Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\your_files_are_encrypted.html
Malicious functions
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Modifies file system
Creates the following files
- D:\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\media\cagcat10\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\media\cagcat10\1033\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\document themes 14\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\document themes 14\theme fonts\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\document themes 14\theme effects\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\document themes 14\theme colors\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\clipart\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\clipart\publisher\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\clipart\publisher\backgrounds\your_files_are_encrypted.html
- %ProgramFiles%\microsoft analysis services\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\media\office14\autoshap\your_files_are_encrypted.html
- %ProgramFiles%\microsoft analysis services\as oledb\your_files_are_encrypted.html
- %ProgramFiles%\microsoft analysis services\as oledb\10\your_files_are_encrypted.html
- %ProgramFiles%\microsoft analysis services\as oledb\10\resources\your_files_are_encrypted.html
- %ProgramFiles%\microsoft analysis services\as oledb\10\resources\1033\your_files_are_encrypted.html
- %ProgramFiles%\microsoft analysis services\as oledb\10\cartridges\your_files_are_encrypted.html
- %ProgramFiles%\java\your_files_are_encrypted.html
- %ProgramFiles%\java\jre1.8.0_45\your_files_are_encrypted.html
- %ProgramFiles%\java\jre1.8.0_45\lib\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\clipart\pub60cor\your_files_are_encrypted.html
- %ProgramFiles%\java\jre1.8.0_45\bin\dtplugin\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\media\office14\bullets\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\swirl\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\sts2\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\springgreen\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\solutions\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\softblue\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\slate\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\oasis\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\lime\your_files_are_encrypted.html
- %ProgramFiles%\java\jre1.8.0_45\lib\security\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\media\office14\1033\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\brightyellow\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\brightorange\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\biscay\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\babyblue\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\americana\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\1033\dataservices\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\1033\bibliography\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\media\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\media\office14\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\desert\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\media\office14\lines\your_files_are_encrypted.html
- %ProgramFiles%\java\jre1.8.0_45\lib\management\your_files_are_encrypted.html
- %ProgramFiles%\java\jre1.8.0_45\lib\jfr\your_files_are_encrypted.html
- %ProgramFiles%\java\jre1.8.0_45\lib\images\your_files_are_encrypted.html
- %ProgramFiles%\dvd maker\shared\dvdstyles\flippage\your_files_are_encrypted.html
- %ProgramFiles%\dvd maker\shared\dvdstyles\rectangles\your_files_are_encrypted.html
- %ProgramFiles%\dvd maker\shared\dvdstyles\push\your_files_are_encrypted.html
- %ProgramFiles%\dvd maker\shared\dvdstyles\pets\your_files_are_encrypted.html
- %ProgramFiles%\dvd maker\shared\dvdstyles\performance\your_files_are_encrypted.html
- %ProgramFiles%\dvd maker\shared\dvdstyles\oldage\your_files_are_encrypted.html
- %ProgramFiles%\dvd maker\shared\dvdstyles\memories\your_files_are_encrypted.html
- %ProgramFiles%\dvd maker\shared\dvdstyles\layeredtitles\your_files_are_encrypted.html
- %ProgramFiles%\dvd maker\shared\dvdstyles\huecycle\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\1033\grooveforms5\your_files_are_encrypted.html
- %ProgramFiles%\dvd maker\shared\dvdstyles\shatter\your_files_are_encrypted.html
- %ProgramFiles%\dvd maker\shared\dvdstyles\babygirl\your_files_are_encrypted.html
- %ProgramFiles%\dvd maker\shared\dvdstyles\babyboy\your_files_are_encrypted.html
- %ProgramFiles%\dvd maker\en-us\your_files_are_encrypted.html
- %CommonProgramFiles%\your_files_are_encrypted.html
- %CommonProgramFiles%\system\your_files_are_encrypted.html
- %CommonProgramFiles%\system\ole db\your_files_are_encrypted.html
- %CommonProgramFiles%\system\ole db\en-us\your_files_are_encrypted.html
- %CommonProgramFiles%\system\msmapi\your_files_are_encrypted.html
- %CommonProgramFiles%\system\msmapi\1033\your_files_are_encrypted.html
- %ProgramFiles%\dvd maker\shared\dvdstyles\full\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\graycheck\your_files_are_encrypted.html
- %ProgramFiles%\dvd maker\shared\dvdstyles\specialoccasion\your_files_are_encrypted.html
- %ProgramFiles%\dvd maker\shared\dvdstyles\travel\your_files_are_encrypted.html
- %ProgramFiles%\dvd maker\shared\dvdstyles\sports\your_files_are_encrypted.html
- %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\your_files_are_encrypted.html
- %ProgramFiles%\java\jre1.8.0_45\lib\fonts\your_files_are_encrypted.html
- %ProgramFiles%\java\jre1.8.0_45\lib\ext\your_files_are_encrypted.html
- %ProgramFiles%\java\jre1.8.0_45\lib\deploy\your_files_are_encrypted.html
- %ProgramFiles%\java\jre1.8.0_45\lib\cmm\your_files_are_encrypted.html
- %ProgramFiles%\java\jre1.8.0_45\lib\applet\your_files_are_encrypted.html
- %ProgramFiles%\java\jre1.8.0_45\lib\amd64\your_files_are_encrypted.html
- %ProgramFiles%\java\jre1.8.0_45\bin\your_files_are_encrypted.html
- %ProgramFiles%\dvd maker\shared\dvdstyles\stacking\your_files_are_encrypted.html
- %ProgramFiles%\java\jre1.8.0_45\bin\server\your_files_are_encrypted.html
- %ProgramFiles%\dvd maker\shared\dvdstyles\resizingpanels\your_files_are_encrypted.html
- %ProgramFiles%\internet explorer\your_files_are_encrypted.html
- %ProgramFiles%\internet explorer\signup\your_files_are_encrypted.html
- %ProgramFiles%\internet explorer\en-us\your_files_are_encrypted.html
- %ProgramFiles%\dvd maker\your_files_are_encrypted.html
- %ProgramFiles%\dvd maker\shared\your_files_are_encrypted.html
- %ProgramFiles%\dvd maker\shared\dvdstyles\your_files_are_encrypted.html
- %ProgramFiles%\dvd maker\shared\dvdstyles\vignette\your_files_are_encrypted.html
- %ProgramFiles%\dvd maker\shared\dvdstyles\videowall\your_files_are_encrypted.html
- %ProgramFiles%\java\jre1.8.0_45\bin\plugin2\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\1033\pubftscm\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\1033\pubspapr\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\1033\quickstyles\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\sts2\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\springgreen\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\softblue\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\slate\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\oasis\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\lime\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\graycheck\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\desert\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\brightyellow\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\swirl\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\brightorange\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\babyblue\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\americana\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\swirl\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\sts2\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\springgreen\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\softblue\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\slate\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\biscay\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\xml files\space templates\your_files_are_encrypted.html
- %CommonProgramFiles%\system\msadc\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\media\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\library\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\library\solver\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\library\analysis\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\infopathom\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\infopathom\infopathomv12\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\infopathom\infopathomformservices\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\infopathom\infopathomformservices\infopathomformservicesv12\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\oasis\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\xml files\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\toolicons\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\welcome tool\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttool\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttool\project report type\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttool\project report type\fancy\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttool\project report type\basic\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\discussion\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\lime\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\certificates\verisign\components\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\certificates\groove.net\managedobjects\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\certificates\groove.net\components\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\forms\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\forms\1033\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\en\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\document parts\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\document parts\1033\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\document parts\1033\14\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\convert\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\certificates\groove.net\servers\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\convert\1033\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\bibliography\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\bibliography\style\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\bibliography\sort\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\addins\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\accwiz\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\accessweb\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\3082\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\1036\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\1033\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\borders\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\onenote\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\desert\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\certificates\verisign\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\brightyellow\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\brightorange\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\biscay\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\babyblue\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\americana\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formstemplates\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\groovedocumentreview\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\graycheck\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\documentshare\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\computers\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\calendar\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\toolbmps\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\sounds\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\sounds\things\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\sounds\places\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\sounds\people\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\certificates\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\certificates\groove.net\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\your_files_are_encrypted.html
- %CommonProgramFiles%\system\msadc\en-us\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\translat\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\pt-pt\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\pt-br\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\pl-pl\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\nl-nl\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\nb-no\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\lv-lv\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\lt-lt\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\ko-kr\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\ja-jp\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\hwrcustomization\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\ru-ru\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\hu-hu\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\hr-hr\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\he-il\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\web\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\symbols\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskpred\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\osknumpad\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\it-it\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\bg-bg\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\sk-sk\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.ww\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.en-us\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\infopath.en-us\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\groove.en-us\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\excel.en-us\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\access.en-us\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\office14\cultures\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\office14\1033\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskmenu\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\ro-ro\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\msclientdatamgr\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\zh-tw\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\zh-cn\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\uk-ua\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\tr-tr\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\th-th\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\sv-se\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\sr-latn-cs\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\msinfo\en-us\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\sl-si\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\numbers\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\main\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\keypad\your_files_are_encrypted.html
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\your_files_are_encrypted.html
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\your_files_are_encrypted.html
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\your_files_are_encrypted.html
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\your_files_are_encrypted.html
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\your_files_are_encrypted.html
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\your_files_are_encrypted.html
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\your_files_are_encrypted.html
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\your_files_are_encrypted.html
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\onenote.en-us\your_files_are_encrypted.html
- C:\msocache\your_files_are_encrypted.html
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\your_files_are_encrypted.html
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\your_files_are_encrypted.html
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\your_files_are_encrypted.html
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\your_files_are_encrypted.html
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\your_files_are_encrypted.html
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\your_files_are_encrypted.html
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\your_files_are_encrypted.html
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\your_files_are_encrypted.html
- C:\kms\your_files_are_encrypted.html
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\msinfo\your_files_are_encrypted.html
- C:\perflogs\admin\your_files_are_encrypted.html
- %CommonProgramFiles%\designer\your_files_are_encrypted.html
- C:\perflogs\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\auxpad\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\fr-fr\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\fi-fi\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\et-ee\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\es-es\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\en-us\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\el-gr\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\de-de\your_files_are_encrypted.html
- <Current directory>\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\da-dk\your_files_are_encrypted.html
- C:\msocache\all users\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\ar-sa\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\help\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\grphflt\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\filters\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\euro\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\equation\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\equation\1033\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\dw\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\ink\cs-cz\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\outlook.en-us\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\powerpoint.en-us\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.en\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\translat\esen\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\translat\enfr\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\translat\enes\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\translat\arfr\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\watermar\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\water\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\sumipntg\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\studio\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\translat\frar\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\strtedge\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\sonora\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\slate\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\sky\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\satin\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\rmnsque\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\ripple\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\ricepapr\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\refined\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\radial\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\spring\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\web folders\1033\your_files_are_encrypted.html
- %CommonProgramFiles%\system\en-us\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\triedit\en-us\your_files_are_encrypted.html
- %CommonProgramFiles%\system\ado\en-us\your_files_are_encrypted.html
- %CommonProgramFiles%\speechengines\your_files_are_encrypted.html
- %CommonProgramFiles%\speechengines\microsoft\your_files_are_encrypted.html
- %CommonProgramFiles%\services\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\web server extensions\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\web server extensions\14\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\web server extensions\14\bin\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\web server extensions\14\bin\1033\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\quad\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\web folders\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\vsto\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\vsto\10.0\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\vsto\10.0\1033\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\vgx\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\vc\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\vba\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\vba\vba7\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\vba\vba7\1033\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\triedit\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\translat\fren\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\eclipse\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\profile\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\bluecalm\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\arctic\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\aftrnoon\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\textconv\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\textconv\en-us\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\stationery\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\source engine\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\smart tag\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\smart tag\lists\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\smart tag\lists\1033\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\axis\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\smart tag\1033\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\office14\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\word.en-us\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\publisher.en-us\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\proplus\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\proofing.en-us\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.fr\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.es\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\proof\your_files_are_encrypted.html
- %CommonProgramFiles%\system\ado\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\papyrus\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\blueprnt\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\network\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\level\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\layers\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\journal\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\iris\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\indust\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\ice\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\expeditn\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\evrgreen\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\pixel\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\edge\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\echo\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\deepblue\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\concrete\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\compass\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\cascade\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\capsules\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\canyon\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\breeze\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\boldstri\your_files_are_encrypted.html
- %CommonProgramFiles%\microsoft shared\themes14\blends\your_files_are_encrypted.html
- %ProgramFiles%\microsoft office\office14\outlookautodiscover\your_files_are_encrypted.html
Modifies the following files
- <Drive name for removable media>:\correct.avi
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlookmui.msi
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlklr.cab
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publr.cab
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.msi
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\pptlr.cab
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.msi
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.msi
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excellr.cab
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\propsww2.cab
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\propsww.cab
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.msi
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\pkeyconfig-office.xrm-ms
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\owow32ww.cab
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.xml
- <Drive name for removable media>:\sdksampleunprivdeveloper.cer
- <Drive name for removable media>:\contoso_1.cer
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.msi
- <Drive name for removable media>:\sdkfailsafeemulator.cer
- <Drive name for removable media>:\contoso.cer
- <Drive name for removable media>:\tileimage.bmp
- <Drive name for removable media>:\coffee.bmp
- <Drive name for removable media>:\dashborder_192.bmp
- <Drive name for removable media>:\dialmap.bmp
- <Drive name for removable media>:\split.avi
- C:\kms\kms_vl_all_aio_debug.log
- C:\kms\kms_vl_all_aio.cmd
- <Drive name for removable media>:\join.avi
- <Drive name for removable media>:\stoc13_ml_quoc_le.pptx
- <Drive name for removable media>:\middaugh_keynote.pptx
Modifies multiple files.
Substitutes the following files
- %ProgramFiles%\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\DELETE.GIF
Modifies user data files (Trojan.Encoder).
