Trojan.Encoder.4513

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ChromeFlashPlayersHardWare' = '"%APPDATA%\ChromeFlashPlayer_88e6680f8b982aa3.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] '*ChromeFlashPlayers32' = '"%APPDATA%\ChromeFlashPlayer_88e6680f8b982aa3.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Chrome Reader UpdateHardWare' = '"<Полный путь к вирусу>"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] '*Chrome Reader Update32' = '{22,00,43,00,3a,00,5c,00,62,00,66,00,33,00,32,00,64,00,33,00,62,00,30,00,5c,00,62,00,36,00,36,00,32,00,65...

Создает или изменяет следующие файлы:

%HOMEPATH%\Start Menu\Programs\Startup\HELP_DECRYPT_YOUR_FILES.TXT
%HOMEPATH%\Start Menu\Programs\Startup\HELP_DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\HELP_DECRYPT_YOUR_FILES.TXT
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\HELP_DECRYPT_YOUR_FILES.HTML

Изменения в файловой системе:

Создает следующие файлы:

C:\Far2\Addons\XLat\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Addons\XLat\Russian\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Addons\Shell\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Addons\XLat\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Addons\XLat\Russian\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Documentation\eng\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Documentation\eng\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Documentation\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Documentation\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Addons\Shell\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Addons\Colors\Custom Highlighting\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Addons\Colors\Default Highlighting\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Addons\Colors\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Addons\Colors\Custom Highlighting\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Addons\Colors\Default Highlighting\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Addons\SetUp\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Addons\SetUp\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Addons\Macros\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Addons\Macros\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Documentation\rus\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\arclite\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\AutoWrap\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\Align\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\arclite\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\AutoWrap\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\Colorer\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\Colorer\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\Brackets\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\Brackets\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\Align\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Encyclopedia\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\FExcept\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Documentation\rus\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Encyclopedia\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\FExcept\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\7-Zip\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\7-Zip\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Addons\Colors\HELP_DECRYPT_YOUR_FILES.TXT
%HOMEPATH%\My Documents\My Pictures\HELP_DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\My Documents\My Received Files\HELP_DECRYPT_YOUR_FILES.TXT
%HOMEPATH%\My Documents\My Music\HELP_DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\My Documents\My Pictures\HELP_DECRYPT_YOUR_FILES.TXT
%HOMEPATH%\My Documents\My Received Files\HELP_DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\PrintHood\HELP_DECRYPT_YOUR_FILES.TXT
%HOMEPATH%\PrintHood\HELP_DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\NetHood\HELP_DECRYPT_YOUR_FILES.TXT
%HOMEPATH%\NetHood\HELP_DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\My Documents\My Music\HELP_DECRYPT_YOUR_FILES.TXT
%TEMP%\HELP_DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\Local Settings\Temporary Internet Files\HELP_DECRYPT_YOUR_FILES.TXT
%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\HELP_DECRYPT_YOUR_FILES.HTML
%TEMP%\HELP_DECRYPT_YOUR_FILES.TXT
%HOMEPATH%\Local Settings\Temporary Internet Files\HELP_DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\My Documents\Downloads\HELP_DECRYPT_YOUR_FILES.TXT
%HOMEPATH%\My Documents\Downloads\HELP_DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\My Documents\HELP_DECRYPT_YOUR_FILES.TXT
%HOMEPATH%\My Documents\HELP_DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\Recent\HELP_DECRYPT_YOUR_FILES.TXT
%HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\HELP_DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\Templates\HELP_DECRYPT_YOUR_FILES.TXT
%HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\HELP_DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\HELP_DECRYPT_YOUR_FILES.TXT
%HOMEPATH%\Templates\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Addons\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Addons\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\HELP_DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\HELP_DECRYPT_YOUR_FILES.TXT
%HOMEPATH%\SendTo\HELP_DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\Start Menu\HELP_DECRYPT_YOUR_FILES.TXT
%HOMEPATH%\Recent\HELP_DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\SendTo\HELP_DECRYPT_YOUR_FILES.TXT
%HOMEPATH%\Start Menu\HELP_DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\Start Menu\Programs\Accessories\HELP_DECRYPT_YOUR_FILES.TXT
%HOMEPATH%\Start Menu\Programs\Accessories\HELP_DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\Start Menu\Programs\HELP_DECRYPT_YOUR_FILES.TXT
%HOMEPATH%\Start Menu\Programs\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\WinSCP\components\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\WinSCP\components\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\WinSCP\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\WinSCP\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\WinSCP\console\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\WinSCP\core\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\WinSCP\dragext\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\WinSCP\console\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\WinSCP\core\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\TmpPanel\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\MacroView\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\MacroView\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\HlfViewer\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\HlfViewer\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\Network\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\ProcList\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\TmpPanel\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\Network\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\ProcList\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\WinSCP\dragext\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\WinSCP\packages\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\WinSCP\packages\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\WinSCP\lib\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\WinSCP\lib\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\WinSCP\putty\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\WinSCP\putty\charset\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\WinSCP\putty\windows\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\WinSCP\putty\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\WinSCP\putty\charset\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\WinSCP\forms\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\WinSCP\fari\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\WinSCP\fari\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\WinSCP\far\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\WinSCP\far\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\WinSCP\filezilla\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\WinSCP\filezilla\misc\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\WinSCP\forms\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\WinSCP\filezilla\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\WinSCP\filezilla\misc\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\FTP\lib\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\Colorer\hrd\console\contrib\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\Colorer\hrd\console\contrib\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\Colorer\hrd\console\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\Colorer\hrd\console\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\Compare\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\DrawLine\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\EditCase\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\Compare\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\DrawLine\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\Colorer\hrd\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\Colorer\hrc\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\Colorer\hrc\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\Colorer\bin\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\Colorer\bin\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\Colorer\hrc\auto\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\Colorer\hrc\auto\types\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\Colorer\hrd\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\Colorer\hrc\auto\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\Colorer\hrc\auto\types\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\EditCase\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\FarCmds\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\FarCmds\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\ExtSearch\sources\RegExp\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\ExtSearch\sources\RegExp\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\FileCase\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\FTP\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\FTP\lib\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\FileCase\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\FTP\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\ExtSearch\sources\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\ExtSearch\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\ExtSearch\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\EMenu\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\EMenu\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\ExtSearch\doc\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\ExtSearch\keys\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\ExtSearch\sources\HELP_DECRYPT_YOUR_FILES.TXT
C:\Far2\Plugins\ExtSearch\doc\HELP_DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\ExtSearch\keys\HELP_DECRYPT_YOUR_FILES.TXT
%ALLUSERSPROFILE%\Start Menu\Programs\Games\HELP_DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Templates\HELP_DECRYPT_YOUR_FILES.TXT
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\HELP_DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Start Menu\Programs\Games\HELP_DECRYPT_YOUR_FILES.TXT
%ALLUSERSPROFILE%\Templates\HELP_DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Application Data\HELP_DECRYPT_YOUR_FILES.TXT
C:\Documents and Settings\Default User\Application Data\HELP_DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\HELP_DECRYPT_YOUR_FILES.TXT
C:\Documents and Settings\Default User\HELP_DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\HELP_DECRYPT_YOUR_FILES.TXT
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\HELP_DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\HELP_DECRYPT_YOUR_FILES.TXT
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\HELP_DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\HELP_DECRYPT_YOUR_FILES.TXT
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\HELP_DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\HELP_DECRYPT_YOUR_FILES.TXT
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\HELP_DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\HELP_DECRYPT_YOUR_FILES.TXT
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\HELP_DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Cookies\HELP_DECRYPT_YOUR_FILES.TXT
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\HELP_DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Local Settings\Temp\HELP_DECRYPT_YOUR_FILES.TXT
C:\Documents and Settings\Default User\Local Settings\History\HELP_DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\HELP_DECRYPT_YOUR_FILES.TXT
C:\Documents and Settings\Default User\Local Settings\Temp\HELP_DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\My Documents\HELP_DECRYPT_YOUR_FILES.TXT
C:\Documents and Settings\Default User\My Documents\HELP_DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\HELP_DECRYPT_YOUR_FILES.TXT
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\HELP_DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Local Settings\History\HELP_DECRYPT_YOUR_FILES.TXT
C:\Documents and Settings\Default User\Desktop\HELP_DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Favorites\HELP_DECRYPT_YOUR_FILES.TXT
C:\Documents and Settings\Default User\Cookies\HELP_DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Desktop\HELP_DECRYPT_YOUR_FILES.TXT
C:\Documents and Settings\Default User\Favorites\HELP_DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Local Settings\Application Data\HELP_DECRYPT_YOUR_FILES.TXT
C:\Documents and Settings\Default User\Local Settings\Application Data\HELP_DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Local Settings\HELP_DECRYPT_YOUR_FILES.TXT
C:\Documents and Settings\Default User\Local Settings\HELP_DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\HELP_DECRYPT_YOUR_FILES.TXT
%ALLUSERSPROFILE%\Desktop\HELP_DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Documents\HELP_DECRYPT_YOUR_FILES.TXT
%ALLUSERSPROFILE%\Application Data\HELP_DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Desktop\HELP_DECRYPT_YOUR_FILES.TXT
%ALLUSERSPROFILE%\Documents\HELP_DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Documents\My Music\My Playlists\HELP_DECRYPT_YOUR_FILES.TXT
%ALLUSERSPROFILE%\Documents\My Music\My Playlists\HELP_DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Documents\My Music\HELP_DECRYPT_YOUR_FILES.TXT
%ALLUSERSPROFILE%\Documents\My Music\HELP_DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Application Data\HELP_DECRYPT_YOUR_FILES.TXT
C:\HELP_DECRYPT_YOUR_FILES.HTML
<Текущая директория>\HELP_DECRYPT_YOUR_FILES.TXT
%APPDATA%\ChromeFlashPlayer_88e6680f8b982aa3.exe
C:\HELP_DECRYPT_YOUR_FILES.TXT
<Текущая директория>\HELP_DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\HELP_DECRYPT_YOUR_FILES.TXT
%ALLUSERSPROFILE%\HELP_DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\HELP_DECRYPT_YOUR_FILES.TXT
C:\Documents and Settings\HELP_DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\HELP_DECRYPT_YOUR_FILES.TXT
%ALLUSERSPROFILE%\DRM\HELP_DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Favorites\HELP_DECRYPT_YOUR_FILES.TXT
%ALLUSERSPROFILE%\Documents\My Videos\HELP_DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\DRM\HELP_DECRYPT_YOUR_FILES.TXT
%ALLUSERSPROFILE%\Favorites\HELP_DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Start Menu\Programs\HELP_DECRYPT_YOUR_FILES.TXT
%ALLUSERSPROFILE%\Start Menu\Programs\HELP_DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Start Menu\HELP_DECRYPT_YOUR_FILES.TXT
%ALLUSERSPROFILE%\Start Menu\HELP_DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Documents\My Videos\HELP_DECRYPT_YOUR_FILES.TXT
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\HELP_DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\HELP_DECRYPT_YOUR_FILES.TXT
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\HELP_DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\HELP_DECRYPT_YOUR_FILES.TXT
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\HELP_DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\HELP_DECRYPT_YOUR_FILES.TXT
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\HELP_DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Documents\My Pictures\HELP_DECRYPT_YOUR_FILES.TXT
%ALLUSERSPROFILE%\Documents\My Pictures\HELP_DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\HELP_DECRYPT_YOUR_FILES.TXT
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\HELP_DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\NetworkService\Local Settings\History\HELP_DECRYPT_YOUR_FILES.TXT
C:\Documents and Settings\NetworkService\Local Settings\History\HELP_DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\NetworkService\Local Settings\Temp\HELP_DECRYPT_YOUR_FILES.TXT
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\HELP_DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\HELP_DECRYPT_YOUR_FILES.TXT
C:\Documents and Settings\NetworkService\Local Settings\Temp\HELP_DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\HELP_DECRYPT_YOUR_FILES.TXT
C:\Documents and Settings\NetworkService\Local Settings\Application Data\HELP_DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\NetworkService\Application Data\HELP_DECRYPT_YOUR_FILES.TXT
C:\Documents and Settings\NetworkService\Application Data\HELP_DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\NetworkService\HELP_DECRYPT_YOUR_FILES.TXT
C:\Documents and Settings\NetworkService\HELP_DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\NetworkService\Cookies\HELP_DECRYPT_YOUR_FILES.TXT
C:\Documents and Settings\NetworkService\Local Settings\HELP_DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\NetworkService\Local Settings\Application Data\HELP_DECRYPT_YOUR_FILES.TXT
C:\Documents and Settings\NetworkService\Cookies\HELP_DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\NetworkService\Local Settings\HELP_DECRYPT_YOUR_FILES.TXT
%HOMEPATH%\HELP_DECRYPT_YOUR_FILES.HTML
<LS_APPDATA>\HELP_DECRYPT_YOUR_FILES.TXT
<LS_APPDATA>\HELP_DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\Local Settings\HELP_DECRYPT_YOUR_FILES.TXT
%HOMEPATH%\Local Settings\HELP_DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\Local Settings\History\HELP_DECRYPT_YOUR_FILES.TXT
%HOMEPATH%\Local Settings\History\History.IE5\HELP_DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\HELP_DECRYPT_YOUR_FILES.TXT
%HOMEPATH%\Local Settings\History\HELP_DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\Local Settings\History\History.IE5\HELP_DECRYPT_YOUR_FILES.TXT
%HOMEPATH%\Favorites\Links\HELP_DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\Cookies\HELP_DECRYPT_YOUR_FILES.TXT
%HOMEPATH%\Cookies\HELP_DECRYPT_YOUR_FILES.HTML
%APPDATA%\HELP_DECRYPT_YOUR_FILES.TXT
%APPDATA%\HELP_DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\Desktop\HELP_DECRYPT_YOUR_FILES.TXT
%HOMEPATH%\Favorites\HELP_DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\Favorites\Links\HELP_DECRYPT_YOUR_FILES.TXT
%HOMEPATH%\Desktop\HELP_DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\Favorites\HELP_DECRYPT_YOUR_FILES.TXT
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\HELP_DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\HELP_DECRYPT_YOUR_FILES.TXT
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\HELP_DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Start Menu\Programs\HELP_DECRYPT_YOUR_FILES.TXT
C:\Documents and Settings\Default User\Start Menu\Programs\HELP_DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\HELP_DECRYPT_YOUR_FILES.TXT
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\HELP_DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\HELP_DECRYPT_YOUR_FILES.TXT
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\HELP_DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\HELP_DECRYPT_YOUR_FILES.TXT
C:\Documents and Settings\Default User\Start Menu\HELP_DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\PrintHood\HELP_DECRYPT_YOUR_FILES.TXT
C:\Documents and Settings\Default User\PrintHood\HELP_DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\NetHood\HELP_DECRYPT_YOUR_FILES.TXT
C:\Documents and Settings\Default User\NetHood\HELP_DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Recent\HELP_DECRYPT_YOUR_FILES.TXT
C:\Documents and Settings\Default User\SendTo\HELP_DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Start Menu\HELP_DECRYPT_YOUR_FILES.TXT
C:\Documents and Settings\Default User\Recent\HELP_DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\SendTo\HELP_DECRYPT_YOUR_FILES.TXT
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\HELP_DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\LocalService\Local Settings\History\HELP_DECRYPT_YOUR_FILES.TXT
C:\Documents and Settings\LocalService\Local Settings\History\HELP_DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\LocalService\Local Settings\Application Data\HELP_DECRYPT_YOUR_FILES.TXT
C:\Documents and Settings\LocalService\Local Settings\Application Data\HELP_DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\HELP_DECRYPT_YOUR_FILES.TXT
C:\Documents and Settings\LocalService\Local Settings\Temp\HELP_DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\HELP_DECRYPT_YOUR_FILES.TXT
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\HELP_DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\LocalService\Local Settings\Temp\HELP_DECRYPT_YOUR_FILES.TXT
C:\Documents and Settings\LocalService\Local Settings\HELP_DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\LocalService\HELP_DECRYPT_YOUR_FILES.TXT
C:\Documents and Settings\LocalService\HELP_DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Templates\HELP_DECRYPT_YOUR_FILES.TXT
C:\Documents and Settings\Default User\Templates\HELP_DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\LocalService\Application Data\HELP_DECRYPT_YOUR_FILES.TXT
C:\Documents and Settings\LocalService\Cookies\HELP_DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\LocalService\Local Settings\HELP_DECRYPT_YOUR_FILES.TXT
C:\Documents and Settings\LocalService\Application Data\HELP_DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\LocalService\Cookies\HELP_DECRYPT_YOUR_FILES.TXT

Сетевая активность:

Подключается к:

'62.##.195.136':80
'74.##5.232.51':80

TCP:

Запросы HTTP GET:

http://62.##.195.136/default.jpg

UDP:

DNS ASK google.com

Другое:

Ищет следующие окна:

ClassName: 'Indicator' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней