Trojan.Encoder.33884

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Povlsomware' = '"<Полный путь к файлу>"'

Вредоносные функции

Читает файлы, отвечающие за хранение паролей сторонними программами

%HOMEPATH%\desktop\1189.jpg
%HOMEPATH%\desktop\toolbar.bmp
%HOMEPATH%\desktop\region-north-karelia.jpg
%HOMEPATH%\desktop\ovp25012015.doc
%HOMEPATH%\desktop\join.avi
%HOMEPATH%\desktop\holycrosschurchinstructions.docx
%HOMEPATH%\desktop\february_catalogue__2015.doc
%HOMEPATH%\desktop\dialmap.bmp
%HOMEPATH%\desktop\default.bmp
%HOMEPATH%\desktop\dashborder_96.bmp
%HOMEPATH%\desktop\applicantform_en.doc
%HOMEPATH%\desktop\508softwareandos.doc
%HOMEPATH%\desktop\3.jpg
%HOMEPATH%\desktop\210252809.jpeg
%HOMEPATH%\desktop\168.jpg
%HOMEPATH%\desktop\168.jpeg
%HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
%HOMEPATH%\desktop\weeklysheet1215.doc

Изменения в файловой системе

Создает следующие файлы

%HOMEPATH%\recent\прочитайка!!!!!.lnk

Изменяет следующие файлы

%ALLUSERSPROFILE%\application data\microsoft\office\documentrepository.ico
%ALLUSERSPROFILE%\application data\microsoft\user account pictures\default pictures\red flower.bmp
%ALLUSERSPROFILE%\application data\microsoft\user account pictures\default pictures\pink flower.bmp
%ALLUSERSPROFILE%\application data\microsoft\user account pictures\default pictures\palm tree.bmp
%ALLUSERSPROFILE%\application data\microsoft\user account pictures\default pictures\lift-off.bmp
%ALLUSERSPROFILE%\application data\microsoft\user account pictures\default pictures\kick.bmp
%ALLUSERSPROFILE%\application data\microsoft\user account pictures\default pictures\horses.bmp
%ALLUSERSPROFILE%\application data\microsoft\user account pictures\default pictures\guitar.bmp
%ALLUSERSPROFILE%\application data\microsoft\user account pictures\default pictures\frog.bmp
%ALLUSERSPROFILE%\application data\microsoft\user account pictures\default pictures\fish.bmp
%ALLUSERSPROFILE%\application data\microsoft\user account pictures\default pictures\duck.bmp
%ALLUSERSPROFILE%\application data\microsoft\user account pictures\default pictures\drip.bmp
%ALLUSERSPROFILE%\application data\microsoft\user account pictures\default pictures\dog.bmp
%ALLUSERSPROFILE%\application data\microsoft\user account pictures\default pictures\dirt bike.bmp
%ALLUSERSPROFILE%\application data\microsoft\user account pictures\default pictures\chess.bmp
%ALLUSERSPROFILE%\application data\microsoft\user account pictures\default pictures\cat.bmp
%ALLUSERSPROFILE%\application data\microsoft\user account pictures\default pictures\car.bmp
%ALLUSERSPROFILE%\application data\microsoft\user account pictures\default pictures\butterfly.bmp
%ALLUSERSPROFILE%\application data\microsoft\user account pictures\default pictures\beach.bmp
%ALLUSERSPROFILE%\application data\microsoft\user account pictures\default pictures\ball.bmp
%ALLUSERSPROFILE%\application data\microsoft\user account pictures\default pictures\astronaut.bmp
%ALLUSERSPROFILE%\application data\microsoft\user account pictures\default pictures\airplane.bmp
%ALLUSERSPROFILE%\application data\microsoft\user account pictures\user.bmp
%ALLUSERSPROFILE%\application data\microsoft\user account pictures\guest.bmp
%ALLUSERSPROFILE%\application data\microsoft\office\sharepointteamsite.ico
%ALLUSERSPROFILE%\application data\microsoft\office\sharepointportalsite.ico
%ALLUSERSPROFILE%\application data\microsoft\office\mysite.ico
%ALLUSERSPROFILE%\application data\microsoft\office\mysharepoints.ico
%ALLUSERSPROFILE%\application data\microsoft\user account pictures\default pictures\skater.bmp
%ALLUSERSPROFILE%\application data\microsoft\user account pictures\default pictures\snowflake.bmp