Техническая информация
Для обеспечения автозапуска и распространения:
Заражает следующие исполняемые файлы:
- C:\Far2\Plugins\arclite\7zCon.sfx
- %CommonProgramFiles%\System\ado\msado20.tlb
- %CommonProgramFiles%\System\ado\msado25.tlb
- %CommonProgramFiles%\System\ado\msado26.tlb
- %CommonProgramFiles%\System\ado\msado27.tlb
- %CommonProgramFiles%\System\ado\msado21.tlb
- %CommonProgramFiles%\Microsoft Shared\Triedit\DHTMLED.OCX
- %CommonProgramFiles%\Microsoft Shared\TextConv\mswrd632.wpc
- %CommonProgramFiles%\Microsoft Shared\TextConv\mswrd832.cnv
- %CommonProgramFiles%\System\Ole DB\sqloledb.rll
- %CommonProgramFiles%\Microsoft Shared\TextConv\write32.wpc
- %CommonProgramFiles%\Microsoft Shared\Speech\sapi.cpl
- %CommonProgramFiles%\Microsoft Shared\MSInfo\IEINFO5.OCX
- C:\Far2\Plugins\FTP\lib\ftpProgress.fll
- C:\Far2\Plugins\FTP\lib\ftpDirList.fll
- C:\Far2\Plugins\arclite\7zSD.sfx
- C:\Far2\Plugins\arclite\7z.sfx
- C:\Far2\Plugins\arclite\7zS2con.sfx
- C:\Far2\Plugins\arclite\7zS2.sfx
- %CommonProgramFiles%\Microsoft Shared\TextConv\html32.cnv
- %CommonProgramFiles%\System\Ole DB\sqlxmlx.rll
Изменения в файловой системе:
Создает следующие файлы:
- C:\Documents and Settings\Default User\PUBLIC
- %CommonProgramFiles%\Microsoft Shared\DECRYPT_INFORMATION.html
- %CommonProgramFiles%\DECRYPT_INFORMATION.html
- C:\Muldrop\PUBLIC_0
- %ProgramFiles%\DECRYPT_INFORMATION.html
- C:\Muldrop\DECRYPT_INFORMATION.iunm_79
- C:\Muldrop\DECRYPT_INFORMATION.iunm_91
- C:\Muldrop\DECRYPT_INFORMATION.iunm_99
- C:\Muldrop\DECRYPT_INFORMATION.iunm_69
- C:\Muldrop\DECRYPT_INFORMATION.iunm_59
- C:\Muldrop\DECRYPT_INFORMATION.iunm_8
- C:\Muldrop\DECRYPT_INFORMATION.iunm_93
- C:\Muldrop\DECRYPT_INFORMATION.iunm_61
- C:\Muldrop\DECRYPT_INFORMATION.iunm_88
- C:\Muldrop\DECRYPT_INFORMATION.iunm_9
- C:\Muldrop\DECRYPT_INFORMATION.iunm_94
- %CommonProgramFiles%\Microsoft Shared\DW\DECRYPT_INFORMATION.html
- %CommonProgramFiles%\Microsoft Shared\Speech\DECRYPT_INFORMATION.html
- %CommonProgramFiles%\Microsoft Shared\web server extensions\DECRYPT_INFORMATION.html
- %CommonProgramFiles%\Microsoft Shared\web server extensions\40\DECRYPT_INFORMATION.html
- C:\Muldrop\DECRYPT_INFORMATION.iunm_64
- %CommonProgramFiles%\System\DECRYPT_INFORMATION.html
- %CommonProgramFiles%\SpeechEngines\Microsoft\TTS\DECRYPT_INFORMATION.html
- %CommonProgramFiles%\SpeechEngines\Microsoft\Lexicon\DECRYPT_INFORMATION.html
- %CommonProgramFiles%\SpeechEngines\Microsoft\DECRYPT_INFORMATION.html
- %CommonProgramFiles%\SpeechEngines\DECRYPT_INFORMATION.html
- %CommonProgramFiles%\ODBC\DECRYPT_INFORMATION.html
- C:\Muldrop\DECRYPT_INFORMATION.iunm_90
- %CommonProgramFiles%\MSSoap\Binaries\Resources\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\DECRYPT_INFORMATION.html
- %CommonProgramFiles%\Microsoft Shared\web server extensions\40\_vti_bin\DECRYPT_INFORMATION.html
- %CommonProgramFiles%\Microsoft Shared\web server extensions\40\isapi\DECRYPT_INFORMATION.html
- %CommonProgramFiles%\Microsoft Shared\web server extensions\40\bots\DECRYPT_INFORMATION.html
- %CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\DECRYPT_INFORMATION.html
- %CommonProgramFiles%\Microsoft Shared\web server extensions\40\admisapi\DECRYPT_INFORMATION.html
- %CommonProgramFiles%\Microsoft Shared\web server extensions\40\admcgi\DECRYPT_INFORMATION.html
- %CommonProgramFiles%\MSSoap\Binaries\DECRYPT_INFORMATION.html
- C:\Muldrop\DECRYPT_INFORMATION.iunm_26
- %CommonProgramFiles%\MSSoap\DECRYPT_INFORMATION.html
- C:\Muldrop\DECRYPT_INFORMATION.iunm_44
- C:\Muldrop\DECRYPT_INFORMATION.iunm_50
- C:\Muldrop\DECRYPT_INFORMATION.iunm_82
- C:\Muldrop\DECRYPT_INFORMATION.iunm_71
- C:\Muldrop\DECRYPT_INFORMATION.iunm_68
- C:\Muldrop\DECRYPT_INFORMATION.iunm_52
- C:\Muldrop\DECRYPT_INFORMATION.iunm_4
- C:\Muldrop\DECRYPT_INFORMATION.iunm_77
- C:\Muldrop\DECRYPT_INFORMATION.iunm_30
- C:\Muldrop\DECRYPT_INFORMATION.iunm_72
- C:\Muldrop\DECRYPT_INFORMATION.iunm_81
- C:\Muldrop\DECRYPT_INFORMATION.iunm_58
- C:\Muldrop\DECRYPT_INFORMATION.iunm_78
- C:\Muldrop\DECRYPT_INFORMATION.iunm_6
- C:\Muldrop\DECRYPT_INFORMATION.iunm_87
- C:\Muldrop\DECRYPT_INFORMATION.iunm_84
- C:\Muldrop\DECRYPT_INFORMATION.iunm_63
- C:\Muldrop\DECRYPT_INFORMATION.iunm_46
- C:\Muldrop\DECRYPT_INFORMATION.iunm_83
- C:\Muldrop\DECRYPT_INFORMATION.iunm_38
- C:\Muldrop\DECRYPT_INFORMATION.iunm_74
- C:\Muldrop\DECRYPT_INFORMATION.iunm_97
- C:\Muldrop\DECRYPT_INFORMATION.iunm_53
- C:\Muldrop\DECRYPT_INFORMATION.iunm_80
- C:\Muldrop\DECRYPT_INFORMATION.iunm_73
- C:\Muldrop\DECRYPT_INFORMATION.iunm_92
- C:\Muldrop\DECRYPT_INFORMATION.iunm_86
- C:\Muldrop\DECRYPT_INFORMATION.iunm_95
- C:\Muldrop\DECRYPT_INFORMATION.iunm_42
- C:\Muldrop\DECRYPT_INFORMATION.iunm_89
- C:\Muldrop\DECRYPT_INFORMATION.iunm_60
- C:\Muldrop\DECRYPT_INFORMATION.iunm_98
- C:\Muldrop\DECRYPT_INFORMATION.iunm_47
- C:\Muldrop\DECRYPT_INFORMATION.iunm_43
- C:\Muldrop\DECRYPT_INFORMATION.iunm_62
- C:\Muldrop\DECRYPT_INFORMATION.iunm_96
- C:\Muldrop\DECRYPT_INFORMATION.iunm_41
- C:\Muldrop\DECRYPT_INFORMATION.iunm_31
- %ProgramFiles%\FireFox\chrome\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\modules\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\extensions\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\defaults\profile\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\defaults\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\res\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\chrome\toolkit\skin\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\chrome\toolkit\content\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\chrome\toolkit\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\DECRYPT_INFORMATION.html
- C:\Muldrop\DECRYPT_INFORMATION.iunm_23
- %ProgramFiles%\Internet Explorer\DECRYPT_INFORMATION.html
- %ProgramFiles%\xerox\DECRYPT_INFORMATION.html
- %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\DECRYPT_INFORMATION.html
- %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\DECRYPT_INFORMATION.html
- %ProgramFiles%\Reference Assemblies\Microsoft\Framework\DECRYPT_INFORMATION.html
- %ProgramFiles%\Reference Assemblies\Microsoft\DECRYPT_INFORMATION.html
- %ProgramFiles%\Reference Assemblies\DECRYPT_INFORMATION.html
- %ProgramFiles%\MSN\MSNCoreFiles\Install\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\chrome\pippki\content\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\modules\services-sync\DECRYPT_INFORMATION.html
- %ProgramFiles%\MSBuild\DECRYPT_INFORMATION.html
- %ProgramFiles%\Movie Maker\Shared\DECRYPT_INFORMATION.html
- %ProgramFiles%\Movie Maker\MUI\DECRYPT_INFORMATION.html
- %ProgramFiles%\Movie Maker\DECRYPT_INFORMATION.html
- %ProgramFiles%\Microsoft.NET\DECRYPT_INFORMATION.html
- %ProgramFiles%\microsoft frontpage\version3.0\DECRYPT_INFORMATION.html
- %ProgramFiles%\microsoft frontpage\DECRYPT_INFORMATION.html
- %ProgramFiles%\MSN\DECRYPT_INFORMATION.html
- %ProgramFiles%\Internet Explorer\MUI\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\chrome\browser\content\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\chrome\browser\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global-platform\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\DECRYPT_INFORMATION.html
- %CommonProgramFiles%\System\ado\msado20.tlb.new
- %ProgramFiles%\FireFox\chrome\browser\skin\classic\DECRYPT_INFORMATION.html
- %CommonProgramFiles%\System\ado\msado27.tlb.new
- %CommonProgramFiles%\System\ado\msado26.tlb.new
- %CommonProgramFiles%\System\ado\msado21.tlb.new
- %CommonProgramFiles%\SpeechEngines\Microsoft\TTS\1033\sam.spd.new
- %CommonProgramFiles%\SpeechEngines\Microsoft\TTS\1033\sam.sdf.new
- %ProgramFiles%\FireFox\chrome\browser\skin\DECRYPT_INFORMATION.html
- %CommonProgramFiles%\SpeechEngines\Microsoft\Lexicon\1033\r1033tts.lxa.new
- %CommonProgramFiles%\SpeechEngines\Microsoft\Lexicon\1033\ltts1033.lxa.new
- %CommonProgramFiles%\Microsoft Shared\Triedit\dhtmled.ocx.new
- %CommonProgramFiles%\Microsoft Shared\Speech\sapi.cpl.new
- %CommonProgramFiles%\Microsoft Shared\MSInfo\ieinfo5.ocx.new
- %ProgramFiles%\FireFox\chrome\browser\content\browser\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\chrome\en-US\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global\DECRYPT_INFORMATION.html
- <SYSTEM32>\dllcache\sam.sdf.new
- <SYSTEM32>\dllcache\sam.spd.new
- %ProgramFiles%\FireFox\chrome\en-US\locale\en-US\DECRYPT_INFORMATION.html
- <SYSTEM32>\dllcache\msado25.tlb.new
- <SYSTEM32>\dllcache\msado20.tlb.new
- <SYSTEM32>\dllcache\msado27.tlb.new
- <SYSTEM32>\dllcache\msado26.tlb.new
- <SYSTEM32>\dllcache\msado21.tlb.new
- %ProgramFiles%\FireFox\chrome\pippki\DECRYPT_INFORMATION.html
- %ProgramFiles%\FireFox\chrome\en-US\locale\en-US\mozapps\DECRYPT_INFORMATION.html
- %CommonProgramFiles%\System\ado\msado25.tlb.new
- <SYSTEM32>\dllcache\ltts1033.lxa.new
- <SYSTEM32>\dllcache\dhtmled.ocx.new
- %ProgramFiles%\FireFox\chrome\en-US\locale\browser\DECRYPT_INFORMATION.html
- <SYSTEM32>\dllcache\sapi.cpl.new
- <SYSTEM32>\dllcache\ieinfo5.ocx.new
- %ProgramFiles%\FireFox\chrome\en-US\locale\DECRYPT_INFORMATION.html
- <SYSTEM32>\dllcache\r1033tts.lxa.new
- C:\Muldrop\DECRYPT_INFORMATION.iunm_10
- C:\Muldrop\DECRYPT_INFORMATION.iunm_16
- C:\Muldrop\DECRYPT_INFORMATION.iunm_13
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\DECRYPT_INFORMATION.html
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\DECRYPT_INFORMATION.html
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\DECRYPT_INFORMATION.html
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\DECRYPT_INFORMATION.html
- C:\Documents and Settings\NetworkService\Application Data\DECRYPT_INFORMATION.html
- C:\Documents and Settings\NetworkService\DECRYPT_INFORMATION.html
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\DECRYPT_INFORMATION.html
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\DECRYPT_INFORMATION.html
- C:\Documents and Settings\LocalService\Local Settings\History\DECRYPT_INFORMATION.html
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\DECRYPT_INFORMATION.html
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\DECRYPT_INFORMATION.html
- C:\Documents and Settings\LocalService\Local Settings\Application Data\DECRYPT_INFORMATION.html
- C:\Documents and Settings\LocalService\Local Settings\DECRYPT_INFORMATION.html
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\DECRYPT_INFORMATION.html
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\DECRYPT_INFORMATION.html
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\DECRYPT_INFORMATION.html
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\DECRYPT_INFORMATION.html
- C:\Documents and Settings\NetworkService\Local Settings\History\DECRYPT_INFORMATION.html
- <LS_APPDATA>\Identities\DECRYPT_INFORMATION.html
- <LS_APPDATA>\DECRYPT_INFORMATION.html
- %HOMEPATH%\Local Settings\DECRYPT_INFORMATION.html
- %HOMEPATH%\Favorites\DECRYPT_INFORMATION.html
- %APPDATA%\Microsoft\SystemCertificates\My\DECRYPT_INFORMATION.html
- %APPDATA%\Microsoft\SystemCertificates\DECRYPT_INFORMATION.html
- %APPDATA%\Microsoft\Internet Explorer\DECRYPT_INFORMATION.html
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\DECRYPT_INFORMATION.html
- <LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\DECRYPT_INFORMATION.html
- %APPDATA%\Microsoft\Credentials\DECRYPT_INFORMATION.html
- %APPDATA%\Microsoft\DECRYPT_INFORMATION.html
- %APPDATA%\Identities\DECRYPT_INFORMATION.html
- %APPDATA%\DECRYPT_INFORMATION.html
- %HOMEPATH%\DECRYPT_INFORMATION.html
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\DECRYPT_INFORMATION.html
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\DECRYPT_INFORMATION.html
- %APPDATA%\Microsoft\Crypto\DECRYPT_INFORMATION.html
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\DECRYPT_INFORMATION.html
- %APPDATA%\Microsoft\Crypto\RSA\DECRYPT_INFORMATION.html
- C:\Documents and Settings\LocalService\Application Data\DECRYPT_INFORMATION.html
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\DECRYPT_INFORMATION.html
- %ALLUSERSPROFILE%\Documents\DECRYPT_INFORMATION.html
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\DECRYPT_INFORMATION.html
- %ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\DECRYPT_INFORMATION.html
- %ALLUSERSPROFILE%\Application Data\Microsoft\Network\DECRYPT_INFORMATION.html
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\DECRYPT_INFORMATION.html
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\DECRYPT_INFORMATION.html
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DECRYPT_INFORMATION.html
- %ALLUSERSPROFILE%\Application Data\Microsoft\DECRYPT_INFORMATION.html
- %ALLUSERSPROFILE%\Application Data\DECRYPT_INFORMATION.html
- %ALLUSERSPROFILE%\DECRYPT_INFORMATION.html
- C:\Documents and Settings\DECRYPT_INFORMATION.html
- C:\DECRYPT_INFORMATION.html
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_23ef5514-3059-436f-a4a7-4cefaab20eb1
- C:\Documents and Settings\Default User\UNIQUE_ID_DO_NOT_REMOVE
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\DECRYPT_INFORMATION.html
- %ALLUSERSPROFILE%\Documents\My Pictures\DECRYPT_INFORMATION.html
- %ALLUSERSPROFILE%\Start Menu\DECRYPT_INFORMATION.html
- %ALLUSERSPROFILE%\Start Menu\Programs\DECRYPT_INFORMATION.html
- C:\Documents and Settings\LocalService\DECRYPT_INFORMATION.html
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\DECRYPT_INFORMATION.html
- C:\Documents and Settings\Default User\Start Menu\Programs\DECRYPT_INFORMATION.html
- C:\Documents and Settings\Default User\Start Menu\DECRYPT_INFORMATION.html
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\DECRYPT_INFORMATION.html
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\DECRYPT_INFORMATION.html
- C:\Documents and Settings\Default User\Local Settings\History\DECRYPT_INFORMATION.html
- C:\Documents and Settings\LocalService\Application Data\Microsoft\DECRYPT_INFORMATION.html
- <LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\DECRYPT_INFORMATION.html
- C:\Documents and Settings\Default User\Local Settings\DECRYPT_INFORMATION.html
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\DECRYPT_INFORMATION.html
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\DECRYPT_INFORMATION.html
- C:\Documents and Settings\Default User\Application Data\Microsoft\DECRYPT_INFORMATION.html
- C:\Documents and Settings\Default User\Application Data\DECRYPT_INFORMATION.html
- C:\Documents and Settings\Default User\DECRYPT_INFORMATION.html
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\DECRYPT_INFORMATION.html
- C:\Documents and Settings\Default User\Local Settings\Application Data\DECRYPT_INFORMATION.html
- %ALLUSERSPROFILE%\Documents\My Music\DECRYPT_INFORMATION.html
- C:\Documents and Settings\NetworkService\Local Settings\DECRYPT_INFORMATION.html
- <LS_APPDATA>\Microsoft\DECRYPT_INFORMATION.html
- C:\Muldrop\DECRYPT_INFORMATION.iunm_12
- C:\Muldrop\DECRYPT_INFORMATION.iunm_14
- C:\Muldrop\DECRYPT_INFORMATION.iunm_75
- C:\Muldrop\DECRYPT_INFORMATION.iunm_33
- C:\Muldrop\DECRYPT_INFORMATION.iunm_55
- C:\Muldrop\DECRYPT_INFORMATION.iunm_7
- C:\Muldrop\DECRYPT_INFORMATION.iunm_28
- C:\Muldrop\DECRYPT_INFORMATION.iunm_5
- C:\Muldrop\DECRYPT_INFORMATION.iunm_67
- C:\Muldrop\DECRYPT_INFORMATION.iunm_24
- C:\Muldrop\DECRYPT_INFORMATION.iunm_39
- C:\Muldrop\DECRYPT_INFORMATION.iunm_51
- C:\Muldrop\DECRYPT_INFORMATION.iunm_36
- C:\Muldrop\DECRYPT_INFORMATION.iunm_34
- C:\Muldrop\DECRYPT_INFORMATION.iunm_11
- C:\Muldrop\DECRYPT_INFORMATION.iunm_22
- C:\Muldrop\DECRYPT_INFORMATION.iunm_54
- C:\Muldrop\DECRYPT_INFORMATION.iunm_25
- C:\Muldrop\DECRYPT_INFORMATION.iunm_37
- C:\Muldrop\DECRYPT_INFORMATION.iunm_2
- C:\Muldrop\DECRYPT_INFORMATION.iunm_35
- C:\Muldrop\DECRYPT_INFORMATION.iunm_56
- C:\Muldrop\DECRYPT_INFORMATION.iunm_48
- C:\Muldrop\DECRYPT_INFORMATION.iunm_85
- C:\Muldrop\DECRYPT_INFORMATION.iunm_76
- C:\Muldrop\DECRYPT_INFORMATION.iunm_3
- C:\Muldrop\DECRYPT_INFORMATION.iunm_45
- C:\Muldrop\DECRYPT_INFORMATION.iunm_32
- C:\Muldrop\DECRYPT_INFORMATION.iunm_66
- C:\Muldrop\DECRYPT_INFORMATION.iunm_70
- C:\Muldrop\DECRYPT_INFORMATION.iunm_49
- C:\Muldrop\DECRYPT_INFORMATION.iunm_65
- C:\Muldrop\DECRYPT_INFORMATION.iunm_101
- C:\Muldrop\DECRYPT_INFORMATION.iunm_40
- C:\Muldrop\DECRYPT_INFORMATION.iunm_17
- C:\Muldrop\DECRYPT_INFORMATION.iunm_15
- C:\Muldrop\DECRYPT_INFORMATION.iunm_57
- C:\Muldrop\DECRYPT_INFORMATION.iunm_29
- C:\Muldrop\DECRYPT_INFORMATION.iunm_100
- <LS_APPDATA>\Microsoft\Credentials\DECRYPT_INFORMATION.html
- C:\Far2\DECRYPT_INFORMATION.html
- C:\Far2\Plugins\Colorer\hrc\DECRYPT_INFORMATION.html
- C:\Far2\Plugins\Colorer\DECRYPT_INFORMATION.html
- C:\Far2\Plugins\DECRYPT_INFORMATION.html
- C:\Far2\Documentation\DECRYPT_INFORMATION.html
- C:\Far2\Addons\XLat\DECRYPT_INFORMATION.html
- C:\Far2\Addons\Colors\DECRYPT_INFORMATION.html
- C:\RECYCLER\DECRYPT_INFORMATION.html
- C:\Far2\Plugins\Colorer\hrd\DECRYPT_INFORMATION.html
- %HOMEPATH%\Start Menu\Programs\Accessories\DECRYPT_INFORMATION.html
- %HOMEPATH%\Start Menu\Programs\DECRYPT_INFORMATION.html
- %HOMEPATH%\Start Menu\DECRYPT_INFORMATION.html
- %HOMEPATH%\My Documents\DECRYPT_INFORMATION.html
- %HOMEPATH%\Local Settings\<INETFILES>\DECRYPT_INFORMATION.html
- %HOMEPATH%\Local Settings\History\History.IE5\DECRYPT_INFORMATION.html
- %HOMEPATH%\Local Settings\History\DECRYPT_INFORMATION.html
- C:\Far2\Addons\DECRYPT_INFORMATION.html
- %ProgramFiles%\MSN\MSNCoreFiles\DECRYPT_INFORMATION.html
- C:\Far2\Plugins\Colorer\hrd\console\DECRYPT_INFORMATION.html
- C:\Far2\Plugins\FTP\DECRYPT_INFORMATION.html
- C:\Far2\Plugins\ExtSearch\DECRYPT_INFORMATION.html
- C:\Muldrop\DECRYPT_INFORMATION.iunm_20
- C:\Muldrop\DECRYPT_INFORMATION.iunm_19
- C:\Muldrop\DECRYPT_INFORMATION.iunm_21
- C:\Muldrop\DECRYPT_INFORMATION.iunm_18
- C:\Muldrop\DECRYPT_INFORMATION.iunm_0
- C:\Muldrop\DECRYPT_INFORMATION.iunm_1
- C:\Far2\Plugins\ExtSearch\sources\DECRYPT_INFORMATION.html
- C:\Muldrop\DECRYPT_INFORMATION.iunm_27
- C:\Far2\Plugins\Colorer\hrc\auto\DECRYPT_INFORMATION.html
- C:\Muldrop\08f575673ddf10d72090304839888f02_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_0
- C:\Far2\PluginSDK\DECRYPT_INFORMATION.html
- C:\Far2\Plugins\WinSCP\putty\DECRYPT_INFORMATION.html
- C:\Far2\Plugins\WinSCP\packages\DECRYPT_INFORMATION.html
- C:\Far2\Plugins\WinSCP\filezilla\DECRYPT_INFORMATION.html
- C:\Far2\Plugins\WinSCP\DECRYPT_INFORMATION.html
- C:\Muldrop\DECRYPT_INFORMATION.iunm_102
- <STUBS_DIR>\DECRYPT_INFORMATION.html
Подменяет следующие файлы:
- <SYSTEM32>\dllcache\ieinfo5.ocx.new
- <SYSTEM32>\dllcache\dhtmled.ocx.new
Изменяет множество файлов пользовательских данных (Trojan.Encoder).
