Trojan.Encoder.31929

Техническая информация

Для обеспечения автозапуска и распространения

Создает или изменяет следующие файлы

%APPDATA%\microsoft\windows\start menu\programs\startup\ransom.exe
%APPDATA%\microsoft\windows\start menu\programs\startup\info.hta

Вредоносные функции

Для затруднения выявления своего присутствия в системе

удаляет теневые копии разделов.

Запускает на исполнение

'<SYSTEM32>\netsh.exe' netsh firewall set opmode mode=disable

Читает файлы, отвечающие за хранение паролей сторонними программами

%HOMEPATH%\desktop\dialmap.bmp
%HOMEPATH%\desktop\fi51.doc
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
%HOMEPATH%\desktop\sdszfo.docx
%HOMEPATH%\desktop\split.avi
%HOMEPATH%\desktop\testcertificate.cer
%HOMEPATH%\desktop\toolbar.bmp

Изменения в файловой системе

Создает следующие файлы

C:\users\default\readme.txt
%ProgramFiles%\bdswitch\readme.txt
%ProgramFiles%\bdwizreg\readme.txt
%ProgramFiles%\blackd\readme.txt
%ProgramFiles%\blackice\readme.txt
%ProgramFiles%\blindman\readme.txt
%ProgramFiles%\btini\readme.txt
%ProgramFiles%\btinint\readme.txt
%ProgramFiles%\cabalmain\readme.txt
%ProgramFiles%\cafix\readme.txt
%ProgramFiles%\cavapp\readme.txt
%ProgramFiles%\cavasm\readme.txt
%HOMEPATH%\favorites\windows live\readme.txt
%ProgramFiles%\cavaud\readme.txt
%ProgramFiles%\cavemsrv\readme.txt
%ProgramFiles%\cavmr\readme.txt
%ProgramFiles%\cavmud\readme.txt
%ProgramFiles%\cavoar\readme.txt
%ProgramFiles%\cavq\readme.txt
%ProgramFiles%\cavscons\readme.txt
%ProgramFiles%\cavse\readme.txt
%ProgramFiles%\cavsn\readme.txt
%ProgramFiles%\bdsurvey\readme.txt
%ProgramFiles%\cavsub\readme.txt
%ProgramFiles%\bdsubmitwiz\readme.txt
%ProgramFiles%\bdss\readme.txt
%ProgramFiles%\avgscan\readme.txt
%ProgramFiles%\avgupden\readme.txt
%ProgramFiles%\avgupsvc\readme.txt
%ProgramFiles%\avgvv\readme.txt
%ProgramFiles%\avgw\readme.txt
%ProgramFiles%\avgwizfw\readme.txt
%ProgramFiles%\avinitnt\readme.txt
%ProgramFiles%\avkserv\readme.txt
%ProgramFiles%\avkservice\readme.txt
%ProgramFiles%\avkwctl\readme.txt
%ProgramFiles%\avnotify\readme.txt
%ProgramFiles%\avpcc\readme.txt
%ProgramFiles%\avpm\readme.txt
%ProgramFiles%\avscan\readme.txt
%ProgramFiles%\avsynmgr\readme.txt
%ProgramFiles%\b2\readme.txt
%ProgramFiles%\backweb-4476822\readme.txt
%ProgramFiles%\bdagent\readme.txt
%ProgramFiles%\bdmcon\readme.txt
%ProgramFiles%\bdnews\readme.txt
%ProgramFiles%\bdoesrv\readme.txt
%ProgramFiles%\bdsubmit\readme.txt
%ProgramFiles%\cavsubmit\readme.txt
%ProgramFiles%\cavumas\readme.txt
%ProgramFiles%\cavuserupd\readme.txt
%ProgramFiles(x86)%\readme.txt
C:\far2\addons\colors\readme.txt
C:\far2\addons\colors\custom_highlighting\readme.txt
