Trojan.Encoder.37849

Техническая информация

Для обеспечения автозапуска и распространения

Создает следующие файлы на съемном носителе

<Имя диска съемного носителя>:\how to restore your files.txt

Вредоносные функции

Завершает или пытается завершить

следующие системные процессы:

System

следующие пользовательские процессы:

firefox.exe

Читает файлы, отвечающие за хранение паролей сторонними программами

%HOMEPATH%\desktop\1189.jpg
%HOMEPATH%\desktop\tree_view.html
%HOMEPATH%\desktop\tree_view.htm
%HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
%HOMEPATH%\desktop\testcertificate.cer
%HOMEPATH%\desktop\sdszfo.docx
%HOMEPATH%\desktop\region-north-karelia.jpeg
%HOMEPATH%\desktop\ovp25012015.doc
%HOMEPATH%\desktop\ituneshelpunavailable.html
%HOMEPATH%\desktop\trivial-merge.htm
%HOMEPATH%\desktop\holycrosschurchinstructions.docx
%HOMEPATH%\desktop\garden.htm
%HOMEPATH%\desktop\fi51.doc
%HOMEPATH%\desktop\default.bmp
%HOMEPATH%\desktop\contosoroot_1.cer
%HOMEPATH%\desktop\contosoroot.cer
%HOMEPATH%\desktop\advice_process.htm
%HOMEPATH%\desktop\4f0bf7ff71f28.jpeg
%HOMEPATH%\desktop\3.jpg
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
%HOMEPATH%\desktop\weeklysheet1215.doc

Изменения в файловой системе

Создает следующие файлы

C:\how to restore your files.txt
%HOMEPATH%\favorites\links for united states\how to restore your files.txt
%HOMEPATH%\favorites\links\how to restore your files.txt
%HOMEPATH%\videos\how to restore your files.txt
%HOMEPATH%\searches\how to restore your files.txt
%HOMEPATH%\saved games\how to restore your files.txt
%HOMEPATH%\pictures\how to restore your files.txt
%HOMEPATH%\music\how to restore your files.txt
%HOMEPATH%\links\how to restore your files.txt
%HOMEPATH%\favorites\how to restore your files.txt
%HOMEPATH%\downloads\how to restore your files.txt
%HOMEPATH%\documents\how to restore your files.txt
%HOMEPATH%\desktop\how to restore your files.txt
%HOMEPATH%\contacts\how to restore your files.txt
%HOMEPATH%\how to restore your files.txt
C:\recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\how to restore your files.txt
C:\users\how to restore your files.txt
C:\recovery\how to restore your files.txt
<Текущая директория>\how to restore your files.txt
C:\kms\how to restore your files.txt
D:\how to restore your files.txt
%HOMEPATH%\favorites\msn websites\how to restore your files.txt

Изменяет следующие файлы

C:\kms\kms_vl_all_aio_debug.log
%HOMEPATH%\favorites\links for united states\gobiernousa.gov.url
%HOMEPATH%\favorites\links for united states\desktop.ini
%HOMEPATH%\favorites\links\web slice gallery.url
%HOMEPATH%\favorites\links\desktop.ini
%HOMEPATH%\videos\desktop.ini
%HOMEPATH%\searches\indexed locations.search-ms
%HOMEPATH%\searches\everywhere.search-ms
%HOMEPATH%\searches\desktop.ini
%HOMEPATH%\saved games\desktop.ini
%HOMEPATH%\pictures\desktop.ini
%HOMEPATH%\music\desktop.ini
%HOMEPATH%\links\desktop.ini
%HOMEPATH%\favorites\desktop.ini
%HOMEPATH%\downloads\desktop.ini
%HOMEPATH%\documents\desktop.ini
%HOMEPATH%\desktop\desktop.ini
%HOMEPATH%\desktop\contosoroot_1.cer
%HOMEPATH%\desktop\contosoroot.cer
%HOMEPATH%\desktop\advice_process.htm
%HOMEPATH%\desktop\4f0bf7ff71f28.jpeg
%HOMEPATH%\desktop\3.jpg
%HOMEPATH%\desktop\1189.jpg
%HOMEPATH%\contacts\user.contact
%HOMEPATH%\contacts\desktop.ini
C:\recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\winre.wim
C:\recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\boot.sdi
C:\users\desktop.ini
%HOMEPATH%\favorites\links for united states\usa.gov.url
D:\install.log

Изменяет множество файлов пользовательских данных (Trojan.Encoder).

Изменяет расширения файлов пользовательских данных (Trojan.Encoder).

Сетевая активность

Подключается к

'<LOCALNET>.21.0':445
'<LOCALNET>.21.161':445
'<LOCALNET>.21.162':445
'<LOCALNET>.21.163':445
'<LOCALNET>.21.164':445
'<LOCALNET>.21.165':445
'<LOCALNET>.21.166':445
'<LOCALNET>.21.167':445
'<LOCALNET>.21.168':445
'<LOCALNET>.21.169':445
'<LOCALNET>.21.170':445
'<LOCALNET>.21.171':445
'<LOCALNET>.21.172':445
'<LOCALNET>.21.173':445
'<LOCALNET>.21.175':445
'<LOCALNET>.21.189':445
'<LOCALNET>.21.176':445
'<LOCALNET>.21.177':445
'<LOCALNET>.21.178':445
'<LOCALNET>.21.179':445
'<LOCALNET>.21.180':445
'<LOCALNET>.21.181':445
'<LOCALNET>.21.182':445
'<LOCALNET>.21.183':445
'<LOCALNET>.21.184':445
'<LOCALNET>.21.185':445
'<LOCALNET>.21.186':445
'<LOCALNET>.21.187':445
'<LOCALNET>.21.188':445
'<LOCALNET>.21.160':445
'<LOCALNET>.21.174':445
'<LOCALNET>.21.159':445
'<LOCALNET>.21.142':445
'<LOCALNET>.21.129':445
'<LOCALNET>.21.130':445
'<LOCALNET>.21.131':445
'<LOCALNET>.21.132':445
'<LOCALNET>.21.133':445
'<LOCALNET>.21.134':445
'<LOCALNET>.21.135':445
'<LOCALNET>.21.136':445
'<LOCALNET>.21.137':445
'<LOCALNET>.21.138':445
'<LOCALNET>.21.139':445
'<LOCALNET>.21.140':445
'<LOCALNET>.21.141':445
'<LOCALNET>.21.143':445
'<LOCALNET>.21.157':445
'<LOCALNET>.21.144':445
'<LOCALNET>.21.145':445
'<LOCALNET>.21.146':445
'<LOCALNET>.21.147':445
'<LOCALNET>.21.148':445
'<LOCALNET>.21.149':445
'<LOCALNET>.21.150':445
'<LOCALNET>.21.151':445
'<LOCALNET>.21.152':445
'<LOCALNET>.21.153':445
'<LOCALNET>.21.154':445
'<LOCALNET>.21.155':445
'<LOCALNET>.21.156':445
'<LOCALNET>.21.158':445
'<LOCALNET>.21.207':445
'<LOCALNET>.21.253':445
'<LOCALNET>.21.192':445
'<LOCALNET>.21.225':445
'<LOCALNET>.21.226':445
'<LOCALNET>.21.227':445
'<LOCALNET>.21.228':445
'<LOCALNET>.21.229':445
'<LOCALNET>.21.230':445
'<LOCALNET>.21.231':445
'<LOCALNET>.21.232':445
'<LOCALNET>.21.233':445
'<LOCALNET>.21.234':445
'<LOCALNET>.21.235':445
'<LOCALNET>.21.236':445
'<LOCALNET>.21.237':445
'<LOCALNET>.21.239':445
'<LOCALNET>.21.191':445
'<LOCALNET>.21.240':445
'<LOCALNET>.21.241':445
'<LOCALNET>.21.242':445
'<LOCALNET>.21.243':445
'<LOCALNET>.21.244':445
'<LOCALNET>.21.245':445
'<LOCALNET>.21.246':445
'<LOCALNET>.21.247':445
'<LOCALNET>.21.248':445
'<LOCALNET>.21.249':445
'<LOCALNET>.21.250':445
'<LOCALNET>.21.251':445
'<LOCALNET>.21.252':445
'<LOCALNET>.21.224':445
'<LOCALNET>.21.128':445
'<LOCALNET>.21.223':445
'<LOCALNET>.21.206':445
'<LOCALNET>.21.193':445
'<LOCALNET>.21.194':445
'<LOCALNET>.21.195':445
'<LOCALNET>.21.196':445
'<LOCALNET>.21.197':445
'<LOCALNET>.21.198':445
'<LOCALNET>.21.199':445
'<LOCALNET>.21.200':445
'<LOCALNET>.21.201':445
'<LOCALNET>.21.202':445
'<LOCALNET>.21.203':445
'<LOCALNET>.21.204':445
'<LOCALNET>.21.205':445
'<LOCALNET>.21.190':445
'<LOCALNET>.21.221':445
'<LOCALNET>.21.208':445
'<LOCALNET>.21.209':445
'<LOCALNET>.21.210':445
'<LOCALNET>.21.211':445
'<LOCALNET>.21.212':445
'<LOCALNET>.21.213':445
'<LOCALNET>.21.214':445
'<LOCALNET>.21.215':445
'<LOCALNET>.21.216':445
'<LOCALNET>.21.217':445
'<LOCALNET>.21.218':445
'<LOCALNET>.21.219':445
'<LOCALNET>.21.220':445
'<LOCALNET>.21.222':445
'<LOCALNET>.21.238':445
'<LOCALNET>.21.127':445
'<LOCALNET>.21.110':445
'<LOCALNET>.21.33':445
'<LOCALNET>.21.34':445
'<LOCALNET>.21.35':445
'<LOCALNET>.21.36':445
'<LOCALNET>.21.37':445
'<LOCALNET>.21.38':445
'<LOCALNET>.21.39':445
'<LOCALNET>.21.40':445
'<LOCALNET>.21.41':445
'<LOCALNET>.21.42':445
'<LOCALNET>.21.43':445
'<LOCALNET>.21.44':445
'<LOCALNET>.21.45':445
'<LOCALNET>.21.47':445
'<LOCALNET>.21.61':445
'<LOCALNET>.21.48':445
'<LOCALNET>.21.49':445
'<LOCALNET>.21.50':445
'<LOCALNET>.21.51':445
'<LOCALNET>.21.52':445
'<LOCALNET>.21.53':445
'<LOCALNET>.21.54':445
'<LOCALNET>.21.55':445
'<LOCALNET>.21.56':445
'<LOCALNET>.21.57':445
'<LOCALNET>.21.58':445
'<LOCALNET>.21.59':445
'<LOCALNET>.21.60':445
'<LOCALNET>.21.32':445
'<LOCALNET>.21.46':445
'<LOCALNET>.21.31':445
'<LOCALNET>.21.14':445
'<LOCALNET>.21.1':445
'<LOCALNET>.21.2':445
'<LOCALNET>.21.3':445
'<LOCALNET>.21.4':445
'<LOCALNET>.21.5':445
'<LOCALNET>.21.6':445
'<LOCALNET>.21.7':445
'<LOCALNET>.21.8':445
'<LOCALNET>.21.9':445
'<LOCALNET>.21.10':445
'<LOCALNET>.21.11':445
'<LOCALNET>.21.12':445
'<LOCALNET>.21.13':445
'<LOCALNET>.21.15':445
'<LOCALNET>.21.29':445
'<LOCALNET>.21.16':445
'<LOCALNET>.21.17':445
'<LOCALNET>.21.18':445
'<LOCALNET>.21.19':445
'<LOCALNET>.21.20':445
'<LOCALNET>.21.21':445
'<LOCALNET>.21.22':445
'<LOCALNET>.21.23':445
'<LOCALNET>.21.24':445
'<LOCALNET>.21.25':445
'<LOCALNET>.21.26':445
'<LOCALNET>.21.27':445
'<LOCALNET>.21.28':445
'<LOCALNET>.21.30':445
'<LOCALNET>.21.79':445
'<LOCALNET>.21.125':445
'<LOCALNET>.21.64':445
'<LOCALNET>.21.97':445
'<LOCALNET>.21.98':445
'<LOCALNET>.21.99':445
'<LOCALNET>.21.100':445
'<LOCALNET>.21.101':445
'<LOCALNET>.21.102':445
'<LOCALNET>.21.103':445
'<LOCALNET>.21.104':445
'<LOCALNET>.21.105':445
'<LOCALNET>.21.106':445
'<LOCALNET>.21.107':445
'<LOCALNET>.21.108':445
'<LOCALNET>.21.109':445
'<LOCALNET>.21.111':445
'<LOCALNET>.21.63':445
'<LOCALNET>.21.112':445
'<LOCALNET>.21.113':445
'<LOCALNET>.21.114':445
'<LOCALNET>.21.115':445
'<LOCALNET>.21.116':445
'<LOCALNET>.21.117':445
'<LOCALNET>.21.118':445
'<LOCALNET>.21.119':445
'<LOCALNET>.21.120':445
'<LOCALNET>.21.121':445
'<LOCALNET>.21.122':445
'<LOCALNET>.21.123':445
'<LOCALNET>.21.124':445
'<LOCALNET>.21.96':445
'<LOCALNET>.21.126':445
'<LOCALNET>.21.95':445
'<LOCALNET>.21.78':445
'<LOCALNET>.21.65':445
'<LOCALNET>.21.66':445
'<LOCALNET>.21.67':445
'<LOCALNET>.21.68':445
'<LOCALNET>.21.69':445
'<LOCALNET>.21.70':445
'<LOCALNET>.21.71':445
'<LOCALNET>.21.72':445
'<LOCALNET>.21.73':445
'<LOCALNET>.21.74':445
'<LOCALNET>.21.75':445
'<LOCALNET>.21.76':445
'<LOCALNET>.21.77':445
'<LOCALNET>.21.62':445
'<LOCALNET>.21.93':445
'<LOCALNET>.21.80':445
'<LOCALNET>.21.81':445
'<LOCALNET>.21.82':445
'<LOCALNET>.21.83':445
'<LOCALNET>.21.84':445
'<LOCALNET>.21.85':445
'<LOCALNET>.21.86':445
'<LOCALNET>.21.87':445
'<LOCALNET>.21.88':445
'<LOCALNET>.21.89':445
'<LOCALNET>.21.90':445
'<LOCALNET>.21.91':445
'<LOCALNET>.21.92':445
'<LOCALNET>.21.94':445
'<LOCALNET>.21.254':445

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней