Trojan.Encoder.25850

Technical Information

To ensure autorun and distribution:

Infects the following executable files:

C:\Far2\Plugins\arclite\7zS2con.sfx
%CommonProgramFiles%\System\ado\msado26.tlb
%CommonProgramFiles%\System\ado\msado21.tlb
%CommonProgramFiles%\System\ado\msado27.tlb
%CommonProgramFiles%\System\ado\msado25.tlb
%CommonProgramFiles%\System\ado\msado20.tlb
%CommonProgramFiles%\Microsoft Shared\TextConv\mswrd832.cnv
%CommonProgramFiles%\Microsoft Shared\TextConv\write32.wpc
%CommonProgramFiles%\Microsoft Shared\Triedit\DHTMLED.OCX
%CommonProgramFiles%\System\Ole DB\sqloledb.rll
%CommonProgramFiles%\Microsoft Shared\TextConv\mswrd632.wpc
%CommonProgramFiles%\Microsoft Shared\Speech\sapi.cpl
%CommonProgramFiles%\Microsoft Shared\MSInfo\IEINFO5.OCX
C:\Far2\Plugins\FTP\lib\ftpProgress.fll
C:\Far2\Plugins\FTP\lib\ftpDirList.fll
C:\Far2\Plugins\arclite\7z.sfx
C:\Far2\Plugins\arclite\7zSD.sfx
C:\Far2\Plugins\arclite\7zS2.sfx
C:\Far2\Plugins\arclite\7zCon.sfx
%CommonProgramFiles%\Microsoft Shared\TextConv\html32.cnv
%CommonProgramFiles%\System\Ole DB\sqlxmlx.rll

Modifies file system:

Creates the following files:

%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\7f603bed929170f96576b4e2d9988a32_23ef5514-3059-436f-a4a7-4cefaab20eb1
C:\Muldrop\DECRYPT_INFORMATION.iunm_54
C:\Muldrop\DECRYPT_INFORMATION.iunm_89
C:\Muldrop\DECRYPT_INFORMATION.iunm_97
C:\Muldrop\DECRYPT_INFORMATION.iunm_44
C:\Muldrop\DECRYPT_INFORMATION.iunm_91
C:\Muldrop\DECRYPT_INFORMATION.iunm_77
C:\Muldrop\DECRYPT_INFORMATION.iunm_85
C:\Muldrop\DECRYPT_INFORMATION.iunm_99
C:\Muldrop\DECRYPT_INFORMATION.iunm_40
C:\Muldrop\DECRYPT_INFORMATION.iunm_93
C:\Muldrop\DECRYPT_INFORMATION.iunm_83
C:\Muldrop\DECRYPT_INFORMATION.iunm_63
C:\Muldrop\DECRYPT_INFORMATION.iunm_81
C:\Muldrop\DECRYPT_INFORMATION.iunm_70
C:\Muldrop\DECRYPT_INFORMATION.iunm_95
C:\Muldrop\dmp_0xbc_0x10000
C:\Muldrop\DECRYPT_INFORMATION.iunm_92
C:\Muldrop\DECRYPT_INFORMATION.iunm_86
%ProgramFiles%\DECRYPT_INFORMATION.html
C:\Muldrop\dmp_0xbc_0x407000
C:\Muldrop\dmp_0xbc_0x400000
C:\Muldrop\DECRYPT_INFORMATION.iunm_76
C:\Muldrop\dmp_0xbc_0x401000
C:\Muldrop\DECRYPT_INFORMATION.iunm_98
C:\Muldrop\dmp_0xbc_0x406000
C:\Muldrop\dmp_0xbc_0x20000
C:\Muldrop\DECRYPT_INFORMATION.iunm_96
C:\Muldrop\DECRYPT_INFORMATION.iunm_72
C:\Muldrop\DECRYPT_INFORMATION.iunm_94
C:\Muldrop\dmp_0xbc_0x76c000
C:\Muldrop\DECRYPT_INFORMATION.iunm_5
C:\Muldrop\DECRYPT_INFORMATION.iunm_65
C:\Muldrop\DECRYPT_INFORMATION.iunm_90
C:\Muldrop\DECRYPT_INFORMATION.iunm_4
C:\Muldrop\PUBLIC_0
C:\Muldrop\DECRYPT_INFORMATION.iunm_79
C:\Muldrop\DECRYPT_INFORMATION.iunm_53
C:\Muldrop\DECRYPT_INFORMATION.iunm_43
C:\Muldrop\DECRYPT_INFORMATION.iunm_38
C:\Muldrop\DECRYPT_INFORMATION.iunm_56
C:\Muldrop\DECRYPT_INFORMATION.iunm_68
C:\Muldrop\DECRYPT_INFORMATION.iunm_7
C:\Muldrop\DECRYPT_INFORMATION.iunm_41
C:\Muldrop\DECRYPT_INFORMATION.iunm_57
C:\Muldrop\DECRYPT_INFORMATION.iunm_62
C:\Muldrop\DECRYPT_INFORMATION.iunm_64
C:\Muldrop\DECRYPT_INFORMATION.iunm_35
C:\Muldrop\DECRYPT_INFORMATION.iunm_60
C:\Muldrop\DECRYPT_INFORMATION.iunm_45
C:\Muldrop\DECRYPT_INFORMATION.iunm_59
C:\Muldrop\DECRYPT_INFORMATION.iunm_8
C:\Muldrop\DECRYPT_INFORMATION.iunm_6
C:\Muldrop\DECRYPT_INFORMATION.iunm_39
C:\Muldrop\DECRYPT_INFORMATION.iunm_48
C:\Muldrop\DECRYPT_INFORMATION.iunm_42
C:\Muldrop\DECRYPT_INFORMATION.iunm_32
C:\Muldrop\DECRYPT_INFORMATION.iunm_80
C:\Muldrop\DECRYPT_INFORMATION.iunm_61
C:\Muldrop\DECRYPT_INFORMATION.iunm_37
C:\Muldrop\DECRYPT_INFORMATION.iunm_78
C:\Muldrop\DECRYPT_INFORMATION.iunm_66
C:\Muldrop\DECRYPT_INFORMATION.iunm_49
C:\Muldrop\DECRYPT_INFORMATION.iunm_88
C:\Muldrop\DECRYPT_INFORMATION.iunm_73
C:\Muldrop\DECRYPT_INFORMATION.iunm_71
C:\Muldrop\DECRYPT_INFORMATION.iunm_30
C:\Muldrop\DECRYPT_INFORMATION.iunm_74
C:\Muldrop\DECRYPT_INFORMATION.iunm_69
C:\Muldrop\DECRYPT_INFORMATION.iunm_50
C:\Muldrop\DECRYPT_INFORMATION.iunm_34
C:\Muldrop\DECRYPT_INFORMATION.iunm_36
%CommonProgramFiles%\DECRYPT_INFORMATION.html
%CommonProgramFiles%\Microsoft Shared\DECRYPT_INFORMATION.html
%CommonProgramFiles%\Microsoft Shared\DW\DECRYPT_INFORMATION.html
<SYSTEM32>\dllcache\msado21.tlb.new
<SYSTEM32>\dllcache\msado20.tlb.new
%ProgramFiles%\FireFox\chrome\en-US\locale\browser\DECRYPT_INFORMATION.html
<SYSTEM32>\dllcache\sam.spd.new
<SYSTEM32>\dllcache\sam.sdf.new
<SYSTEM32>\dllcache\ltts1033.lxa.new
<SYSTEM32>\dllcache\msado25.tlb.new
<SYSTEM32>\dllcache\msado26.tlb.new
<SYSTEM32>\dllcache\dhtmled.ocx.new
%ProgramFiles%\FireFox\chrome\en-US\DECRYPT_INFORMATION.html
<SYSTEM32>\dllcache\sapi.cpl.new
<SYSTEM32>\dllcache\ieinfo5.ocx.new
%ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\DECRYPT_INFORMATION.html
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\DECRYPT_INFORMATION.html
%ProgramFiles%\FireFox\chrome\en-US\locale\DECRYPT_INFORMATION.html
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\DECRYPT_INFORMATION.html
<SYSTEM32>\dllcache\msado27.tlb.new
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\DECRYPT_INFORMATION.html
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\DECRYPT_INFORMATION.html
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\DECRYPT_INFORMATION.html
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\DECRYPT_INFORMATION.html
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\DECRYPT_INFORMATION.html
%ProgramFiles%\FireFox\chrome\toolkit\skin\DECRYPT_INFORMATION.html
%ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\DECRYPT_INFORMATION.html
%ProgramFiles%\FireFox\chrome\toolkit\content\global\DECRYPT_INFORMATION.html
%ProgramFiles%\FireFox\chrome\toolkit\content\DECRYPT_INFORMATION.html
%ProgramFiles%\FireFox\chrome\toolkit\DECRYPT_INFORMATION.html
%ProgramFiles%\FireFox\chrome\pippki\content\DECRYPT_INFORMATION.html
%ProgramFiles%\FireFox\chrome\pippki\DECRYPT_INFORMATION.html
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\mozapps\DECRYPT_INFORMATION.html
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global-platform\DECRYPT_INFORMATION.html
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global\DECRYPT_INFORMATION.html
%CommonProgramFiles%\System\ado\msado27.tlb.new
<SYSTEM32>\dllcache\r1033tts.lxa.new
%CommonProgramFiles%\System\ado\msado25.tlb.new
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\DECRYPT_INFORMATION.html
%CommonProgramFiles%\System\ado\msado26.tlb.new
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\isapi\DECRYPT_INFORMATION.html
%CommonProgramFiles%\SpeechEngines\DECRYPT_INFORMATION.html
%CommonProgramFiles%\ODBC\DECRYPT_INFORMATION.html
%CommonProgramFiles%\MSSoap\Binaries\Resources\DECRYPT_INFORMATION.html
%CommonProgramFiles%\MSSoap\Binaries\DECRYPT_INFORMATION.html
%CommonProgramFiles%\MSSoap\DECRYPT_INFORMATION.html
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\_vti_bin\DECRYPT_INFORMATION.html
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bots\DECRYPT_INFORMATION.html
%CommonProgramFiles%\SpeechEngines\Microsoft\Lexicon\DECRYPT_INFORMATION.html
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\DECRYPT_INFORMATION.html
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admisapi\DECRYPT_INFORMATION.html
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admcgi\DECRYPT_INFORMATION.html
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\DECRYPT_INFORMATION.html
%CommonProgramFiles%\Microsoft Shared\web server extensions\DECRYPT_INFORMATION.html
%CommonProgramFiles%\Microsoft Shared\Speech\DECRYPT_INFORMATION.html
C:\Muldrop\DECRYPT_INFORMATION.iunm_75
%CommonProgramFiles%\System\DECRYPT_INFORMATION.html
%CommonProgramFiles%\SpeechEngines\Microsoft\TTS\DECRYPT_INFORMATION.html
%ProgramFiles%\FireFox\chrome\DECRYPT_INFORMATION.html
%CommonProgramFiles%\SpeechEngines\Microsoft\DECRYPT_INFORMATION.html
%CommonProgramFiles%\System\ado\msado21.tlb.new
%ProgramFiles%\FireFox\chrome\browser\skin\classic\DECRYPT_INFORMATION.html
%CommonProgramFiles%\System\ado\msado20.tlb.new
%CommonProgramFiles%\SpeechEngines\Microsoft\TTS\1033\sam.spd.new
%CommonProgramFiles%\SpeechEngines\Microsoft\TTS\1033\sam.sdf.new
%ProgramFiles%\FireFox\chrome\browser\skin\DECRYPT_INFORMATION.html
%CommonProgramFiles%\SpeechEngines\Microsoft\Lexicon\1033\ltts1033.lxa.new
%CommonProgramFiles%\SpeechEngines\Microsoft\Lexicon\1033\r1033tts.lxa.new
%CommonProgramFiles%\Microsoft Shared\Triedit\dhtmled.ocx.new
%CommonProgramFiles%\Microsoft Shared\Speech\sapi.cpl.new
%CommonProgramFiles%\Microsoft Shared\MSInfo\ieinfo5.ocx.new
%ProgramFiles%\FireFox\chrome\browser\content\browser\DECRYPT_INFORMATION.html
%ProgramFiles%\FireFox\chrome\browser\content\DECRYPT_INFORMATION.html
%ProgramFiles%\FireFox\chrome\browser\DECRYPT_INFORMATION.html
%ProgramFiles%\FireFox\DECRYPT_INFORMATION.html
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\DECRYPT_INFORMATION.html
C:\Muldrop\DECRYPT_INFORMATION.iunm_23
C:\Muldrop\DECRYPT_INFORMATION.iunm_24
C:\Documents and Settings\NetworkService\Application Data\Microsoft\DECRYPT_INFORMATION.html
C:\Documents and Settings\NetworkService\Application Data\DECRYPT_INFORMATION.html
C:\Documents and Settings\NetworkService\DECRYPT_INFORMATION.html
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\DECRYPT_INFORMATION.html
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\DECRYPT_INFORMATION.html
C:\Documents and Settings\LocalService\Local Settings\History\DECRYPT_INFORMATION.html
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\DECRYPT_INFORMATION.html
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\DECRYPT_INFORMATION.html
C:\Documents and Settings\LocalService\Local Settings\Application Data\DECRYPT_INFORMATION.html
C:\Documents and Settings\LocalService\Local Settings\DECRYPT_INFORMATION.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\DECRYPT_INFORMATION.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\DECRYPT_INFORMATION.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\DECRYPT_INFORMATION.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\DECRYPT_INFORMATION.html
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\DECRYPT_INFORMATION.html
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\DECRYPT_INFORMATION.html
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\DECRYPT_INFORMATION.html
C:\Documents and Settings\NetworkService\Local Settings\DECRYPT_INFORMATION.html
%APPDATA%\Microsoft\SystemCertificates\DECRYPT_INFORMATION.html
%APPDATA%\Microsoft\Internet Explorer\DECRYPT_INFORMATION.html
%APPDATA%\Microsoft\Crypto\RSA\DECRYPT_INFORMATION.html
%APPDATA%\Microsoft\Crypto\DECRYPT_INFORMATION.html
%APPDATA%\Microsoft\Credentials\DECRYPT_INFORMATION.html
%APPDATA%\Microsoft\DECRYPT_INFORMATION.html
%APPDATA%\Identities\DECRYPT_INFORMATION.html
%APPDATA%\DECRYPT_INFORMATION.html
%HOMEPATH%\DECRYPT_INFORMATION.html
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\DECRYPT_INFORMATION.html
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\DECRYPT_INFORMATION.html
C:\Documents and Settings\NetworkService\Local Settings\History\DECRYPT_INFORMATION.html
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\DECRYPT_INFORMATION.html
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\DECRYPT_INFORMATION.html
C:\Documents and Settings\NetworkService\Local Settings\Application Data\DECRYPT_INFORMATION.html
C:\Documents and Settings\LocalService\Application Data\DECRYPT_INFORMATION.html
%APPDATA%\Microsoft\SystemCertificates\My\DECRYPT_INFORMATION.html
C:\Documents and Settings\LocalService\DECRYPT_INFORMATION.html
C:\Documents and Settings\Default User\Start Menu\Programs\DECRYPT_INFORMATION.html
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\DECRYPT_INFORMATION.html
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\DECRYPT_INFORMATION.html
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\DECRYPT_INFORMATION.html
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\DECRYPT_INFORMATION.html
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\DECRYPT_INFORMATION.html
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DECRYPT_INFORMATION.html
%ALLUSERSPROFILE%\Documents\DECRYPT_INFORMATION.html
%ALLUSERSPROFILE%\Application Data\Microsoft\DECRYPT_INFORMATION.html
%ALLUSERSPROFILE%\DECRYPT_INFORMATION.html
C:\Documents and Settings\DECRYPT_INFORMATION.html
C:\DECRYPT_INFORMATION.html
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_23ef5514-3059-436f-a4a7-4cefaab20eb1
C:\Documents and Settings\Default User\UNIQUE_ID_DO_NOT_REMOVE
C:\Documents and Settings\Default User\PUBLIC
%ALLUSERSPROFILE%\Application Data\DECRYPT_INFORMATION.html
%ALLUSERSPROFILE%\Documents\My Music\DECRYPT_INFORMATION.html
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\DECRYPT_INFORMATION.html
%ALLUSERSPROFILE%\Documents\My Pictures\DECRYPT_INFORMATION.html
C:\Documents and Settings\Default User\Start Menu\DECRYPT_INFORMATION.html
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\DECRYPT_INFORMATION.html
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\DECRYPT_INFORMATION.html
C:\Documents and Settings\Default User\Local Settings\History\DECRYPT_INFORMATION.html
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\DECRYPT_INFORMATION.html
C:\Documents and Settings\Default User\Local Settings\Application Data\DECRYPT_INFORMATION.html
C:\Documents and Settings\Default User\Local Settings\DECRYPT_INFORMATION.html
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\DECRYPT_INFORMATION.html
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\DECRYPT_INFORMATION.html
C:\Documents and Settings\Default User\Application Data\Microsoft\DECRYPT_INFORMATION.html
C:\Documents and Settings\Default User\Application Data\DECRYPT_INFORMATION.html
C:\Documents and Settings\Default User\DECRYPT_INFORMATION.html
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\DECRYPT_INFORMATION.html
%ALLUSERSPROFILE%\Start Menu\Programs\DECRYPT_INFORMATION.html
%ALLUSERSPROFILE%\Start Menu\DECRYPT_INFORMATION.html
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\DECRYPT_INFORMATION.html
%HOMEPATH%\Favorites\DECRYPT_INFORMATION.html
%HOMEPATH%\Local Settings\DECRYPT_INFORMATION.html
<LS_APPDATA>\DECRYPT_INFORMATION.html
C:\Muldrop\DECRYPT_INFORMATION.iunm_22
C:\Muldrop\DECRYPT_INFORMATION.iunm_27
C:\Muldrop\DECRYPT_INFORMATION.iunm_15
C:\Muldrop\DECRYPT_INFORMATION.iunm_20
C:\Muldrop\DECRYPT_INFORMATION.iunm_13
C:\Muldrop\DECRYPT_INFORMATION.iunm_14
C:\Muldrop\DECRYPT_INFORMATION.iunm_25
C:\Muldrop\DECRYPT_INFORMATION.iunm_26
C:\Muldrop\DECRYPT_INFORMATION.iunm_12
C:\Muldrop\DECRYPT_INFORMATION.iunm_102
C:\Muldrop\DECRYPT_INFORMATION.iunm_100
C:\Muldrop\DECRYPT_INFORMATION.iunm_18
C:\Muldrop\DECRYPT_INFORMATION.iunm_0
C:\Muldrop\DECRYPT_INFORMATION.iunm_17
C:\Muldrop\DECRYPT_INFORMATION.iunm_1
C:\Muldrop\DECRYPT_INFORMATION.iunm_31
C:\Muldrop\DECRYPT_INFORMATION.iunm_21
C:\Muldrop\DECRYPT_INFORMATION.iunm_82
C:\Muldrop\DECRYPT_INFORMATION.iunm_33
C:\Muldrop\DECRYPT_INFORMATION.iunm_67
C:\Muldrop\DECRYPT_INFORMATION.iunm_9
C:\Muldrop\DECRYPT_INFORMATION.iunm_55
C:\Muldrop\DECRYPT_INFORMATION.iunm_84
C:\Muldrop\DECRYPT_INFORMATION.iunm_46
C:\Muldrop\DECRYPT_INFORMATION.iunm_28
C:\Muldrop\DECRYPT_INFORMATION.iunm_87
C:\Muldrop\DECRYPT_INFORMATION.iunm_51
C:\Muldrop\DECRYPT_INFORMATION.iunm_52
C:\Muldrop\DECRYPT_INFORMATION.iunm_47
C:\Muldrop\DECRYPT_INFORMATION.iunm_58
C:\Muldrop\DECRYPT_INFORMATION.iunm_2
C:\Muldrop\DECRYPT_INFORMATION.iunm_29
C:\Muldrop\DECRYPT_INFORMATION.iunm_101
C:\Muldrop\DECRYPT_INFORMATION.iunm_11
C:\Muldrop\DECRYPT_INFORMATION.iunm_19
C:\Muldrop\DECRYPT_INFORMATION.iunm_16
C:\Muldrop\DECRYPT_INFORMATION.iunm_10
%HOMEPATH%\Local Settings\<INETFILES>\DECRYPT_INFORMATION.html
C:\Far2\Addons\DECRYPT_INFORMATION.html
C:\Far2\DECRYPT_INFORMATION.html
%HOMEPATH%\Start Menu\Programs\Accessories\DECRYPT_INFORMATION.html
%HOMEPATH%\Start Menu\Programs\DECRYPT_INFORMATION.html
%HOMEPATH%\Start Menu\DECRYPT_INFORMATION.html
%HOMEPATH%\My Documents\DECRYPT_INFORMATION.html
%HOMEPATH%\Local Settings\History\History.IE5\DECRYPT_INFORMATION.html
C:\Far2\Addons\XLat\DECRYPT_INFORMATION.html
%HOMEPATH%\Local Settings\History\DECRYPT_INFORMATION.html
<LS_APPDATA>\Microsoft\Credentials\DECRYPT_INFORMATION.html
<LS_APPDATA>\Microsoft\DECRYPT_INFORMATION.html
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\DECRYPT_INFORMATION.html
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\DECRYPT_INFORMATION.html
<LS_APPDATA>\Identities\DECRYPT_INFORMATION.html
C:\Muldrop\DECRYPT_INFORMATION.iunm_3
C:\Far2\Plugins\DECRYPT_INFORMATION.html
C:\Far2\Documentation\DECRYPT_INFORMATION.html
C:\Far2\Plugins\Colorer\hrc\DECRYPT_INFORMATION.html
C:\Far2\Addons\Colors\DECRYPT_INFORMATION.html
C:\Muldrop\7g603cfe929170g96576c4f2e9988b32_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_1
C:\Muldrop\7g603cfe929170g96576c4f2e9988b32_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_0
C:\Muldrop\08f575673ddf10d72090304839888f02_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_0
C:\Far2\PluginSDK\DECRYPT_INFORMATION.html
C:\Far2\Plugins\WinSCP\putty\DECRYPT_INFORMATION.html
C:\Far2\Plugins\WinSCP\packages\DECRYPT_INFORMATION.html
C:\Far2\Plugins\WinSCP\filezilla\DECRYPT_INFORMATION.html
C:\Far2\Plugins\WinSCP\DECRYPT_INFORMATION.html
C:\Far2\Plugins\FTP\DECRYPT_INFORMATION.html
C:\Far2\Plugins\ExtSearch\sources\DECRYPT_INFORMATION.html
C:\Far2\Plugins\ExtSearch\DECRYPT_INFORMATION.html
C:\Far2\Plugins\Colorer\hrd\console\DECRYPT_INFORMATION.html
C:\Far2\Plugins\Colorer\hrd\DECRYPT_INFORMATION.html
C:\Far2\Plugins\Colorer\hrc\auto\DECRYPT_INFORMATION.html
C:\Far2\Plugins\Colorer\DECRYPT_INFORMATION.html
%ProgramFiles%\FireFox\defaults\DECRYPT_INFORMATION.html

Substitutes the following files:

<SYSTEM32>\dllcache\ieinfo5.ocx.new
<SYSTEM32>\dllcache\dhtmled.ocx.new

Modifies user data files (Trojan.Encoder).

Miscellaneous:

Creates and executes the following:

'<Full path to file>'

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial