Trojan.Encoder.25389

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Alcmeter' = '%TEMP%\rB0BQ15r0UNhapw.exe'
[<HKLM>\SOFTWARE\Classes\QXQJEVSDEYXMFBG\shell\open\command] '' = '%TEMP%\rB0BQ15r0UNhapw.exe'

Создает или изменяет следующие файлы:

%ALLUSERSPROFILE%\Start Menu\Programs\Startup\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Start Menu\Programs\Startup\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Start Menu\Programs\Startup\Shortcut to startup_local.lnk

Заражает следующие исполняемые файлы:

C:\Far2\Far.exe
%ProgramFiles%\MSN\MSNCoreFiles\Install\MSN9Components\Digcore.exe
%ProgramFiles%\MSN\MSNCoreFiles\Install\MSN9Components\Msncli.exe
%ProgramFiles%\MSN\MSNCoreFiles\Install\msnsusii.exe
%ProgramFiles%\MSN Gaming Zone\Windows\bckgzm.exe
%ProgramFiles%\MSN Gaming Zone\Windows\chkrzm.exe
%ProgramFiles%\MSN Gaming Zone\Windows\hrtzzm.exe
%ProgramFiles%\MSN Gaming Zone\Windows\Rvsezm.exe
%ProgramFiles%\MSN Gaming Zone\Windows\shvlzm.exe
%ProgramFiles%\MSN Gaming Zone\Windows\zClientm.exe
%ProgramFiles%\NetMeeting\cb32.exe
%ProgramFiles%\NetMeeting\conf.exe
%ProgramFiles%\NetMeeting\wb32.exe
%ProgramFiles%\Outlook Express\msimn.exe
%ProgramFiles%\Outlook Express\oemig50.exe
%ProgramFiles%\Outlook Express\setup50.exe
%ProgramFiles%\Outlook Express\wab.exe
%ProgramFiles%\Outlook Express\wabmig.exe
%ProgramFiles%\Windows Media Player\migrate.exe
%ProgramFiles%\Windows Media Player\mplayer2.exe
%ProgramFiles%\Windows Media Player\setup_wm.exe
%ProgramFiles%\Windows Media Player\wmplayer.exe
%ProgramFiles%\Windows NT\Accessories\wordpad.exe
%ProgramFiles%\Windows NT\dialer.exe
%ProgramFiles%\Movie Maker\moviemk.exe
%ProgramFiles%\Windows NT\hypertrm.exe
%ProgramFiles%\Messenger\msmsgs.exe
%ProgramFiles%\Internet Explorer\iedw.exe
%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE
%CommonProgramFiles%\Microsoft Shared\DW\DWTRIG20.EXE
%CommonProgramFiles%\Microsoft Shared\MSInfo\msinfo32.exe
%CommonProgramFiles%\Microsoft Shared\Speech\sapisvr.exe
%ProgramFiles%\FireFox\crashreporter.exe
%ProgramFiles%\FireFox\firefox.exe
%ProgramFiles%\FireFox\js.exe
%ProgramFiles%\FireFox\mangle.exe
%ProgramFiles%\FireFox\nsinstall.exe
%ProgramFiles%\FireFox\plugin-container.exe
%ProgramFiles%\FireFox\shlibsign.exe
%ProgramFiles%\FireFox\uninstall\helper.exe
%ProgramFiles%\FireFox\updater.exe
%ProgramFiles%\FireFox\xpcshell.exe
%ProgramFiles%\FireFox\xpidl.exe
%ProgramFiles%\FireFox\xpt_dump.exe
%ProgramFiles%\FireFox\xpt_link.exe
%ProgramFiles%\Internet Explorer\Connection Wizard\icwconn1.exe
%ProgramFiles%\Internet Explorer\Connection Wizard\icwconn2.exe
%ProgramFiles%\Internet Explorer\Connection Wizard\icwrmind.exe
%ProgramFiles%\Internet Explorer\Connection Wizard\icwtutor.exe
%ProgramFiles%\Internet Explorer\Connection Wizard\inetwiz.exe
%ProgramFiles%\Internet Explorer\Connection Wizard\isignup.exe
%ProgramFiles%\Internet Explorer\IEXPLORE.EXE
%ProgramFiles%\Windows NT\Pinball\PINBALL.EXE

Вредоносные функции:

Внедряет код в

следующие системные процессы:

%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\rB0BQ15r0UNhapw.exe
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\scrollbar\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\radio\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\printpreview\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\media\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\dirListing\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\console\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\checkbox\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\alerts\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\content\xbl-marquee\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\toolbar\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\content\satchel\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\content\passwordmgr\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\xpinstall\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\update\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\profile\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\preferences\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\plugins\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\handling\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\extensions\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\downloads\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\res\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\content\global\cpow\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\tree\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\downloads\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\tree\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\toolbar\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\splitter\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\scrollbar\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\radio\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\printpreview\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\media\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\dirListing\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\console\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\content\global\xml\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\splitter\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\alerts\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\xpinstall\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\viewsource\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\update\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\profile\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\plugins\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\places\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\passwordmgr\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\handling\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\downloads\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\content\global\svg\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\handling\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\browser\places\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global\layout\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global\dom\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\cookie\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\autoconfig\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\alerts\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\browser-region\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\browser\sidebar\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\browser\safebrowsing\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\browser\preferences\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global\search\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global\security\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\browser\downloads\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\browser\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\branding\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\skin\classic\communicator\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\tabview\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\tabbrowser\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\preferences\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\places\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\feeds\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\browser\feeds\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\checkbox\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global\svg\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\mozapps\update\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\mozapps\xpinstall\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\content\global\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\content\cookie\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\pippki\content\pippki\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\feedback\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\services\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\places\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\pippki\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\pipnss\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\passwordmgr\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\necko\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\content\global\alerts\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global\xml\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global\xpinstall\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\mozapps\preferences\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\mozapps\plugins\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\mozapps\handling\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\mozapps\extensions\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\mozapps\downloads\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global-region\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global-platform\win\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global-platform\unix\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global-platform\mac\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global\xslt\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\mozapps\profile\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\ExtSearch\keys\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\passwordmgr\HOW TO DECRYPT FILES.txt
%ProgramFiles%\NetMeeting\conf.exe.new
<SYSTEM32>\dllcache\iexplore.exe.new
%ProgramFiles%\NetMeeting\cb32.exe.new
%ProgramFiles%\Windows NT\Pinball\HOW TO DECRYPT FILES.txt
<SYSTEM32>\dllcache\iedw.exe.new
<SYSTEM32>\dllcache\isignup.exe.new
<SYSTEM32>\dllcache\inetwiz.exe.new
<SYSTEM32>\dllcache\icwtutor.exe.new
%ProgramFiles%\Windows NT\HOW TO DECRYPT FILES.txt
<SYSTEM32>\dllcache\icwrmind.exe.new
<SYSTEM32>\dllcache\icwconn2.exe.new
<SYSTEM32>\dllcache\moviemk.exe.new
%ProgramFiles%\Windows NT\Accessories\HOW TO DECRYPT FILES.txt
%ProgramFiles%\MSN Gaming Zone\Windows\zclientm.exe.new
%ProgramFiles%\MSN Gaming Zone\Windows\shvlzm.exe.new
%ProgramFiles%\MSN Gaming Zone\Windows\rvsezm.exe.new
%ProgramFiles%\MSN Gaming Zone\Windows\hrtzzm.exe.new
%ProgramFiles%\Windows Media Player\Skins\HOW TO DECRYPT FILES.txt
%ProgramFiles%\MSN Gaming Zone\Windows\chkrzm.exe.new
%ProgramFiles%\MSN Gaming Zone\Windows\bckgzm.exe.new
%ProgramFiles%\Windows Media Player\HOW TO DECRYPT FILES.txt
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\HOW TO DECRYPT FILES.txt
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HOW TO DECRYPT FILES.txt
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\HOW TO DECRYPT FILES.txt
<SYSTEM32>\dllcache\icwconn1.exe.new
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\HOW TO DECRYPT FILES.txt
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\HOW TO DECRYPT FILES.txt
<STUBS_DIR>\AVGCTRL\HOW TO DECRYPT FILES.txt
<STUBS_DIR>\AVGCC32\HOW TO DECRYPT FILES.txt
<STUBS_DIR>\avgcc\HOW TO DECRYPT FILES.txt
<STUBS_DIR>\ashAvSrv\HOW TO DECRYPT FILES.txt
<STUBS_DIR>\ashAvast\HOW TO DECRYPT FILES.txt
<STUBS_DIR>\ash\HOW TO DECRYPT FILES.txt
<STUBS_DIR>\aion\HOW TO DECRYPT FILES.txt
%ProgramFiles%\Windows NT\Accessories\wordpad.exe.new
<STUBS_DIR>\ageofconan\HOW TO DECRYPT FILES.txt
%ProgramFiles%\Windows Media Player\wmplayer.exe.new
<SYSTEM32>\dllcache\zclientm.exe.new
%ProgramFiles%\Outlook Express\msimn.exe.new
%ProgramFiles%\NetMeeting\wb32.exe.new
<SYSTEM32>\dllcache\rvsezm.exe.new
<SYSTEM32>\dllcache\hrtzzm.exe.new
<SYSTEM32>\dllcache\chkrzm.exe.new
%ProgramFiles%\Windows Media Player\setup_wm.exe.new
C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\HOW TO DECRYPT FILES.txt
<SYSTEM32>\dllcache\bckgzm.exe.new
%ProgramFiles%\Windows Media Player\mplayer2.exe.new
%ProgramFiles%\Windows Media Player\migrate.exe.new
%ProgramFiles%\Outlook Express\wabmig.exe.new
%ProgramFiles%\Outlook Express\wab.exe.new
%ProgramFiles%\Outlook Express\setup50.exe.new
<STUBS_DIR>\360tray\HOW TO DECRYPT FILES.txt
%ProgramFiles%\Outlook Express\oemig50.exe.new
%ProgramFiles%\FireFox\chrome\en-US\locale\browser\migration\HOW TO DECRYPT FILES.txt
%ProgramFiles%\Outlook Express\HOW TO DECRYPT FILES.txt
%ProgramFiles%\MSN Gaming Zone\Windows\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\res\html\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\res\fonts\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\res\entityTables\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\res\dtd\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\res\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\modules\tabview\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\modules\services-sync\ext\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\modules\services-sync\engines\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\modules\services-sync\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\modules\services-crypto\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\uninstall\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\modules\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\dictionaries\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\defaults\profile\chrome\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\defaults\profile\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\defaults\pref\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\defaults\autoconfig\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\components\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\xpinstall\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\viewsource\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\update\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\profile\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\plugins\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\HOW TO DECRYPT FILES.txt
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\places\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\searchplugins\HOW TO DECRYPT FILES.txt
%ProgramFiles%\Online Services\HOW TO DECRYPT FILES.txt
%ProgramFiles%\Movie Maker\moviemk.exe.new
%ProgramFiles%\Internet Explorer\iexplore.exe.new
%ProgramFiles%\Internet Explorer\iedw.exe.new
%ProgramFiles%\Internet Explorer\Connection Wizard\isignup.exe.new
%ProgramFiles%\Internet Explorer\Connection Wizard\inetwiz.exe.new
%ProgramFiles%\Internet Explorer\Connection Wizard\icwtutor.exe.new
%ProgramFiles%\Internet Explorer\Connection Wizard\icwrmind.exe.new
%ProgramFiles%\Internet Explorer\Connection Wizard\icwconn2.exe.new
%ProgramFiles%\Internet Explorer\Connection Wizard\icwconn1.exe.new
%ProgramFiles%\NetMeeting\HOW TO DECRYPT FILES.txt
%ProgramFiles%\Internet Explorer\HOW TO DECRYPT FILES.txt
%ProgramFiles%\Internet Explorer\Connection Wizard\HOW TO DECRYPT FILES.txt
%ProgramFiles%\MSN\MSNCoreFiles\Install\MSN9Components\HOW TO DECRYPT FILES.txt
%ProgramFiles%\MSN\MSNCoreFiles\Install\HOW TO DECRYPT FILES.txt
%ProgramFiles%\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\HOW TO DECRYPT FILES.txt
%ProgramFiles%\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\HOW TO DECRYPT FILES.txt
%ProgramFiles%\Movie Maker\Shared\Profiles\HOW TO DECRYPT FILES.txt
%ProgramFiles%\Movie Maker\Shared\HOW TO DECRYPT FILES.txt
%ProgramFiles%\Movie Maker\MUI\0409\HOW TO DECRYPT FILES.txt
%ProgramFiles%\Movie Maker\HOW TO DECRYPT FILES.txt
%ProgramFiles%\Microsoft.NET\RedistList\HOW TO DECRYPT FILES.txt
%ProgramFiles%\Messenger\HOW TO DECRYPT FILES.txt
%ProgramFiles%\Internet Explorer\SIGNUP\HOW TO DECRYPT FILES.txt
%ProgramFiles%\MSN\MSNCoreFiles\OOBE\HOW TO DECRYPT FILES.txt
%ProgramFiles%\Internet Explorer\MUI\0409\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\tabview\HOW TO DECRYPT FILES.txt
<SYSTEM32>\dllcache\sapisvr.exe.new
<SYSTEM32>\dllcache\msinfo32.exe.new
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\HOW TO DECRYPT FILES.txt
%APPDATA%\Microsoft\Windows\Themes\HOW TO DECRYPT FILES.txt
%APPDATA%\Microsoft\Media Player\HOW TO DECRYPT FILES.txt
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\HOW TO DECRYPT FILES.txt
%APPDATA%\Microsoft\Internet Explorer\HOW TO DECRYPT FILES.txt
%APPDATA%\Microsoft\Address Book\HOW TO DECRYPT FILES.txt
%APPDATA%\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\HOW TO DECRYPT FILES.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\BGGTYMH1\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\History\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\MOE00UY1\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\LBMMC3H3\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\CJCTQ25G\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\HOW TO DECRYPT FILES.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Local Settings\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Local Settings\History\HOW TO DECRYPT FILES.txt
%HOMEPATH%\My Documents\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Local Settings\<INETFILES>\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\HOW TO DECRYPT FILES.txt
%TEMP%\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Local Settings\History\History.IE5\HOW TO DECRYPT FILES.txt
%HOMEPATH%\My Documents\My Music\HOW TO DECRYPT FILES.txt
%APPDATA%\Mozilla\Firefox\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Cookies\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\Microsoft\Windows Media\9.0\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\Microsoft\Windows\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\Microsoft\Media Player\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Favorites\Links\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Favorites\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\VMware\HOW TO DECRYPT FILES.txt
<STUBS_DIR>\AVP\HOW TO DECRYPT FILES.txt
%HOMEPATH%\My Documents\My Pictures\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\DRM\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Documents\My Videos\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Documents\My Pictures\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\History\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Documents\My Music\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Documents\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Pbk\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Player\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Dr Watson\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Application Data\HOW TO DECRYPT FILES.txt
<Текущая директория>\HOW TO DECRYPT FILES.txt
C:\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Games\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Cookies\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Application Data\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Cookies\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Templates\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Start Menu\Programs\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Start Menu\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\SendTo\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\History\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\HOW TO DECRYPT FILES.txt
<SYSTEM32>\dllcache\shvlzm.exe.new
%HOMEPATH%\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Start Menu\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Services\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\MSSoap\Binaries\Resources\1033\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\MSSoap\Binaries\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\1033\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\Web Folders\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\VGX\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\VC\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\Triedit\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\TextConv\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\Stationery\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Recent\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\Speech\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\MSInfo\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\3082\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\2052\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1042\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1041\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1040\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1036\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1033\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1031\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1028\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\Speech\1033\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1025\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DAO\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\System\ado\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\SpeechEngines\Microsoft\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\tabbrowser\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\preferences\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\places\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\feeds\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\search\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\safebrowsing\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\places\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\SpeechEngines\Microsoft\TTS\1033\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\migration\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\SpeechEngines\Microsoft\Lexicon\1033\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\certerror\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\bookmarks\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\Speech\sapisvr.exe.new
%ProgramFiles%\FireFox\chrome\browser\content\branding\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\MSInfo\msinfo32.exe.new
%ProgramFiles%\FireFox\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\System\Ole DB\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\System\msadc\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\System\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\history\HOW TO DECRYPT FILES.txt
%HOMEPATH%\SendTo\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\feeds\HOW TO DECRYPT FILES.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Brackets\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\AutoWrap\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\arclite\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Align\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\7-Zip\HOW TO DECRYPT FILES.txt
C:\Far2\FExcept\HOW TO DECRYPT FILES.txt
C:\Far2\Encyclopedia\HOW TO DECRYPT FILES.txt
C:\Far2\Documentation\rus\HOW TO DECRYPT FILES.txt
C:\Far2\Documentation\eng\HOW TO DECRYPT FILES.txt
C:\Far2\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\XLat\Russian\HOW TO DECRYPT FILES.txt
C:\Far2\PluginSDK\Headers.c\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\XLat\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\SetUp\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\Macros\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\Colors\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\Colors\Default Highlighting\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\Colors\Custom Highlighting\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Templates\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Start Menu\Programs\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Start Menu\Programs\Accessories\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\Shell\HOW TO DECRYPT FILES.txt
C:\Muldrop\HOW TO DECRYPT FILES.txt
C:\Far2\PluginSDK\Headers.pas\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\hrc\auto\types\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\WinSCP\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\TmpPanel\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\ProcList\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Network\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\MacroView\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\HlfViewer\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\FTP\lib\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\FTP\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\FileCase\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\FarCmds\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\hrc\auto\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\ExtSearch\sources\RegExp\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\bin\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\ExtSearch\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\ExtSearch\doc\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\EMenu\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\EditCase\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\DrawLine\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Compare\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\hrd\console\contrib\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\hrd\console\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\hrd\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\hrc\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\ExtSearch\sources\HOW TO DECRYPT FILES.txt
<STUBS_DIR>\AVP32\HOW TO DECRYPT FILES.txt

Присваивает атрибут 'скрытый' для следующих файлов:

<Полный путь к файлу>

Перемещает следующие файлы:

%APPDATA%\Microsoft\Internet Explorer\brndlog.txt в %APPDATA%\Microsoft\Internet Explorer\brndlog.txt.XmUyNTrN
%ProgramFiles%\NetMeeting\TestSnd.wav в %ProgramFiles%\NetMeeting\TestSnd.wav.XmUyNTrN
%ProgramFiles%\NetMeeting\wb32.exe в %ProgramFiles%\NetMeeting\wb32.exe.XmUyNTrN
%ProgramFiles%\Online Services\Refer me to more Internet Service Providers.lnk в %ProgramFiles%\Online Services\Refer me to more Internet Service Providers.lnk.XmUyNTrN
%ProgramFiles%\Online Services\Use MSN Explorer to sign up for Internet Access (US only).lnk в %ProgramFiles%\Online Services\Use MSN Explorer to sign up for Internet Access (US only).lnk.XmUyNTrN
%ProgramFiles%\Outlook Express\msimn.exe в %ProgramFiles%\Outlook Express\msimn.exe.XmUyNTrN
%ProgramFiles%\Outlook Express\msoe.txt в %ProgramFiles%\Outlook Express\msoe.txt.XmUyNTrN
%ProgramFiles%\Outlook Express\oemig50.exe в %ProgramFiles%\Outlook Express\oemig50.exe.XmUyNTrN
%ProgramFiles%\Outlook Express\setup50.exe в %ProgramFiles%\Outlook Express\setup50.exe.XmUyNTrN
%ProgramFiles%\Outlook Express\wab.exe в %ProgramFiles%\Outlook Express\wab.exe.XmUyNTrN
%ProgramFiles%\Outlook Express\wabmig.exe в %ProgramFiles%\Outlook Express\wabmig.exe.XmUyNTrN
%ProgramFiles%\Windows Media Player\migrate.exe в %ProgramFiles%\Windows Media Player\migrate.exe.XmUyNTrN
%ProgramFiles%\Windows Media Player\mplayer2.exe в %ProgramFiles%\Windows Media Player\mplayer2.exe.XmUyNTrN
%ProgramFiles%\Windows Media Player\setup_wm.exe в %ProgramFiles%\Windows Media Player\setup_wm.exe.XmUyNTrN
%ProgramFiles%\Windows Media Player\wmplayer.exe в %ProgramFiles%\Windows Media Player\wmplayer.exe.XmUyNTrN
%ProgramFiles%\Windows NT\Accessories\wordpad.exe в %ProgramFiles%\Windows NT\Accessories\wordpad.exe.XmUyNTrN
%ProgramFiles%\Windows NT\dialer.exe в %ProgramFiles%\Windows NT\dialer.exe.XmUyNTrN
%ProgramFiles%\Windows NT\hypertrm.exe в %ProgramFiles%\Windows NT\hypertrm.exe.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\PINBALL.EXE в %ProgramFiles%\Windows NT\Pinball\PINBALL.EXE.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND1.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND1.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND104.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND104.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND105.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND105.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND108.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND108.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND111.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND111.WAV.XmUyNTrN
%ProgramFiles%\NetMeeting\conf.exe в %ProgramFiles%\NetMeeting\conf.exe.XmUyNTrN
%ProgramFiles%\Internet Explorer\Connection Wizard\icwconn2.exe в %ProgramFiles%\Internet Explorer\Connection Wizard\icwconn2.exe.XmUyNTrN
%ProgramFiles%\NetMeeting\cb32.exe в %ProgramFiles%\NetMeeting\cb32.exe.XmUyNTrN
%ProgramFiles%\MSN Gaming Zone\Windows\zClientm.exe в %ProgramFiles%\MSN Gaming Zone\Windows\zClientm.exe.XmUyNTrN
%ProgramFiles%\Internet Explorer\Connection Wizard\icwtutor.exe в %ProgramFiles%\Internet Explorer\Connection Wizard\icwtutor.exe.XmUyNTrN
%ProgramFiles%\Internet Explorer\Connection Wizard\inetwiz.exe в %ProgramFiles%\Internet Explorer\Connection Wizard\inetwiz.exe.XmUyNTrN
%ProgramFiles%\Internet Explorer\Connection Wizard\isignup.exe в %ProgramFiles%\Internet Explorer\Connection Wizard\isignup.exe.XmUyNTrN
%ProgramFiles%\Internet Explorer\iedw.exe в %ProgramFiles%\Internet Explorer\iedw.exe.XmUyNTrN
%ProgramFiles%\Internet Explorer\IEXPLORE.EXE в %ProgramFiles%\Internet Explorer\IEXPLORE.EXE.XmUyNTrN
%ProgramFiles%\Messenger\logowin.gif в %ProgramFiles%\Messenger\logowin.gif.XmUyNTrN
%ProgramFiles%\Messenger\lvback.gif в %ProgramFiles%\Messenger\lvback.gif.XmUyNTrN
%ProgramFiles%\Messenger\msmsgs.exe в %ProgramFiles%\Messenger\msmsgs.exe.XmUyNTrN
%ProgramFiles%\Messenger\newalert.wav в %ProgramFiles%\Messenger\newalert.wav.XmUyNTrN
%ProgramFiles%\Messenger\newemail.wav в %ProgramFiles%\Messenger\newemail.wav.XmUyNTrN
%ProgramFiles%\Messenger\online.wav в %ProgramFiles%\Messenger\online.wav.XmUyNTrN
%ProgramFiles%\Messenger\type.wav в %ProgramFiles%\Messenger\type.wav.XmUyNTrN
%ProgramFiles%\Movie Maker\moviemk.exe в %ProgramFiles%\Movie Maker\moviemk.exe.XmUyNTrN
%ProgramFiles%\Movie Maker\Shared\Empty.txt в %ProgramFiles%\Movie Maker\Shared\Empty.txt.XmUyNTrN
%ProgramFiles%\Movie Maker\Shared\Profiles\Blank.txt в %ProgramFiles%\Movie Maker\Shared\Profiles\Blank.txt.XmUyNTrN
%ProgramFiles%\MSN\MSNCoreFiles\Install\MSN9Components\Digcore.exe в %ProgramFiles%\MSN\MSNCoreFiles\Install\MSN9Components\Digcore.exe.XmUyNTrN
%ProgramFiles%\MSN\MSNCoreFiles\Install\MSN9Components\Msncli.exe в %ProgramFiles%\MSN\MSNCoreFiles\Install\MSN9Components\Msncli.exe.XmUyNTrN
%ProgramFiles%\MSN\MSNCoreFiles\Install\msnsusii.exe в %ProgramFiles%\MSN\MSNCoreFiles\Install\msnsusii.exe.XmUyNTrN
%ProgramFiles%\MSN Gaming Zone\Windows\bckgzm.exe в %ProgramFiles%\MSN Gaming Zone\Windows\bckgzm.exe.XmUyNTrN
%ProgramFiles%\MSN Gaming Zone\Windows\chkrzm.exe в %ProgramFiles%\MSN Gaming Zone\Windows\chkrzm.exe.XmUyNTrN
%ProgramFiles%\MSN Gaming Zone\Windows\hrtzzm.exe в %ProgramFiles%\MSN Gaming Zone\Windows\hrtzzm.exe.XmUyNTrN
%ProgramFiles%\MSN Gaming Zone\Windows\Rvsezm.exe в %ProgramFiles%\MSN Gaming Zone\Windows\Rvsezm.exe.XmUyNTrN
%ProgramFiles%\MSN Gaming Zone\Windows\shvlzm.exe в %ProgramFiles%\MSN Gaming Zone\Windows\shvlzm.exe.XmUyNTrN
%ProgramFiles%\NetMeeting\Blip.wav в %ProgramFiles%\NetMeeting\Blip.wav.XmUyNTrN
%ProgramFiles%\Internet Explorer\Connection Wizard\icwrmind.exe в %ProgramFiles%\Internet Explorer\Connection Wizard\icwrmind.exe.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND112.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND112.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND136.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND136.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND43.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND43.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND45.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND45.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND49.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND49.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND49D.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND49D.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND5.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND5.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND50.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND50.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND528.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND528.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND53.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND53.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND54.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND54.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND55.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND55.WAV.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\radio\radio-check.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\radio\radio-check.gif.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND560.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND560.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND57.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND57.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND58.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND58.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND6.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND6.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND65.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND65.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND68.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND68.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND7.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND7.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND713.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND713.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND735.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND735.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND8.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND8.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND827.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND827.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND4.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND4.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND42.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND42.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND13.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND13.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND12.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND12.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND36.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND36.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND14.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND14.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND16.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND16.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND17.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND17.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND18.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND18.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND181.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND181.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND19.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND19.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND20.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND20.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND21.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND21.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND22.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND22.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND24.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND24.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND240.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND240.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND243.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND243.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND25.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND25.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND26.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND26.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND27.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND27.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND28.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND28.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND29.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND29.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND3.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND3.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND30.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND30.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND34.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND34.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND35.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND35.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND38.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND38.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND131.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND131.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND39.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND39.WAV.XmUyNTrN
%ProgramFiles%\Internet Explorer\Connection Wizard\icwconn1.exe в %ProgramFiles%\Internet Explorer\Connection Wizard\icwconn1.exe.XmUyNTrN
%ProgramFiles%\FireFox\xpt_link.exe в %ProgramFiles%\FireFox\xpt_link.exe.XmUyNTrN
%ProgramFiles%\FireFox\xpt_dump.exe в %ProgramFiles%\FireFox\xpt_dump.exe.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\Close.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\Close.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\Minimize.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\Minimize.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\Restore.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\Restore.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\radio\radio-check-dis.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\radio\radio-check-dis.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\radio\radio-check.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\radio\radio-check.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\scrollbar\slider.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\scrollbar\slider.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\splitter\grip-bottom.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\splitter\grip-bottom.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\splitter\grip-left.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\splitter\grip-left.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\splitter\grip-right.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\splitter\grip-right.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\splitter\grip-top.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\splitter\grip-top.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\toolbar\chevron.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\toolbar\chevron.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\tree\columnpicker.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\tree\columnpicker.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-dn-dis.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-dn-dis.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-dn-hov.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-dn-hov.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-dn-sharp.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-dn-sharp.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-dn.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-dn.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-lft-dis.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-lft-dis.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-lft-hov.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-lft-hov.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-lft-sharp-end.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-lft-sharp-end.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-lft-sharp.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-lft-sharp.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-lft.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-lft.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-rit-dis.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-rit-dis.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\console\console-error-caret.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\console\console-error-caret.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-rit-hov.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-rit-hov.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\checkbox\cbox-check.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\checkbox\cbox-check.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-up.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-up.gif.XmUyNTrN
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk в %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk.XmUyNTrN
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk в %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk.XmUyNTrN
%TEMP%\rB0BQ15r0UNhapw.exe в %TEMP%\rB0BQ15r0UNhapw.exe.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\content\global\notfound.wav в %ProgramFiles%\FireFox\chrome\toolkit\content\global\notfound.wav.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\res\arrow.gif в %ProgramFiles%\FireFox\chrome\toolkit\res\arrow.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\res\arrowd.gif в %ProgramFiles%\FireFox\chrome\toolkit\res\arrowd.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-dn-dis.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-dn-dis.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-dn-hov.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-dn-hov.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-dn-sharp.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-dn-sharp.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-dn.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-dn.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-lft-dis.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-lft-dis.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-lft-hov.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-lft-hov.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-lft-sharp-end.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-lft-sharp-end.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-lft-sharp.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-lft-sharp.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-lft.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-lft.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-rit-dis.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-rit-dis.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-rit-hov.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-rit-hov.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-rit-sharp-end.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-rit-sharp-end.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-rit-sharp.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-rit-sharp.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-rit.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-rit.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-up-dis.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-up-dis.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-up-hov.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-up-hov.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-up-sharp.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-up-sharp.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\checkbox\cbox-check-dis.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\checkbox\cbox-check-dis.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-rit-sharp-end.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-rit-sharp-end.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\console\console-error-dash.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\console\console-error-dash.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-rit-sharp.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-rit-sharp.gif.XmUyNTrN
%ProgramFiles%\FireFox\res\table-add-column-after-active.gif в %ProgramFiles%\FireFox\res\table-add-column-after-active.gif.XmUyNTrN
%ProgramFiles%\FireFox\res\table-add-column-after.gif в %ProgramFiles%\FireFox\res\table-add-column-after.gif.XmUyNTrN
%ProgramFiles%\FireFox\res\table-add-column-before-active.gif в %ProgramFiles%\FireFox\res\table-add-column-before-active.gif.XmUyNTrN
%ProgramFiles%\FireFox\res\table-add-column-before-hover.gif в %ProgramFiles%\FireFox\res\table-add-column-before-hover.gif.XmUyNTrN
%ProgramFiles%\FireFox\res\table-add-column-before.gif в %ProgramFiles%\FireFox\res\table-add-column-before.gif.XmUyNTrN
%ProgramFiles%\FireFox\res\table-add-row-after-active.gif в %ProgramFiles%\FireFox\res\table-add-row-after-active.gif.XmUyNTrN
%ProgramFiles%\FireFox\res\table-add-row-after-hover.gif в %ProgramFiles%\FireFox\res\table-add-row-after-hover.gif.XmUyNTrN
%ProgramFiles%\FireFox\res\table-add-row-after.gif в %ProgramFiles%\FireFox\res\table-add-row-after.gif.XmUyNTrN
%ProgramFiles%\FireFox\res\table-add-row-before-active.gif в %ProgramFiles%\FireFox\res\table-add-row-before-active.gif.XmUyNTrN
%ProgramFiles%\FireFox\res\table-add-row-before-hover.gif в %ProgramFiles%\FireFox\res\table-add-row-before-hover.gif.XmUyNTrN
%ProgramFiles%\FireFox\res\table-add-row-before.gif в %ProgramFiles%\FireFox\res\table-add-row-before.gif.XmUyNTrN
%ProgramFiles%\FireFox\res\table-remove-column-active.gif в %ProgramFiles%\FireFox\res\table-remove-column-active.gif.XmUyNTrN
%ProgramFiles%\FireFox\res\table-remove-column-hover.gif в %ProgramFiles%\FireFox\res\table-remove-column-hover.gif.XmUyNTrN
%ProgramFiles%\FireFox\res\table-remove-column.gif в %ProgramFiles%\FireFox\res\table-remove-column.gif.XmUyNTrN
%ProgramFiles%\FireFox\res\table-remove-row-active.gif в %ProgramFiles%\FireFox\res\table-remove-row-active.gif.XmUyNTrN
%ProgramFiles%\FireFox\res\table-remove-row-hover.gif в %ProgramFiles%\FireFox\res\table-remove-row-hover.gif.XmUyNTrN
%ProgramFiles%\FireFox\res\table-remove-row.gif в %ProgramFiles%\FireFox\res\table-remove-row.gif.XmUyNTrN
%ProgramFiles%\FireFox\shlibsign.exe в %ProgramFiles%\FireFox\shlibsign.exe.XmUyNTrN
%ProgramFiles%\FireFox\uninstall\helper.exe в %ProgramFiles%\FireFox\uninstall\helper.exe.XmUyNTrN
%ProgramFiles%\FireFox\updater.exe в %ProgramFiles%\FireFox\updater.exe.XmUyNTrN
%ProgramFiles%\FireFox\xpcshell.exe в %ProgramFiles%\FireFox\xpcshell.exe.XmUyNTrN
%ProgramFiles%\FireFox\xpidl.exe в %ProgramFiles%\FireFox\xpidl.exe.XmUyNTrN
%ProgramFiles%\FireFox\res\grabber.gif в %ProgramFiles%\FireFox\res\grabber.gif.XmUyNTrN
%ProgramFiles%\FireFox\plugin-container.exe в %ProgramFiles%\FireFox\plugin-container.exe.XmUyNTrN
%ProgramFiles%\FireFox\res\table-add-column-after-hover.gif в %ProgramFiles%\FireFox\res\table-add-column-after-hover.gif.XmUyNTrN
%ProgramFiles%\FireFox\README.txt в %ProgramFiles%\FireFox\README.txt.XmUyNTrN
%ProgramFiles%\FireFox\nsinstall.exe в %ProgramFiles%\FireFox\nsinstall.exe.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-rit.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-rit.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-up-hov.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-up-hov.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-up-sharp.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-up-sharp.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-up.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-up.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\checkbox\cbox-check-dis.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\checkbox\cbox-check-dis.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\checkbox\cbox-check.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\checkbox\cbox-check.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\console\console-error-caret.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\console\console-error-caret.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\console\console-error-dash.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\console\console-error-dash.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\Close.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\Close.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\Minimize.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\Minimize.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\Restore.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\Restore.gif.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND9.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND9.WAV.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND563.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND563.WAV.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\radio\radio-check-dis.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\radio\radio-check-dis.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\splitter\grip-bottom.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\splitter\grip-bottom.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\splitter\grip-left.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\splitter\grip-left.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\splitter\grip-right.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\splitter\grip-right.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\splitter\grip-top.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\splitter\grip-top.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\toolbar\chevron.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\toolbar\chevron.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\tree\columnpicker.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\tree\columnpicker.gif.XmUyNTrN
%ProgramFiles%\FireFox\crashreporter.exe в %ProgramFiles%\FireFox\crashreporter.exe.XmUyNTrN
%ProgramFiles%\FireFox\firefox.exe в %ProgramFiles%\FireFox\firefox.exe.XmUyNTrN
%ProgramFiles%\FireFox\js.exe в %ProgramFiles%\FireFox\js.exe.XmUyNTrN
%ProgramFiles%\FireFox\mangle.exe в %ProgramFiles%\FireFox\mangle.exe.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-up-dis.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-up-dis.gif.XmUyNTrN
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\scrollbar\slider.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\scrollbar\slider.gif.XmUyNTrN
%ProgramFiles%\Windows NT\Pinball\SOUND999.WAV в %ProgramFiles%\Windows NT\Pinball\SOUND999.WAV.XmUyNTrN

Подменяет следующие файлы:

<SYSTEM32>\dllcache\msinfo32.exe.new
<SYSTEM32>\dllcache\rvsezm.exe.new
<SYSTEM32>\dllcache\hrtzzm.exe.new
<SYSTEM32>\dllcache\chkrzm.exe.new
<SYSTEM32>\dllcache\bckgzm.exe.new
<SYSTEM32>\dllcache\moviemk.exe.new
<SYSTEM32>\dllcache\iexplore.exe.new
<SYSTEM32>\dllcache\shvlzm.exe.new
<SYSTEM32>\dllcache\iedw.exe.new
<SYSTEM32>\dllcache\inetwiz.exe.new
<SYSTEM32>\dllcache\icwtutor.exe.new
<SYSTEM32>\dllcache\icwrmind.exe.new
<SYSTEM32>\dllcache\icwconn2.exe.new
<SYSTEM32>\dllcache\icwconn1.exe.new
<SYSTEM32>\dllcache\sapisvr.exe.new
<SYSTEM32>\dllcache\isignup.exe.new
<SYSTEM32>\dllcache\zclientm.exe.new

Создает файлы с требованием оплатить расшифровку файлов (Trojan.Encoder).

Изменяет множество файлов пользовательских данных (Trojan.Encoder).

Изменяет расширения файлов пользовательских данных (Trojan.Encoder).

Другое:

Запускает на исполнение:

'%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe'

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней