Trojan.Encoder.3544

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Classes\OQCTXRAXDSCWQKX\shell\open\command] '' = '%TEMP%\iu1L7v68tl6K05n.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Alcmeter' = '%TEMP%\iu1L7v68tl6K05n.exe'

Создает или изменяет следующие файлы:

%HOMEPATH%\Start Menu\Programs\Startup\Shortcut to startup_local.lnk
%HOMEPATH%\Start Menu\Programs\Startup\BENI_OKU.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\BENI_OKU.txt

Изменения в файловой системе:

Создает следующие файлы:

C:\Documents and Settings\Default User\Local Settings\History\BENI_OKU.txt
C:\Documents and Settings\Default User\Local Settings\BENI_OKU.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\BENI_OKU.txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\BENI_OKU.txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\BENI_OKU.txt
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\BENI_OKU.txt
C:\Documents and Settings\Default User\Application Data\BENI_OKU.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Games\BENI_OKU.txt
%ALLUSERSPROFILE%\Start Menu\Programs\BENI_OKU.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\BENI_OKU.txt
C:\Documents and Settings\Default User\Cookies\BENI_OKU.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\BENI_OKU.txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\BENI_OKU.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\BENI_OKU.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\BENI_OKU.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\BENI_OKU.txt
C:\Documents and Settings\Default User\Templates\BENI_OKU.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\BENI_OKU.txt
C:\Documents and Settings\Default User\Start Menu\Programs\BENI_OKU.txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\BENI_OKU.txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\BENI_OKU.txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\BENI_OKU.txt
C:\Documents and Settings\Default User\Start Menu\BENI_OKU.txt
C:\Documents and Settings\Default User\SendTo\BENI_OKU.txt
C:\Documents and Settings\Default User\BENI_OKU.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\BENI_OKU.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Pbk\BENI_OKU.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Player\BENI_OKU.txt
%ALLUSERSPROFILE%\Documents\My Music\BENI_OKU.txt
%ALLUSERSPROFILE%\Documents\BENI_OKU.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\BENI_OKU.txt
<Текущая директория>\BENI_OKU.txt
C:\BENI_OKU.txt
%TEMP%\iu1L7v68tl6K05n.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Dr Watson\BENI_OKU.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\BENI_OKU.txt
%ALLUSERSPROFILE%\Application Data\BENI_OKU.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\BENI_OKU.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\BENI_OKU.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\BENI_OKU.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\BENI_OKU.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\BENI_OKU.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\BENI_OKU.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\BENI_OKU.txt
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\BENI_OKU.txt
%ALLUSERSPROFILE%\Documents\My Pictures\BENI_OKU.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\BENI_OKU.txt
%ALLUSERSPROFILE%\Start Menu\BENI_OKU.txt
%ALLUSERSPROFILE%\DRM\BENI_OKU.txt
%ALLUSERSPROFILE%\Documents\My Videos\BENI_OKU.txt