Trojan.Encoder.42425

Техническая информация

Для обеспечения автозапуска и распространения

Создает следующие файлы на съемном носителе

<Имя диска съемного носителя>:\r3st0r3_f14es__t07iz_47k0z_xb38.txt

Изменения в файловой системе

Создает следующие файлы

C:\r3st0r3_f14es__t07iz_47k0z_xb38.txt
%HOMEPATH%\documents\my videos\r3st0r3_f14es__t07iz_47k0z_xb38.txt
%HOMEPATH%\documents\my pictures\r3st0r3_f14es__t07iz_47k0z_xb38.txt
%HOMEPATH%\documents\my music\r3st0r3_f14es__t07iz_47k0z_xb38.txt
%HOMEPATH%\documents\r3st0r3_f14es__t07iz_47k0z_xb38.txt
%HOMEPATH%\desktop\r3st0r3_f14es__t07iz_47k0z_xb38.txt
%HOMEPATH%\favorites\r3st0r3_f14es__t07iz_47k0z_xb38.txt
%HOMEPATH%\cookies\r3st0r3_f14es__t07iz_47k0z_xb38.txt
%HOMEPATH%\application data\r3st0r3_f14es__t07iz_47k0z_xb38.txt
%HOMEPATH%\r3st0r3_f14es__t07iz_47k0z_xb38.txt
C:\users\public\videos\sample videos\r3st0r3_f14es__t07iz_47k0z_xb38.txt
C:\users\public\recorded tv\sample media\r3st0r3_f14es__t07iz_47k0z_xb38.txt
C:\users\public\recorded tv\r3st0r3_f14es__t07iz_47k0z_xb38.txt
C:\users\public\music\sample music\r3st0r3_f14es__t07iz_47k0z_xb38.txt
%HOMEPATH%\contacts\r3st0r3_f14es__t07iz_47k0z_xb38.txt
C:\users\default\start menu\r3st0r3_f14es__t07iz_47k0z_xb38.txt
%HOMEPATH%\favorites\links\r3st0r3_f14es__t07iz_47k0z_xb38.txt
D:\r3st0r3_f14es__t07iz_47k0z_xb38.txt
%HOMEPATH%\sendto\r3st0r3_f14es__t07iz_47k0z_xb38.txt
%HOMEPATH%\recent\r3st0r3_f14es__t07iz_47k0z_xb38.txt
%HOMEPATH%\templates\r3st0r3_f14es__t07iz_47k0z_xb38.txt
%HOMEPATH%\start menu\r3st0r3_f14es__t07iz_47k0z_xb38.txt
%HOMEPATH%\searches\r3st0r3_f14es__t07iz_47k0z_xb38.txt
C:\users\public\pictures\sample pictures\r3st0r3_f14es__t07iz_47k0z_xb38.txt
%HOMEPATH%\downloads\r3st0r3_f14es__t07iz_47k0z_xb38.txt
%HOMEPATH%\nethood\r3st0r3_f14es__t07iz_47k0z_xb38.txt
%HOMEPATH%\links\r3st0r3_f14es__t07iz_47k0z_xb38.txt
%HOMEPATH%\local settings\r3st0r3_f14es__t07iz_47k0z_xb38.txt
%HOMEPATH%\favorites\windows live\r3st0r3_f14es__t07iz_47k0z_xb38.txt
%HOMEPATH%\favorites\msn websites\r3st0r3_f14es__t07iz_47k0z_xb38.txt
%HOMEPATH%\favorites\microsoft websites\r3st0r3_f14es__t07iz_47k0z_xb38.txt
%HOMEPATH%\printhood\r3st0r3_f14es__t07iz_47k0z_xb38.txt
%HOMEPATH%\favorites\links for united states\r3st0r3_f14es__t07iz_47k0z_xb38.txt
C:\users\public\documents\my pictures\r3st0r3_f14es__t07iz_47k0z_xb38.txt
C:\users\public\libraries\r3st0r3_f14es__t07iz_47k0z_xb38.txt
C:\users\public\favorites\r3st0r3_f14es__t07iz_47k0z_xb38.txt
C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\r3st0r3_f14es__t07iz_47k0z_xb38.txt
C:\documents and settings\r3st0r3_f14es__t07iz_47k0z_xb38.txt
C:\kms\r3st0r3_f14es__t07iz_47k0z_xb38.txt
C:\msocache\r3st0r3_f14es__t07iz_47k0z_xb38.txt
C:\perflogs\r3st0r3_f14es__t07iz_47k0z_xb38.txt
C:\perflogs\admin\r3st0r3_f14es__t07iz_47k0z_xb38.txt
<Текущая директория>\r3st0r3_f14es__t07iz_47k0z_xb38.txt
C:\recovery\r3st0r3_f14es__t07iz_47k0z_xb38.txt
C:\users\default\links\r3st0r3_f14es__t07iz_47k0z_xb38.txt
C:\users\default\documents\r3st0r3_f14es__t07iz_47k0z_xb38.txt
C:\users\default\documents\my music\r3st0r3_f14es__t07iz_47k0z_xb38.txt
C:\users\default\documents\my pictures\r3st0r3_f14es__t07iz_47k0z_xb38.txt
C:\users\default\documents\my videos\r3st0r3_f14es__t07iz_47k0z_xb38.txt
C:\users\default\downloads\r3st0r3_f14es__t07iz_47k0z_xb38.txt
C:\users\default\desktop\r3st0r3_f14es__t07iz_47k0z_xb38.txt
%HOMEPATH%\saved games\r3st0r3_f14es__t07iz_47k0z_xb38.txt
C:\users\default\local settings\r3st0r3_f14es__t07iz_47k0z_xb38.txt
C:\users\default\r3st0r3_f14es__t07iz_47k0z_xb38.txt
C:\users\default\cookies\r3st0r3_f14es__t07iz_47k0z_xb38.txt
C:\users\public\downloads\r3st0r3_f14es__t07iz_47k0z_xb38.txt
C:\users\public\documents\my videos\r3st0r3_f14es__t07iz_47k0z_xb38.txt
C:\users\public\documents\my music\r3st0r3_f14es__t07iz_47k0z_xb38.txt
C:\users\public\documents\r3st0r3_f14es__t07iz_47k0z_xb38.txt
C:\users\public\desktop\r3st0r3_f14es__t07iz_47k0z_xb38.txt
C:\users\default\nethood\r3st0r3_f14es__t07iz_47k0z_xb38.txt
C:\users\default\templates\r3st0r3_f14es__t07iz_47k0z_xb38.txt
C:\users\default\application data\r3st0r3_f14es__t07iz_47k0z_xb38.txt
C:\users\default\sendto\r3st0r3_f14es__t07iz_47k0z_xb38.txt
C:\users\default\saved games\r3st0r3_f14es__t07iz_47k0z_xb38.txt
C:\users\default\favorites\r3st0r3_f14es__t07iz_47k0z_xb38.txt
C:\users\default\recent\r3st0r3_f14es__t07iz_47k0z_xb38.txt
C:\users\default\printhood\r3st0r3_f14es__t07iz_47k0z_xb38.txt
C:\users\public\r3st0r3_f14es__t07iz_47k0z_xb38.txt
m:\r3st0r3_f14es__t07iz_47k0z_xb38.txt

Изменяет следующие файлы

C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\winre.wim.t0n1
%HOMEPATH%\desktop\google chrome.lnk.t0n1
%HOMEPATH%\desktop\508softwareandos.doc.t0n1
%HOMEPATH%\contacts\user.contact.t0n1
C:\users\public\pictures\sample pictures\tulips.jpg.t0n1
C:\users\public\pictures\sample pictures\lighthouse.jpg.t0n1
C:\users\public\videos\sample videos\wildlife.wmv.t0n1
C:\users\public\music\sample music\sleep away.mp3.t0n1
C:\users\public\music\sample music\kalimba.mp3.t0n1
C:\users\public\recorded tv\sample media\win7_scenic-demoshort_raw.wtv.t0n1
C:\users\public\music\sample music\maid with the flaxen hair.mp3.t0n1
C:\users\public\pictures\sample pictures\koala.jpg.t0n1
C:\users\public\pictures\sample pictures\hydrangeas.jpg.t0n1
C:\users\public\pictures\sample pictures\desert.jpg.t0n1
C:\users\public\desktop\steam.lnk.t0n1
C:\users\public\desktop\opera.lnk.t0n1
C:\users\public\desktop\firefox.lnk.t0n1
C:\users\public\pictures\sample pictures\jellyfish.jpg.t0n1
C:\users\public\desktop\mozilla thunderbird.lnk.t0n1
C:\users\public\desktop\acrobat reader dc.lnk.t0n1
C:\users\public\pictures\sample pictures\chrysanthemum.jpg.t0n1
C:\users\public\libraries\recordedtv.library-ms.t0n1
C:\users\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms.t0n1
C:\users\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf.t0n1
C:\users\default\ntuser.dat.log1.t0n1
C:\users\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms.t0n1
C:\users\default\ntuser.dat.log2.t0n1
C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\boot.sdi.t0n1
%HOMEPATH%\desktop\telegram.lnk.t0n1
%HOMEPATH%\favorites\links\web slice gallery.url.t0n1