Pour les utilisateurs

Fermer

Bibliothèque
Ma bibliothèque

+ Ajouter à la bibliothèque

Recherche
Recherche

Contacter-nous !
Support 24/24 | Rules regarding submitting

Envoyer un message

Requête à l'aide du formulaire

Nous téléphoner

0 825 300 230

Forum

Vos requêtes

  • Toutes : -
  • Non clôturées : -
  • Dernière : le -
Créer une nouvelle requête

Nous téléphoner

0 825 300 230

Profil

FR

RU CN DE EN ES FR IT JP KZ UZ PL BY ID
Fermer
Services support
Scanners
Dr.Web vxCube
Démo
Bibliothèque virale
Base documentaire

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Actualités

Trojan.Encoder.38071

Added to the Dr.Web virus database: 2023-10-03

Virus description added:

Technical Information

Malicious functions
Reads files which store third party applications passwords
  • %APPDATA%\thunderbird\profiles.ini
  • %HOMEPATH%\desktop\508softwareandos.doc
  • %HOMEPATH%\desktop\applicantform_en.doc
  • %APPDATA%\mozilla\firefox\profiles.ini
  • %HOMEPATH%\desktop\contoso.cer
Modifies file system
Creates the following files
  • <Current directory>\newtonsoft.json.dll
  • %LOCALAPPDATA%\gdipfontcachev1.dat
Sets the 'hidden' attribute to the following files
  • <Current directory>\newtonsoft.json.dll
Moves the following system files
  • from %WINDIR%\dtcinstall.log to %WINDIR%\dtcinstall.log.cloud
Moves the following files
  • from %ProgramFiles%\microsoft office\document themes 14\adjacency.thmx to %ProgramFiles%\microsoft office\document themes 14\adjacency.thmx.cloud
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1253.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1253.txt.cloud
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00126_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00126_.gif.cloud
  • from %ProgramFiles%\winrar\license.txt to %ProgramFiles%\winrar\license.txt.cloud
  • from %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143753.gif to %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143753.gif.cloud
  • from %ProgramFiles%\mozilla thunderbird\api-ms-win-core-synch-l1-2-0.dll to %ProgramFiles%\mozilla thunderbird\api-ms-win-core-synch-l1-2-0.dll.cloud
  • from %ProgramFiles%\microsoft office\office14\accddslm.dll to %ProgramFiles%\microsoft office\office14\accddslm.dll.cloud
  • from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\blist.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\blist.sqlite.cloud
  • from %ProgramFiles%\java\jre1.8.0_45\bin\awt.dll to %ProgramFiles%\java\jre1.8.0_45\bin\awt.dll.cloud
  • from %ProgramFiles%\microsoft office\media\office14\bullets\bd10254_.gif to %ProgramFiles%\microsoft office\media\office14\bullets\bd10254_.gif.cloud
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00129_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00129_.gif.cloud
  • from %ProgramFiles%\mozilla thunderbird\api-ms-win-core-processthreads-l1-1-1.dll to %ProgramFiles%\mozilla thunderbird\api-ms-win-core-processthreads-l1-1-1.dll.cloud
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1254.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1254.txt.cloud
  • from %ProgramFiles%\java\jre1.8.0_45\lib\accessibility.properties to %ProgramFiles%\java\jre1.8.0_45\lib\accessibility.properties.cloud
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\ace.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\ace.dll.cloud
  • from %ProgramFiles(x86)%\opera\launcher.exe to %ProgramFiles(x86)%\opera\launcher.exe.cloud
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1257.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1257.txt.cloud
  • from %ProgramFiles%\microsoft office\templates\1033\adjacencyreport.dotx to %ProgramFiles%\microsoft office\templates\1033\adjacencyreport.dotx.cloud
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1258.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1258.txt.cloud
  • from %APPDATA%\microsoft\windows\start menu\programs\telegram desktop\uninstall telegram.lnk to %APPDATA%\microsoft\windows\start menu\programs\telegram desktop\uninstall telegram.lnk.cloud
  • from %ProgramFiles%\microsoft office\media\office14\autoshap\bd18181_.wmf to %ProgramFiles%\microsoft office\media\office14\autoshap\bd18181_.wmf.cloud
  • from %APPDATA%\microsoft\internet explorer\quick launch\window switcher.lnk to %APPDATA%\microsoft\internet explorer\quick launch\window switcher.lnk.cloud
  • from %TEMP%\aspnetsetup_00001.log to %TEMP%\aspnetsetup_00001.log.cloud
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\cyrillic.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\cyrillic.txt.cloud
  • from %ProgramFiles(x86)%\mozilla firefox\distibution\policies.json to %ProgramFiles(x86)%\mozilla firefox\distibution\policies.json.cloud
  • from %APPDATA%\microsoft\windows\start menu\programs\telegram desktop\telegram.lnk to %APPDATA%\microsoft\windows\start menu\programs\telegram desktop\telegram.lnk.cloud
  • from %APPDATA%\microsoft\windows\start menu\programs\winrar\winrar.lnk to %APPDATA%\microsoft\windows\start menu\programs\winrar\winrar.lnk.cloud
  • from %ProgramFiles%\microsoft office\media\office14\autoshap\bd18180_.wmf to %ProgramFiles%\microsoft office\media\office14\autoshap\bd18180_.wmf.cloud
  • from %ProgramFiles%\microsoft office\media\office14\autoshap\autoshap.dll to %ProgramFiles%\microsoft office\media\office14\autoshap\autoshap.dll.cloud
  • from %APPDATA%\microsoft\windows\start menu\programs\winrar\winrar help.lnk to %APPDATA%\microsoft\windows\start menu\programs\winrar\winrar help.lnk.cloud
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1252.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1252.txt.cloud
  • from %ProgramFiles%\microsoft office\document themes 14\aspect.thmx to %ProgramFiles%\microsoft office\document themes 14\aspect.thmx.cloud
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\minionpro-bold.otf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\minionpro-bold.otf.cloud
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00120_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00120_.gif.cloud
  • from %ProgramFiles%\microsoft office\media\cagcat10\j0149627.wmf to %ProgramFiles%\microsoft office\media\cagcat10\j0149627.wmf.cloud
  • from %APPDATA%\microsoft\windows\start menu\programs\google chrome\google chrome.lnk to %APPDATA%\microsoft\windows\start menu\programs\google chrome\google chrome.lnk.cloud
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\corpchar.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\corpchar.txt.cloud
  • from %ProgramFiles%\microsoft office\media\office14\1033\office10.mml to %ProgramFiles%\microsoft office\media\office14\1033\office10.mml.cloud
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\croatian.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\croatian.txt.cloud
  • from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\microsoft.visualstudio.tools.applications.addinmanager.dll to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\microsoft.visualstudio.tools.applications.addinmanager.dll.cloud
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\minionpro-boldit.otf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\minionpro-boldit.otf.cloud
  • from %ProgramFiles%\mozilla thunderbird\api-ms-win-core-localization-l1-2-0.dll to %ProgramFiles%\mozilla thunderbird\api-ms-win-core-localization-l1-2-0.dll.cloud
  • from %ProgramFiles(x86)%\mozilla firefox\browser\override.ini to %ProgramFiles(x86)%\mozilla firefox\browser\override.ini.cloud
  • from %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143752.gif to %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143752.gif.cloud
  • from %APPDATA%\mozilla\firefox\crash reports\installtime20200708170202 to %APPDATA%\mozilla\firefox\crash reports\installtime20200708170202.cloud
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\adobe\zdingbat.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\adobe\zdingbat.txt.cloud
  • from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\microsoft.visualstudio.tools.applications.comrpcchannel.dll to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\microsoft.visualstudio.tools.applications.comrpcchannel.dll.cloud
  • from %TEMP%\armui.ini to %TEMP%\armui.ini.cloud
  • from %ProgramFiles%\microsoft office\stationery\1033\jungle.gif to %ProgramFiles%\microsoft office\stationery\1033\jungle.gif.cloud
  • from %APPDATA%\microsoft\windows\start menu\programs\accessories\command prompt.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\command prompt.lnk.cloud
  • from %ProgramFiles%\microsoft office\media\office14\bullets\bd10253_.gif to %ProgramFiles%\microsoft office\media\office14\bullets\bd10253_.gif.cloud
  • from %ProgramFiles%\microsoft office\office14\accddsf.dll to %ProgramFiles%\microsoft office\office14\accddsf.dll.cloud
  • from %APPDATA%\microsoft\windows\start menu\programs\winrar\console rar manual.lnk to %APPDATA%\microsoft\windows\start menu\programs\winrar\console rar manual.lnk.cloud
  • from %APPDATA%\microsoft\windows\start menu\programs\winrar\what is new in the latest version.lnk to %APPDATA%\microsoft\windows\start menu\programs\winrar\what is new in the latest version.lnk.cloud
  • from %ProgramFiles(x86)%\opera\installer_prefs.json to %ProgramFiles(x86)%\opera\installer_prefs.json.cloud
  • from %TEMP%\aspnetsetup_00000.log to %TEMP%\aspnetsetup_00000.log.cloud
  • from %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme.txt to %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme.txt.cloud
  • from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\microsoft.visualstudio.tools.applications.adapter.dll to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\microsoft.visualstudio.tools.applications.adapter.dll.cloud
  • from %ProgramFiles%\microsoft office\document themes 14\austin.thmx to %ProgramFiles%\microsoft office\document themes 14\austin.thmx.cloud
  • from %APPDATA%\microsoft\windows\recent\automaticdestinations\1b4dd67f29cb1962.automaticdestinations-ms to %APPDATA%\microsoft\windows\recent\automaticdestinations\1b4dd67f29cb1962.automaticdestinations-ms.cloud
  • from %ProgramFiles%\java\jre1.8.0_45\bin\dcpr.dll to %ProgramFiles%\java\jre1.8.0_45\bin\dcpr.dll.cloud
  • from %ProgramFiles(x86)%\steam\steam.exe to %ProgramFiles(x86)%\steam\steam.exe.cloud
  • from %TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt to %TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt.cloud
  • from %ProgramFiles%\microsoft office\media\office14\bullets\bd10263_.gif to %ProgramFiles%\microsoft office\media\office14\bullets\bd10263_.gif.cloud
  • from %ProgramFiles%\java\jre1.8.0_45\bin\decora_sse.dll to %ProgramFiles%\java\jre1.8.0_45\bin\decora_sse.dll.cloud
  • from %ProgramFiles%\microsoft office\media\cagcat10\j0157995.wmf to %ProgramFiles%\microsoft office\media\cagcat10\j0157995.wmf.cloud
  • from %ProgramFiles%\microsoft office\media\office14\bullets\bd10264_.gif to %ProgramFiles%\microsoft office\media\office14\bullets\bd10264_.gif.cloud
  • from %ProgramFiles%\microsoft office\media\office14\lines\bd10256_.gif to %ProgramFiles%\microsoft office\media\office14\lines\bd10256_.gif.cloud
  • from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\addons.json to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\addons.json.cloud
  • from %ProgramFiles%\microsoft office\document themes 14\clarity.thmx to %ProgramFiles%\microsoft office\document themes 14\clarity.thmx.cloud
  • from %APPDATA%\mozilla\firefox\profiles\bcjnbgva.default\times.json to %APPDATA%\mozilla\firefox\profiles\bcjnbgva.default\times.json.cloud
  • from %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\wb00516l.gif to %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\wb00516l.gif.cloud
  • from %APPDATA%\mozilla\firefox\profiles\bcjnbgva.default\user.js to %APPDATA%\mozilla\firefox\profiles\bcjnbgva.default\user.js.cloud
  • from %ProgramFiles%\microsoft office\media\office14\lines\bd10289_.gif to %ProgramFiles%\microsoft office\media\office14\lines\bd10289_.gif.cloud
  • from %ProgramFiles%\mozilla thunderbird\api-ms-win-crt-convert-l1-1-0.dll to %ProgramFiles%\mozilla thunderbird\api-ms-win-crt-convert-l1-1-0.dll.cloud
  • from %ProgramFiles(x86)%\steam\logs\bootstrap_log.txt to %ProgramFiles(x86)%\steam\logs\bootstrap_log.txt.cloud
  • from %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\wb00531l.gif to %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\wb00531l.gif.cloud
  • from %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\wb00673l.gif to %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\wb00673l.gif.cloud
  • from %ProgramFiles%\winrar\rarext32.dll to %ProgramFiles%\winrar\rarext32.dll.cloud
  • from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\firefox.lnk to %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\firefox.lnk.cloud
  • from %TEMP%\dd_setuputility.txt to %TEMP%\dd_setuputility.txt.cloud
  • from %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\addonstartup.json.lz4 to %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\addonstartup.json.lz4.cloud
  • from %ProgramFiles%\java\jre1.8.0_45\bin\deploy.dll to %ProgramFiles%\java\jre1.8.0_45\bin\deploy.dll.cloud
  • from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\system.addin.dll to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\system.addin.dll.cloud
  • from %ProgramFiles(x86)%\microsoft visual studio 8\vsta\bin\1033\vstaprojectui.dll to %ProgramFiles(x86)%\microsoft visual studio 8\vsta\bin\1033\vstaprojectui.dll.cloud
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\iceland.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\iceland.txt.cloud
  • from %ProgramFiles(x86)%\microsoft visual studio 8\vsta\bin\1033\vstaclientpkgui.dll to %ProgramFiles(x86)%\microsoft visual studio 8\vsta\bin\1033\vstaclientpkgui.dll.cloud
  • from %ProgramFiles%\microsoft office\office14\accicons.exe to %ProgramFiles%\microsoft office\office14\accicons.exe.cloud
  • from %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143749.gif to %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143749.gif.cloud
  • from %TEMP%\chrome_installer.log to %TEMP%\chrome_installer.log.cloud
  • from %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\addons.json to %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\addons.json.cloud
  • from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\microsoft.visualstudio.tools.applications.designtime.dll to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\publicassemblies\microsoft.visualstudio.tools.applications.designtime.dll.cloud
  • from %ProgramFiles%\microsoft office\media\office14\lines\bd10219_.gif to %ProgramFiles%\microsoft office\media\office14\lines\bd10219_.gif.cloud
  • from %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143754.gif to %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143754.gif.cloud
  • from %ProgramFiles%\microsoft office\media\office14\bullets\bd10255_.gif to %ProgramFiles%\microsoft office\media\office14\bullets\bd10255_.gif.cloud
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrobroker.exe to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrobroker.exe.cloud
  • from %ProgramFiles%\microsoft office\document themes 14\black tie.thmx to %ProgramFiles%\microsoft office\document themes 14\black tie.thmx.cloud
  • from %ProgramFiles%\microsoft office\templates\1033\adjacencyresume.dotx to %ProgramFiles%\microsoft office\templates\1033\adjacencyresume.dotx.cloud
  • from %ProgramFiles%\mozilla thunderbird\api-ms-win-core-timezone-l1-1-0.dll to %ProgramFiles%\mozilla thunderbird\api-ms-win-core-timezone-l1-1-0.dll.cloud
  • from %ProgramFiles%\java\jre1.8.0_45\lib\calendars.properties to %ProgramFiles%\java\jre1.8.0_45\lib\calendars.properties.cloud
  • from %ProgramFiles%\java\jre1.8.0_45\bin\bci.dll to %ProgramFiles%\java\jre1.8.0_45\bin\bci.dll.cloud
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00130_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00130_.gif.cloud
  • from %ProgramFiles(x86)%\opera\resources.pri to %ProgramFiles(x86)%\opera\resources.pri.cloud
  • from %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt to %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt.cloud
  • from %ProgramFiles%\winrar\rar.exe to %ProgramFiles%\winrar\rar.exe.cloud
  • from %ProgramFiles%\winrar\rar.txt to %ProgramFiles%\winrar\rar.txt.cloud
  • from %ProgramFiles%\microsoft office\media\cagcat10\j0157763.wmf to %ProgramFiles%\microsoft office\media\cagcat10\j0157763.wmf.cloud
  • from %ProgramFiles%\microsoft office\media\office14\autoshap\bd18182_.wmf to %ProgramFiles%\microsoft office\media\office14\autoshap\bd18182_.wmf.cloud
  • from %ProgramFiles%\mozilla thunderbird\api-ms-win-crt-conio-l1-1-0.dll to %ProgramFiles%\mozilla thunderbird\api-ms-win-crt-conio-l1-1-0.dll.cloud
  • from %ProgramFiles%\microsoft office\templates\1033\apothecaryletter.dotx to %ProgramFiles%\microsoft office\templates\1033\apothecaryletter.dotx.cloud
  • from %ProgramFiles%\microsoft office\document themes 14\civic.thmx to %ProgramFiles%\microsoft office\document themes 14\civic.thmx.cloud
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrofx32.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrofx32.dll.cloud
  • from %ProgramFiles%\winrar\rarext.dll to %ProgramFiles%\winrar\rarext.dll.cloud
  • from %ProgramFiles%\microsoft office\media\cagcat10\j0149887.wmf to %ProgramFiles%\microsoft office\media\cagcat10\j0149887.wmf.cloud
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\greek.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\greek.txt.cloud
  • from %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143758.gif to %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143758.gif.cloud
  • from %ProgramFiles%\microsoft office\media\office14\office10.mmw to %ProgramFiles%\microsoft office\media\office14\office10.mmw.cloud
  • from %ProgramFiles%\microsoft office\document themes 14\apothecary.thmx to %ProgramFiles%\microsoft office\document themes 14\apothecary.thmx.cloud
  • from %APPDATA%\mozilla\firefox\profiles.ini to %APPDATA%\mozilla\firefox\profiles.ini.cloud
  • from %ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\microsoft.synchronization.dll to %ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\microsoft.synchronization.dll.cloud
  • from %ProgramFiles%\java\jre1.8.0_45\license to %ProgramFiles%\java\jre1.8.0_45\license.cloud
  • from %ProgramFiles%\winrar\7zxa.dll to %ProgramFiles%\winrar\7zxa.dll.cloud
  • from %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceme35.dll to %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceme35.dll.cloud
  • from %APPDATA%\thunderbird\installs.ini to %APPDATA%\thunderbird\installs.ini.cloud
  • from %ProgramFiles%\mozilla firefox\accessiblehandler.dll to %ProgramFiles%\mozilla firefox\accessiblehandler.dll.cloud
  • from %APPDATA%\thunderbird\profiles.ini to %APPDATA%\thunderbird\profiles.ini.cloud
  • from %APPDATA%\thunderbird\profiles\49zr3fqa.default\times.json to %APPDATA%\thunderbird\profiles\49zr3fqa.default\times.json.cloud
  • from %ProgramFiles%\mozilla thunderbird\accessiblemarshal.dll to %ProgramFiles%\mozilla thunderbird\accessiblemarshal.dll.cloud
  • from %ProgramFiles%\mozilla firefox\accessiblemarshal.dll to %ProgramFiles%\mozilla firefox\accessiblemarshal.dll.cloud
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00052_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00052_.gif.cloud
  • from %APPDATA%\microsoft\windows\sendto\desktop (create shortcut).desklink to %APPDATA%\microsoft\windows\sendto\desktop (create shortcut).desklink.cloud
  • from %ProgramFiles%\windows sidebar\settings.ini to %ProgramFiles%\windows sidebar\settings.ini.cloud
  • from %ProgramFiles%\java\jre1.8.0_45\readme.txt to %ProgramFiles%\java\jre1.8.0_45\readme.txt.cloud
  • from %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143746.gif to %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143746.gif.cloud
  • from %APPDATA%\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget to %APPDATA%\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget.cloud
  • from %ProgramFiles%\microsoft office\media\office14\office10.dll to %ProgramFiles%\microsoft office\media\office14\office10.dll.cloud
  • from %ProgramFiles%\java\jre1.8.0_45\release to %ProgramFiles%\java\jre1.8.0_45\release.cloud
  • from %APPDATA%\thunderbird\crash reports\installtime20210406220621 to %APPDATA%\thunderbird\crash reports\installtime20210406220621.cloud
  • from %APPDATA%\microsoft\windows\libraries\documents.library-ms to %APPDATA%\microsoft\windows\libraries\documents.library-ms.cloud
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\adobepistd.otf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\adobepistd.otf.cloud
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\courierstd-bold.otf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\courierstd-bold.otf.cloud
  • from %ProgramFiles%\microsoft office\media\cagcat10\j0090070.wmf to %ProgramFiles%\microsoft office\media\cagcat10\j0090070.wmf.cloud
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00040_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00040_.gif.cloud
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00038_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00038_.gif.cloud
  • from %ProgramFiles%\microsoft office\media\cagcat10\j0088542.wmf to %ProgramFiles%\microsoft office\media\cagcat10\j0088542.wmf.cloud
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00037_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00037_.gif.cloud
  • from %ProgramFiles%\microsoft office\document themes 14\angles.thmx to %ProgramFiles%\microsoft office\document themes 14\angles.thmx.cloud
  • from %ProgramFiles%\msbuild\microsoft\windows workflow foundation\v3.0\workflow.targets to %ProgramFiles%\msbuild\microsoft\windows workflow foundation\v3.0\workflow.targets.cloud
  • from %ProgramFiles%\msbuild\microsoft\windows workflow foundation\v3.0\workflow.visualbasic.targets to %ProgramFiles%\msbuild\microsoft\windows workflow foundation\v3.0\workflow.visualbasic.targets.cloud
  • from %ProgramFiles%\microsoft office\media\cagcat10\cagcat10.dll to %ProgramFiles%\microsoft office\media\cagcat10\cagcat10.dll.cloud
  • from %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceca35.dll to %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceca35.dll.cloud
  • from %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143743.gif to %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143743.gif.cloud
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00011_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00011_.gif.cloud
  • from %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143744.gif to %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143744.gif.cloud
  • from %ProgramFiles%\microsoft synchronization services\ado.net\v1.0\microsoft.synchronization.data.dll to %ProgramFiles%\microsoft synchronization services\ado.net\v1.0\microsoft.synchronization.data.dll.cloud
  • from %ProgramFiles%\microsoft office\stationery\1033\currency.gif to %ProgramFiles%\microsoft office\stationery\1033\currency.gif.cloud
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00021_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00021_.gif.cloud
  • from %ProgramFiles%\mozilla firefox\accessible.tlb to %ProgramFiles%\mozilla firefox\accessible.tlb.cloud
  • from %ProgramFiles%\mozilla thunderbird\api-ms-win-core-file-l1-2-0.dll to %ProgramFiles%\mozilla thunderbird\api-ms-win-core-file-l1-2-0.dll.cloud
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\readme.htm to %ProgramFiles(x86)%\adobe\acrobat reader dc\readme.htm.cloud
  • from %ProgramFiles%\microsoft synchronization services\ado.net\v1.0\microsoft.synchronization.data.sqlserverce.dll to %ProgramFiles%\microsoft synchronization services\ado.net\v1.0\microsoft.synchronization.data.sqlserverce.dll.cloud
  • from %ProgramFiles%\microsoft office\templates\1033\adjacencyletter.dotx to %ProgramFiles%\microsoft office\templates\1033\adjacencyletter.dotx.cloud
  • from %ProgramFiles%\microsoft office\templates\1033\adjacencymergeletter.dotx to %ProgramFiles%\microsoft office\templates\1033\adjacencymergeletter.dotx.cloud
  • from %ProgramFiles%\mozilla thunderbird\accessible.tlb to %ProgramFiles%\mozilla thunderbird\accessible.tlb.cloud
  • from %ProgramFiles%\microsoft office\media\cagcat10\cagcat10.mmw to %ProgramFiles%\microsoft office\media\cagcat10\cagcat10.mmw.cloud
  • from %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlcecompact35.dll to %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlcecompact35.dll.cloud
  • from %ProgramFiles%\mozilla thunderbird\accessiblehandler.dll to %ProgramFiles%\mozilla thunderbird\accessiblehandler.dll.cloud
  • from %ProgramFiles%\microsoft office\media\cagcat10\elphrg01.wav to %ProgramFiles%\microsoft office\media\cagcat10\elphrg01.wav.cloud
  • from %ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\license agreements\synchronizationeula.rtf to %ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\license agreements\synchronizationeula.rtf.cloud
  • from %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceer35en.dll to %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceer35en.dll.cloud
  • from %ProgramFiles%\microsoft synchronization services\ado.net\v1.0\microsoft.synchronization.data.server.dll to %ProgramFiles%\microsoft synchronization services\ado.net\v1.0\microsoft.synchronization.data.server.dll.cloud
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\1494870c-9912-c184-4cc9-b401-a53f4d8de290.pdf to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\1494870c-9912-c184-4cc9-b401-a53f4d8de290.pdf.cloud
  • from %ProgramFiles%\java\jre1.8.0_45\copyright to %ProgramFiles%\java\jre1.8.0_45\copyright.cloud
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00004_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00004_.gif.cloud
  • from %ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\feedsync.dll to %ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\feedsync.dll.cloud
  • from %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143745.gif to %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143745.gif.cloud
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\adobe\symbol.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\adobe\symbol.txt.cloud
  • from %ProgramFiles(x86)%\microsoft office\office14\authzax.dll to %ProgramFiles(x86)%\microsoft office\office14\authzax.dll.cloud
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00090_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00090_.gif.cloud
  • from %APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk to %APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk.cloud
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\courierstd-oblique.otf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\courierstd-oblique.otf.cloud
  • from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\addons.json to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\addons.json.cloud
  • from %ProgramFiles(x86)%\microsoft visual studio 8\vsta\bin\vstaclientpkg.dll to %ProgramFiles(x86)%\microsoft visual studio 8\vsta\bin\vstaclientpkg.dll.cloud
  • from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\addonstartup.json.lz4 to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\addonstartup.json.lz4.cloud
  • from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\privateassemblies\microsoft.visualstudio.tools.applications.project.dll to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\privateassemblies\microsoft.visualstudio.tools.applications.project.dll.cloud
  • from %ProgramFiles%\microsoft office\office14\accdds.dll to %ProgramFiles%\microsoft office\office14\accdds.dll.cloud
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\a3dutils.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\a3dutils.dll.cloud
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\courierstd.otf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\courierstd.otf.cloud
  • from %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\abook.sqlite to %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\abook.sqlite.cloud
  • from %ProgramFiles%\winrar\ace32loader.exe to %ProgramFiles%\winrar\ace32loader.exe.cloud
  • from %ProgramFiles(x86)%\msbuild\microsoft\windows workflow foundation\v3.0\workflow.targets to %ProgramFiles(x86)%\msbuild\microsoft\windows workflow foundation\v3.0\workflow.targets.cloud
  • from %ProgramFiles(x86)%\microsoft office\office14\bcslaunch.dll to %ProgramFiles(x86)%\microsoft office\office14\bcslaunch.dll.cloud
  • from %APPDATA%\microsoft\windows\start menu\programs\internet explorer.lnk to %APPDATA%\microsoft\windows\start menu\programs\internet explorer.lnk.cloud
  • from %ProgramFiles(x86)%\msbuild\microsoft\windows workflow foundation\v3.0\workflow.visualbasic.targets to %ProgramFiles(x86)%\msbuild\microsoft\windows workflow foundation\v3.0\workflow.visualbasic.targets.cloud
  • from %ProgramFiles(x86)%\microsoft visual studio 8\vsta\bin\vstaproject.dll to %ProgramFiles(x86)%\microsoft visual studio 8\vsta\bin\vstaproject.dll.cloud
  • from %TEMP%\adobesfx.log to %TEMP%\adobesfx.log.cloud
  • from %ProgramFiles%\microsoft office\stationery\1033\judgesch.gif to %ProgramFiles%\microsoft office\stationery\1033\judgesch.gif.cloud
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00103_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00103_.gif.cloud
  • from %ProgramFiles(x86)%\microsoft.net\primary interop assemblies\adodb.dll to %ProgramFiles(x86)%\microsoft.net\primary interop assemblies\adodb.dll.cloud
  • from %APPDATA%\microsoft\windows\libraries\videos.library-ms to %APPDATA%\microsoft\windows\libraries\videos.library-ms.cloud
  • from %ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\resources\1033\synchronization.rll to %ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\resources\1033\synchronization.rll.cloud
  • from %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143750.gif to %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143750.gif.cloud
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00092_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00092_.gif.cloud
  • from %APPDATA%\microsoft\internet explorer\quick launch\shows desktop.lnk to %APPDATA%\microsoft\internet explorer\quick launch\shows desktop.lnk.cloud
  • from %ProgramFiles%\winrar\descript.ion to %ProgramFiles%\winrar\descript.ion.cloud
  • from %ProgramFiles(x86)%\steam\uninstall.exe to %ProgramFiles(x86)%\steam\uninstall.exe.cloud
  • from %ProgramFiles%\microsoft office\stationery\1033\offisupp.gif to %ProgramFiles%\microsoft office\stationery\1033\offisupp.gif.cloud
  • from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00057_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00057_.gif.cloud
  • from %ProgramFiles%\microsoft office\document themes 14\apex.thmx to %ProgramFiles%\microsoft office\document themes 14\apex.thmx.cloud
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1250.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1250.txt.cloud
  • from %APPDATA%\mozilla\firefox\installs.ini to %APPDATA%\mozilla\firefox\installs.ini.cloud
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\courierstd-boldoblique.otf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\courierstd-boldoblique.otf.cloud
  • from %ProgramFiles%\winrar\default.sfx to %ProgramFiles%\winrar\default.sfx.cloud
  • from %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceqp35.dll to %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceqp35.dll.cloud
  • from %APPDATA%\microsoft\windows\libraries\music.library-ms to %APPDATA%\microsoft\windows\libraries\music.library-ms.cloud
  • from %APPDATA%\microsoft\windows\start menu\programs\internet explorer (64-bit).lnk to %APPDATA%\microsoft\windows\start menu\programs\internet explorer (64-bit).lnk.cloud
  • from %APPDATA%\microsoft\windows\libraries\pictures.library-ms to %APPDATA%\microsoft\windows\libraries\pictures.library-ms.cloud
  • from %ProgramFiles%\microsoft office\media\cagcat10\j0090386.wmf to %ProgramFiles%\microsoft office\media\cagcat10\j0090386.wmf.cloud
  • from %ProgramFiles%\microsoft office\media\cagcat10\j0149407.wmf to %ProgramFiles%\microsoft office\media\cagcat10\j0149407.wmf.cloud
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1251.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1251.txt.cloud
  • from %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlcese35.dll to %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlcese35.dll.cloud
  • from %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143748.gif to %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143748.gif.cloud
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\saslprep\saslprepprofile_norm_bidi.spp to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\saslprep\saslprepprofile_norm_bidi.spp.cloud
  • from %ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\synchronization.dll to %ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\synchronization.dll.cloud
  • from %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme-javafx.txt to %ProgramFiles%\java\jre1.8.0_45\thirdpartylicensereadme-javafx.txt.cloud
  • from %ProgramFiles(x86)%\msbuild\microsoft.office.infopath.targets to %ProgramFiles(x86)%\msbuild\microsoft.office.infopath.targets.cloud
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\centeuro.txt to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\centeuro.txt.cloud
  • from %ProgramFiles%\microsoft office\media\cagcat10\j0149481.wmf to %ProgramFiles%\microsoft office\media\cagcat10\j0149481.wmf.cloud
  • from %TEMP%\adobearm.log to %TEMP%\adobearm.log.cloud
  • from %ProgramFiles%\microsoft office\stationery\1033\dadshirt.gif to %ProgramFiles%\microsoft office\stationery\1033\dadshirt.gif.cloud
  • from %APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk to %APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk.cloud
  • from %ProgramFiles(x86)%\adobe\acrobat reader dc\esl\aiodlite.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\esl\aiodlite.dll.cloud
  • from %ProgramFiles%\mozilla thunderbird\api-ms-win-core-file-l2-1-0.dll to %ProgramFiles%\mozilla thunderbird\api-ms-win-core-file-l2-1-0.dll.cloud
  • from %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceoledb35.dll to %ProgramFiles%\microsoft sql server compact edition\v3.5\sqlceoledb35.dll.cloud
  • from %ProgramFiles%\winrar\default64.sfx to %ProgramFiles%\winrar\default64.sfx.cloud
  • from %ProgramFiles%\microsoft office\templates\1033\apothecarymergeletter.dotx to %ProgramFiles%\microsoft office\templates\1033\apothecarymergeletter.dotx.cloud
Modifies the following files
  • C:\kms\kms_vl_all_aio.cmd
  • %ProgramFiles%\microsoft office\templates\1033\adjacencyletter.dotx
  • %ProgramFiles%\java\jre1.8.0_45\copyright
  • C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\setup.xml
  • %ALLUSERSPROFILE%\mozilla\updates\e7cf176e110c211b\update-config.json
  • C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proofing.msi
  • %ProgramFiles(x86)%\adobe\acrobat reader dc\readme.htm
  • %CommonProgramFiles%\microsoft shared\grphflt\cgmimp32.cfg
  • %ProgramFiles%\mozilla firefox\accessible.tlb
  • %ProgramFiles%\microsoft office\clipart\pub60cor\ag00021_.gif
  • %ProgramFiles%\microsoft office\stationery\1033\currency.gif
  • C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.msi
  • %ALLUSERSPROFILE%\mozilla\updates\308046b0af4a39cb\update-config.json
  • C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\office32mui.msi
  • %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143744.gif
  • %ProgramFiles%\microsoft office\clipart\pub60cor\ag00011_.gif
  • %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\j0143743.gif
  • %ALLUSERSPROFILE%\mozilla\updates\d78bf5dd33499ec2\update-config.json
  • %ProgramFiles%\msbuild\microsoft\windows workflow foundation\v3.0\workflow.visualbasic.targets
  • %ProgramFiles%\microsoft office\clipart\pub60cor\ag00004_.gif
  • C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.xml
  • %ProgramFiles%\microsoft office\document themes 14\adjacency.thmx
  • %ProgramFiles%\msbuild\microsoft\windows workflow foundation\v3.0\workflow.targets
  • C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.xml
  • C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.msi
  • D:\install.log
  • C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.msi
  • C:\kms\kms_vl_all_aio_debug.log
  • C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.xml
  • %ALLUSERSPROFILE%\sun\java\java update\jaureglist.xml
Modifies multiple files.
Substitutes the following executable files
  • %ALLUSERSPROFILE%\Microsoft\IdentityCRL\ppcrlui.dll
  • %ALLUSERSPROFILE%\Oracle\Java\javapath\javaws.exe
  • %ALLUSERSPROFILE%\Package Cache\{38b2c744-ad08-4d5b-91a2-3fb6f739ff3e}\VC_redist.x86.exe
  • %ALLUSERSPROFILE%\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe
  • %ALLUSERSPROFILE%\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
  • %ALLUSERSPROFILE%\Package Cache\{295d1583-fdb9-414b-a4c8-da539362a26b}\VC_redist.x64.exe
  • %ALLUSERSPROFILE%\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
Substitutes the following files
  • %ALLUSERSPROFILE%\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\abcpy.ini
  • %ALLUSERSPROFILE%\Microsoft\OFFICE\MySharePoints.ico
  • %ALLUSERSPROFILE%\Microsoft\MF\Active.GRL
  • %ALLUSERSPROFILE%\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\state.rsm
  • %ALLUSERSPROFILE%\Package Cache\{295d1583-fdb9-414b-a4c8-da539362a26b}\state.rsm
  • %ALLUSERSPROFILE%\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm
  • %ALLUSERSPROFILE%\Microsoft\MF\Pending.GRL
  • %ALLUSERSPROFILE%\Package Cache\{6CD9E9ED-906D-4196-8DC3-F987D2F6615F}v14.29.30133\packages\vcRuntimeMinimum_amd64\cab1.cab
  • %ALLUSERSPROFILE%\Microsoft\OFFICE\SharePointPortalSite.ico
  • %ALLUSERSPROFILE%\Microsoft\RAC\StateData\RacDatabase.sdf
  • %ALLUSERSPROFILE%\Microsoft\Search\Data\Applications\Windows\MSS.chk
  • %ALLUSERSPROFILE%\Package Cache\{F1B0FB3A-E0EA-47A6-9383-3650655403B0}v14.16.27024\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi
  • %ALLUSERSPROFILE%\Package Cache\{9D29FC96-9EEE-4253-943F-96B3BBFDD0B6}v14.16.27024\packages\vcRuntimeAdditional_amd64\cab1.cab
  • %ALLUSERSPROFILE%\Package Cache\{6CD9E9ED-906D-4196-8DC3-F987D2F6615F}v14.29.30133\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi
  • %ALLUSERSPROFILE%\Microsoft\OFFICE\SharePointTeamSite.ico
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).

Recommandations pour le traitement

  1. Si le système d'exploitation peut être démarré (en mode normal ou en mode sans échec), téléchargez Dr.Web Security Space et lancez un scan complet de votre ordinateur et de tous les supports amovibles que vous utilisez. En savoir plus sur Dr.Web Security Space.
  2. Si le démarrage du système d'exploitation est impossible, veuillez modifier les paramètres du BIOS de votre ordinateur pour démarrer votre ordinateur via CD/DVD ou clé USB. Téléchargez l'image du disque de secours de restauration du système Dr.Web® LiveDisk ou l'utilitaire pour enregistrer Dr.Web® LiveDisk sur une clé USB, puis préparez la clé USB appropriée. Démarrez l'ordinateur à l'aide de cette clé et lancez le scan complet et le traitement des menaces détectées.
Version démo gratuite

 

Télécharger Dr.Web

Par le numéro de série

Veuillez lancer le scan complet du système à l'aide de Dr.Web Antivirus pour Mac OS.

Version démo gratuite

 

Télécharger Dr.Web sur le site

Par le numéro de série

Télécharger Dr.Web sur l'Apple Store

Veuillez lancer le scan complet de toutes les partitions du disque à l'aide de Dr.Web Antivirus pour Linux.

Version démo gratuite

 

Télécharger Dr.Web

Par le numéro de série

  1. Si votre appareil mobile fonctionne correctement, veuillez télécharger et installer sur votre appareil mobile Dr.Web pour Android. Lancez un scan complet et suivez les recommandations sur la neutralisation des menaces détectées.
  2. Si l'appareil mobile est bloqué par le Trojan de la famille Android.Locker (un message sur la violation grave de la loi ou la demande d'une rançon est affiché sur l'écran de l'appareil mobile), procédez comme suit:
    • démarrez votre Smartphone ou votre tablette en mode sans échec (si vous ne savez pas comment faire, consultez la documentation de l'appareil mobile ou contactez le fabricant) ;
    • puis téléchargez et installez sur votre appareil mobile Dr.Web pour Android et lancez un scan complet puis suivez les recommandations sur la neutralisation des menaces détectées ;
    • Débranchez votre appareil et rebranchez-le.

En savoir plus sur Dr.Web pour Android

Free trial

14 days

Download now
Get it on Google Play