.0.1
'<SYSTEM32>\cmd.exe' /c ping -n 1 127.0.0.1 & del /f "<Full path to file>"

Modifies file system:

Creates the following files:

C:\Far2\Plugins\WinSCP\putty\!READ.htm
C:\Far2\Plugins\WinSCP\putty\charset\!READ.htm
C:\Far2\Plugins\WinSCP\putty\windows\!READ.htm
C:\Far2\Plugins\WinSCP\packages\tb2k\!READ.htm
C:\Far2\Plugins\WinSCP\packages\tbx\!READ.htm
C:\Far2\Plugins\WinSCP\packages\theme\!READ.htm
C:\Far2\PluginSDK\!READ.htm
C:\Far2\PluginSDK\Headers.c\!READ.htm
C:\Far2\PluginSDK\Headers.pas\!READ.htm
C:\Far2\Plugins\WinSCP\release\!READ.htm
C:\Far2\Plugins\WinSCP\resource\!READ.htm
C:\Far2\Plugins\WinSCP\windows\!READ.htm
C:\Far2\Plugins\WinSCP\packages\my\!READ.htm
C:\Far2\Plugins\WinSCP\far\!READ.htm
C:\Far2\Plugins\WinSCP\fari\!READ.htm
C:\Far2\Plugins\WinSCP\filezilla\!READ.htm
C:\Far2\Plugins\WinSCP\console\!READ.htm
C:\Far2\Plugins\WinSCP\core\!READ.htm
C:\Far2\Plugins\WinSCP\dragext\!READ.htm
C:\Far2\Plugins\WinSCP\packages\!READ.htm
C:\Far2\Plugins\WinSCP\packages\dragndrop\!READ.htm
C:\Far2\Plugins\WinSCP\packages\filemng\!READ.htm
C:\Far2\Plugins\WinSCP\filezilla\misc\!READ.htm
C:\Far2\Plugins\WinSCP\forms\!READ.htm
C:\Far2\Plugins\WinSCP\lib\!READ.htm
<STUBS_DIR>\AVPM\!READ.htm
<STUBS_DIR>\AVSYNMGR\!READ.htm
<STUBS_DIR>\bankcl\!READ.htm
<STUBS_DIR>\AVP\!READ.htm
<STUBS_DIR>\AVP32\!READ.htm
<STUBS_DIR>\AVPCC\!READ.htm
<STUBS_DIR>\bdagent\!READ.htm
<STUBS_DIR>\bdss\!READ.htm
<STUBS_DIR>\bdsubmit\!READ.htm
<STUBS_DIR>\BBClient\!READ.htm
<STUBS_DIR>\bclient\!READ.htm
<STUBS_DIR>\bc_loader\!READ.htm
<STUBS_DIR>\AVGCTRL\!READ.htm
<STUBS_DIR>\!READ.htm
<STUBS_DIR>\360tray\!READ.htm
<STUBS_DIR>\ageofconan\!READ.htm
C:\Muldrop\!READ.htm
C:\RECYCLER\!READ.htm
C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\!READ.htm
<STUBS_DIR>\ashAvSrv\!READ.htm
<STUBS_DIR>\avgcc\!READ.htm
<STUBS_DIR>\AVGCC32\!READ.htm
<STUBS_DIR>\aion\!READ.htm
<STUBS_DIR>\ash\!READ.htm
<STUBS_DIR>\ashAvast\!READ.htm
C:\Far2\Plugins\!READ.htm
C:\Far2\Plugins\7-Zip\!READ.htm
C:\Far2\Plugins\Align\!READ.htm
C:\Far2\Documentation\rus\!READ.htm
C:\Far2\Encyclopedia\!READ.htm
C:\Far2\FExcept\!READ.htm
C:\Far2\Plugins\Colorer\!READ.htm
C:\Far2\Plugins\Colorer\bin\!READ.htm
C:\Far2\Plugins\Colorer\hrc\!READ.htm
C:\Far2\Plugins\arclite\!READ.htm
C:\Far2\Plugins\AutoWrap\!READ.htm
C:\Far2\Plugins\Brackets\!READ.htm
C:\Far2\Documentation\eng\!READ.htm
C:\Far2\Addons\Colors\!READ.htm
C:\Far2\Addons\Colors\Custom Highlighting\!READ.htm
C:\Far2\Addons\Colors\Default Highlighting\!READ.htm
%HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\!READ.htm
C:\Far2\!READ.htm
C:\Far2\Addons\!READ.htm
C:\Far2\Addons\XLat\!READ.htm
C:\Far2\Addons\XLat\Russian\!READ.htm
C:\Far2\Documentation\!READ.htm
C:\Far2\Addons\Macros\!READ.htm
C:\Far2\Addons\SetUp\!READ.htm
C:\Far2\Addons\Shell\!READ.htm
C:\Far2\Plugins\FTP\!READ.htm
C:\Far2\Plugins\FTP\lib\!READ.htm
C:\Far2\Plugins\HlfViewer\!READ.htm
C:\Far2\Plugins\ExtSearch\sources\RegExp\!READ.htm
C:\Far2\Plugins\FarCmds\!READ.htm
C:\Far2\Plugins\FileCase\!READ.htm
C:\Far2\Plugins\TmpPanel\!READ.htm
C:\Far2\Plugins\WinSCP\!READ.htm
C:\Far2\Plugins\WinSCP\components\!READ.htm
C:\Far2\Plugins\MacroView\!READ.htm
C:\Far2\Plugins\Network\!READ.htm
C:\Far2\Plugins\ProcList\!READ.htm
C:\Far2\Plugins\ExtSearch\sources\!READ.htm
C:\Far2\Plugins\Colorer\hrd\console\!READ.htm
C:\Far2\Plugins\Colorer\hrd\console\contrib\!READ.htm
C:\Far2\Plugins\Compare\!READ.htm
C:\Far2\Plugins\Colorer\hrc\auto\!READ.htm
C:\Far2\Plugins\Colorer\hrc\auto\types\!READ.htm
C:\Far2\Plugins\Colorer\hrd\!READ.htm
C:\Far2\Plugins\ExtSearch\!READ.htm
C:\Far2\Plugins\ExtSearch\doc\!READ.htm
C:\Far2\Plugins\ExtSearch\keys\!READ.htm
C:\Far2\Plugins\DrawLine\!READ.htm
C:\Far2\Plugins\EditCase\!READ.htm
C:\Far2\Plugins\EMenu\!READ.htm
<STUBS_DIR>\opera\!READ.htm
<STUBS_DIR>\outpost\!READ.htm
<STUBS_DIR>\pidgin\!READ.htm
<STUBS_DIR>\nod32\!READ.htm
<STUBS_DIR>\ntvdm\!READ.htm
<STUBS_DIR>\oncbcli\!READ.htm
<STUBS_DIR>\RagFree\!READ.htm
<STUBS_DIR>\rclient\!READ.htm
<STUBS_DIR>\safari\!READ.htm
<STUBS_DIR>\putty\!READ.htm
<STUBS_DIR>\qip\!READ.htm
<STUBS_DIR>\Ragexe\!READ.htm
<STUBS_DIR>\nod\!READ.htm
<STUBS_DIR>\maplestory\!READ.htm
<STUBS_DIR>\MCAGENT\!READ.htm
<STUBS_DIR>\Mir3Game\!READ.htm
<STUBS_DIR>\loadmain\!READ.htm
<STUBS_DIR>\lotroclient\!READ.htm
<STUBS_DIR>\magent\!READ.htm
<STUBS_DIR>\msnmsgr\!READ.htm
<STUBS_DIR>\NAVAPW32\!READ.htm
<STUBS_DIR>\netxray\!READ.htm
<STUBS_DIR>\miranda32\!READ.htm
<STUBS_DIR>\mpftray\!READ.htm
<STUBS_DIR>\msn6\!READ.htm
<STUBS_DIR>\wow\!READ.htm
<STUBS_DIR>\wsm\!READ.htm
<STUBS_DIR>\YahooMessenger\!READ.htm
<STUBS_DIR>\webmoney\!READ.htm
<STUBS_DIR>\winbaram\!READ.htm
<STUBS_DIR>\woool\!READ.htm
<STUBS_DIR>\ZONEALARM\!READ.htm
<STUBS_DIR>\ZZ__cd75efb816b2cc__\!READ.htm
<STUBS_DIR>\__cd75efb816b2cc__\!READ.htm
<STUBS_DIR>\ybclient\!READ.htm
<STUBS_DIR>\zapro\!READ.htm
<STUBS_DIR>\zlclient\!READ.htm
<STUBS_DIR>\wclnt\!READ.htm
<STUBS_DIR>\so3d\!READ.htm
<STUBS_DIR>\spidernt\!READ.htm
<STUBS_DIR>\sro_client\!READ.htm
<STUBS_DIR>\sgbclient\!READ.htm
<STUBS_DIR>\skype\!READ.htm
<STUBS_DIR>\smc\!READ.htm
<STUBS_DIR>\trillian\!READ.htm
<STUBS_DIR>\TwelveSky2\!READ.htm
<STUBS_DIR>\UniStream\!READ.htm
<STUBS_DIR>\startclient7\!READ.htm
<STUBS_DIR>\tiny\!READ.htm
<STUBS_DIR>\translink\!READ.htm
<STUBS_DIR>\Drweb32w\!READ.htm
<STUBS_DIR>\drweb386\!READ.htm
<STUBS_DIR>\Drwebupw\!READ.htm
<STUBS_DIR>\dekaron\!READ.htm
<STUBS_DIR>\dnf\!READ.htm
<STUBS_DIR>\drweb\!READ.htm
<STUBS_DIR>\ekrn\!READ.htm
<STUBS_DIR>\elbank\!READ.htm
<STUBS_DIR>\elementclient\!READ.htm
<STUBS_DIR>\Drwebwcl\!READ.htm
<STUBS_DIR>\ecmd\!READ.htm
<STUBS_DIR>\egni\!READ.htm
<STUBS_DIR>\contactNG\!READ.htm
<STUBS_DIR>\cbmain\!READ.htm
<STUBS_DIR>\cbsmain\!READ.htm
<STUBS_DIR>\ccapp\!READ.htm
<STUBS_DIR>\bk\!READ.htm
<STUBS_DIR>\cabalmain\!READ.htm
<STUBS_DIR>\cbank\!READ.htm
<STUBS_DIR>\client7\!READ.htm
<STUBS_DIR>\clmain\!READ.htm
<STUBS_DIR>\clntw32\!READ.htm
<STUBS_DIR>\chrome\!READ.htm
<STUBS_DIR>\ClamWin\!READ.htm
<STUBS_DIR>\clbank\!READ.htm
<STUBS_DIR>\InphaseNXD\!READ.htm
<STUBS_DIR>\intpro\!READ.htm
<STUBS_DIR>\iscc\!READ.htm
<STUBS_DIR>\ICQ\!READ.htm
<STUBS_DIR>\iexplore\!READ.htm
<STUBS_DIR>\inbank-start-ff\!READ.htm
<STUBS_DIR>\kb_cli\!READ.htm
<STUBS_DIR>\l2\!READ.htm
<STUBS_DIR>\lin\!READ.htm
<STUBS_DIR>\ISClient\!READ.htm
<STUBS_DIR>\java\!READ.htm
<STUBS_DIR>\javaw\!READ.htm
<STUBS_DIR>\httplook\!READ.htm
<STUBS_DIR>\fsav32\!READ.htm
<STUBS_DIR>\fsavaui\!READ.htm
<STUBS_DIR>\fsavgui\!READ.htm
<STUBS_DIR>\el_cli\!READ.htm
<STUBS_DIR>\firefox\!READ.htm
<STUBS_DIR>\fsav\!READ.htm
<STUBS_DIR>\GUARD\!READ.htm
<STUBS_DIR>\GVOnline\!READ.htm
<STUBS_DIR>\gw\!READ.htm
<STUBS_DIR>\gc\!READ.htm
<STUBS_DIR>\ge\!READ.htm
<STUBS_DIR>\googletalk\!READ.htm
C:\Documents and Settings\Default User\PrintHood\!READ.htm
C:\Documents and Settings\Default User\Recent\!READ.htm
C:\Documents and Settings\Default User\SendTo\!READ.htm
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\!READ.htm
C:\Documents and Settings\Default User\My Documents\!READ.htm
C:\Documents and Settings\Default User\NetHood\!READ.htm
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\!READ.htm
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\!READ.htm
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\!READ.htm
C:\Documents and Settings\Default User\Start Menu\!READ.htm
C:\Documents and Settings\Default User\Start Menu\Programs\!READ.htm
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\!READ.htm
C:\Documents and Settings\Default User\Local Settings\History\!READ.htm
C:\Documents and Settings\Default User\Cookies\!READ.htm
C:\Documents and Settings\Default User\Desktop\!READ.htm
C:\Documents and Settings\Default User\Favorites\!READ.htm
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\!READ.htm
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\!READ.htm
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\!READ.htm
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\!READ.htm
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\!READ.htm
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\!READ.htm
C:\Documents and Settings\Default User\Local Settings\!READ.htm
C:\Documents and Settings\Default User\Local Settings\Application Data\!READ.htm
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\!READ.htm
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\!READ.htm
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\!READ.htm
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\!READ.htm
C:\Documents and Settings\LocalService\Local Settings\!READ.htm
C:\Documents and Settings\LocalService\Local Settings\Application Data\!READ.htm
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\!READ.htm
C:\Documents and Settings\NetworkService\Application Data\!READ.htm
C:\Documents and Settings\NetworkService\Application Data\Microsoft\!READ.htm
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\!READ.htm
C:\Documents and Settings\LocalService\Local Settings\History\!READ.htm
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\!READ.htm
C:\Documents and Settings\NetworkService\!READ.htm
C:\Documents and Settings\LocalService\Cookies\!READ.htm
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\!READ.htm
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\!READ.htm
C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\!READ.htm
C:\Documents and Settings\LocalService\!READ.htm
C:\Documents and Settings\LocalService\Application Data\!READ.htm
C:\Documents and Settings\LocalService\Application Data\Microsoft\!READ.htm
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\!READ.htm
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\!READ.htm
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\!READ.htm
C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\!READ.htm
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\!READ.htm
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\!READ.htm
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\!READ.htm
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\!READ.htm
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Cm\!READ.htm
%ALLUSERSPROFILE%\Application Data\Microsoft\HTML Help\!READ.htm
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Index\!READ.htm
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Player\!READ.htm
%ALLUSERSPROFILE%\Desktop\!READ.htm
%ALLUSERSPROFILE%\Documents\!READ.htm
%ALLUSERSPROFILE%\Documents\My Music\!READ.htm
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Pbk\!READ.htm
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\!READ.htm
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\!READ.htm
%ALLUSERSPROFILE%\Application Data\Microsoft\Dr Watson\!READ.htm
%ALLUSERSPROFILE%\!READ.htm
%ALLUSERSPROFILE%\Application Data\!READ.htm
%ALLUSERSPROFILE%\Application Data\Microsoft\!READ.htm
C:\!READ.htm
<Current directory>\!READ.htm
C:\Documents and Settings\!READ.htm
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\!READ.htm
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\!READ.htm
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\!READ.htm
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\!READ.htm
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\!READ.htm
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\MachineKeys\!READ.htm
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\!READ.htm
%ALLUSERSPROFILE%\Start Menu\Programs\Games\!READ.htm
C:\Documents and Settings\Default User\!READ.htm
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\!READ.htm
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\!READ.htm
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\!READ.htm
C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\!READ.htm
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\!READ.htm
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\!READ.htm
C:\Documents and Settings\Default User\Application Data\!READ.htm
C:\Documents and Settings\Default User\Application Data\Microsoft\!READ.htm
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\!READ.htm
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\!READ.htm
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\!READ.htm
%ALLUSERSPROFILE%\Documents\My Pictures\!READ.htm
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\!READ.htm
%ALLUSERSPROFILE%\Documents\My Music\My Playlists\!READ.htm
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\!READ.htm
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\!READ.htm
%ALLUSERSPROFILE%\Start Menu\!READ.htm
%ALLUSERSPROFILE%\Start Menu\Programs\!READ.htm
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\!READ.htm
%ALLUSERSPROFILE%\Documents\My Videos\!READ.htm
%ALLUSERSPROFILE%\DRM\!READ.htm
%ALLUSERSPROFILE%\Favorites\!READ.htm
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\0\!READ.htm
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\1\!READ.htm
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\2\!READ.htm
<LS_APPDATA>\Mozilla\Firefox\Profiles\!READ.htm
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\!READ.htm
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\!READ.htm
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\6\!READ.htm
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\7\!READ.htm
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\8\!READ.htm
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\3\!READ.htm
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\4\!READ.htm
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\5\!READ.htm
<LS_APPDATA>\Mozilla\Firefox\!READ.htm
<LS_APPDATA>\Microsoft\!READ.htm
<LS_APPDATA>\Microsoft\CD Burning\!READ.htm
<LS_APPDATA>\Microsoft\Credentials\!READ.htm
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\!READ.htm
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\!READ.htm
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\!READ.htm
<LS_APPDATA>\Microsoft\Windows Media\!READ.htm
<LS_APPDATA>\Microsoft\Windows Media\9.0\!READ.htm
<LS_APPDATA>\Mozilla\!READ.htm
<LS_APPDATA>\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\!READ.htm
<LS_APPDATA>\Microsoft\Media Player\!READ.htm
<LS_APPDATA>\Microsoft\Windows\!READ.htm
%HOMEPATH%\My Documents\My Received Files\!READ.htm
%HOMEPATH%\NetHood\!READ.htm
%HOMEPATH%\PrintHood\!READ.htm
%HOMEPATH%\My Documents\Downloads\!READ.htm
%HOMEPATH%\My Documents\My Music\!READ.htm
%HOMEPATH%\My Documents\My Pictures\!READ.htm
%HOMEPATH%\Start Menu\Programs\!READ.htm
%HOMEPATH%\Start Menu\Programs\Accessories\!READ.htm
%HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\!READ.htm
%HOMEPATH%\Recent\!READ.htm
%HOMEPATH%\SendTo\!READ.htm
%HOMEPATH%\Start Menu\!READ.htm
%HOMEPATH%\My Documents\!READ.htm
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\C\!READ.htm
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\D\!READ.htm
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\E\!READ.htm
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\9\!READ.htm
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\A\!READ.htm
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\B\!READ.htm
%HOMEPATH%\Local Settings\History\!READ.htm
%HOMEPATH%\Local Settings\History\History.IE5\!READ.htm
%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\!READ.htm
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\F\!READ.htm
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\!READ.htm
<LS_APPDATA>\VMware\!READ.htm
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\!READ.htm
%HOMEPATH%\!READ.htm
%APPDATA%\!READ.htm
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\!READ.htm
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\!READ.htm
C:\Documents and Settings\NetworkService\Local Settings\History\!READ.htm
%APPDATA%\Microsoft\Address Book\!READ.htm
%APPDATA%\Microsoft\Credentials\!READ.htm
%APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\!READ.htm
%APPDATA%\Identities\!READ.htm
%APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\!READ.htm
%APPDATA%\Microsoft\!READ.htm
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\!READ.htm
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\!READ.htm
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\!READ.htm
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\!READ.htm
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\!READ.htm
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\!READ.htm
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\!READ.htm
C:\Documents and Settings\NetworkService\Local Settings\!READ.htm
C:\Documents and Settings\NetworkService\Local Settings\Application Data\!READ.htm
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\!READ.htm
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\!READ.htm
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\!READ.htm
C:\Documents and Settings\NetworkService\Cookies\!READ.htm
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\!READ.htm
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\!READ.htm
%HOMEPATH%\Cookies\!READ.htm
%APPDATA%\Mozilla\Firefox\!READ.htm
%APPDATA%\Mozilla\Firefox\Profiles\!READ.htm
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\!READ.htm
%HOMEPATH%\Local Settings\!READ.htm
<LS_APPDATA>\!READ.htm
<LS_APPDATA>\Identities\!READ.htm
%HOMEPATH%\Desktop\!READ.htm
%HOMEPATH%\Favorites\!READ.htm
%HOMEPATH%\Favorites\Links\!READ.htm
%APPDATA%\Mozilla\Extensions\!READ.htm
%APPDATA%\Microsoft\MMC\!READ.htm
%APPDATA%\Microsoft\SystemCertificates\!READ.htm
%APPDATA%\Microsoft\SystemCertificates\My\!READ.htm
%APPDATA%\Microsoft\Internet Explorer\!READ.htm
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\!READ.htm
%APPDATA%\Microsoft\Media Player\!READ.htm
%APPDATA%\Microsoft\Windows\!READ.htm
%APPDATA%\Microsoft\Windows\Themes\!READ.htm
%APPDATA%\Mozilla\!READ.htm
%APPDATA%\Microsoft\SystemCertificates\My\Certificates\!READ.htm
%APPDATA%\Microsoft\SystemCertificates\My\CRLs\!READ.htm
%APPDATA%\Microsoft\SystemCertificates\My\CTLs\!READ.htm

Moves the following files:

from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\icxCFfSdT5ByW%Cv.cerber6
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\_gBi8GQSZbkyZprx.cerber6
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.js to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\6h3XeENbgeFopUvb.cerber6
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\WlH2c1LIu5oos9Xe.cerber6
from %APPDATA%\Microsoft\Internet Explorer\brndlog.txt to %APPDATA%\Microsoft\Internet Explorer\a8lb_c67%DW7NUIb.cerber6
from %APPDATA%\Microsoft\Internet Explorer\brndlog.bak to %APPDATA%\Microsoft\Internet Explorer\3I2y9L4pNe56Q9xd.cerber6
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\YVkzVcVClcQF-v%L.cerber6
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\yqgSmtKLGhXN2w14.cerber6

Deletes itself.

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial