Trojan.Encoder.26662

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%ALLUSERSPROFILE%\Start Menu\Programs\Startup\!!!SAVE_FILES_INFO!!!.txt
%HOMEPATH%\Start Menu\Programs\Startup\!!!SAVE_FILES_INFO!!!.txt

Creates the following files on removable media:

<Drive name for removable media>:\!!!SAVE_FILES_INFO!!!.txt

Modifies file system:

Creates the following files:

C:\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\ExtSearch\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\EMenu\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\EditCase\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\DrawLine\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\Compare\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\Colorer\hrd\console\contrib\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\Colorer\hrd\console\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\Colorer\hrd\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\Colorer\hrc\auto\types\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\Colorer\hrc\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\ExtSearch\keys\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\Colorer\bin\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\Colorer\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\Brackets\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\AutoWrap\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\arclite\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\Align\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\7-Zip\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\Colorer\hrc\auto\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Documentation\rus\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\ExtSearch\sources\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\WinSCP\lib\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\WinSCP\forms\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\WinSCP\filezilla\misc\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\WinSCP\filezilla\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\WinSCP\fari\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\WinSCP\far\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\WinSCP\dragext\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\WinSCP\core\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\WinSCP\console\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\FExcept\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\ExtSearch\doc\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\TmpPanel\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\ProcList\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\Network\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\MacroView\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\HlfViewer\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\FTP\lib\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\FTP\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\FileCase\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\FarCmds\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\WinSCP\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\ExtSearch\sources\RegExp\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Encyclopedia\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Documentation\eng\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\WinSCP\packages\dragndrop\!!!SAVE_FILES_INFO!!!.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\F\!!!SAVE_FILES_INFO!!!.txt
%HOMEPATH%\My Documents\!!!SAVE_FILES_INFO!!!.txt
%HOMEPATH%\Local Settings\<INETFILES>\!!!SAVE_FILES_INFO!!!.txt
%TEMP%\!!!SAVE_FILES_INFO!!!.txt
%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\!!!SAVE_FILES_INFO!!!.txt
%HOMEPATH%\Local Settings\History\History.IE5\!!!SAVE_FILES_INFO!!!.txt
%HOMEPATH%\Local Settings\History\!!!SAVE_FILES_INFO!!!.txt
<LS_APPDATA>\VMware\!!!SAVE_FILES_INFO!!!.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\!!!SAVE_FILES_INFO!!!.txt
%HOMEPATH%\My Documents\Downloads\!!!SAVE_FILES_INFO!!!.txt
%HOMEPATH%\My Documents\My Music\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\WinSCP\packages\!!!SAVE_FILES_INFO!!!.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\C\!!!SAVE_FILES_INFO!!!.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\B\!!!SAVE_FILES_INFO!!!.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\A\!!!SAVE_FILES_INFO!!!.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\9\!!!SAVE_FILES_INFO!!!.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\8\!!!SAVE_FILES_INFO!!!.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\7\!!!SAVE_FILES_INFO!!!.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\6\!!!SAVE_FILES_INFO!!!.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\5\!!!SAVE_FILES_INFO!!!.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\D\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\WinSCP\components\!!!SAVE_FILES_INFO!!!.txt
%HOMEPATH%\My Documents\My Pictures\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Addons\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Addons\XLat\Russian\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Addons\XLat\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Addons\Shell\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Addons\SetUp\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Addons\Macros\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Addons\Colors\Default Highlighting\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Addons\Colors\Custom Highlighting\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Addons\Colors\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Documentation\!!!SAVE_FILES_INFO!!!.txt
%HOMEPATH%\My Documents\My Received Files\!!!SAVE_FILES_INFO!!!.txt
%HOMEPATH%\NetHood\!!!SAVE_FILES_INFO!!!.txt
%HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\!!!SAVE_FILES_INFO!!!.txt
%HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\!!!SAVE_FILES_INFO!!!.txt
%HOMEPATH%\Start Menu\Programs\Accessories\!!!SAVE_FILES_INFO!!!.txt
%HOMEPATH%\Start Menu\Programs\!!!SAVE_FILES_INFO!!!.txt
%HOMEPATH%\Start Menu\!!!SAVE_FILES_INFO!!!.txt
%HOMEPATH%\SendTo\!!!SAVE_FILES_INFO!!!.txt
%HOMEPATH%\Recent\!!!SAVE_FILES_INFO!!!.txt
%HOMEPATH%\PrintHood\!!!SAVE_FILES_INFO!!!.txt
%HOMEPATH%\Templates\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\NetworkService\Local Settings\History\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\WinSCP\packages\filemng\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\System\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\SpeechEngines\Microsoft\TTS\1033\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\SpeechEngines\Microsoft\TTS\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\SpeechEngines\Microsoft\Lexicon\1033\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\SpeechEngines\Microsoft\Lexicon\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\SpeechEngines\Microsoft\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\SpeechEngines\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\Services\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\ODBC\Data Sources\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\System\ado\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\ODBC\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\MSSoap\Binaries\Resources\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\MSSoap\Binaries\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\MSSoap\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\_vti_bin\_vti_aut\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\_vti_bin\_vti_adm\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\_vti_bin\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\servsupp\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\isapi\_vti_aut\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\isapi\_vti_adm\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\MSSoap\Binaries\Resources\1033\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\isapi\!!!SAVE_FILES_INFO!!!.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\4\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bots\vinavbar\!!!SAVE_FILES_INFO!!!.txt
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\!!!SAVE_FILES_INFO!!!.txt
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\!!!SAVE_FILES_INFO!!!.txt
%ProgramFiles%\FireFox\chrome\browser\skin\classic\!!!SAVE_FILES_INFO!!!.txt
%ProgramFiles%\FireFox\chrome\browser\skin\!!!SAVE_FILES_INFO!!!.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\search\!!!SAVE_FILES_INFO!!!.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\safebrowsing\!!!SAVE_FILES_INFO!!!.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\!!!SAVE_FILES_INFO!!!.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\places\!!!SAVE_FILES_INFO!!!.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\System\Ole DB\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\System\msadc\!!!SAVE_FILES_INFO!!!.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\feeds\!!!SAVE_FILES_INFO!!!.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\certerror\!!!SAVE_FILES_INFO!!!.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\bookmarks\!!!SAVE_FILES_INFO!!!.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\!!!SAVE_FILES_INFO!!!.txt
%ProgramFiles%\FireFox\chrome\browser\content\branding\!!!SAVE_FILES_INFO!!!.txt
%ProgramFiles%\FireFox\chrome\browser\content\!!!SAVE_FILES_INFO!!!.txt
%ProgramFiles%\FireFox\chrome\browser\!!!SAVE_FILES_INFO!!!.txt
%ProgramFiles%\FireFox\chrome\!!!SAVE_FILES_INFO!!!.txt
%ProgramFiles%\FireFox\!!!SAVE_FILES_INFO!!!.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\history\!!!SAVE_FILES_INFO!!!.txt
%ProgramFiles%\ComPlus Applications\!!!SAVE_FILES_INFO!!!.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\E\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\1033\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\Microsoft Shared\VC\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\Microsoft Shared\DW\1025\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\Microsoft Shared\DW\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\Microsoft Shared\DAO\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\Microsoft Shared\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\!!!SAVE_FILES_INFO!!!.txt
%ProgramFiles%\!!!SAVE_FILES_INFO!!!.txt
C:\Muldrop\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\PluginSDK\Headers.pas\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\Microsoft Shared\DW\1031\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\PluginSDK\Headers.c\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\WinSCP\windows\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\WinSCP\resource\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\WinSCP\release\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\WinSCP\putty\windows\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\WinSCP\putty\charset\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\WinSCP\putty\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\WinSCP\packages\theme\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\WinSCP\packages\tbx\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\WinSCP\packages\tb2k\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\PluginSDK\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bots\!!!SAVE_FILES_INFO!!!.txt
C:\Far2\Plugins\WinSCP\packages\my\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\Microsoft Shared\DW\1028\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admisapi\scripts\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admisapi\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admcgi\scripts\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admcgi\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\Microsoft Shared\Web Folders\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\Microsoft Shared\VGX\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\Microsoft Shared\DW\1036\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\Microsoft Shared\DW\1033\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\Microsoft Shared\TextConv\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\Microsoft Shared\Stationery\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\Microsoft Shared\Speech\1033\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\Microsoft Shared\Speech\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\Microsoft Shared\MSInfo\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\Microsoft Shared\DW\3082\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\Microsoft Shared\DW\2052\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\Microsoft Shared\DW\1042\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\Microsoft Shared\DW\1041\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\Microsoft Shared\Triedit\!!!SAVE_FILES_INFO!!!.txt
%CommonProgramFiles%\Microsoft Shared\DW\1040\!!!SAVE_FILES_INFO!!!.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\3\!!!SAVE_FILES_INFO!!!.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\2\!!!SAVE_FILES_INFO!!!.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\1\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\Default User\Local Settings\Temp\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\Default User\Local Settings\History\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\!!!SAVE_FILES_INFO!!!.txt
%ALLUSERSPROFILE%\Start Menu\Programs\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\Default User\Local Settings\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\Default User\Favorites\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\Default User\Desktop\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\Default User\Cookies\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\Default User\Templates\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\LocalService\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\LocalService\Application Data\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\Default User\My Documents\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\Default User\NetHood\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\Default User\Start Menu\Programs\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\Default User\Start Menu\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\Default User\SendTo\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\Default User\Recent\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\Default User\PrintHood\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\!!!SAVE_FILES_INFO!!!.txt
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\feeds\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\!!!SAVE_FILES_INFO!!!.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\!!!SAVE_FILES_INFO!!!.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\!!!SAVE_FILES_INFO!!!.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Pbk\!!!SAVE_FILES_INFO!!!.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Cm\!!!SAVE_FILES_INFO!!!.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\!!!SAVE_FILES_INFO!!!.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\!!!SAVE_FILES_INFO!!!.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Player\!!!SAVE_FILES_INFO!!!.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Index\!!!SAVE_FILES_INFO!!!.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\HTML Help\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\!!!SAVE_FILES_INFO!!!.txt
%ALLUSERSPROFILE%\Desktop\!!!SAVE_FILES_INFO!!!.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\!!!SAVE_FILES_INFO!!!.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\!!!SAVE_FILES_INFO!!!.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\MachineKeys\!!!SAVE_FILES_INFO!!!.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\!!!SAVE_FILES_INFO!!!.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\!!!SAVE_FILES_INFO!!!.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\!!!SAVE_FILES_INFO!!!.txt
%ALLUSERSPROFILE%\Application Data\!!!SAVE_FILES_INFO!!!.txt
%ALLUSERSPROFILE%\!!!SAVE_FILES_INFO!!!.txt
<Current directory>\!!!SAVE_FILES_INFO!!!.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Dr Watson\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\!!!SAVE_FILES_INFO!!!.txt
%ALLUSERSPROFILE%\Documents\!!!SAVE_FILES_INFO!!!.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\!!!SAVE_FILES_INFO!!!.txt
%ALLUSERSPROFILE%\Documents\My Music\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\Default User\Application Data\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\Default User\!!!SAVE_FILES_INFO!!!.txt
%ALLUSERSPROFILE%\Templates\!!!SAVE_FILES_INFO!!!.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Games\!!!SAVE_FILES_INFO!!!.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\!!!SAVE_FILES_INFO!!!.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\!!!SAVE_FILES_INFO!!!.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\!!!SAVE_FILES_INFO!!!.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\!!!SAVE_FILES_INFO!!!.txt
%ALLUSERSPROFILE%\Documents\My Music\My Playlists\!!!SAVE_FILES_INFO!!!.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\!!!SAVE_FILES_INFO!!!.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\!!!SAVE_FILES_INFO!!!.txt
%ALLUSERSPROFILE%\Start Menu\!!!SAVE_FILES_INFO!!!.txt
%ALLUSERSPROFILE%\Favorites\!!!SAVE_FILES_INFO!!!.txt
%ALLUSERSPROFILE%\DRM\!!!SAVE_FILES_INFO!!!.txt
%ALLUSERSPROFILE%\Documents\My Videos\!!!SAVE_FILES_INFO!!!.txt
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\!!!SAVE_FILES_INFO!!!.txt
%ALLUSERSPROFILE%\Documents\My Pictures\!!!SAVE_FILES_INFO!!!.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\!!!SAVE_FILES_INFO!!!.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\!!!SAVE_FILES_INFO!!!.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\!!!SAVE_FILES_INFO!!!.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\migration\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\!!!SAVE_FILES_INFO!!!.txt
%HOMEPATH%\Cookies\!!!SAVE_FILES_INFO!!!.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\!!!SAVE_FILES_INFO!!!.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\!!!SAVE_FILES_INFO!!!.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\!!!SAVE_FILES_INFO!!!.txt
%APPDATA%\Mozilla\Firefox\Profiles\!!!SAVE_FILES_INFO!!!.txt
%APPDATA%\Mozilla\Firefox\!!!SAVE_FILES_INFO!!!.txt
%APPDATA%\Mozilla\Extensions\!!!SAVE_FILES_INFO!!!.txt
%APPDATA%\Mozilla\!!!SAVE_FILES_INFO!!!.txt
%APPDATA%\Microsoft\Windows\Themes\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\LocalService\Cookies\!!!SAVE_FILES_INFO!!!.txt
%APPDATA%\Microsoft\Windows\!!!SAVE_FILES_INFO!!!.txt
%APPDATA%\Microsoft\SystemCertificates\My\CRLs\!!!SAVE_FILES_INFO!!!.txt
%APPDATA%\Microsoft\SystemCertificates\My\Certificates\!!!SAVE_FILES_INFO!!!.txt
%APPDATA%\Microsoft\SystemCertificates\My\!!!SAVE_FILES_INFO!!!.txt
%APPDATA%\Microsoft\SystemCertificates\!!!SAVE_FILES_INFO!!!.txt
%APPDATA%\Microsoft\MMC\!!!SAVE_FILES_INFO!!!.txt
%APPDATA%\Microsoft\Media Player\!!!SAVE_FILES_INFO!!!.txt
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\!!!SAVE_FILES_INFO!!!.txt
%APPDATA%\Microsoft\Internet Explorer\!!!SAVE_FILES_INFO!!!.txt
%APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\!!!SAVE_FILES_INFO!!!.txt
%APPDATA%\Microsoft\SystemCertificates\My\CTLs\!!!SAVE_FILES_INFO!!!.txt
%APPDATA%\Microsoft\Credentials\!!!SAVE_FILES_INFO!!!.txt
%APPDATA%\Microsoft\Address Book\!!!SAVE_FILES_INFO!!!.txt
%HOMEPATH%\Local Settings\!!!SAVE_FILES_INFO!!!.txt
%HOMEPATH%\Favorites\!!!SAVE_FILES_INFO!!!.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\0\!!!SAVE_FILES_INFO!!!.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\!!!SAVE_FILES_INFO!!!.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\!!!SAVE_FILES_INFO!!!.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\!!!SAVE_FILES_INFO!!!.txt
<LS_APPDATA>\Mozilla\Firefox\!!!SAVE_FILES_INFO!!!.txt
<LS_APPDATA>\Mozilla\!!!SAVE_FILES_INFO!!!.txt
<LS_APPDATA>\Microsoft\Windows Media\9.0\!!!SAVE_FILES_INFO!!!.txt
<LS_APPDATA>\Microsoft\Windows Media\!!!SAVE_FILES_INFO!!!.txt
%HOMEPATH%\Favorites\Links\!!!SAVE_FILES_INFO!!!.txt
<LS_APPDATA>\Microsoft\Windows\!!!SAVE_FILES_INFO!!!.txt
%HOMEPATH%\Desktop\!!!SAVE_FILES_INFO!!!.txt
<LS_APPDATA>\Microsoft\Credentials\!!!SAVE_FILES_INFO!!!.txt
<LS_APPDATA>\Microsoft\CD Burning\!!!SAVE_FILES_INFO!!!.txt
<LS_APPDATA>\Microsoft\!!!SAVE_FILES_INFO!!!.txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\!!!SAVE_FILES_INFO!!!.txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\!!!SAVE_FILES_INFO!!!.txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\!!!SAVE_FILES_INFO!!!.txt
<LS_APPDATA>\Identities\!!!SAVE_FILES_INFO!!!.txt
<LS_APPDATA>\!!!SAVE_FILES_INFO!!!.txt
<LS_APPDATA>\Microsoft\Media Player\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\LocalService\Local Settings\!!!SAVE_FILES_INFO!!!.txt
<LS_APPDATA>\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\NetworkService\Application Data\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\NetworkService\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\MOE00UY1\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\LBMMC3H3\!!!SAVE_FILES_INFO!!!.txt
%APPDATA%\Identities\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\CJCTQ25G\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\LocalService\Local Settings\Temp\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\LocalService\Local Settings\History\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\BGGTYMH1\!!!SAVE_FILES_INFO!!!.txt
%APPDATA%\Microsoft\!!!SAVE_FILES_INFO!!!.txt
%APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\!!!SAVE_FILES_INFO!!!.txt
%APPDATA%\!!!SAVE_FILES_INFO!!!.txt
%HOMEPATH%\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\NetworkService\Local Settings\Temp\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\NetworkService\Local Settings\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\NetworkService\Cookies\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\!!!SAVE_FILES_INFO!!!.txt
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\!!!SAVE_FILES_INFO!!!.txt
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\places\!!!SAVE_FILES_INFO!!!.txt

Network activity:

Connects to:

'xx###t.pp.ua':80

TCP:

HTTP GET requests:

http://xx###t.pp.ua/testsv/get.php

UDP:

DNS ASK xx###t.pp.ua

Miscellaneous:

Creates and executes the following:

'<Full path to file>' --ForNetRes x5I74v4h003xJ0iyhUfHQ8W6o0RDSicmSfg72KVA 6se9RaIxXF9m70zWmx7nL3bVRp691w4SNY8UCir0
'<Full path to file>' --Service 2856 x5I74v4h003xJ0iyhUfHQ8W6o0RDSicmSfg72KVA 6se9RaIxXF9m70zWmx7nL3bVRp691w4SNY8UCir0
'<Full path to file>' --Service 2936 x5I74v4h003xJ0iyhUfHQ8W6o0RDSicmSfg72KVA 6se9RaIxXF9m70zWmx7nL3bVRp691w4SNY8UCir0

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial