Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'falrqtcr472' = '"%TEMP%\IXP000.TMP\tasksche.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'wextract_cleanup0' = 'rundll32.exe <SYSTEM32>\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"'
Malicious functions:
Creates and executes the following:
- '%TEMP%\IXP000.TMP\taskdl.exe'
- '%TEMP%\IXP000.TMP\1.xyz'
Executes the following:
- '<SYSTEM32>\taskkill.exe' /f /im MSExchange*
- '<SYSTEM32>\taskkill.exe' /f /im Microsoft.Exchange.*
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "falrqtcr472" /t REG_SZ /d "\"%TEMP%\IXP000.TMP\tasksche.exe\"" /f
- '<SYSTEM32>\taskkill.exe' /f /im mysqld.exe
- '<SYSTEM32>\taskkill.exe' /f /im sqlwriter.exe
- '<SYSTEM32>\taskkill.exe' /f /im sqlserver.exe
- '<SYSTEM32>\cmd.exe' /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "falrqtcr472" /t REG_SZ /d "\"%TEMP%\IXP000.TMP\tasksche.exe\"" /f
- '<SYSTEM32>\attrib.exe' +h .
- '%ProgramFiles%\Internet Explorer\IEXPLORE.EXE'
- '<SYSTEM32>\cmd.exe' /c echo on error resume next:CreateObject("WScript.Shell").Run "%TEMP%\IXP000.TMP\1.xyz",1: >"%HOMEPATH%\Start Menu\Programs\Startup\x.vbs"
- '<SYSTEM32>\cmd.exe' /c start /b @WanaDecryptor@.exe vs
- '<SYSTEM32>\cscript.exe' //nologo m.vbs
- '<SYSTEM32>\cmd.exe' /c 100701511853437.bat
Injects code into
the following user processes:
- 1.xyz
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
a large number of user processes.
Modifies file system:
Creates the following files:
- C:\Far2\Plugins\FTP\FtpCmds.txt.WNCRYT
- C:\Far2\Plugins\ExtSearch\sources\RegExp\@WanaDecryptor@.exe.lnk
- C:\Far2\Plugins\FTP\FtpCmds_rus.txt.WNCRYT
- C:\Far2\Plugins\FTP\Notes_rus.txt.WNCRYT
- C:\Far2\Plugins\FTP\Notes.txt.WNCRYT
- C:\Far2\Plugins\ExtSearch\sources\RegExp\@Please_Read_Me@.txt
- C:\Far2\Plugins\ExtSearch\doc\@Please_Read_Me@.txt
- C:\Far2\Plugins\ExtSearch\doc\RUS_READ.TXT.WNCRYT
- C:\Far2\Plugins\ExtSearch\doc\@WanaDecryptor@.exe.lnk
- C:\Far2\Plugins\ExtSearch\sources\@WanaDecryptor@.exe.lnk
- C:\Far2\Plugins\ExtSearch\sources\@Please_Read_Me@.txt
- C:\Far2\Plugins\FTP\@Please_Read_Me@.txt
- C:\Documents and Settings\Default User\Templates\quattro.wb2.WNCRYT
- C:\startup_local.bat.WNCRYT
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db.WNCRYT
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js.WNCRYT
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db.WNCRYT
- <STUBS_DIR>\@WanaDecryptor@.exe
- C:\Far2\PluginSDK\Headers.pas\@Please_Read_Me@.txt
- C:\Far2\Plugins\FTP\@WanaDecryptor@.exe
- C:\Far2\PluginSDK\Headers.pas\@WanaDecryptor@.exe
- <STUBS_DIR>\@Please_Read_Me@.txt
- <STUBS_DIR>\list_full.txt.WNCRYT
- C:\Far2\Documentation\rus\Far.FAQ.txt.WNCRYT
- C:\Far2\Documentation\rus\Bug.Report.txt.WNCRYT
- C:\Far2\Documentation\rus\Plugins.Install.txt.WNCRYT
- C:\Far2\Documentation\rus\TechInfo.txt.WNCRYT
- C:\Far2\Documentation\rus\Plugins.Review.txt.WNCRYT
- C:\Far2\Documentation\rus\Arc.Support.txt.WNCRYT
- C:\Far2\Documentation\eng\Plugins.Review.txt.WNCRYT
- C:\Far2\Documentation\eng\Plugins.Install.txt.WNCRYT
- C:\Far2\Documentation\eng\TechInfo.txt.WNCRYT
- C:\Far2\Documentation\eng\@WanaDecryptor@.exe
- C:\Far2\Documentation\eng\@Please_Read_Me@.txt
- C:\Far2\Documentation\rus\@Please_Read_Me@.txt
- C:\Far2\Plugins\ExtSearch\doc\ENG_NEWS.TXT.WNCRYT
- C:\Far2\Plugins\Colorer\hrc\@WanaDecryptor@.exe.lnk
- C:\Far2\Plugins\ExtSearch\doc\ENG_READ.TXT.WNCRYT
- C:\Far2\Plugins\ExtSearch\doc\RUS_NEWS.TXT.WNCRYT
- C:\Far2\Plugins\ExtSearch\doc\REGEXPS.TXT.WNCRYT
- C:\Far2\Plugins\Colorer\hrc\@Please_Read_Me@.txt
- C:\Far2\Plugins\7-Zip\far7z.txt.WNCRYT
- C:\Far2\Documentation\rus\@WanaDecryptor@.exe
- C:\Far2\Plugins\7-Zip\@Please_Read_Me@.txt
- C:\Far2\Plugins\Colorer\hrc\changes.txt.WNCRYT
- C:\Far2\Plugins\7-Zip\@WanaDecryptor@.exe
- C:\Far2\Addons\README.TXT.WNCRYT
- C:\Far2\SaveSettings.cmd.WNCRYT
- C:\Far2\Addons\Colors\export_colors.bat.WNCRYT
- C:\Far2\Addons\Colors\Default Highlighting\import_colors.bat.WNCRYT
- C:\Far2\Addons\Colors\Custom Highlighting\import_colors.bat.WNCRYT
- C:\Far2\RestoreSettings.cmd.WNCRYT
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak.WNCRYT
- %APPDATA%\Microsoft\Internet Explorer\brndlog.bak.WNCRYT
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.js.WNCRYT
- C:\Far2\ClearPluginsCache.cmd.WNCRYT
- %HOMEPATH%\Templates\sndrec.wav.WNCRYT
- C:\Far2\Plugins\ExtSearch\sources\ESEARCH.BAT.WNCRYT
- <STUBS_DIR>\proc_games.txt.WNCRYT
- <STUBS_DIR>\proc_fake.txt.WNCRYT
- <STUBS_DIR>\proc_im.txt.WNCRYT
- <STUBS_DIR>\runall.bat.WNCRYT
- <STUBS_DIR>\proc_tools.txt.WNCRYT
- <STUBS_DIR>\proc_browsers.txt.WNCRYT
- C:\Far2\Plugins\ExtSearch\sources\ExtClipBoard.cpp.WNCRYT
- C:\Far2\Plugins\ExtSearch\sources\esearch_debug.bat.WNCRYT
- <STUBS_DIR>\list_short.txt.WNCRYT
- <STUBS_DIR>\proc_banks.txt.WNCRYT
- <STUBS_DIR>\proc_av.txt.WNCRYT
- C:\Far2\Plugins\ExtSearch\sources\ExtMenu.cpp.WNCRYT
- C:\Far2\Plugins\ExtSearch\sources\ExtChCase.cpp.WNCRYT
- C:\Far2\Plugins\ExtSearch\sources\ExtRegExp.cpp.WNCRYT
- C:\Far2\Plugins\ExtSearch\sources\ExtSearchMix.cpp.WNCRYT
- C:\Far2\Plugins\ExtSearch\sources\ExtSearch.cpp.WNCRYT
- C:\Far2\Plugins\Colorer\hrc\auto\types\auto.jar.WNCRYT
- <LS_APPDATA>\IconCache.db.WNCRYT
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db.WNCRYT
- %HOMEPATH%\Templates\quattro.wb2.WNCRYT
- C:\Far2\Plugins\Colorer\hrc\common.jar.WNCRYT
- C:\Far2\Addons\Colors\import_colors.bat.WNCRYT
- C:\Far2\Plugins\ExtSearch\sources\ExtSearchReg.cpp.WNCRYT
- C:\AUTOEXEC.BAT.WNCRYT
- C:\Far2\PluginSDK\Headers.pas\PluginW.pas.WNCRYT
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.bak.WNCRYT
- C:\Documents and Settings\Default User\Templates\sndrec.wav.WNCRYT
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.txt.WNCRYT
- C:\Far2\PluginSDK\Headers.pas\FarKeysW.pas.WNCRYT
- C:\Far2\Plugins\ExtSearch\sources\RegExp\CLOCALE.H.WNCRYT
- C:\Far2\Plugins\ExtSearch\sources\RegExp\CLOCALE.CPP.WNCRYT
- C:\Far2\Plugins\ExtSearch\sources\RegExp\CREGEXP.CPP.WNCRYT
- C:\Far2\PluginSDK\Headers.pas\FarColorW.pas.WNCRYT
- C:\Far2\Plugins\ExtSearch\sources\RegExp\CREGEXP.H.WNCRYT
- %TEMP%\IXP000.TMP\msg\m_spanish.wnry
- %TEMP%\IXP000.TMP\msg\m_slovak.wnry
- %TEMP%\IXP000.TMP\msg\m_swedish.wnry
- %TEMP%\IXP000.TMP\msg\m_vietnamese.wnry
- %TEMP%\IXP000.TMP\msg\m_turkish.wnry
- %TEMP%\IXP000.TMP\msg\m_russian.wnry
- %TEMP%\IXP000.TMP\msg\m_norwegian.wnry
- %TEMP%\IXP000.TMP\msg\m_latvian.wnry
- %TEMP%\IXP000.TMP\msg\m_polish.wnry
- %TEMP%\IXP000.TMP\msg\m_romanian.wnry
- %TEMP%\IXP000.TMP\msg\m_portuguese.wnry
- %TEMP%\IXP000.TMP\r.wnry
- %TEMP%\IXP000.TMP\00000000.res
- %TEMP%\IXP000.TMP\00000000.eky
- %TEMP%\IXP000.TMP\@WanaDecryptor@.exe
- %TEMP%\IXP000.TMP\@Please_Read_Me@.txt
- %TEMP%\IXP000.TMP\100701511853437.bat
- %TEMP%\IXP000.TMP\00000000.pky
- %TEMP%\IXP000.TMP\t.wnry
- %TEMP%\IXP000.TMP\s.wnry
- %TEMP%\IXP000.TMP\taskdl.exe
- %TEMP%\IXP000.TMP\u.wnry
- %TEMP%\IXP000.TMP\taskse.exe
- %TEMP%\IXP000.TMP\msg\m_chinese (simplified).wnry
- %TEMP%\IXP000.TMP\msg\m_bulgarian.wnry
- %TEMP%\IXP000.TMP\msg\m_chinese (traditional).wnry
- %TEMP%\IXP000.TMP\msg\m_czech.wnry
- %TEMP%\IXP000.TMP\msg\m_croatian.wnry
- %TEMP%\IXP000.TMP\c.wnry
- %TEMP%\IXP000.TMP\1.xy_
- %TEMP%\IXP000.TMP\1.xyz
- <LS_APPDATA>\CSIDL_
- %TEMP%\IXP000.TMP\b.wnry
- <LS_APPDATA>\CSIDL_X
- %TEMP%\IXP000.TMP\msg\m_danish.wnry
- %TEMP%\IXP000.TMP\msg\m_indonesian.wnry
- %TEMP%\IXP000.TMP\msg\m_greek.wnry
- %TEMP%\IXP000.TMP\msg\m_italian.wnry
- %TEMP%\IXP000.TMP\msg\m_korean.wnry
- %TEMP%\IXP000.TMP\msg\m_japanese.wnry
- %TEMP%\IXP000.TMP\msg\m_german.wnry
- %TEMP%\IXP000.TMP\msg\m_english.wnry
- %TEMP%\IXP000.TMP\msg\m_dutch.wnry
- %TEMP%\IXP000.TMP\msg\m_filipino.wnry
- %TEMP%\IXP000.TMP\msg\m_french.wnry
- %TEMP%\IXP000.TMP\msg\m_finnish.wnry
- %HOMEPATH%\Templates\winword2.doc.WNCRYT
- %HOMEPATH%\Templates\winword.doc.WNCRYT
- %HOMEPATH%\Templates\@Please_Read_Me@.txt
- C:\Far2\@Please_Read_Me@.txt
- %HOMEPATH%\Templates\@WanaDecryptor@.exe
- %HOMEPATH%\Templates\powerpnt.ppt.WNCRYT
- <LS_APPDATA>\@Please_Read_Me@.txt
- %APPDATA%\Microsoft\Internet Explorer\@WanaDecryptor@.exe.lnk
- <LS_APPDATA>\@WanaDecryptor@.exe.lnk
- %HOMEPATH%\Templates\excel4.xls.WNCRYT
- %HOMEPATH%\Templates\excel.xls.WNCRYT
- C:\Far2\@WanaDecryptor@.exe
- C:\Far2\Addons\Colors\Default Highlighting\@WanaDecryptor@.exe.lnk
- C:\Far2\Addons\Colors\Default Highlighting\@Please_Read_Me@.txt
- C:\Far2\Documentation\eng\Arc.Support.txt.WNCRYT
- C:\Far2\Documentation\eng\Far.FAQ.txt.WNCRYT
- C:\Far2\Documentation\eng\Bug.Report.txt.WNCRYT
- C:\Far2\Addons\Colors\Custom Highlighting\@WanaDecryptor@.exe.lnk
- C:\Far2\Addons\@WanaDecryptor@.exe
- C:\Far2\Addons\@Please_Read_Me@.txt
- C:\Far2\Addons\Colors\@Please_Read_Me@.txt
- C:\Far2\Addons\Colors\Custom Highlighting\@Please_Read_Me@.txt
- C:\Far2\Addons\Colors\@WanaDecryptor@.exe
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.WNCRYT
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\@Please_Read_Me@.txt
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.WNCRYT
- C:\@WanaDecryptor@.exe
- C:\@Please_Read_Me@.txt
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.WNCRYT
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.WNCRYT
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\@Please_Read_Me@.txt
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.WNCRYT
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.WNCRYT
- %TEMP%\IXP000.TMP\m.vbs
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\@Please_Read_Me@.txt
- C:\Documents and Settings\Default User\Templates\@Please_Read_Me@.txt
- C:\Documents and Settings\Default User\Templates\winword2.doc.WNCRYT
- C:\Documents and Settings\Default User\Templates\@WanaDecryptor@.exe
- %APPDATA%\Microsoft\Internet Explorer\@Please_Read_Me@.txt
- %APPDATA%\Microsoft\Internet Explorer\brndlog.txt.WNCRYT
- C:\Documents and Settings\Default User\Templates\winword.doc.WNCRYT
- %TEMP%\IXP000.TMP\@WanaDecryptor@.exe.lnk
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\@Please_Read_Me@.txt
- C:\Documents and Settings\Default User\Templates\excel.xls.WNCRYT
- C:\Documents and Settings\Default User\Templates\powerpnt.ppt.WNCRYT
- C:\Documents and Settings\Default User\Templates\excel4.xls.WNCRYT
Sets the 'hidden' attribute to the following files:
- <LS_APPDATA>\CSIDL_X
- <LS_APPDATA>\CSIDL_
Deletes the following files:
- %TEMP%\IXP000.TMP\msg\m_polish.wnry
- %TEMP%\IXP000.TMP\msg\m_norwegian.wnry
- %TEMP%\IXP000.TMP\msg\m_portuguese.wnry
- %TEMP%\IXP000.TMP\msg\m_russian.wnry
- %TEMP%\IXP000.TMP\msg\m_romanian.wnry
- %TEMP%\IXP000.TMP\msg\m_latvian.wnry
- %TEMP%\IXP000.TMP\msg\m_indonesian.wnry
- %TEMP%\IXP000.TMP\msg\m_greek.wnry
- %TEMP%\IXP000.TMP\msg\m_italian.wnry
- %TEMP%\IXP000.TMP\msg\m_korean.wnry
- %TEMP%\IXP000.TMP\msg\m_japanese.wnry
- %TEMP%\IXP000.TMP\t.wnry
- %TEMP%\IXP000.TMP\s.wnry
- %TEMP%\IXP000.TMP\taskdl.exe
- %TEMP%\IXP000.TMP\u.wnry
- %TEMP%\IXP000.TMP\taskse.exe
- %TEMP%\IXP000.TMP\r.wnry
- %TEMP%\IXP000.TMP\msg\m_spanish.wnry
- %TEMP%\IXP000.TMP\msg\m_slovak.wnry
- %TEMP%\IXP000.TMP\msg\m_swedish.wnry
- %TEMP%\IXP000.TMP\msg\m_vietnamese.wnry
- %TEMP%\IXP000.TMP\msg\m_turkish.wnry
- %TEMP%\IXP000.TMP\msg\m_german.wnry
- %TEMP%\IXP000.TMP\@WanaDecryptor@.exe.lnk
- %TEMP%\IXP000.TMP\@WanaDecryptor@.exe
- %TEMP%\IXP000.TMP\b.wnry
- %TEMP%\IXP000.TMP\m.vbs
- %TEMP%\IXP000.TMP\c.wnry
- %TEMP%\IXP000.TMP\@Please_Read_Me@.txt
- %TEMP%\IXP000.TMP\1.xyz
- %TEMP%\IXP000.TMP\1.xy_
- %TEMP%\IXP000.TMP\00000000.pky
- %TEMP%\IXP000.TMP\100701511853437.bat
- %TEMP%\IXP000.TMP\00000000.res
- %TEMP%\IXP000.TMP\msg\m_english.wnry
- %TEMP%\IXP000.TMP\msg\m_dutch.wnry
- %TEMP%\IXP000.TMP\msg\m_filipino.wnry
- %TEMP%\IXP000.TMP\msg\m_french.wnry
- %TEMP%\IXP000.TMP\msg\m_finnish.wnry
- %TEMP%\IXP000.TMP\msg\m_danish.wnry
- %TEMP%\IXP000.TMP\msg\m_chinese (simplified).wnry
- %TEMP%\IXP000.TMP\msg\m_bulgarian.wnry
- %TEMP%\IXP000.TMP\msg\m_chinese (traditional).wnry
- %TEMP%\IXP000.TMP\msg\m_czech.wnry
- %TEMP%\IXP000.TMP\msg\m_croatian.wnry
Moves the following files:
- from C:\Far2\Plugins\ExtSearch\sources\RegExp\CREGEXP.H.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\RegExp\CREGEXP.H.WNCRY
- from C:\Far2\PluginSDK\Headers.pas\FarColorW.pas.WNCRYT to C:\Far2\PluginSDK\Headers.pas\FarColorW.pas.WNCRY
- from C:\Far2\Plugins\ExtSearch\sources\RegExp\CREGEXP.CPP.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\RegExp\CREGEXP.CPP.WNCRY
- from C:\Far2\Plugins\ExtSearch\sources\RegExp\CLOCALE.CPP.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\RegExp\CLOCALE.CPP.WNCRY
- from C:\Far2\Plugins\ExtSearch\sources\RegExp\CLOCALE.H.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\RegExp\CLOCALE.H.WNCRY
- from C:\Far2\PluginSDK\Headers.pas\FarKeysW.pas.WNCRYT to C:\Far2\PluginSDK\Headers.pas\FarKeysW.pas.WNCRY
- from C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.txt.WNCRYT to C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.txt.WNCRY
- from C:\Documents and Settings\Default User\Templates\sndrec.wav.WNCRYT to C:\Documents and Settings\Default User\Templates\sndrec.wav.WNCRY
- from C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.bak.WNCRYT to C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.bak.WNCRY
- from C:\Far2\PluginSDK\Headers.pas\PluginW.pas.WNCRYT to C:\Far2\PluginSDK\Headers.pas\PluginW.pas.WNCRY
- from C:\AUTOEXEC.BAT.WNCRYT to C:\AUTOEXEC.BAT.WNCRY
- from C:\Far2\Plugins\ExtSearch\sources\ExtSearchReg.cpp.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\ExtSearchReg.cpp.WNCRY
- from C:\Far2\Addons\Colors\import_colors.bat.WNCRYT to C:\Far2\Addons\Colors\import_colors.bat.WNCRY
- from C:\Far2\Plugins\Colorer\hrc\common.jar.WNCRYT to C:\Far2\Plugins\Colorer\hrc\common.jar.WNCRY
- from %HOMEPATH%\Templates\quattro.wb2.WNCRYT to %HOMEPATH%\Templates\quattro.wb2.WNCRY
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db.WNCRYT to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db.WNCRY
- from <LS_APPDATA>\IconCache.db.WNCRYT to <LS_APPDATA>\IconCache.db.WNCRY
- from C:\Far2\Plugins\Colorer\hrc\auto\types\auto.jar.WNCRYT to C:\Far2\Plugins\Colorer\hrc\auto\types\auto.jar.WNCRY
- from C:\Far2\Plugins\ExtSearch\sources\ExtSearch.cpp.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\ExtSearch.cpp.WNCRY
- from C:\Far2\Plugins\ExtSearch\sources\ExtSearchMix.cpp.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\ExtSearchMix.cpp.WNCRY
- from C:\Far2\Plugins\ExtSearch\sources\ExtRegExp.cpp.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\ExtRegExp.cpp.WNCRY
- from C:\Far2\Plugins\ExtSearch\sources\ExtChCase.cpp.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\ExtChCase.cpp.WNCRY
- from C:\Far2\Plugins\ExtSearch\sources\ExtMenu.cpp.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\ExtMenu.cpp.WNCRY
- from <STUBS_DIR>\proc_av.txt.WNCRYT to <STUBS_DIR>\proc_av.txt.WNCRY
- from <STUBS_DIR>\proc_banks.txt.WNCRYT to <STUBS_DIR>\proc_banks.txt.WNCRY
- from <STUBS_DIR>\list_short.txt.WNCRYT to <STUBS_DIR>\list_short.txt.WNCRY
- from C:\Far2\Plugins\ExtSearch\sources\esearch_debug.bat.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\esearch_debug.bat.WNCRY
- from C:\Far2\Plugins\ExtSearch\sources\ExtClipBoard.cpp.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\ExtClipBoard.cpp.WNCRY
- from <STUBS_DIR>\proc_browsers.txt.WNCRYT to <STUBS_DIR>\proc_browsers.txt.WNCRY
- from <STUBS_DIR>\proc_tools.txt.WNCRYT to <STUBS_DIR>\proc_tools.txt.WNCRY
- from <STUBS_DIR>\runall.bat.WNCRYT to <STUBS_DIR>\runall.bat.WNCRY
- from <STUBS_DIR>\proc_im.txt.WNCRYT to <STUBS_DIR>\proc_im.txt.WNCRY
- from <STUBS_DIR>\proc_fake.txt.WNCRYT to <STUBS_DIR>\proc_fake.txt.WNCRY
- from <STUBS_DIR>\proc_games.txt.WNCRYT to <STUBS_DIR>\proc_games.txt.WNCRY
- from C:\Far2\Plugins\ExtSearch\sources\ESEARCH.BAT.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\ESEARCH.BAT.WNCRY
- from %HOMEPATH%\Templates\sndrec.wav.WNCRYT to %HOMEPATH%\Templates\sndrec.wav.WNCRY
- from C:\Far2\ClearPluginsCache.cmd.WNCRYT to C:\Far2\ClearPluginsCache.cmd.WNCRY
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.js.WNCRYT to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.js.WNCRY
- from %APPDATA%\Microsoft\Internet Explorer\brndlog.bak.WNCRYT to %APPDATA%\Microsoft\Internet Explorer\brndlog.bak.WNCRY
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak.WNCRYT to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak.WNCRY
- from C:\Far2\RestoreSettings.cmd.WNCRYT to C:\Far2\RestoreSettings.cmd.WNCRY
- from C:\Far2\Addons\Colors\Custom Highlighting\import_colors.bat.WNCRYT to C:\Far2\Addons\Colors\Custom Highlighting\import_colors.bat.WNCRY
- from C:\Far2\Addons\Colors\Default Highlighting\import_colors.bat.WNCRYT to C:\Far2\Addons\Colors\Default Highlighting\import_colors.bat.WNCRY
- from C:\Far2\Addons\Colors\export_colors.bat.WNCRYT to C:\Far2\Addons\Colors\export_colors.bat.WNCRY
- from C:\Far2\SaveSettings.cmd.WNCRYT to C:\Far2\SaveSettings.cmd.WNCRY
- from C:\Far2\Addons\README.TXT.WNCRYT to C:\Far2\Addons\README.TXT.WNCRY
- from %HOMEPATH%\Templates\winword.doc.WNCRYT to %HOMEPATH%\Templates\winword.doc.WNCRY
- from %HOMEPATH%\Templates\winword2.doc.WNCRYT to %HOMEPATH%\Templates\winword2.doc.WNCRY
- from %HOMEPATH%\Templates\powerpnt.ppt.WNCRYT to %HOMEPATH%\Templates\powerpnt.ppt.WNCRY
- from %HOMEPATH%\Templates\excel.xls.WNCRYT to %HOMEPATH%\Templates\excel.xls.WNCRY
- from %HOMEPATH%\Templates\excel4.xls.WNCRYT to %HOMEPATH%\Templates\excel4.xls.WNCRY
- from C:\Far2\Documentation\eng\Arc.Support.txt.WNCRYT to C:\Far2\Documentation\eng\Arc.Support.txt.WNCRY
- from C:\Far2\Documentation\eng\Plugins.Review.txt.WNCRYT to C:\Far2\Documentation\eng\Plugins.Review.txt.WNCRY
- from C:\Far2\Documentation\eng\TechInfo.txt.WNCRYT to C:\Far2\Documentation\eng\TechInfo.txt.WNCRY
- from C:\Far2\Documentation\eng\Plugins.Install.txt.WNCRYT to C:\Far2\Documentation\eng\Plugins.Install.txt.WNCRY
- from C:\Far2\Documentation\eng\Bug.Report.txt.WNCRYT to C:\Far2\Documentation\eng\Bug.Report.txt.WNCRY
- from C:\Far2\Documentation\eng\Far.FAQ.txt.WNCRYT to C:\Far2\Documentation\eng\Far.FAQ.txt.WNCRY
- from %APPDATA%\Microsoft\Internet Explorer\brndlog.txt.WNCRYT to %APPDATA%\Microsoft\Internet Explorer\brndlog.txt.WNCRY
- from %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.WNCRYT to %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.WNCRY
- from %ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.WNCRYT to %ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.WNCRY
- from %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.WNCRYT to %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.WNCRY
- from %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.WNCRYT to %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.WNCRY
- from %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.WNCRYT to %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.WNCRY
- from %ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.WNCRYT to %ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.WNCRY
- from C:\Documents and Settings\Default User\Templates\winword.doc.WNCRYT to C:\Documents and Settings\Default User\Templates\winword.doc.WNCRY
- from C:\Documents and Settings\Default User\Templates\winword2.doc.WNCRYT to C:\Documents and Settings\Default User\Templates\winword2.doc.WNCRY
- from C:\Documents and Settings\Default User\Templates\powerpnt.ppt.WNCRYT to C:\Documents and Settings\Default User\Templates\powerpnt.ppt.WNCRY
- from C:\Documents and Settings\Default User\Templates\excel.xls.WNCRYT to C:\Documents and Settings\Default User\Templates\excel.xls.WNCRY
- from C:\Documents and Settings\Default User\Templates\excel4.xls.WNCRYT to C:\Documents and Settings\Default User\Templates\excel4.xls.WNCRY
- from C:\Far2\Plugins\FTP\Notes.txt.WNCRYT to C:\Far2\Plugins\FTP\Notes.txt.WNCRY
- from C:\Far2\Plugins\FTP\Notes_rus.txt.WNCRYT to C:\Far2\Plugins\FTP\Notes_rus.txt.WNCRY
- from C:\Far2\Plugins\FTP\FtpCmds_rus.txt.WNCRYT to C:\Far2\Plugins\FTP\FtpCmds_rus.txt.WNCRY
- from C:\Far2\Plugins\ExtSearch\doc\RUS_READ.TXT.WNCRYT to C:\Far2\Plugins\ExtSearch\doc\RUS_READ.TXT.WNCRY
- from C:\Far2\Plugins\FTP\FtpCmds.txt.WNCRYT to C:\Far2\Plugins\FTP\FtpCmds.txt.WNCRY
- from <STUBS_DIR>\list_full.txt.WNCRYT to <STUBS_DIR>\list_full.txt.WNCRY
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db.WNCRYT to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db.WNCRY
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js.WNCRYT to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js.WNCRY
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db.WNCRYT to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db.WNCRY
- from C:\startup_local.bat.WNCRYT to C:\startup_local.bat.WNCRY
- from C:\Documents and Settings\Default User\Templates\quattro.wb2.WNCRYT to C:\Documents and Settings\Default User\Templates\quattro.wb2.WNCRY
- from C:\Far2\Plugins\ExtSearch\doc\RUS_NEWS.TXT.WNCRYT to C:\Far2\Plugins\ExtSearch\doc\RUS_NEWS.TXT.WNCRY
- from C:\Far2\Documentation\rus\Plugins.Install.txt.WNCRYT to C:\Far2\Documentation\rus\Plugins.Install.txt.WNCRY
- from C:\Far2\Documentation\rus\Plugins.Review.txt.WNCRYT to C:\Far2\Documentation\rus\Plugins.Review.txt.WNCRY
- from C:\Far2\Documentation\rus\Far.FAQ.txt.WNCRYT to C:\Far2\Documentation\rus\Far.FAQ.txt.WNCRY
- from C:\Far2\Documentation\rus\Arc.Support.txt.WNCRYT to C:\Far2\Documentation\rus\Arc.Support.txt.WNCRY
- from C:\Far2\Documentation\rus\Bug.Report.txt.WNCRYT to C:\Far2\Documentation\rus\Bug.Report.txt.WNCRY
- from C:\Far2\Documentation\rus\TechInfo.txt.WNCRYT to C:\Far2\Documentation\rus\TechInfo.txt.WNCRY
- from C:\Far2\Plugins\ExtSearch\doc\ENG_READ.TXT.WNCRYT to C:\Far2\Plugins\ExtSearch\doc\ENG_READ.TXT.WNCRY
- from C:\Far2\Plugins\ExtSearch\doc\REGEXPS.TXT.WNCRYT to C:\Far2\Plugins\ExtSearch\doc\REGEXPS.TXT.WNCRY
- from C:\Far2\Plugins\ExtSearch\doc\ENG_NEWS.TXT.WNCRYT to C:\Far2\Plugins\ExtSearch\doc\ENG_NEWS.TXT.WNCRY
- from C:\Far2\Plugins\7-Zip\far7z.txt.WNCRYT to C:\Far2\Plugins\7-Zip\far7z.txt.WNCRY
- from C:\Far2\Plugins\Colorer\hrc\changes.txt.WNCRYT to C:\Far2\Plugins\Colorer\hrc\changes.txt.WNCRY
Substitutes the following files:
- %TEMP%\IXP000.TMP\c.wnry
- %TEMP%\IXP000.TMP\00000000.res
Changes user data files extensions (Trojan.Encoder).
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: ''
- ClassName: 'Progman' WindowName: ''
