Trojan.Encoder.33946

Техническая информация

Для обеспечения автозапуска и распространения

Создает следующие файлы на съемном носителе

<Имя диска съемного носителя>:\readme.txt
<Имя диска съемного носителя>:\join.avi
<Имя диска съемного носителя>:\dashborder_96.bmp
<Имя диска съемного носителя>:\tileimage.bmp
<Имя диска съемного носителя>:\dashborder_192.bmp
<Имя диска съемного носителя>:\coffee.bmp

Изменения в файловой системе

Создает следующие файлы

C:\readme.txt
%ProgramFiles%\cavasm\readme.txt
%ProgramFiles%\cavaud\readme.txt
%ProgramFiles%\cavemsrv\readme.txt
%ProgramFiles%\cavmr\readme.txt
%ProgramFiles%\cavmud\readme.txt
%ProgramFiles%\cavoar\readme.txt
%ProgramFiles%\cavq\readme.txt
%ProgramFiles%\cavscons\readme.txt
%ProgramFiles%\cavse\readme.txt
%ProgramFiles%\cavsn\readme.txt
%ProgramFiles%\cavsub\readme.txt
%ProgramFiles%\cavsubmit\readme.txt
%ProgramFiles%\cavumas\readme.txt
%ProgramFiles%\cavuserupd\readme.txt
%ProgramFiles%\cavvl\readme.txt
%ProgramFiles%\ccapp\readme.txt
%ProgramFiles%\ccevtmgr\readme.txt
%ProgramFiles%\ccleaner\readme.txt
%ProgramFiles%\ccproxy\readme.txt
%ProgramFiles%\cavapp\readme.txt
%ProgramFiles%\avnotify\readme.txt
%ProgramFiles%\cafix\readme.txt
%ProgramFiles%\btinint\readme.txt
%ProgramFiles%\avpm\readme.txt
%ProgramFiles%\avscan\readme.txt
%ProgramFiles%\avsynmgr\readme.txt
%ProgramFiles%\b2\readme.txt
%ProgramFiles%\backweb-4476822\readme.txt
%ProgramFiles%\bdagent\readme.txt
%ProgramFiles%\bdmcon\readme.txt
%ProgramFiles%\bdnews\readme.txt
%ProgramFiles%\bdoesrv\readme.txt
%ProgramFiles%\bdss\readme.txt
%ProgramFiles%\bdsubmit\readme.txt
%ProgramFiles%\bdsubmitwiz\readme.txt
%ProgramFiles%\bdsurvey\readme.txt
%ProgramFiles%\bdswitch\readme.txt
%ProgramFiles%\bdwizreg\readme.txt
%ProgramFiles%\blackd\readme.txt
%ProgramFiles%\blackice\readme.txt
%ProgramFiles%\blindman\readme.txt
%ProgramFiles%\btini\readme.txt
%ProgramFiles%\cabalmain\readme.txt
%ProgramFiles%\avpcc\readme.txt
%ProgramFiles%\ccsetmgr\readme.txt
%ProgramFiles%\clamtray\readme.txt
%ProgramFiles%\dekaron\readme.txt
%ProgramFiles%\digsby\readme.txt
%ProgramFiles%\digsby-app\readme.txt
%ProgramFiles%\directftp\readme.txt
%ProgramFiles%\dislite\readme.txt
%ProgramFiles%\dnf\readme.txt
%ProgramFiles%\dpatrolq\readme.txt
%ProgramFiles%\drvctl\readme.txt
%ProgramFiles%\ashsimpl\readme.txt
%ProgramFiles%\drvirus\readme.txt
%ProgramFiles%\drwadins\readme.txt
%ProgramFiles%\drweb\readme.txt
%ProgramFiles%\drweb32w\readme.txt
%ProgramFiles%\drweb386\readme.txt
%ProgramFiles%\drwebscd\readme.txt
%ProgramFiles%\drwebupw\readme.txt
%ProgramFiles%\drwebwcl\readme.txt
D:\readme.txt
%ProgramFiles%\defensewall\readme.txt
%ProgramFiles%\defwatch\readme.txt
%ProgramFiles%\chrome\readme.txt
%ProgramFiles%\cemrep\readme.txt
%ProgramFiles%\cuteftp\readme.txt
%ProgramFiles%\clamwin\readme.txt
%ProgramFiles%\claw95\readme.txt
%ProgramFiles%\claw95cf\readme.txt
%ProgramFiles%\cleaner\readme.txt
%ProgramFiles%\cleaner3\readme.txt
%ProgramFiles%\clisvc\readme.txt
%ProgramFiles%\clrcche\readme.txt
%ProgramFiles%\cmain\readme.txt
%ProgramFiles%\cmgrdian\readme.txt
%CommonProgramFiles%\readme.txt
%ProgramFiles%\copyx64\readme.txt
%ProgramFiles%\courier\readme.txt
%ProgramFiles%\cpd\readme.txt
%ProgramFiles%\csendto\readme.txt
%ProgramFiles%\cssexc\readme.txt
%ProgramFiles%\custinstall\readme.txt
%ProgramFiles%\custsetup\readme.txt
%ProgramFiles%\dbconvert\readme.txt
%ProgramFiles%\clamscan\readme.txt
%ProgramFiles%\dbtool\readme.txt
%ProgramFiles%\avkwctl\readme.txt
%ProgramFiles%\avkservice\readme.txt
%ProgramFiles%\avkserv\readme.txt
%ProgramFiles%\aavshield\readme.txt
%ProgramFiles%\about\readme.txt
%ProgramFiles%\ackwin32\readme.txt
%ProgramFiles%\admunch\readme.txt
%ProgramFiles%\agb5\readme.txt
%ProgramFiles%\ageofconan\readme.txt
%ProgramFiles%\ahnsd\readme.txt
%ProgramFiles%\aim6\readme.txt
%ProgramFiles%\aimpro\readme.txt
%ProgramFiles%\airdefense\readme.txt
%ProgramFiles%\almon\readme.txt
%ProgramFiles%\alsvc\readme.txt
%ProgramFiles%\amon\readme.txt
%ProgramFiles%\amsn\readme.txt
%ProgramFiles%\anti-trojan\readme.txt
%ProgramFiles%\antivirus\readme.txt
%ProgramFiles%\aoltbserver\readme.txt
%ProgramFiles%\armor2net\readme.txt
%ProgramFiles%\a2upd\readme.txt
%ProgramFiles%\armorsurf\readme.txt
%ProgramFiles%\a2start\readme.txt
%ProgramFiles%\a2scan\readme.txt
C:\far2\readme.txt
C:\msocache\readme.txt
%ProgramFiles%\readme.txt
%ProgramFiles(x86)%\readme.txt
%ALLUSERSPROFILE%\readme.txt
C:\recovery\readme.txt
C:\totalcmd\readme.txt
C:\users\readme.txt
<Текущая директория>\readme.txt
C:\far2\documentation\readme.txt
C:\far2\encyclopedia\readme.txt
C:\far2\fexcept\readme.txt
C:\far2\plugins\readme.txt
C:\far2\pluginsdk\readme.txt
C:\msocache\all users\readme.txt
%ProgramFiles%\360tray\readme.txt
%ProgramFiles%\a2cmd\readme.txt
%ProgramFiles%\a2guard\readme.txt
%ProgramFiles%\a2hijackfree\readme.txt
%ProgramFiles%\a2service\readme.txt
%ProgramFiles%\ash\readme.txt
%ProgramFiles%\a2wizard\readme.txt
%ProgramFiles%\ashavast\readme.txt
%ProgramFiles%\avcmd\readme.txt
%ProgramFiles%\avconsol\readme.txt
%ProgramFiles%\avgamsvr\readme.txt
%ProgramFiles%\avgcc\readme.txt
%ProgramFiles%\avgdiag\readme.txt
%ProgramFiles%\avgemc\readme.txt
%ProgramFiles%\avgfwsrv\readme.txt
%ProgramFiles%\avginet\readme.txt
%ProgramFiles%\avgnpdln\readme.txt
%ProgramFiles%\avgnpsvc\readme.txt
%ProgramFiles%\avgrssvc\readme.txt
%ProgramFiles%\avgscan\readme.txt
%ProgramFiles%\avgupden\readme.txt
%ProgramFiles%\avgupsvc\readme.txt
%ProgramFiles%\avgvv\readme.txt
%ProgramFiles%\avgw\readme.txt
%ProgramFiles%\avgwizfw\readme.txt
%ProgramFiles%\avinitnt\readme.txt
%ProgramFiles%\avciman\readme.txt
%ProgramFiles%\avadmin\readme.txt
%ProgramFiles%\avconfig\readme.txt
%ProgramFiles%\avcenter\readme.txt
%ProgramFiles%\autotrace\readme.txt
%ProgramFiles%\ashavsrv\readme.txt
%ProgramFiles%\ashdisp\readme.txt
%ProgramFiles%\ashdug\readme.txt
%ProgramFiles%\ashenhcd\readme.txt
%ProgramFiles%\ashlogv\readme.txt
%ProgramFiles%\ashmaisv\readme.txt
%ProgramFiles%\ashpopwz\readme.txt
%ProgramFiles%\ashquick\readme.txt
%ProgramFiles%\ashserv\readme.txt
%ProgramFiles%\drwreg\readme.txt
%ProgramFiles%\drvmap\readme.txt
%ProgramFiles%\ashsimp2\readme.txt
%ProgramFiles%\ashskpck\readme.txt
%ProgramFiles%\ashupd\readme.txt
%ProgramFiles%\ashwebsv\readme.txt
%ProgramFiles%\ash_updatemediator\readme.txt
%ProgramFiles%\aswregsvr\readme.txt
%ProgramFiles%\aswupdsv\readme.txt
%ProgramFiles%\autodown\readme.txt
%ProgramFiles%\autostartexplorer\readme.txt
%ProgramFiles%\ashchest\readme.txt
%ProgramFiles%\ashskpcc\readme.txt
%ProgramFiles%\dvd maker\readme.txt

Перемещает следующие файлы

%ProgramFiles%\desktop.ini в %ProgramFiles%\desktop.ini.tppmw
%ProgramFiles(x86)%\desktop.ini в %ProgramFiles(x86)%\desktop.ini.tppmw

Изменяет следующие файлы

C:\far2\changelog
C:\totalcmd\tcunin64.wul
C:\totalcmd\size!.txt
C:\totalcmd\register.rtf
C:\totalcmd\no.bar
C:\totalcmd\keyboard.txt
C:\totalcmd\history.txt
C:\totalcmd\descript.ion
C:\totalcmd\default.bar
%ALLUSERSPROFILE%\ntuser.pol
%ProgramFiles(x86)%\desktop.ini
%ProgramFiles%\desktop.ini
C:\far2\savesettings.cmd
C:\far2\restoresettings.cmd
C:\far2\file_id.diz
C:\far2\farspa.lng
C:\far2\farrus.lng
C:\far2\farrus.hlf
C:\far2\farpol.lng
C:\far2\farhun.lng
C:\far2\farhun.hlf
C:\far2\farger.lng
C:\far2\fareng.lng
C:\far2\fareng.hlf
C:\far2\farcze.lng
C:\far2\far.map
C:\far2\clearpluginscache.cmd
C:\far2\changelog_eng
C:\totalcmd\tcuninst.wul
C:\totalcmd\totalcmd.chm

Изменяет множество файлов.

Изменяет множество файлов пользовательских данных (Trojan.Encoder).

Изменяет расширения файлов пользовательских данных (Trojan.Encoder).

Сетевая активность

Подключается к

'<LOCALNET>.22.0':445
'<LOCALNET>.22.161':445
'<LOCALNET>.22.162':445
'<LOCALNET>.22.163':445
'<LOCALNET>.22.164':445
'<LOCALNET>.22.165':445
'<LOCALNET>.22.166':445
'<LOCALNET>.22.167':445
'<LOCALNET>.22.168':445
'<LOCALNET>.22.169':445
'<LOCALNET>.22.170':445
'<LOCALNET>.22.171':445
'<LOCALNET>.22.172':445
'<LOCALNET>.22.173':445
'<LOCALNET>.22.175':445
'<LOCALNET>.22.189':445
'<LOCALNET>.22.176':445
'<LOCALNET>.22.177':445
'<LOCALNET>.22.178':445
'<LOCALNET>.22.179':445
'<LOCALNET>.22.180':445
'<LOCALNET>.22.181':445
'<LOCALNET>.22.182':445
'<LOCALNET>.22.183':445
'<LOCALNET>.22.184':445
'<LOCALNET>.22.185':445
'<LOCALNET>.22.186':445
'<LOCALNET>.22.187':445
'<LOCALNET>.22.188':445
'<LOCALNET>.22.160':445
'<LOCALNET>.22.174':445
'<LOCALNET>.22.159':445
'<LOCALNET>.22.142':445
'<LOCALNET>.22.129':445
'<LOCALNET>.22.130':445
'<LOCALNET>.22.131':445
'<LOCALNET>.22.132':445
'<LOCALNET>.22.133':445
'<LOCALNET>.22.134':445
'<LOCALNET>.22.135':445
'<LOCALNET>.22.136':445
'<LOCALNET>.22.137':445
'<LOCALNET>.22.138':445
'<LOCALNET>.22.139':445
'<LOCALNET>.22.140':445
'<LOCALNET>.22.141':445
'<LOCALNET>.22.143':445
'<LOCALNET>.22.157':445
'<LOCALNET>.22.144':445
'<LOCALNET>.22.145':445
'<LOCALNET>.22.146':445
'<LOCALNET>.22.147':445
'<LOCALNET>.22.148':445
'<LOCALNET>.22.149':445
'<LOCALNET>.22.150':445
'<LOCALNET>.22.151':445
'<LOCALNET>.22.152':445
'<LOCALNET>.22.153':445
'<LOCALNET>.22.154':445
'<LOCALNET>.22.155':445
'<LOCALNET>.22.156':445
'<LOCALNET>.22.158':445
'<LOCALNET>.22.207':445
'<LOCALNET>.22.253':445
'<LOCALNET>.22.192':445
'<LOCALNET>.22.225':445
'<LOCALNET>.22.226':445
'<LOCALNET>.22.227':445
'<LOCALNET>.22.228':445
'<LOCALNET>.22.229':445
'<LOCALNET>.22.230':445
'<LOCALNET>.22.231':445
'<LOCALNET>.22.232':445
'<LOCALNET>.22.233':445
'<LOCALNET>.22.234':445
'<LOCALNET>.22.235':445
'<LOCALNET>.22.236':445
'<LOCALNET>.22.237':445
'<LOCALNET>.22.239':445
'<LOCALNET>.22.191':445
'<LOCALNET>.22.240':445
'<LOCALNET>.22.241':445
'<LOCALNET>.22.242':445
'<LOCALNET>.22.243':445
'<LOCALNET>.22.244':445
'<LOCALNET>.22.245':445
'<LOCALNET>.22.246':445
'<LOCALNET>.22.247':445
'<LOCALNET>.22.248':445
'<LOCALNET>.22.249':445
'<LOCALNET>.22.250':445
'<LOCALNET>.22.251':445
'<LOCALNET>.22.252':445
'<LOCALNET>.22.224':445
'<LOCALNET>.22.128':445
'<LOCALNET>.22.223':445
'<LOCALNET>.22.206':445
'<LOCALNET>.22.193':445
'<LOCALNET>.22.194':445
'<LOCALNET>.22.195':445
'<LOCALNET>.22.196':445
'<LOCALNET>.22.197':445
'<LOCALNET>.22.198':445
'<LOCALNET>.22.199':445
'<LOCALNET>.22.200':445
'<LOCALNET>.22.201':445
'<LOCALNET>.22.202':445
'<LOCALNET>.22.203':445
'<LOCALNET>.22.204':445
'<LOCALNET>.22.205':445
'<LOCALNET>.22.190':445
'<LOCALNET>.22.221':445
'<LOCALNET>.22.208':445
'<LOCALNET>.22.209':445
'<LOCALNET>.22.210':445
'<LOCALNET>.22.211':445
'<LOCALNET>.22.212':445
'<LOCALNET>.22.213':445
'<LOCALNET>.22.214':445
'<LOCALNET>.22.215':445
'<LOCALNET>.22.216':445
'<LOCALNET>.22.217':445
'<LOCALNET>.22.218':445
'<LOCALNET>.22.219':445
'<LOCALNET>.22.220':445
'<LOCALNET>.22.222':445
'<LOCALNET>.22.238':445
'<LOCALNET>.22.127':445
'<LOCALNET>.22.110':445
'<LOCALNET>.22.33':445
'<LOCALNET>.22.34':445
'<LOCALNET>.22.35':445
'<LOCALNET>.22.36':445
'<LOCALNET>.22.37':445
'<LOCALNET>.22.38':445
'<LOCALNET>.22.39':445
'<LOCALNET>.22.40':445
'<LOCALNET>.22.41':445
'<LOCALNET>.22.42':445
'<LOCALNET>.22.43':445
'<LOCALNET>.22.44':445
'<LOCALNET>.22.45':445
'<LOCALNET>.22.47':445
'<LOCALNET>.22.61':445
'<LOCALNET>.22.48':445
'<LOCALNET>.22.49':445
'<LOCALNET>.22.50':445
'<LOCALNET>.22.51':445
'<LOCALNET>.22.52':445
'<LOCALNET>.22.53':445
'<LOCALNET>.22.54':445
'<LOCALNET>.22.55':445
'<LOCALNET>.22.56':445
'<LOCALNET>.22.57':445
'<LOCALNET>.22.58':445
'<LOCALNET>.22.59':445
'<LOCALNET>.22.60':445
'<LOCALNET>.22.32':445
'<LOCALNET>.22.46':445
'<LOCALNET>.22.31':445
'<LOCALNET>.22.14':445
'<LOCALNET>.22.1':445
'<LOCALNET>.22.2':445
'<LOCALNET>.22.3':445
'<LOCALNET>.22.4':445
'<LOCALNET>.22.5':445
'<LOCALNET>.22.6':445
'<LOCALNET>.22.7':445
'<LOCALNET>.22.8':445
'<LOCALNET>.22.9':445
'<LOCALNET>.22.10':445
'<LOCALNET>.22.11':445
'<LOCALNET>.22.12':445
'<LOCALNET>.22.13':445
'<LOCALNET>.22.15':445
'<LOCALNET>.22.29':445
'<LOCALNET>.22.16':445
'<LOCALNET>.22.17':445
'<LOCALNET>.22.18':445
'<LOCALNET>.22.19':445
'<LOCALNET>.22.20':445
'<LOCALNET>.22.21':445
'<LOCALNET>.22.22':445
'<LOCALNET>.22.23':445
'<LOCALNET>.22.24':445
'<LOCALNET>.22.25':445
'<LOCALNET>.22.26':445
'<LOCALNET>.22.27':445
'<LOCALNET>.22.28':445
'<LOCALNET>.22.30':445
'<LOCALNET>.22.79':445
'<LOCALNET>.22.125':445
'<LOCALNET>.22.64':445
'<LOCALNET>.22.97':445
'<LOCALNET>.22.98':445
'<LOCALNET>.22.99':445
'<LOCALNET>.22.100':445
'<LOCALNET>.22.101':445
'<LOCALNET>.22.102':445
'<LOCALNET>.22.103':445
'<LOCALNET>.22.104':445
'<LOCALNET>.22.105':445
'<LOCALNET>.22.106':445
'<LOCALNET>.22.107':445
'<LOCALNET>.22.108':445
'<LOCALNET>.22.109':445
'<LOCALNET>.22.111':445
'<LOCALNET>.22.63':445
'<LOCALNET>.22.112':445
'<LOCALNET>.22.113':445
'<LOCALNET>.22.114':445
'<LOCALNET>.22.115':445
'<LOCALNET>.22.116':445
'<LOCALNET>.22.117':445
'<LOCALNET>.22.118':445
'<LOCALNET>.22.119':445
'<LOCALNET>.22.120':445
'<LOCALNET>.22.121':445
'<LOCALNET>.22.122':445
'<LOCALNET>.22.123':445
'<LOCALNET>.22.124':445
'<LOCALNET>.22.96':445
'<LOCALNET>.22.126':445
'<LOCALNET>.22.95':445
'<LOCALNET>.22.78':445
'<LOCALNET>.22.65':445
'<LOCALNET>.22.66':445
'<LOCALNET>.22.67':445
'<LOCALNET>.22.68':445
'<LOCALNET>.22.69':445
'<LOCALNET>.22.70':445
'<LOCALNET>.22.71':445
'<LOCALNET>.22.72':445
'<LOCALNET>.22.73':445
'<LOCALNET>.22.74':445
'<LOCALNET>.22.75':445
'<LOCALNET>.22.76':445
'<LOCALNET>.22.77':445
'<LOCALNET>.22.62':445
'<LOCALNET>.22.93':445
'<LOCALNET>.22.80':445
'<LOCALNET>.22.81':445
'<LOCALNET>.22.82':445
'<LOCALNET>.22.83':445
'<LOCALNET>.22.84':445
'<LOCALNET>.22.85':445
'<LOCALNET>.22.86':445
'<LOCALNET>.22.87':445
'<LOCALNET>.22.88':445
'<LOCALNET>.22.89':445
'<LOCALNET>.22.90':445
'<LOCALNET>.22.91':445
'<LOCALNET>.22.92':445
'<LOCALNET>.22.94':445
'<LOCALNET>.22.254':445

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней