Trojan.Encoder.37972

Техническая информация

Вредоносные функции

Для затруднения выявления своего присутствия в системе

удаляет теневые копии разделов.

Читает файлы, отвечающие за хранение паролей сторонними программами

%HOMEPATH%\desktop\3.jpeg
%HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
%HOMEPATH%\desktop\ovp25012015.doc
%HOMEPATH%\desktop\nwfieldnotes1966.docx
%HOMEPATH%\desktop\join.avi
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
%HOMEPATH%\desktop\glidescope_review_rev_010.docx
%HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx
%HOMEPATH%\desktop\dialmap.bmp
%HOMEPATH%\desktop\dial.bmp
%HOMEPATH%\desktop\delete.avi
%HOMEPATH%\desktop\dashborder_144.bmp
%HOMEPATH%\desktop\archer.avi
%HOMEPATH%\desktop\adhd_and_obesity.docx
%HOMEPATH%\desktop\february_catalogue__2015.doc
%HOMEPATH%\desktop\weeklysheet1215.doc

Изменения в файловой системе

Перемещает следующие файлы

%APPDATA%\microsoft\windows\themes\transcodedwallpaper.jpg в %APPDATA%\microsoft\windows\themes\transcodedwallpaper.jpg.imsorry
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\prefs.js в %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\prefs.js.imsorry
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\pkcs11.txt в %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\pkcs11.txt.imsorry
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\key4.db в %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\key4.db.imsorry
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\cert9.db в %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\cert9.db.imsorry
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\alternateservices.txt в %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\alternateservices.txt.imsorry
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\alternateservices.txt в %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\alternateservices.txt.imsorry
%APPDATA%\mozilla\firefox\profiles\bcjnbgva.default\user.js в %APPDATA%\mozilla\firefox\profiles\bcjnbgva.default\user.js.imsorry
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\securitypreloadstate.txt в %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\securitypreloadstate.txt.imsorry
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\user.js в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\user.js.imsorry
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\sitesecurityservicestate.txt в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\sitesecurityservicestate.txt.imsorry
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\securitypreloadstate.txt в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\securitypreloadstate.txt.imsorry
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\prefs.js в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\prefs.js.imsorry
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\pkcs11.txt в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\pkcs11.txt.imsorry
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\key4.db в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\key4.db.imsorry
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\cert9.db в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\cert9.db.imsorry
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\alternateservices.txt в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\alternateservices.txt.imsorry
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\trrblacklist.txt в %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\trrblacklist.txt.imsorry
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\sitesecurityservicestate.txt в %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\sitesecurityservicestate.txt.imsorry

Изменяет следующие файлы

%APPDATA%\microsoft\windows\themes\transcodedwallpaper.jpg
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\sitesecurityservicestate.txt
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\securitypreloadstate.txt
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\prefs.js
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\pkcs11.txt
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\key4.db
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\cert9.db
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\alternateservices.txt
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\alternateservices.txt
%HOMEPATH%\desktop\3.jpeg
%APPDATA%\mozilla\firefox\profiles\bcjnbgva.default\user.js
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\trrblacklist.txt
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\sitesecurityservicestate.txt
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\securitypreloadstate.txt
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\prefs.js
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\pkcs11.txt
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\key4.db
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\cert9.db
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\alternateservices.txt
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\user.js
%HOMEPATH%\desktop\adhd_and_obesity.docx