C:\far2\addons\colors\default_highlighting\readme.txt
C:\far2\addons\macros\readme.txt
C:\far2\addons\setup\readme.txt
%PROGRAMDATA%\readme.txt
%ProgramFiles(x86)%\adobe\readme.txt
%ProgramFiles(x86)%\adobe\acrobat reader dc\readme.txt
%PROGRAMDATA%\adobe\arm\readme.txt
C:\far2\addons\shell\readme.txt
C:\totalcmd\readme.txt
C:\far2\addons\xlat\readme.txt
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\readme.txt
%CommonProgramFiles%\microsoft shared\grphflt\readme.txt
C:\far2\addons\xlat\russian\readme.txt
%ProgramFiles(x86)%\adobe\acrobat reader dc\esl\readme.txt
%PROGRAMDATA%\adobe\readme.txt
C:\far2\documentation\readme.txt
C:\far2\documentation\eng\readme.txt
%CommonProgramFiles%\microsoft shared\euro\readme.txt
%CommonProgramFiles%\microsoft shared\filters\readme.txt
%CommonProgramFiles%\microsoft shared\equation\1033\readme.txt
%CommonProgramFiles%\microsoft shared\equation\readme.txt
%CommonProgramFiles%\microsoft shared\dw\readme.txt
%ProgramFiles%\ccapp\readme.txt
%ProgramFiles%\ccevtmgr\readme.txt
%ProgramFiles%\ccleaner\readme.txt
%ProgramFiles%\ccproxy\readme.txt
%ProgramFiles%\ccsetmgr\readme.txt
%ProgramFiles%\cemrep\readme.txt
%ProgramFiles%\chrome\readme.txt
%ProgramFiles%\clamscan\readme.txt
%ProgramFiles%\clamtray\readme.txt
%ProgramFiles%\avgrssvc\readme.txt
%ProgramFiles%\claw95\readme.txt
%ProgramFiles%\clamwin\readme.txt
%ProgramFiles%\cleaner\readme.txt
%ProgramFiles%\cleaner3\readme.txt
%ProgramFiles%\clisvc\readme.txt
%ProgramFiles%\clrcche\readme.txt
%ProgramFiles%\cmain\readme.txt
%ProgramFiles%\cmgrdian\readme.txt
%CommonProgramFiles%\readme.txt
%CommonProgramFiles%\designer\readme.txt
%CommonProgramFiles%\microsoft shared\readme.txt
%ProgramFiles%\cavvl\readme.txt
%ProgramFiles%\claw95cf\readme.txt
C:\recovery\readme.txt
%ProgramFiles%\avgnpsvc\readme.txt
%ProgramFiles%\avcenter\readme.txt
<Текущая директория>\readme.txt
C:\far2\readme.txt
C:\perflogs\readme.txt
C:\msocache\readme.txt
C:\msocache\all users\readme.txt
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\readme.txt
%HOMEPATH%\favorites\microsoft websites\readme.txt
%ProgramFiles%\readme.txt
%ProgramFiles%\360tray\readme.txt
%ProgramFiles%\a2cmd\readme.txt
%ProgramFiles%\a2guard\readme.txt
%ProgramFiles%\a2hijackfree\readme.txt
%ProgramFiles%\a2scan\readme.txt
%ProgramFiles%\a2service\readme.txt
%ProgramFiles%\a2start\readme.txt
%ProgramFiles%\a2upd\readme.txt
%ProgramFiles%\a2wizard\readme.txt
%ProgramFiles%\aavshield\readme.txt
%ProgramFiles%\about\readme.txt
%ProgramFiles%\ackwin32\readme.txt
%ProgramFiles%\admunch\readme.txt
C:\readme.txt
%ProgramFiles%\agb5\readme.txt
%HOMEPATH%\favorites\links for united states\readme.txt
C:\users\public\music\sample music\readme.txt
C:\users\public\readme.txt
C:\users\public\desktop\readme.txt
C:\users\public\videos\readme.txt
C:\users\public\pictures\readme.txt
C:\users\public\music\readme.txt
C:\users\public\downloads\readme.txt
C:\users\public\documents\readme.txt
%HOMEPATH%\readme.txt
%HOMEPATH%\videos\readme.txt
%HOMEPATH%\desktop\readme.txt
%HOMEPATH%\contacts\readme.txt
%HOMEPATH%\searches\readme.txt
%HOMEPATH%\saved games\readme.txt
%HOMEPATH%\pictures\readme.txt
%HOMEPATH%\music\readme.txt
C:\users\public\pictures\sample pictures\readme.txt
%HOMEPATH%\favorites\readme.txt
%HOMEPATH%\links\readme.txt
C:\users\public\videos\sample videos\readme.txt
%HOMEPATH%\downloads\readme.txt
%HOMEPATH%\documents\readme.txt
%HOMEPATH%\favorites\links\readme.txt
%ProgramFiles%\ageofconan\readme.txt
%ProgramFiles%\ahnsd\readme.txt
%ProgramFiles%\aim6\readme.txt
%ProgramFiles%\ashupd\readme.txt
%ProgramFiles%\ashwebsv\readme.txt
%ProgramFiles%\ash_updatemediator\readme.txt
%ProgramFiles%\aswregsvr\readme.txt
%ProgramFiles%\aswupdsv\readme.txt
%HOMEPATH%\favorites\msn websites\readme.txt
%ProgramFiles%\autodown\readme.txt
%ProgramFiles%\autostartexplorer\readme.txt
%ProgramFiles%\autotrace\readme.txt
%ProgramFiles%\avginet\readme.txt
%ProgramFiles%\avadmin\readme.txt
%ProgramFiles%\avciman\readme.txt
%ProgramFiles%\avcmd\readme.txt
%ProgramFiles%\avconfig\readme.txt
%ProgramFiles%\avconsol\readme.txt
%ProgramFiles%\avgamsvr\readme.txt
%ProgramFiles%\avgcc\readme.txt
%ProgramFiles%\avgdiag\readme.txt
%ProgramFiles%\avgemc\readme.txt
%ProgramFiles%\avgfwsrv\readme.txt
%ProgramFiles%\ashskpcc\readme.txt
%ProgramFiles%\ashskpck\readme.txt
%ProgramFiles%\ashsimpl\readme.txt
%ProgramFiles%\ashsimp2\readme.txt
%ProgramFiles%\ashserv\readme.txt
%ProgramFiles%\airdefense\readme.txt
%ProgramFiles%\almon\readme.txt
%ProgramFiles%\alsvc\readme.txt
%ProgramFiles%\amon\readme.txt
%ProgramFiles%\amsn\readme.txt
%ProgramFiles%\anti-trojan\readme.txt
%ProgramFiles%\antivirus\readme.txt
%ProgramFiles%\aoltbserver\readme.txt
%ProgramFiles%\armor2net\readme.txt
%ProgramFiles%\avgnpdln\readme.txt
%ProgramFiles%\ash\readme.txt
%ProgramFiles%\armorsurf\readme.txt
%ProgramFiles%\ashavsrv\readme.txt
%ProgramFiles%\ashchest\readme.txt
%ProgramFiles%\ashdisp\readme.txt
%ProgramFiles%\ashdug\readme.txt
%ProgramFiles%\ashenhcd\readme.txt
%ProgramFiles%\ashlogv\readme.txt
%ProgramFiles%\ashmaisv\readme.txt
%ProgramFiles%\ashpopwz\readme.txt
%ProgramFiles%\ashquick\readme.txt
%ProgramFiles%\aimpro\readme.txt
%ProgramFiles%\ashavast\readme.txt
%PROGRAMDATA%\adobe\arm\reader_15.007.20033\readme.txt

Перемещает следующие файлы

%ProgramFiles%\360tray\360tray.exe в %ProgramFiles%\360tray\360tray.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\bdss\bdss.exe в %ProgramFiles%\bdss\bdss.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\bdsubmit\bdsubmit.exe в %ProgramFiles%\bdsubmit\bdsubmit.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\bdsubmitwiz\bdsubmitwiz.exe в %ProgramFiles%\bdsubmitwiz\bdsubmitwiz.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\bdsurvey\bdsurvey.exe в %ProgramFiles%\bdsurvey\bdsurvey.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\bdswitch\bdswitch.exe в %ProgramFiles%\bdswitch\bdswitch.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\bdwizreg\bdwizreg.exe в %ProgramFiles%\bdwizreg\bdwizreg.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\blackice\blackice.exe в %ProgramFiles%\blackice\blackice.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\avpcc\avpcc.exe в %ProgramFiles%\avpcc\avpcc.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\blindman\blindman.exe в %ProgramFiles%\blindman\blindman.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\btini\btini.exe в %ProgramFiles%\btini\btini.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\btinint\btinint.exe в %ProgramFiles%\btinint\btinint.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\cabalmain\cabalmain.exe в %ProgramFiles%\cabalmain\cabalmain.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\cafix\cafix.exe в %ProgramFiles%\cafix\cafix.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\cavapp\cavapp.exe в %ProgramFiles%\cavapp\cavapp.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\bdoesrv\bdoesrv.exe в %ProgramFiles%\bdoesrv\bdoesrv.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\bdnews\bdnews.exe в %ProgramFiles%\bdnews\bdnews.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\bdmcon\bdmcon.exe в %ProgramFiles%\bdmcon\bdmcon.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\bdagent\bdagent.exe в %ProgramFiles%\bdagent\bdagent.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\backweb-4476822\backweb-4476822.exe в %ProgramFiles%\backweb-4476822\backweb-4476822.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\b2\b2.exe в %ProgramFiles%\b2\b2.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\avsynmgr\avsynmgr.exe в %ProgramFiles%\avsynmgr\avsynmgr.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\avscan\avscan.exe в %ProgramFiles%\avscan\avscan.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\avpm\avpm.exe в %ProgramFiles%\avpm\avpm.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\blackd\blackd.exe в %ProgramFiles%\blackd\blackd.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\avnotify\avnotify.exe в %ProgramFiles%\avnotify\avnotify.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\avkwctl\avkwctl.exe в %ProgramFiles%\avkwctl\avkwctl.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\avkservice\avkservice.exe в %ProgramFiles%\avkservice\avkservice.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\avkserv\avkserv.exe в %ProgramFiles%\avkserv\avkserv.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\avinitnt\avinitnt.exe в %ProgramFiles%\avinitnt\avinitnt.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\avgwizfw\avgwizfw.exe в %ProgramFiles%\avgwizfw\avgwizfw.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\avgw\avgw.exe в %ProgramFiles%\avgw\avgw.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\cavasm\cavasm.exe в %ProgramFiles%\cavasm\cavasm.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\cavsubmit\cavsubmit.exe в %ProgramFiles%\cavsubmit\cavsubmit.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\1494870c-9912-c184-4cc9-b401-a53f4d8de290.pdf в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\1494870c-9912-c184-4cc9-b401-a53f4d8de290.pdf.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\cavmr\cavmr.exe в %ProgramFiles%\cavmr\cavmr.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\chrome\chrome.exe в %ProgramFiles%\chrome\chrome.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\clamscan\clamscan.exe в %ProgramFiles%\clamscan\clamscan.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\clamtray\clamtray.exe в %ProgramFiles%\clamtray\clamtray.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\clamwin\clamwin.exe в %ProgramFiles%\clamwin\clamwin.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\claw95\claw95.exe в %ProgramFiles%\claw95\claw95.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\claw95cf\claw95cf.exe в %ProgramFiles%\claw95cf\claw95cf.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\cleaner3\cleaner3.exe в %ProgramFiles%\cleaner3\cleaner3.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\cavaud\cavaud.exe в %ProgramFiles%\cavaud\cavaud.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\clisvc\clisvc.exe в %ProgramFiles%\clisvc\clisvc.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\clrcche\clrcche.exe в %ProgramFiles%\clrcche\clrcche.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\cmain\cmain.exe в %ProgramFiles%\cmain\cmain.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\cmgrdian\cmgrdian.exe в %ProgramFiles%\cmgrdian\cmgrdian.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles(x86)%\adobe\acrobat reader dc\readme.htm в %ProgramFiles(x86)%\adobe\acrobat reader dc\readme.htm.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles(x86)%\adobe\acrobat reader dc\esl\aiodlite.dll в %ProgramFiles(x86)%\adobe\acrobat reader dc\esl\aiodlite.dll.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\cemrep\cemrep.exe в %ProgramFiles%\cemrep\cemrep.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\ccsetmgr\ccsetmgr.exe в %ProgramFiles%\ccsetmgr\ccsetmgr.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\ccproxy\ccproxy.exe в %ProgramFiles%\ccproxy\ccproxy.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\ccleaner\ccleaner.exe в %ProgramFiles%\ccleaner\ccleaner.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\ccevtmgr\ccevtmgr.exe в %ProgramFiles%\ccevtmgr\ccevtmgr.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\ccapp\ccapp.exe в %ProgramFiles%\ccapp\ccapp.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\cavvl\cavvl.exe в %ProgramFiles%\cavvl\cavvl.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\cavuserupd\cavuserupd.exe в %ProgramFiles%\cavuserupd\cavuserupd.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\cavumas\cavumas.exe в %ProgramFiles%\cavumas\cavumas.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\avgvv\avgvv.exe в %ProgramFiles%\avgvv\avgvv.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\cavsub\cavsub.exe в %ProgramFiles%\cavsub\cavsub.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\cavsn\cavsn.exe в %ProgramFiles%\cavsn\cavsn.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\cavse\cavse.exe в %ProgramFiles%\cavse\cavse.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\cavscons\cavscons.exe в %ProgramFiles%\cavscons\cavscons.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\cavq\cavq.exe в %ProgramFiles%\cavq\cavq.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\cavoar\cavoar.exe в %ProgramFiles%\cavoar\cavoar.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\cavmud\cavmud.exe в %ProgramFiles%\cavmud\cavmud.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\cavemsrv\cavemsrv.exe в %ProgramFiles%\cavemsrv\cavemsrv.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\cleaner\cleaner.exe в %ProgramFiles%\cleaner\cleaner.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\avgupsvc\avgupsvc.exe в %ProgramFiles%\avgupsvc\avgupsvc.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\avgcc\avgcc.exe в %ProgramFiles%\avgcc\avgcc.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\airdefense\airdefense.exe в %ProgramFiles%\airdefense\airdefense.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\almon\almon.exe в %ProgramFiles%\almon\almon.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\alsvc\alsvc.exe в %ProgramFiles%\alsvc\alsvc.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\amon\amon.exe в %ProgramFiles%\amon\amon.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\amsn\amsn.exe в %ProgramFiles%\amsn\amsn.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\anti-trojan\anti-trojan.exe в %ProgramFiles%\anti-trojan\anti-trojan.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\aoltbserver\aoltbserver.exe в %ProgramFiles%\aoltbserver\aoltbserver.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\a2wizard\a2wizard.exe в %ProgramFiles%\a2wizard\a2wizard.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\armor2net\armor2net.exe в %ProgramFiles%\armor2net\armor2net.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\armorsurf\armorsurf.exe в %ProgramFiles%\armorsurf\armorsurf.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\ash\ash.exe в %ProgramFiles%\ash\ash.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\ashavast\ashavast.exe в %ProgramFiles%\ashavast\ashavast.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\ashavsrv\ashavsrv.exe в %ProgramFiles%\ashavsrv\ashavsrv.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\ashchest\ashchest.exe в %ProgramFiles%\ashchest\ashchest.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\aimpro\aimpro.exe в %ProgramFiles%\aimpro\aimpro.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\aim6\aim6.exe в %ProgramFiles%\aim6\aim6.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\ahnsd\ahnsd.exe в %ProgramFiles%\ahnsd\ahnsd.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\ageofconan\ageofconan.exe в %ProgramFiles%\ageofconan\ageofconan.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\agb5\agb5.exe в %ProgramFiles%\agb5\agb5.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\admunch\admunch.exe в %ProgramFiles%\admunch\admunch.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\ackwin32\ackwin32.exe в %ProgramFiles%\ackwin32\ackwin32.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\about\about.exe в %ProgramFiles%\about\about.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\aavshield\aavshield.exe в %ProgramFiles%\aavshield\aavshield.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\antivirus\antivirus.exe в %ProgramFiles%\antivirus\antivirus.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\a2upd\a2upd.exe в %ProgramFiles%\a2upd\a2upd.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\a2start\a2start.exe в %ProgramFiles%\a2start\a2start.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\a2service\a2service.exe в %ProgramFiles%\a2service\a2service.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\a2scan\a2scan.exe в %ProgramFiles%\a2scan\a2scan.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\a2hijackfree\a2hijackfree.exe в %ProgramFiles%\a2hijackfree\a2hijackfree.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\a2guard\a2guard.exe в %ProgramFiles%\a2guard\a2guard.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\a2cmd\a2cmd.exe в %ProgramFiles%\a2cmd\a2cmd.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\ashdisp\ashdisp.exe в %ProgramFiles%\ashdisp\ashdisp.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\ashskpck\ashskpck.exe в %ProgramFiles%\ashskpck\ashskpck.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\avgscan\avgscan.exe в %ProgramFiles%\avgscan\avgscan.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\ashlogv\ashlogv.exe в %ProgramFiles%\ashlogv\ashlogv.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\avcenter\avcenter.exe в %ProgramFiles%\avcenter\avcenter.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\avciman\avciman.exe в %ProgramFiles%\avciman\avciman.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\avcmd\avcmd.exe в %ProgramFiles%\avcmd\avcmd.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\avconfig\avconfig.exe в %ProgramFiles%\avconfig\avconfig.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\avconsol\avconsol.exe в %ProgramFiles%\avconsol\avconsol.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\avgamsvr\avgamsvr.exe в %ProgramFiles%\avgamsvr\avgamsvr.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\avgdiag\avgdiag.exe в %ProgramFiles%\avgdiag\avgdiag.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\ashdug\ashdug.exe в %ProgramFiles%\ashdug\ashdug.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\avgemc\avgemc.exe в %ProgramFiles%\avgemc\avgemc.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\avgfwsrv\avgfwsrv.exe в %ProgramFiles%\avgfwsrv\avgfwsrv.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\avginet\avginet.exe в %ProgramFiles%\avginet\avginet.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\avgnpdln\avgnpdln.exe в %ProgramFiles%\avgnpdln\avgnpdln.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\avgnpsvc\avgnpsvc.exe в %ProgramFiles%\avgnpsvc\avgnpsvc.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\avgrssvc\avgrssvc.exe в %ProgramFiles%\avgrssvc\avgrssvc.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\avadmin\avadmin.exe в %ProgramFiles%\avadmin\avadmin.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\autotrace\autotrace.exe в %ProgramFiles%\autotrace\autotrace.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\autostartexplorer\autostartexplorer.exe в %ProgramFiles%\autostartexplorer\autostartexplorer.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\autodown\autodown.exe в %ProgramFiles%\autodown\autodown.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\aswupdsv\aswupdsv.exe в %ProgramFiles%\aswupdsv\aswupdsv.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\aswregsvr\aswregsvr.exe в %ProgramFiles%\aswregsvr\aswregsvr.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\ash_updatemediator\ash_updatemediator.exe в %ProgramFiles%\ash_updatemediator\ash_updatemediator.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\ashwebsv\ashwebsv.exe в %ProgramFiles%\ashwebsv\ashwebsv.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\ashupd\ashupd.exe в %ProgramFiles%\ashupd\ashupd.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\avgupden\avgupden.exe в %ProgramFiles%\avgupden\avgupden.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\ashskpcc\ashskpcc.exe в %ProgramFiles%\ashskpcc\ashskpcc.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\ashsimpl\ashsimpl.exe в %ProgramFiles%\ashsimpl\ashsimpl.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\ashsimp2\ashsimp2.exe в %ProgramFiles%\ashsimp2\ashsimp2.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\ashserv\ashserv.exe в %ProgramFiles%\ashserv\ashserv.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\ashquick\ashquick.exe в %ProgramFiles%\ashquick\ashquick.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\ashpopwz\ashpopwz.exe в %ProgramFiles%\ashpopwz\ashpopwz.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\ashmaisv\ashmaisv.exe в %ProgramFiles%\ashmaisv\ashmaisv.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles%\ashenhcd\ashenhcd.exe в %ProgramFiles%\ashenhcd\ashenhcd.exe.id-ece3edd5.[jerjis@tuta.io].banks1
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\a3dutils.dll в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\a3dutils.dll.id-ece3edd5.[jerjis@tuta.io].banks1

Подменяет следующие файлы

C:\Far2\Addons\README.TXT

Изменяет множество файлов пользовательских данных (Trojan.Encoder).

Другое

Запускает на исполнение

'<SYSTEM32>\cmd.exe'
'<SYSTEM32>\netsh.exe' netsh advfirewall set currentprofile state off
'<SYSTEM32>\cmd.exe' /C vssadmin Delete Shadows /All /Quiet
'<SYSTEM32>\vssvc.exe'
'<SYSTEM32>\svchost.exe' -k swprv

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней