Trojan.Encoder.15735

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Classes\DVDIRUWAGLVVMWB\shell\open\command] '' = '%TEMP%\I87Zn79nrK1YVJT.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsSupport' = '%TEMP%\I87Zn79nrK1YVJT.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WindowsSupport' = '%TEMP%\I87Zn79nrK1YVJT.exe'

Creates or modifies the following files:

%HOMEPATH%\Start Menu\Programs\Startup\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\HOW TO DECRYPT FILES.txt

Modifies file system:

Creates the following files:

C:\Far2\Plugins\Compare\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\hrd\console\contrib\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\hrd\console\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\EMenu\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\EditCase\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\DrawLine\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\hrd\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\bin\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Brackets\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\hrc\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\hrc\auto\types\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\hrc\auto\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\ExtSearch\doc\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\MacroView\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\HlfViewer\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\FTP\lib\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\TmpPanel\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\ProcList\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Network\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\FTP\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\ExtSearch\sources\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\ExtSearch\keys\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\ExtSearch\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\FileCase\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\FarCmds\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\ExtSearch\sources\RegExp\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\AutoWrap\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Templates\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Start Menu\Programs\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\Colors\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\Colors\Default Highlighting\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\Colors\Custom Highlighting\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Start Menu\Programs\Accessories\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Recent\HOW TO DECRYPT FILES.txt
%HOMEPATH%\HOW TO DECRYPT FILES.txt
%HOMEPATH%\My Documents\My Pictures\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Start Menu\HOW TO DECRYPT FILES.txt
%HOMEPATH%\SendTo\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\HOW TO DECRYPT FILES.txt
C:\Far2\FExcept\HOW TO DECRYPT FILES.txt
C:\Far2\Encyclopedia\HOW TO DECRYPT FILES.txt
C:\Far2\Documentation\rus\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\arclite\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Align\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\7-Zip\HOW TO DECRYPT FILES.txt
C:\Far2\Documentation\eng\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\Shell\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\SetUp\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\Macros\HOW TO DECRYPT FILES.txt
C:\Far2\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\XLat\Russian\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\XLat\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\WinSCP\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\content\branding\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\System\Ole DB\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\SpeechEngines\Microsoft\TTS\1033\sam.sdf.new
%ProgramFiles%\FireFox\chrome\browser\content\browser\bookmarks\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\System\msadc\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\SpeechEngines\Microsoft\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\SpeechEngines\Microsoft\Lexicon\1033\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Services\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\System\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\System\ado\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\SpeechEngines\Microsoft\TTS\1033\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\certerror\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\search\HOW TO DECRYPT FILES.txt
<SYSTEM32>\dllcache\sam.sdf.new
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\preferences\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\places\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\feeds\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\safebrowsing\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\migration\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\history\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\feeds\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\places\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\MSSoap\Binaries\Resources\1033\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1040\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1036\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1033\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\2052\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1042\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1041\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1031\HOW TO DECRYPT FILES.txt
C:\Muldrop\HOW TO DECRYPT FILES.txt
C:\Far2\PluginSDK\Headers.pas\HOW TO DECRYPT FILES.txt
C:\Far2\PluginSDK\Headers.c\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1028\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1025\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DAO\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\3082\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\Web Folders\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\VGX\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\VC\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\MSSoap\Binaries\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\1033\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\Triedit\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\Speech\1033\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\MSInfo\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\TextConv\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\Stationery\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\Speech\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Cookies\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\History\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Application Data\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Games\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Start Menu\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\SendTo\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Start Menu\Programs\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\HOW TO DECRYPT FILES.txt
<Current directory>\HOW TO DECRYPT FILES.txt
C:\HOW TO DECRYPT FILES.txt
%TEMP%\I87Zn79nrK1YVJT.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Dr Watson\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Application Data\HOW TO DECRYPT FILES.txt
%TEMP%\CabD.tmp
%TEMP%\Cab5.tmp
%TEMP%\Cab3.tmp
%TEMP%\Cab1.tmp
%TEMP%\CabB.tmp
%TEMP%\Cab9.tmp
%TEMP%\Cab7.tmp
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Player\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Documents\My Videos\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Documents\My Pictures\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\DRM\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Pbk\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Documents\My Music\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Documents\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Favorites\Links\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Favorites\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Cookies\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\Microsoft\Media Player\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\HOW TO DECRYPT FILES.txt
%APPDATA%\Mozilla\Firefox\HOW TO DECRYPT FILES.txt
%APPDATA%\Microsoft\Windows\Themes\HOW TO DECRYPT FILES.txt
%APPDATA%\Microsoft\Media Player\HOW TO DECRYPT FILES.txt
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\HOW TO DECRYPT FILES.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\HOW TO DECRYPT FILES.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\HOW TO DECRYPT FILES.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\Microsoft\Windows\HOW TO DECRYPT FILES.txt
%TEMP%\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Local Settings\History\History.IE5\HOW TO DECRYPT FILES.txt
%HOMEPATH%\My Documents\My Music\HOW TO DECRYPT FILES.txt
%HOMEPATH%\My Documents\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Local Settings\<INETFILES>\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Local Settings\History\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\Microsoft\Windows Media\9.0\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Local Settings\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\VMware\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\HOW TO DECRYPT FILES.txt
%APPDATA%\Microsoft\Internet Explorer\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\CJCTQ25G\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\BGGTYMH1\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\MOE00UY1\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\LBMMC3H3\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Cookies\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Templates\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\History\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\HOW TO DECRYPT FILES.txt
%APPDATA%\Microsoft\Address Book\HOW TO DECRYPT FILES.txt
%APPDATA%\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\History\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\HOW TO DECRYPT FILES.txt

Sets the 'hidden' attribute to the following files:

<Full path to file>

Deletes the following files:

%TEMP%\Cab9.tmp
%TEMP%\CabB.tmp
%TEMP%\CabD.tmp
%TEMP%\Cab7.tmp
%TEMP%\Cab1.tmp
%TEMP%\Cab3.tmp
%TEMP%\Cab5.tmp

Moves the following files:

from %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\tabs.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\tabs.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\safebrowsing\sb-loader.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\safebrowsing\sb-loader.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\safeMode.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\safeMode.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\sync.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\sync.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\privacy.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\privacy.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\security.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\security.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\selectBookmark.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\selectBookmark.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\search\search.xml to %ProgramFiles%\FireFox\chrome\browser\content\browser\search\search.xml.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\search\searchbarBindings.css to %ProgramFiles%\FireFox\chrome\browser\content\browser\search\searchbarBindings.css.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\setDesktopBackground.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\setDesktopBackground.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\search\engineManager.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\search\engineManager.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\sanitize.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\sanitize.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\sanitizeDialog.css to %ProgramFiles%\FireFox\chrome\browser\content\browser\sanitizeDialog.css.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\sanitizeDialog.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\sanitizeDialog.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\permissionsutils.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\permissionsutils.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\applications.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\applications.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\connection.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\connection.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\content.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\content.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\applicationManager.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\applicationManager.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\places\tree.xml to %ProgramFiles%\FireFox\chrome\browser\content\browser\places\tree.xml.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\places\treeView.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\places\treeView.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\advanced.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\advanced.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\languages.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\languages.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\main.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\main.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\permissions.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\permissions.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\handlers.xml to %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\handlers.xml.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\cookies.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\cookies.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\fonts.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\fonts.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\handlers.css to %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\handlers.css.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\syncAddDevice.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\syncAddDevice.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\feeds\subscribe.css to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\feeds\subscribe.css.cerber
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\fullscreen-video.css to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\fullscreen-video.css.cerber
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\inspector.css to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\inspector.css.cerber
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\feeds\subscribe-ui.css to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\feeds\subscribe-ui.css.cerber
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\aboutSyncTabs.css to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\aboutSyncTabs.css.cerber
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\browser.css to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\browser.css.cerber
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\engineManager.css to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\engineManager.css.cerber
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\places\places.css to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\places\places.css.cerber
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\preferences\applications.css to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\preferences\applications.css.cerber
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\preferences\preferences.css to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\preferences\preferences.css.cerber
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\places\organizer.css to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\places\organizer.css.cerber
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\keyhole-forward-mask.svg to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\keyhole-forward-mask.svg.cerber
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\pageInfo.css to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\pageInfo.css.cerber
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\places\editBookmarkOverlay.css to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\places\editBookmarkOverlay.css.cerber
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\aboutSessionRestore.css to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\aboutSessionRestore.css.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\syncUtils.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\syncUtils.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\tabbrowser.css to %ProgramFiles%\FireFox\chrome\browser\content\browser\tabbrowser.css.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\tabbrowser.xml to %ProgramFiles%\FireFox\chrome\browser\content\browser\tabbrowser.xml.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\syncSetup.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\syncSetup.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\syncGenericChange.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\syncGenericChange.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\syncNotification.xml to %ProgramFiles%\FireFox\chrome\browser\content\browser\syncNotification.xml.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\syncQuota.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\syncQuota.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\web-panels.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\web-panels.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\aboutCertError.css to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\aboutCertError.css.cerber
from %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\aboutPrivateBrowsing.css to %ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\aboutPrivateBrowsing.css.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\utilityOverlay.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\utilityOverlay.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\tabview.css to %ProgramFiles%\FireFox\chrome\browser\content\browser\tabview.css.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\tabview.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\tabview.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\urlbarBindings.xml to %ProgramFiles%\FireFox\chrome\browser\content\browser\urlbarBindings.xml.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\places\places.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\places\places.js.cerber
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.js to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.js.cerber
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\signons.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\signons.sqlite.cerber
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\webappsstore.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\webappsstore.sqlite.cerber
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak.cerber
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js.cerber
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.sqlite.cerber
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutHome.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutHome.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutSessionRestore.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutSessionRestore.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutSyncTabs-bindings.xml to %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutSyncTabs-bindings.xml.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutHome.css to %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutHome.css.cerber
from %ProgramFiles%\FireFox\blocklist.xml to %ProgramFiles%\FireFox\blocklist.xml.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutDialog.css to %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutDialog.css.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutDialog.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutDialog.js.cerber
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\pluginreg.dat to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\pluginreg.dat.cerber
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userContent-example.css to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userContent-example.css.cerber
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chromeappsstore.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chromeappsstore.sqlite.cerber
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\content-prefs.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\content-prefs.sqlite.cerber
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userChrome-example.css to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userChrome-example.css.cerber
from %APPDATA%\Microsoft\Address Book\%USERNAME%.wab to %APPDATA%\Microsoft\Address Book\%USERNAME%.wab.cerber
from %APPDATA%\Microsoft\Internet Explorer\brndlog.bak to %APPDATA%\Microsoft\Internet Explorer\brndlog.bak.cerber
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db.cerber
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db.cerber
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\permissions.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\permissions.sqlite.cerber
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\places.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\places.sqlite.cerber
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\formhistory.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\formhistory.sqlite.cerber
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cookies.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cookies.sqlite.cerber
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\downloads.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\downloads.sqlite.cerber
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.sqlite.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutSyncTabs.css to %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutSyncTabs.css.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\security.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\security.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\places\bookmarkProperties.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\places\bookmarkProperties.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\places\browserPlacesViews.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\places\browserPlacesViews.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\permissions.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\permissions.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\pageInfo.css to %ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\pageInfo.css.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\pageInfo.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\pageInfo.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\pageInfo.xml to %ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\pageInfo.xml.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\places\moveBookmarks.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\places\moveBookmarks.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\places\organizer.css to %ProgramFiles%\FireFox\chrome\browser\content\browser\places\organizer.css.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\places\places.css to %ProgramFiles%\FireFox\chrome\browser\content\browser\places\places.css.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\places\menu.xml to %ProgramFiles%\FireFox\chrome\browser\content\browser\places\menu.xml.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\places\controller.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\places\controller.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\places\editBookmarkOverlay.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\places\editBookmarkOverlay.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\places\history-panel.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\places\history-panel.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\feeds.xml to %ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\feeds.xml.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\browser.css to %ProgramFiles%\FireFox\chrome\browser\content\browser\browser.css.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\browser.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\browser.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\certerror\aboutCertError.css to %ProgramFiles%\FireFox\chrome\browser\content\browser\certerror\aboutCertError.css.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\browser-tabPreviews.xml to %ProgramFiles%\FireFox\chrome\browser\content\browser\browser-tabPreviews.xml.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutSyncTabs.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutSyncTabs.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\bookmarks\bookmarksPanel.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\bookmarks\bookmarksPanel.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\bookmarks\sidebarUtils.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\bookmarks\sidebarUtils.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\nsContextMenu.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\nsContextMenu.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\openLocation.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\openLocation.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\feeds.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\feeds.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\migration\migration.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\migration\migration.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\feeds\subscribe.css to %ProgramFiles%\FireFox\chrome\browser\content\browser\feeds\subscribe.css.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\feeds\subscribe.js to %ProgramFiles%\FireFox\chrome\browser\content\browser\feeds\subscribe.js.cerber
from %ProgramFiles%\FireFox\chrome\browser\content\browser\feeds\subscribe.xml to %ProgramFiles%\FireFox\chrome\browser\content\browser\feeds\subscribe.xml.cerber

Creates ransom message files (Trojan.Encoder).

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Network activity:

Connects to:

'www.download.windowsupdate.com':80
'ca#####.digicert.com':80
'wp#d':80

TCP:

HTTP GET requests:

http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
http://11#.#11.111.1/wpad.dat via wp#d
http://ca#####.digicert.com/DigiCertAssuredIDRootCA.crt

UDP:

DNS ASK www.download.windowsupdate.com
DNS ASK ca#####.digicert.com
DNS ASK wp#d

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial