Trojan.Encoder.29688

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\] 'unlock' = '"c:\Decoding help.hta"'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\] 'searchfiles' = '%WINDIR%\searchfiles.exe'
[<HKLM>\Software\Classes\.[ID]MUsnD0o3adbBXHM9[ID]\shell\open\command] '' = '%WINDIR%\SysWow64\mshta.exe "c:\Decoding help.hta"'

Заражает следующие исполняемые файлы

%CommonProgramFiles(x86)%\steam\steamservice.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles(x86)%\k-lite codec pack\filters\vsfilter.dll.[id]musnd0o3adbbxhm9[id]
%ProgramFiles(x86)%\k-lite codec pack\tools\codectweaktool.exe.[id]musnd0o3adbbxhm9[id]
%CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\osppobjs.dll.[id]musnd0o3adbbxhm9[id]
%CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\osppsvc.exe.[id]musnd0o3adbbxhm9[id]
%CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\osppwmi.dll.[id]musnd0o3adbbxhm9[id]
%ProgramFiles(x86)%\k-lite codec pack\mpc-hc64\d3dcompiler_43.dll.[id]musnd0o3adbbxhm9[id]
%CommonProgramFiles(x86)%\microsoft shared\help\msenv.dll.[id]musnd0o3adbbxhm9[id]
%CommonProgramFiles(x86)%\microsoft shared\textconv\wksconv\wkconv.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles(x86)%\microsoft analysis services\as oledb\10\msmdlocal.dll.[id]musnd0o3adbbxhm9[id]

Создает следующие файлы на съемном носителе

<Имя диска съемного носителя>:\decoding help.hta
<Имя диска съемного носителя>:\split.avi
<Имя диска съемного носителя>:\000814251_video_01.avi
<Имя диска съемного носителя>:\join.avi
<Имя диска съемного носителя>:\default.bmp
<Имя диска съемного носителя>:\dialmap.bmp
<Имя диска съемного носителя>:\coffee.bmp
<Имя диска съемного носителя>:\dashborder_192.bmp
<Имя диска съемного носителя>:\sdksampleprivdeveloper.cer
<Имя диска съемного носителя>:\sdkfailsafeemulator.cer
<Имя диска съемного носителя>:\contoso.cer
<Имя диска съемного носителя>:\tcm851ax32.exe

Вредоносные функции

Для затруднения выявления своего присутствия в системе

блокирует:

Средство контроля пользовательских учетных записей (UAC)

удаляет теневые копии разделов.

Изменения в файловой системе

Создает следующие файлы

%WINDIR%\searchfiles.exe
%ProgramFiles%\avpm\decoding help.hta
%ProgramFiles%\avpcc\decoding help.hta
%ProgramFiles%\avnotify\decoding help.hta
%ProgramFiles%\avkwctl\decoding help.hta
%ProgramFiles%\avkservice\decoding help.hta
%ProgramFiles%\btini\decoding help.hta
%ProgramFiles%\bdnews\decoding help.hta
%ProgramFiles%\blindman\decoding help.hta
%ProgramFiles%\bdagent\decoding help.hta
%ProgramFiles%\blackd\decoding help.hta
%ProgramFiles%\bdswitch\decoding help.hta
%ProgramFiles%\bdsurvey\decoding help.hta
%ProgramFiles%\bdsubmitwiz\decoding help.hta
%ProgramFiles%\bdsubmit\decoding help.hta
%ProgramFiles%\cavoar\decoding help.hta
%ProgramFiles%\cavmud\decoding help.hta
%ProgramFiles%\blackice\decoding help.hta
%ProgramFiles%\cavaud\decoding help.hta
%ProgramFiles%\bdwizreg\decoding help.hta
%ProgramFiles%\bdmcon\decoding help.hta
%ProgramFiles%\bdoesrv\decoding help.hta
%ProgramFiles%\bdss\decoding help.hta
%ProgramFiles%\autostartexplorer\decoding help.hta
%ProgramFiles%\autodown\decoding help.hta
%ProgramFiles%\aswupdsv\decoding help.hta
%ProgramFiles%\avgnpsvc\decoding help.hta
%ProgramFiles%\avgnpdln\decoding help.hta
%ProgramFiles%\avginet\decoding help.hta
%ProgramFiles%\avgfwsrv\decoding help.hta
%ProgramFiles%\avadmin\decoding help.hta
%ProgramFiles%\avgcc\decoding help.hta
%ProgramFiles%\avconsol\decoding help.hta
%ProgramFiles%\avconfig\decoding help.hta
%ProgramFiles%\avkserv\decoding help.hta
%ProgramFiles%\avinitnt\decoding help.hta
%ProgramFiles%\avgwizfw\decoding help.hta
%ProgramFiles%\avgupsvc\decoding help.hta
%ProgramFiles%\avgupden\decoding help.hta
%ProgramFiles%\avgscan\decoding help.hta
%ProgramFiles%\avgamsvr\decoding help.hta
%ProgramFiles%\avgrssvc\decoding help.hta
%ProgramFiles%\avciman\decoding help.hta
%ProgramFiles%\autotrace\decoding help.hta
%ProgramFiles%\cavasm\decoding help.hta
%ProgramFiles%\btinint\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\information retrieval\decoding help.hta
%PROGRAMDATA%\microsoft\user account pictures\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\ink\decoding help.hta
C:\far2\encyclopedia\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\ink\1.7\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\ink\1.0\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\stationery\decoding help.hta
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\dao\decoding help.hta
%ProgramFiles(x86)%\mozilla firefox\decoding help.hta
C:\far2\fexcept\decoding help.hta
%PROGRAMDATA%\microsoft\identitycrl\decoding help.hta
%CommonProgramFiles(x86)%\adobe\helpcfg\en_us\decoding help.hta
%PROGRAMDATA%\microsoft\network\downloader\decoding help.hta
%PROGRAMDATA%\microsoft\user account pictures\default pictures\decoding help.hta
%PROGRAMDATA%\microsoft\ilscache\decoding help.hta
C:\users\all users\microsoft toolkit\settings.xml.[id]musnd0o3adbbxhm9[id]
C:\users\all users\microsoft help\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\help\decoding help.hta
%CommonProgramFiles(x86)%\adobe\arm\1.0\cache\decoding help.hta
%ProgramFiles(x86)%\adobe\acrobat reader dc\resource\decoding help.hta
%ProgramFiles%\alsvc\decoding help.hta
%ProgramFiles%\cavsn\decoding help.hta
%ProgramFiles%\cavse\decoding help.hta
%ProgramFiles%\cavscons\decoding help.hta
%ProgramFiles%\cavq\decoding help.hta
%ProgramFiles%\cavumas\decoding help.hta
%ProgramFiles%\cavsubmit\decoding help.hta
%ProgramFiles%\cavsub\decoding help.hta
%ProgramFiles%\ccapp\decoding help.hta
%ProgramFiles%\cavvl\decoding help.hta
%ProgramFiles%\cavuserupd\decoding help.hta
%ProgramFiles%\ccsetmgr\decoding help.hta
%ProgramFiles%\ccproxy\decoding help.hta
%ProgramFiles%\ccleaner\decoding help.hta
%ProgramFiles%\ccevtmgr\decoding help.hta
%ProgramFiles%\clamwin\decoding help.hta
%ProgramFiles%\chrome\decoding help.hta
%ProgramFiles%\cemrep\decoding help.hta
%ProgramFiles%\cavapp\decoding help.hta
%ProgramFiles%\cabalmain\decoding help.hta
%ProgramFiles%\cafix\decoding help.hta
%ProgramFiles%\avcenter\decoding help.hta
%ProgramFiles%\avcmd\decoding help.hta
%ProgramFiles%\ashquick\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\ink\en-us\decoding help.hta
%ProgramFiles(x86)%\adobe\acrobat reader dc\esl\decoding help.hta
%ProgramFiles%\decoding help.hta
%ProgramFiles%\avgdiag\decoding help.hta
%ProgramFiles%\aswregsvr\decoding help.hta
%ProgramFiles%\ashwebsv\decoding help.hta
C:\users\default\decoding help.hta
%ProgramFiles%\ackwin32\decoding help.hta
C:\far2\decoding help.hta
%ProgramFiles%\a2cmd\decoding help.hta
%ProgramFiles%\dekaron\decoding help.hta
%ProgramFiles%\cpd\decoding help.hta
%ProgramFiles%\cavmr\decoding help.hta
%ProgramFiles%\cavemsrv\decoding help.hta
%ProgramFiles%\backweb-4476822\decoding help.hta
%ProgramFiles%\b2\decoding help.hta
%ProgramFiles%\about\decoding help.hta
C:\users\decoding help.hta
%ProgramFiles%\360tray\decoding help.hta
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\decoding help.hta
%PROGRAMDATA%\microsoft\officesoftwareprotectionplatform\cache\decoding help.hta
%WINDIR%\ncler.txt
D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\decoding help.hta
%PROGRAMDATA%\decoding help.hta
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\decoding help.hta
%ProgramFiles(x86)%\decoding help.hta
<Текущая директория>\decoding help.hta
%ProgramFiles(x86)%\adobe\acrobat reader dc\decoding help.hta
%CommonProgramFiles(x86)%\services\decoding help.hta
%CommonProgramFiles(x86)%\steam\decoding help.hta
C:\decoding help.hta
%CommonProgramFiles(x86)%\adobe\arm\1.0\decoding help.hta
%PROGRAMDATA%\microsoft\officesoftwareprotectionplatform\decoding help.hta
C:\totalcmd\decoding help.hta
%ProgramFiles(x86)%\internet explorer\decoding help.hta
%ProgramFiles(x86)%\k-lite codec pack\decoding help.hta
%CommonProgramFiles(x86)%\system\decoding help.hta
%CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\decoding help.hta
%CommonProgramFiles(x86)%\java\java update\decoding help.hta
%ProgramFiles%\avsynmgr\decoding help.hta
%CommonProgramFiles(x86)%\px storage engine\decoding help.hta
%ProgramFiles%\avscan\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\help\1040\decoding help.hta
%ProgramFiles%\avgw\decoding help.hta
%ProgramFiles%\aoltbserver\decoding help.hta
%ProgramFiles%\anti-trojan\decoding help.hta
%ProgramFiles%\amsn\decoding help.hta
%ProgramFiles%\ashpopwz\decoding help.hta
%ProgramFiles%\ashmaisv\decoding help.hta
%ProgramFiles%\ashlogv\decoding help.hta
%ProgramFiles%\ashenhcd\decoding help.hta
%ProgramFiles%\ashdug\decoding help.hta
%ProgramFiles%\ashdisp\decoding help.hta
%ProgramFiles%\ashchest\decoding help.hta
%ProgramFiles%\ashavsrv\decoding help.hta
%ProgramFiles%\ash_updatemediator\decoding help.hta
%ProgramFiles%\ashupd\decoding help.hta
%ProgramFiles%\ashskpck\decoding help.hta
%ProgramFiles%\ashskpcc\decoding help.hta
%ProgramFiles%\ashsimpl\decoding help.hta
%ProgramFiles%\ashsimp2\decoding help.hta
%ProgramFiles%\ashserv\decoding help.hta
%ProgramFiles%\armor2net\decoding help.hta
%ProgramFiles%\avgvv\decoding help.hta
%ProgramFiles%\antivirus\decoding help.hta
%PROGRAMDATA%\microsoft\mf\decoding help.hta
C:\users\all users\mozilla\logs\maintenanceservice-install.log.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\ash\decoding help.hta
%ProgramFiles%\admunch\decoding help.hta
%ProgramFiles%\aavshield\decoding help.hta
%ProgramFiles%\a2wizard\decoding help.hta
%ProgramFiles%\a2upd\decoding help.hta
%ProgramFiles%\airdefense\decoding help.hta
%ProgramFiles%\aimpro\decoding help.hta
%ProgramFiles%\aim6\decoding help.hta
%ProgramFiles%\ahnsd\decoding help.hta
%ProgramFiles%\avgemc\decoding help.hta
%ProgramFiles%\ageofconan\decoding help.hta
%ProgramFiles%\a2scan\decoding help.hta
%ProgramFiles%\a2service\decoding help.hta
%ProgramFiles%\a2guard\decoding help.hta
%ProgramFiles%\a2hijackfree\decoding help.hta
%ProgramFiles%\amon\decoding help.hta
%ProgramFiles%\almon\decoding help.hta
%ProgramFiles%\agb5\decoding help.hta
%ProgramFiles%\ashavast\decoding help.hta
%ProgramFiles%\a2start\decoding help.hta
%ProgramFiles%\armorsurf\decoding help.hta
C:\users\all users\mozilla\logs\maintenanceservice-uninstall.log.[id]musnd0o3adbbxhm9[id]

Перемещает следующие файлы

%ProgramFiles(x86)%\desktop.ini в %ProgramFiles(x86)%\desktop.ini.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\avkwctl\avkwctl.exe в %ProgramFiles%\avkwctl\avkwctl.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\avkservice\avkservice.exe в %ProgramFiles%\avkservice\avkservice.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\btini\btini.exe в %ProgramFiles%\btini\btini.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\blindman\blindman.exe в %ProgramFiles%\blindman\blindman.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\blackice\blackice.exe в %ProgramFiles%\blackice\blackice.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\blackd\blackd.exe в %ProgramFiles%\blackd\blackd.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\bdwizreg\bdwizreg.exe в %ProgramFiles%\bdwizreg\bdwizreg.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\bdswitch\bdswitch.exe в %ProgramFiles%\bdswitch\bdswitch.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\bdsurvey\bdsurvey.exe в %ProgramFiles%\bdsurvey\bdsurvey.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\bdsubmitwiz\bdsubmitwiz.exe в %ProgramFiles%\bdsubmitwiz\bdsubmitwiz.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\bdsubmit\bdsubmit.exe в %ProgramFiles%\bdsubmit\bdsubmit.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\cavoar\cavoar.exe в %ProgramFiles%\cavoar\cavoar.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\cavmud\cavmud.exe в %ProgramFiles%\cavmud\cavmud.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\cavaud\cavaud.exe в %ProgramFiles%\cavaud\cavaud.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\cavasm\cavasm.exe в %ProgramFiles%\cavasm\cavasm.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\avnotify\avnotify.exe в %ProgramFiles%\avnotify\avnotify.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\cavapp\cavapp.exe в %ProgramFiles%\cavapp\cavapp.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\avpcc\avpcc.exe в %ProgramFiles%\avpcc\avpcc.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\bdagent\bdagent.exe в %ProgramFiles%\bdagent\bdagent.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\avgcc\avgcc.exe в %ProgramFiles%\avgcc\avgcc.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\avgamsvr\avgamsvr.exe в %ProgramFiles%\avgamsvr\avgamsvr.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\avconsol\avconsol.exe в %ProgramFiles%\avconsol\avconsol.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\avconfig\avconfig.exe в %ProgramFiles%\avconfig\avconfig.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\avkserv\avkserv.exe в %ProgramFiles%\avkserv\avkserv.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\avinitnt\avinitnt.exe в %ProgramFiles%\avinitnt\avinitnt.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\avgwizfw\avgwizfw.exe в %ProgramFiles%\avgwizfw\avgwizfw.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\avgupsvc\avgupsvc.exe в %ProgramFiles%\avgupsvc\avgupsvc.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\avgupden\avgupden.exe в %ProgramFiles%\avgupden\avgupden.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\avgscan\avgscan.exe в %ProgramFiles%\avgscan\avgscan.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\avgrssvc\avgrssvc.exe в %ProgramFiles%\avgrssvc\avgrssvc.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\bdss\bdss.exe в %ProgramFiles%\bdss\bdss.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\bdoesrv\bdoesrv.exe в %ProgramFiles%\bdoesrv\bdoesrv.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\bdnews\bdnews.exe в %ProgramFiles%\bdnews\bdnews.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\bdmcon\bdmcon.exe в %ProgramFiles%\bdmcon\bdmcon.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\avpm\avpm.exe в %ProgramFiles%\avpm\avpm.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\cemrep\cemrep.exe в %ProgramFiles%\cemrep\cemrep.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\pavprsrv\pavprsrv.exe в %ProgramFiles%\pavprsrv\pavprsrv.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\btinint\btinint.exe в %ProgramFiles%\btinint\btinint.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles(x86)%\k-lite codec pack\filters\vsfilter.dll в %ProgramFiles(x86)%\k-lite codec pack\filters\vsfilter.dll.[id]musnd0o3adbbxhm9[id]
%ProgramFiles(x86)%\k-lite codec pack\tools\codectweaktool-1.bin в %ProgramFiles(x86)%\k-lite codec pack\tools\codectweaktool-1.bin.[id]musnd0o3adbbxhm9[id]
%ProgramFiles(x86)%\k-lite codec pack\tools\codectweaktool.exe в %ProgramFiles(x86)%\k-lite codec pack\tools\codectweaktool.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles(x86)%\k-lite codec pack\mpc-hc64\d3dcompiler_43.dll в %ProgramFiles(x86)%\k-lite codec pack\mpc-hc64\d3dcompiler_43.dll.[id]musnd0o3adbbxhm9[id]
%ProgramFiles(x86)%\k-lite codec pack\info\faq.css в %ProgramFiles(x86)%\k-lite codec pack\info\faq.css.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\clamtray\clamtray.exe в %ProgramFiles%\clamtray\clamtray.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\clamscan\clamscan.exe в %ProgramFiles%\clamscan\clamscan.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles(x86)%\microsoft analysis services\as oledb\10\msmdlocal.dll в %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\msmdlocal.dll.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\partinfo\partinfo.exe в %ProgramFiles%\partinfo\partinfo.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\partin9x\partin9x.exe в %ProgramFiles%\partin9x\partin9x.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\partin\partin.exe в %ProgramFiles%\partin\partin.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\outpost\outpost.exe в %ProgramFiles%\outpost\outpost.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\pccntmon\pccntmon.exe в %ProgramFiles%\pccntmon\pccntmon.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\pccguide\pccguide.exe в %ProgramFiles%\pccguide\pccguide.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\pavsrv51\pavsrv51.exe в %ProgramFiles%\pavsrv51\pavsrv51.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles(x86)%\internet explorer\signup\install.ins в %ProgramFiles(x86)%\internet explorer\signup\install.ins.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\avgfwsrv\avgfwsrv.exe в %ProgramFiles%\avgfwsrv\avgfwsrv.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles(x86)%\k-lite codec pack\tools\codectweaktool-0.bin в %ProgramFiles(x86)%\k-lite codec pack\tools\codectweaktool-0.bin.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\chrome\chrome.exe в %ProgramFiles%\chrome\chrome.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\cavsn\cavsn.exe в %ProgramFiles%\cavsn\cavsn.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\cavse\cavse.exe в %ProgramFiles%\cavse\cavse.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\cavscons\cavscons.exe в %ProgramFiles%\cavscons\cavscons.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\cavq\cavq.exe в %ProgramFiles%\cavq\cavq.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\cavumas\cavumas.exe в %ProgramFiles%\cavumas\cavumas.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\cavsubmit\cavsubmit.exe в %ProgramFiles%\cavsubmit\cavsubmit.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\cavsub\cavsub.exe в %ProgramFiles%\cavsub\cavsub.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\ccapp\ccapp.exe в %ProgramFiles%\ccapp\ccapp.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\cavvl\cavvl.exe в %ProgramFiles%\cavvl\cavvl.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\cavuserupd\cavuserupd.exe в %ProgramFiles%\cavuserupd\cavuserupd.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\ccsetmgr\ccsetmgr.exe в %ProgramFiles%\ccsetmgr\ccsetmgr.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\ccproxy\ccproxy.exe в %ProgramFiles%\ccproxy\ccproxy.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\ccleaner\ccleaner.exe в %ProgramFiles%\ccleaner\ccleaner.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\ccevtmgr\ccevtmgr.exe в %ProgramFiles%\ccevtmgr\ccevtmgr.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\clamwin\clamwin.exe в %ProgramFiles%\clamwin\clamwin.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\cafix\cafix.exe в %ProgramFiles%\cafix\cafix.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\cabalmain\cabalmain.exe в %ProgramFiles%\cabalmain\cabalmain.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\avginet\avginet.exe в %ProgramFiles%\avginet\avginet.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\amon\amon.exe в %ProgramFiles%\amon\amon.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\avgw\avgw.exe в %ProgramFiles%\avgw\avgw.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\avgvv\avgvv.exe в %ProgramFiles%\avgvv\avgvv.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\avgemc\avgemc.exe в %ProgramFiles%\avgemc\avgemc.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\admunch\admunch.exe в %ProgramFiles%\admunch\admunch.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\aavshield\aavshield.exe в %ProgramFiles%\aavshield\aavshield.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\a2wizard\a2wizard.exe в %ProgramFiles%\a2wizard\a2wizard.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\a2upd\a2upd.exe в %ProgramFiles%\a2upd\a2upd.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\airdefense\airdefense.exe в %ProgramFiles%\airdefense\airdefense.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\aimpro\aimpro.exe в %ProgramFiles%\aimpro\aimpro.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\aim6\aim6.exe в %ProgramFiles%\aim6\aim6.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\ahnsd\ahnsd.exe в %ProgramFiles%\ahnsd\ahnsd.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\ageofconan\ageofconan.exe в %ProgramFiles%\ageofconan\ageofconan.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\a2start\a2start.exe в %ProgramFiles%\a2start\a2start.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\a2scan\a2scan.exe в %ProgramFiles%\a2scan\a2scan.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\a2service\a2service.exe в %ProgramFiles%\a2service\a2service.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\avscan\avscan.exe в %ProgramFiles%\avscan\avscan.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\a2guard\a2guard.exe в %ProgramFiles%\a2guard\a2guard.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\avsynmgr\avsynmgr.exe в %ProgramFiles%\avsynmgr\avsynmgr.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\backweb-4476822\backweb-4476822.exe в %ProgramFiles%\backweb-4476822\backweb-4476822.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles(x86)%\adobe\acrobat reader dc\readme.htm в %ProgramFiles(x86)%\adobe\acrobat reader dc\readme.htm.[id]musnd0o3adbbxhm9[id]
%ProgramFiles(x86)%\k-lite codec pack\unins000.dat в %ProgramFiles(x86)%\k-lite codec pack\unins000.dat.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\desktop.ini в %ProgramFiles%\desktop.ini.[id]musnd0o3adbbxhm9[id]
%ProgramFiles(x86)%\adobe\acrobat reader dc\esl\aiodlite.dll в %ProgramFiles(x86)%\adobe\acrobat reader dc\esl\aiodlite.dll.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\avgdiag\avgdiag.exe в %ProgramFiles%\avgdiag\avgdiag.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\aswregsvr\aswregsvr.exe в %ProgramFiles%\aswregsvr\aswregsvr.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\ashwebsv\ashwebsv.exe в %ProgramFiles%\ashwebsv\ashwebsv.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\ackwin32\ackwin32.exe в %ProgramFiles%\ackwin32\ackwin32.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\about\about.exe в %ProgramFiles%\about\about.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\a2cmd\a2cmd.exe в %ProgramFiles%\a2cmd\a2cmd.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\360tray\360tray.exe в %ProgramFiles%\360tray\360tray.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\dekaron\dekaron.exe в %ProgramFiles%\dekaron\dekaron.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\cpd\cpd.exe в %ProgramFiles%\cpd\cpd.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\cavmr\cavmr.exe в %ProgramFiles%\cavmr\cavmr.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\cavemsrv\cavemsrv.exe в %ProgramFiles%\cavemsrv\cavemsrv.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\b2\b2.exe в %ProgramFiles%\b2\b2.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\ashchest\ashchest.exe в %ProgramFiles%\ashchest\ashchest.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\avgnpsvc\avgnpsvc.exe в %ProgramFiles%\avgnpsvc\avgnpsvc.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\almon\almon.exe в %ProgramFiles%\almon\almon.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\ashupd\ashupd.exe в %ProgramFiles%\ashupd\ashupd.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\ashskpck\ashskpck.exe в %ProgramFiles%\ashskpck\ashskpck.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\ashskpcc\ashskpcc.exe в %ProgramFiles%\ashskpcc\ashskpcc.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\ashsimpl\ashsimpl.exe в %ProgramFiles%\ashsimpl\ashsimpl.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\ashsimp2\ashsimp2.exe в %ProgramFiles%\ashsimp2\ashsimp2.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\ashserv\ashserv.exe в %ProgramFiles%\ashserv\ashserv.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\ashquick\ashquick.exe в %ProgramFiles%\ashquick\ashquick.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\avcmd\avcmd.exe в %ProgramFiles%\avcmd\avcmd.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\avcenter\avcenter.exe в %ProgramFiles%\avcenter\avcenter.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\avciman\avciman.exe в %ProgramFiles%\avciman\avciman.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\avadmin\avadmin.exe в %ProgramFiles%\avadmin\avadmin.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\autotrace\autotrace.exe в %ProgramFiles%\autotrace\autotrace.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\autostartexplorer\autostartexplorer.exe в %ProgramFiles%\autostartexplorer\autostartexplorer.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\autodown\autodown.exe в %ProgramFiles%\autodown\autodown.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\aswupdsv\aswupdsv.exe в %ProgramFiles%\aswupdsv\aswupdsv.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\ash_updatemediator\ash_updatemediator.exe в %ProgramFiles%\ash_updatemediator\ash_updatemediator.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\avgnpdln\avgnpdln.exe в %ProgramFiles%\avgnpdln\avgnpdln.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\ashavsrv\ashavsrv.exe в %ProgramFiles%\ashavsrv\ashavsrv.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\ashdisp\ashdisp.exe в %ProgramFiles%\ashdisp\ashdisp.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\agb5\agb5.exe в %ProgramFiles%\agb5\agb5.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\ashavast\ashavast.exe в %ProgramFiles%\ashavast\ashavast.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\ash\ash.exe в %ProgramFiles%\ash\ash.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\alsvc\alsvc.exe в %ProgramFiles%\alsvc\alsvc.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\armorsurf\armorsurf.exe в %ProgramFiles%\armorsurf\armorsurf.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\armor2net\armor2net.exe в %ProgramFiles%\armor2net\armor2net.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\aoltbserver\aoltbserver.exe в %ProgramFiles%\aoltbserver\aoltbserver.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\antivirus\antivirus.exe в %ProgramFiles%\antivirus\antivirus.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\anti-trojan\anti-trojan.exe в %ProgramFiles%\anti-trojan\anti-trojan.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\amsn\amsn.exe в %ProgramFiles%\amsn\amsn.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\ashpopwz\ashpopwz.exe в %ProgramFiles%\ashpopwz\ashpopwz.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\ashmaisv\ashmaisv.exe в %ProgramFiles%\ashmaisv\ashmaisv.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\ashlogv\ashlogv.exe в %ProgramFiles%\ashlogv\ashlogv.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\ashenhcd\ashenhcd.exe в %ProgramFiles%\ashenhcd\ashenhcd.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\ashdug\ashdug.exe в %ProgramFiles%\ashdug\ashdug.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\a2hijackfree\a2hijackfree.exe в %ProgramFiles%\a2hijackfree\a2hijackfree.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\pavproxy\pavproxy.exe в %ProgramFiles%\pavproxy\pavproxy.exe.[id]musnd0o3adbbxhm9[id]

Подменяет следующие исполняемые файлы

<Полный путь к файлу>
%CommonProgramFiles%\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL
%CommonProgramFiles%\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

Подменяет следующие файлы

%CommonProgramFiles(x86)%\Services\verisign.bmp

Самоперемещается

из <Полный путь к файлу> в <Полный путь к файлу>.[id]musnd0o3adbbxhm9[id]

Изменяет расширения файлов пользовательских данных (Trojan.Encoder).

Другое

Создает и запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c vssadmin delete shadows /all' (со скрытым окном)
'%WINDIR%\syswow64\werfault.exe' -u -p 2316 -s 628' (со скрытым окном)

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c vssadmin delete shadows /all

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней