Trojan.Encoder.15735

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Classes\DVDIRUWAGLVVMWB\shell\open\command] '' = '%TEMP%\I87Zn79nrK1YVJT.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsSupport' = '%TEMP%\I87Zn79nrK1YVJT.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WindowsSupport' = '%TEMP%\I87Zn79nrK1YVJT.exe'

Создает или изменяет следующие файлы:

%HOMEPATH%\Start Menu\Programs\Startup\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\HOW TO DECRYPT FILES.txt

Изменения в файловой системе:

Создает следующие файлы:

C:\Far2\Plugins\Compare\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\hrd\console\contrib\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\hrd\console\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\EMenu\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\EditCase\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\DrawLine\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\hrd\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\bin\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Brackets\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\hrc\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\hrc\auto\types\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\hrc\auto\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\ExtSearch\doc\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\MacroView\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\HlfViewer\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\FTP\lib\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\TmpPanel\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\ProcList\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Network\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\FTP\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\ExtSearch\sources\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\ExtSearch\keys\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\ExtSearch\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\FileCase\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\FarCmds\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\ExtSearch\sources\RegExp\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\AutoWrap\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Templates\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Start Menu\Programs\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\Colors\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\Colors\Default Highlighting\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\Colors\Custom Highlighting\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Start Menu\Programs\Accessories\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Recent\HOW TO DECRYPT FILES.txt
%HOMEPATH%\HOW TO DECRYPT FILES.txt
%HOMEPATH%\My Documents\My Pictures\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Start Menu\HOW TO DECRYPT FILES.txt
%HOMEPATH%\SendTo\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\HOW TO DECRYPT FILES.txt
C:\Far2\FExcept\HOW TO DECRYPT FILES.txt
C:\Far2\Encyclopedia\HOW TO DECRYPT FILES.txt
C:\Far2\Documentation\rus\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\arclite\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Align\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\7-Zip\HOW TO DECRYPT FILES.txt
C:\Far2\Documentation\eng\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\Shell\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\SetUp\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\Macros\HOW TO DECRYPT FILES.txt
C:\Far2\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\XLat\Russian\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\XLat\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\WinSCP\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\content\branding\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\System\Ole DB\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\SpeechEngines\Microsoft\TTS\1033\sam.sdf.new
%ProgramFiles%\FireFox\chrome\browser\content\browser\bookmarks\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\System\msadc\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\SpeechEngines\Microsoft\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\SpeechEngines\Microsoft\Lexicon\1033\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Services\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\System\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\System\ado\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\SpeechEngines\Microsoft\TTS\1033\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\certerror\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\search\HOW TO DECRYPT FILES.txt
<SYSTEM32>\dllcache\sam.sdf.new
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\preferences\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\places\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\feeds\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\safebrowsing\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\migration\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\history\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\feeds\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\places\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\MSSoap\Binaries\Resources\1033\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1040\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1036\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1033\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\2052\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1042\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1041\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1031\HOW TO DECRYPT FILES.txt
C:\Muldrop\HOW TO DECRYPT FILES.txt
C:\Far2\PluginSDK\Headers.pas\HOW TO DECRYPT FILES.txt
C:\Far2\PluginSDK\Headers.c\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1028\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1025\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DAO\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\3082\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\Web Folders\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\VGX\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\VC\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\MSSoap\Binaries\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\1033\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\Triedit\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\Speech\1033\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\MSInfo\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\TextConv\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\Stationery\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\Speech\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Cookies\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\History\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Application Data\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Games\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Start Menu\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\SendTo\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Start Menu\Programs\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\HOW TO DECRYPT FILES.txt
<Текущая директория>\HOW TO DECRYPT FILES.txt
C:\HOW TO DECRYPT FILES.txt
%TEMP%\I87Zn79nrK1YVJT.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Dr Watson\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Application Data\HOW TO DECRYPT FILES.txt
%TEMP%\CabD.tmp
%TEMP%\Cab5.tmp
%TEMP%\Cab3.tmp
%TEMP%\Cab1.tmp
%TEMP%\CabB.tmp
%TEMP%\Cab9.tmp
%TEMP%\Cab7.tmp
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Player\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Documents\My Videos\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Documents\My Pictures\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\DRM\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Pbk\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Documents\My Music\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Documents\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Favorites\Links\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Favorites\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Cookies\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\Microsoft\Media Player\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\HOW TO DECRYPT FILES.txt
%APPDATA%\Mozilla\Firefox\HOW TO DECRYPT FILES.txt
%APPDATA%\Microsoft\Windows\Themes\HOW TO DECRYPT FILES.txt
%APPDATA%\Microsoft\Media Player\HOW TO DECRYPT FILES.txt
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\HOW TO DECRYPT FILES.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\HOW TO DECRYPT FILES.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\HOW TO DECRYPT FILES.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\Microsoft\Windows\HOW TO DECRYPT FILES.txt
%TEMP%\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Local Settings\History\History.IE5\HOW TO DECRYPT FILES.txt
%HOMEPATH%\My Documents\My Music\HOW TO DECRYPT FILES.txt
%HOMEPATH%\My Documents\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Local Settings\<INETFILES>\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Local Settings\History\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\Microsoft\Windows Media\9.0\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Local Settings\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\VMware\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\HOW TO DECRYPT FILES.txt
%APPDATA%\Microsoft\Internet Explorer\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\CJCTQ25G\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\BGGTYMH1\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\MOE00UY1\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\LBMMC3H3\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Cookies\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Templates\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\History\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\HOW TO DECRYPT FILES.txt
%APPDATA%\Microsoft\Address Book\HOW TO DECRYPT FILES.txt
%APPDATA%\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\History\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\HOW TO DECRYPT FILES.txt

Присваивает атрибут 'скрытый' для следующих файлов:

<Полный путь к файлу>

Удаляет следующие файлы:

%TEMP%\Cab9.tmp
%TEMP%\CabB.tmp
%TEMP%\CabD.tmp
%TEMP%\Cab7.tmp
%TEMP%\Cab1.tmp
%TEMP%\Cab3.tmp
%TEMP%\Cab5.tmp

Перемещает следующие файлы:

%ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\tabs.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\tabs.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\safebrowsing\sb-loader.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\safebrowsing\sb-loader.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\safeMode.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\safeMode.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\sync.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\sync.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\privacy.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\privacy.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\security.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\security.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\selectBookmark.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\selectBookmark.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\search\search.xml в %ProgramFiles%\FireFox\chrome\browser\content\browser\search\search.xml.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\search\searchbarBindings.css в %ProgramFiles%\FireFox\chrome\browser\content\browser\search\searchbarBindings.css.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\setDesktopBackground.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\setDesktopBackground.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\search\engineManager.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\search\engineManager.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\sanitize.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\sanitize.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\sanitizeDialog.css в %ProgramFiles%\FireFox\chrome\browser\content\browser\sanitizeDialog.css.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\sanitizeDialog.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\sanitizeDialog.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\permissionsutils.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\permissionsutils.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\applications.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\applications.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\connection.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\connection.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\content.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\content.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\applicationManager.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\applicationManager.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\places\tree.xml в %ProgramFiles%\FireFox\chrome\browser\content\browser\places\tree.xml.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\places\treeView.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\places\treeView.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\advanced.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\advanced.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\languages.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\languages.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\main.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\main.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\permissions.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\permissions.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\handlers.xml в %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\handlers.xml.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\cookies.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\cookies.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\fonts.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\fonts.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\handlers.css в %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\handlers.css.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\syncAddDevice.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\syncAddDevice.js.cerber
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\feeds\subscribe.css в %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\feeds\subscribe.css.cerber
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\fullscreen-video.css в %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\fullscreen-video.css.cerber
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\inspector.css в %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\inspector.css.cerber
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\feeds\subscribe-ui.css в %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\feeds\subscribe-ui.css.cerber
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\aboutSyncTabs.css в %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\aboutSyncTabs.css.cerber
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\browser.css в %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\browser.css.cerber
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\engineManager.css в %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\engineManager.css.cerber
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\places\places.css в %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\places\places.css.cerber
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\preferences\applications.css в %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\preferences\applications.css.cerber
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\preferences\preferences.css в %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\preferences\preferences.css.cerber
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\places\organizer.css в %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\places\organizer.css.cerber
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\keyhole-forward-mask.svg в %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\keyhole-forward-mask.svg.cerber
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\pageInfo.css в %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\pageInfo.css.cerber
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\places\editBookmarkOverlay.css в %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\places\editBookmarkOverlay.css.cerber
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\aboutSessionRestore.css в %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\aboutSessionRestore.css.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\syncUtils.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\syncUtils.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\tabbrowser.css в %ProgramFiles%\FireFox\chrome\browser\content\browser\tabbrowser.css.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\tabbrowser.xml в %ProgramFiles%\FireFox\chrome\browser\content\browser\tabbrowser.xml.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\syncSetup.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\syncSetup.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\syncGenericChange.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\syncGenericChange.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\syncNotification.xml в %ProgramFiles%\FireFox\chrome\browser\content\browser\syncNotification.xml.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\syncQuota.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\syncQuota.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\web-panels.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\web-panels.js.cerber
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\aboutCertError.css в %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\aboutCertError.css.cerber
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\aboutPrivateBrowsing.css в %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\aboutPrivateBrowsing.css.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\utilityOverlay.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\utilityOverlay.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\tabview.css в %ProgramFiles%\FireFox\chrome\browser\content\browser\tabview.css.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\tabview.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\tabview.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\urlbarBindings.xml в %ProgramFiles%\FireFox\chrome\browser\content\browser\urlbarBindings.xml.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\places\places.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\places\places.js.cerber
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.js в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.js.cerber
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\signons.sqlite в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\signons.sqlite.cerber
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\webappsstore.sqlite в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\webappsstore.sqlite.cerber
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak.cerber
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js.cerber
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.sqlite в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.sqlite.cerber
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\aboutHome.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutHome.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\aboutSessionRestore.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutSessionRestore.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\aboutSyncTabs-bindings.xml в %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutSyncTabs-bindings.xml.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\aboutHome.css в %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutHome.css.cerber
%ProgramFiles%\FireFox\blocklist.xml в %ProgramFiles%\FireFox\blocklist.xml.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\aboutDialog.css в %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutDialog.css.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\aboutDialog.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutDialog.js.cerber
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\pluginreg.dat в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\pluginreg.dat.cerber
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userContent-example.css в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userContent-example.css.cerber
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chromeappsstore.sqlite в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chromeappsstore.sqlite.cerber
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\content-prefs.sqlite в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\content-prefs.sqlite.cerber
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userChrome-example.css в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userChrome-example.css.cerber
%APPDATA%\Microsoft\Address Book\%USERNAME%.wab в %APPDATA%\Microsoft\Address Book\%USERNAME%.wab.cerber
%APPDATA%\Microsoft\Internet Explorer\brndlog.bak в %APPDATA%\Microsoft\Internet Explorer\brndlog.bak.cerber
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db.cerber
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db.cerber
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\permissions.sqlite в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\permissions.sqlite.cerber
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\places.sqlite в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\places.sqlite.cerber
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\formhistory.sqlite в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\formhistory.sqlite.cerber
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cookies.sqlite в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cookies.sqlite.cerber
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\downloads.sqlite в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\downloads.sqlite.cerber
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.sqlite в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.sqlite.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\aboutSyncTabs.css в %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutSyncTabs.css.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\security.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\security.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\places\bookmarkProperties.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\places\bookmarkProperties.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\places\browserPlacesViews.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\places\browserPlacesViews.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\permissions.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\permissions.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\pageInfo.css в %ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\pageInfo.css.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\pageInfo.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\pageInfo.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\pageInfo.xml в %ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\pageInfo.xml.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\places\moveBookmarks.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\places\moveBookmarks.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\places\organizer.css в %ProgramFiles%\FireFox\chrome\browser\content\browser\places\organizer.css.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\places\places.css в %ProgramFiles%\FireFox\chrome\browser\content\browser\places\places.css.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\places\menu.xml в %ProgramFiles%\FireFox\chrome\browser\content\browser\places\menu.xml.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\places\controller.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\places\controller.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\places\editBookmarkOverlay.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\places\editBookmarkOverlay.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\places\history-panel.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\places\history-panel.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\feeds.xml в %ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\feeds.xml.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\browser.css в %ProgramFiles%\FireFox\chrome\browser\content\browser\browser.css.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\browser.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\browser.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\certerror\aboutCertError.css в %ProgramFiles%\FireFox\chrome\browser\content\browser\certerror\aboutCertError.css.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\browser-tabPreviews.xml в %ProgramFiles%\FireFox\chrome\browser\content\browser\browser-tabPreviews.xml.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\aboutSyncTabs.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutSyncTabs.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\bookmarks\bookmarksPanel.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\bookmarks\bookmarksPanel.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\bookmarks\sidebarUtils.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\bookmarks\sidebarUtils.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\nsContextMenu.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\nsContextMenu.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\openLocation.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\openLocation.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\feeds.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\feeds.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\migration\migration.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\migration\migration.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\feeds\subscribe.css в %ProgramFiles%\FireFox\chrome\browser\content\browser\feeds\subscribe.css.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\feeds\subscribe.js в %ProgramFiles%\FireFox\chrome\browser\content\browser\feeds\subscribe.js.cerber
%ProgramFiles%\FireFox\chrome\browser\content\browser\feeds\subscribe.xml в %ProgramFiles%\FireFox\chrome\browser\content\browser\feeds\subscribe.xml.cerber

Создает файлы с требованием оплатить расшифровку файлов (Trojan.Encoder).

Изменяет множество файлов пользовательских данных (Trojan.Encoder).

Изменяет расширения файлов пользовательских данных (Trojan.Encoder).

Сетевая активность:

Подключается к:

'www.download.windowsupdate.com':80
'ca#####.digicert.com':80
'wp#d':80

TCP:

Запросы HTTP GET:

http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
http://11#.#11.111.1/wpad.dat via wp#d
http://ca#####.digicert.com/DigiCertAssuredIDRootCA.crt

UDP:

DNS ASK www.download.windowsupdate.com
DNS ASK ca#####.digicert.com
DNS ASK wp#d

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней