Trojan.Encoder.25389

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Alcmeter' = '%TEMP%\rB0BQ15r0UNhapw.exe'
[<HKLM>\SOFTWARE\Classes\QXQJEVSDEYXMFBG\shell\open\command] '' = '%TEMP%\rB0BQ15r0UNhapw.exe'

Creates or modifies the following files:

%ALLUSERSPROFILE%\Start Menu\Programs\Startup\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Start Menu\Programs\Startup\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Start Menu\Programs\Startup\Shortcut to startup_local.lnk

Infects the following executable files:

C:\Far2\Far.exe
%ProgramFiles%\MSN\MSNCoreFiles\Install\MSN9Components\Digcore.exe
%ProgramFiles%\MSN\MSNCoreFiles\Install\MSN9Components\Msncli.exe
%ProgramFiles%\MSN\MSNCoreFiles\Install\msnsusii.exe
%ProgramFiles%\MSN Gaming Zone\Windows\bckgzm.exe
%ProgramFiles%\MSN Gaming Zone\Windows\chkrzm.exe
%ProgramFiles%\MSN Gaming Zone\Windows\hrtzzm.exe
%ProgramFiles%\MSN Gaming Zone\Windows\Rvsezm.exe
%ProgramFiles%\MSN Gaming Zone\Windows\shvlzm.exe
%ProgramFiles%\MSN Gaming Zone\Windows\zClientm.exe
%ProgramFiles%\NetMeeting\cb32.exe
%ProgramFiles%\NetMeeting\conf.exe
%ProgramFiles%\NetMeeting\wb32.exe
%ProgramFiles%\Outlook Express\msimn.exe
%ProgramFiles%\Outlook Express\oemig50.exe
%ProgramFiles%\Outlook Express\setup50.exe
%ProgramFiles%\Outlook Express\wab.exe
%ProgramFiles%\Outlook Express\wabmig.exe
%ProgramFiles%\Windows Media Player\migrate.exe
%ProgramFiles%\Windows Media Player\mplayer2.exe
%ProgramFiles%\Windows Media Player\setup_wm.exe
%ProgramFiles%\Windows Media Player\wmplayer.exe
%ProgramFiles%\Windows NT\Accessories\wordpad.exe
%ProgramFiles%\Windows NT\dialer.exe
%ProgramFiles%\Movie Maker\moviemk.exe
%ProgramFiles%\Windows NT\hypertrm.exe
%ProgramFiles%\Messenger\msmsgs.exe
%ProgramFiles%\Internet Explorer\iedw.exe
%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE
%CommonProgramFiles%\Microsoft Shared\DW\DWTRIG20.EXE
%CommonProgramFiles%\Microsoft Shared\MSInfo\msinfo32.exe
%CommonProgramFiles%\Microsoft Shared\Speech\sapisvr.exe
%ProgramFiles%\FireFox\crashreporter.exe
%ProgramFiles%\FireFox\firefox.exe
%ProgramFiles%\FireFox\js.exe
%ProgramFiles%\FireFox\mangle.exe
%ProgramFiles%\FireFox\nsinstall.exe
%ProgramFiles%\FireFox\plugin-container.exe
%ProgramFiles%\FireFox\shlibsign.exe
%ProgramFiles%\FireFox\uninstall\helper.exe
%ProgramFiles%\FireFox\updater.exe
%ProgramFiles%\FireFox\xpcshell.exe
%ProgramFiles%\FireFox\xpidl.exe
%ProgramFiles%\FireFox\xpt_dump.exe
%ProgramFiles%\FireFox\xpt_link.exe
%ProgramFiles%\Internet Explorer\Connection Wizard\icwconn1.exe
%ProgramFiles%\Internet Explorer\Connection Wizard\icwconn2.exe
%ProgramFiles%\Internet Explorer\Connection Wizard\icwrmind.exe
%ProgramFiles%\Internet Explorer\Connection Wizard\icwtutor.exe
%ProgramFiles%\Internet Explorer\Connection Wizard\inetwiz.exe
%ProgramFiles%\Internet Explorer\Connection Wizard\isignup.exe
%ProgramFiles%\Internet Explorer\IEXPLORE.EXE
%ProgramFiles%\Windows NT\Pinball\PINBALL.EXE

Malicious functions:

Injects code into

the following system processes:

%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Modifies file system:

Creates the following files:

%TEMP%\rB0BQ15r0UNhapw.exe
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\scrollbar\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\radio\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\printpreview\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\media\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\dirListing\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\console\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\checkbox\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\alerts\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\content\xbl-marquee\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\toolbar\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\content\satchel\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\content\passwordmgr\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\xpinstall\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\update\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\profile\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\preferences\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\plugins\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\handling\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\extensions\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\downloads\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\res\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\content\global\cpow\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\tree\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\downloads\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\tree\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\toolbar\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\splitter\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\scrollbar\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\radio\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\printpreview\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\media\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\dirListing\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\console\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\content\global\xml\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\splitter\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\alerts\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\xpinstall\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\viewsource\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\update\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\profile\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\plugins\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\places\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\passwordmgr\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\handling\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\downloads\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\content\global\svg\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\handling\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\browser\places\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global\layout\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global\dom\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\cookie\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\autoconfig\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\alerts\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\browser-region\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\browser\sidebar\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\browser\safebrowsing\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\browser\preferences\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global\search\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global\security\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\browser\downloads\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\browser\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\branding\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\skin\classic\communicator\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\tabview\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\tabbrowser\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\preferences\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\places\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\feeds\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\browser\feeds\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\checkbox\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global\svg\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\mozapps\update\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\mozapps\xpinstall\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\content\global\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\content\cookie\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\pippki\content\pippki\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\feedback\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\services\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\places\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\pippki\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\pipnss\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\passwordmgr\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\necko\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\content\global\alerts\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global\xml\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global\xpinstall\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\mozapps\preferences\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\mozapps\plugins\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\mozapps\handling\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\mozapps\extensions\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\mozapps\downloads\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global-region\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global-platform\win\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global-platform\unix\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global-platform\mac\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global\xslt\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\mozapps\profile\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\ExtSearch\keys\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\passwordmgr\HOW TO DECRYPT FILES.txt
%ProgramFiles%\NetMeeting\conf.exe.new
<SYSTEM32>\dllcache\iexplore.exe.new
%ProgramFiles%\NetMeeting\cb32.exe.new
%ProgramFiles%\Windows NT\Pinball\HOW TO DECRYPT FILES.txt
<SYSTEM32>\dllcache\iedw.exe.new
<SYSTEM32>\dllcache\isignup.exe.new
<SYSTEM32>\dllcache\inetwiz.exe.new
<SYSTEM32>\dllcache\icwtutor.exe.new
%ProgramFiles%\Windows NT\HOW TO DECRYPT FILES.txt
<SYSTEM32>\dllcache\icwrmind.exe.new
<SYSTEM32>\dllcache\icwconn2.exe.new
<SYSTEM32>\dllcache\moviemk.exe.new
%ProgramFiles%\Windows NT\Accessories\HOW TO DECRYPT FILES.txt
%ProgramFiles%\MSN Gaming Zone\Windows\zclientm.exe.new
%ProgramFiles%\MSN Gaming Zone\Windows\shvlzm.exe.new
%ProgramFiles%\MSN Gaming Zone\Windows\rvsezm.exe.new
%ProgramFiles%\MSN Gaming Zone\Windows\hrtzzm.exe.new
%ProgramFiles%\Windows Media Player\Skins\HOW TO DECRYPT FILES.txt
%ProgramFiles%\MSN Gaming Zone\Windows\chkrzm.exe.new
%ProgramFiles%\MSN Gaming Zone\Windows\bckgzm.exe.new
%ProgramFiles%\Windows Media Player\HOW TO DECRYPT FILES.txt
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\HOW TO DECRYPT FILES.txt
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HOW TO DECRYPT FILES.txt
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\HOW TO DECRYPT FILES.txt
<SYSTEM32>\dllcache\icwconn1.exe.new
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\HOW TO DECRYPT FILES.txt
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\HOW TO DECRYPT FILES.txt
<STUBS_DIR>\AVGCTRL\HOW TO DECRYPT FILES.txt
<STUBS_DIR>\AVGCC32\HOW TO DECRYPT FILES.txt
<STUBS_DIR>\avgcc\HOW TO DECRYPT FILES.txt
<STUBS_DIR>\ashAvSrv\HOW TO DECRYPT FILES.txt
<STUBS_DIR>\ashAvast\HOW TO DECRYPT FILES.txt
<STUBS_DIR>\ash\HOW TO DECRYPT FILES.txt
<STUBS_DIR>\aion\HOW TO DECRYPT FILES.txt
%ProgramFiles%\Windows NT\Accessories\wordpad.exe.new
<STUBS_DIR>\ageofconan\HOW TO DECRYPT FILES.txt
%ProgramFiles%\Windows Media Player\wmplayer.exe.new
<SYSTEM32>\dllcache\zclientm.exe.new
%ProgramFiles%\Outlook Express\msimn.exe.new
%ProgramFiles%\NetMeeting\wb32.exe.new
<SYSTEM32>\dllcache\rvsezm.exe.new
<SYSTEM32>\dllcache\hrtzzm.exe.new
<SYSTEM32>\dllcache\chkrzm.exe.new
%ProgramFiles%\Windows Media Player\setup_wm.exe.new
C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\HOW TO DECRYPT FILES.txt
<SYSTEM32>\dllcache\bckgzm.exe.new
%ProgramFiles%\Windows Media Player\mplayer2.exe.new
%ProgramFiles%\Windows Media Player\migrate.exe.new
%ProgramFiles%\Outlook Express\wabmig.exe.new
%ProgramFiles%\Outlook Express\wab.exe.new
%ProgramFiles%\Outlook Express\setup50.exe.new
<STUBS_DIR>\360tray\HOW TO DECRYPT FILES.txt
%ProgramFiles%\Outlook Express\oemig50.exe.new
%ProgramFiles%\FireFox\chrome\en-US\locale\browser\migration\HOW TO DECRYPT FILES.txt
%ProgramFiles%\Outlook Express\HOW TO DECRYPT FILES.txt
%ProgramFiles%\MSN Gaming Zone\Windows\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\res\html\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\res\fonts\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\res\entityTables\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\res\dtd\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\res\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\modules\tabview\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\modules\services-sync\ext\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\modules\services-sync\engines\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\modules\services-sync\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\modules\services-crypto\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\uninstall\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\modules\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\dictionaries\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\defaults\profile\chrome\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\defaults\profile\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\defaults\pref\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\defaults\autoconfig\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\components\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\xpinstall\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\viewsource\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\update\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\profile\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\plugins\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\HOW TO DECRYPT FILES.txt
%ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\places\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\searchplugins\HOW TO DECRYPT FILES.txt
%ProgramFiles%\Online Services\HOW TO DECRYPT FILES.txt
%ProgramFiles%\Movie Maker\moviemk.exe.new
%ProgramFiles%\Internet Explorer\iexplore.exe.new
%ProgramFiles%\Internet Explorer\iedw.exe.new
%ProgramFiles%\Internet Explorer\Connection Wizard\isignup.exe.new
%ProgramFiles%\Internet Explorer\Connection Wizard\inetwiz.exe.new
%ProgramFiles%\Internet Explorer\Connection Wizard\icwtutor.exe.new
%ProgramFiles%\Internet Explorer\Connection Wizard\icwrmind.exe.new
%ProgramFiles%\Internet Explorer\Connection Wizard\icwconn2.exe.new
%ProgramFiles%\Internet Explorer\Connection Wizard\icwconn1.exe.new
%ProgramFiles%\NetMeeting\HOW TO DECRYPT FILES.txt
%ProgramFiles%\Internet Explorer\HOW TO DECRYPT FILES.txt
%ProgramFiles%\Internet Explorer\Connection Wizard\HOW TO DECRYPT FILES.txt
%ProgramFiles%\MSN\MSNCoreFiles\Install\MSN9Components\HOW TO DECRYPT FILES.txt
%ProgramFiles%\MSN\MSNCoreFiles\Install\HOW TO DECRYPT FILES.txt
%ProgramFiles%\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\HOW TO DECRYPT FILES.txt
%ProgramFiles%\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\HOW TO DECRYPT FILES.txt
%ProgramFiles%\Movie Maker\Shared\Profiles\HOW TO DECRYPT FILES.txt
%ProgramFiles%\Movie Maker\Shared\HOW TO DECRYPT FILES.txt
%ProgramFiles%\Movie Maker\MUI\0409\HOW TO DECRYPT FILES.txt
%ProgramFiles%\Movie Maker\HOW TO DECRYPT FILES.txt
%ProgramFiles%\Microsoft.NET\RedistList\HOW TO DECRYPT FILES.txt
%ProgramFiles%\Messenger\HOW TO DECRYPT FILES.txt
%ProgramFiles%\Internet Explorer\SIGNUP\HOW TO DECRYPT FILES.txt
%ProgramFiles%\MSN\MSNCoreFiles\OOBE\HOW TO DECRYPT FILES.txt
%ProgramFiles%\Internet Explorer\MUI\0409\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\tabview\HOW TO DECRYPT FILES.txt
<SYSTEM32>\dllcache\sapisvr.exe.new
<SYSTEM32>\dllcache\msinfo32.exe.new
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\HOW TO DECRYPT FILES.txt
%APPDATA%\Microsoft\Windows\Themes\HOW TO DECRYPT FILES.txt
%APPDATA%\Microsoft\Media Player\HOW TO DECRYPT FILES.txt
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\HOW TO DECRYPT FILES.txt
%APPDATA%\Microsoft\Internet Explorer\HOW TO DECRYPT FILES.txt
%APPDATA%\Microsoft\Address Book\HOW TO DECRYPT FILES.txt
%APPDATA%\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\HOW TO DECRYPT FILES.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\BGGTYMH1\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\History\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\MOE00UY1\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\LBMMC3H3\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\CJCTQ25G\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\HOW TO DECRYPT FILES.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Local Settings\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Local Settings\History\HOW TO DECRYPT FILES.txt
%HOMEPATH%\My Documents\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Local Settings\<INETFILES>\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\HOW TO DECRYPT FILES.txt
%TEMP%\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Local Settings\History\History.IE5\HOW TO DECRYPT FILES.txt
%HOMEPATH%\My Documents\My Music\HOW TO DECRYPT FILES.txt
%APPDATA%\Mozilla\Firefox\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Cookies\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\Microsoft\Windows Media\9.0\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\Microsoft\Windows\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\Microsoft\Media Player\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Favorites\Links\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Favorites\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\VMware\HOW TO DECRYPT FILES.txt
<STUBS_DIR>\AVP\HOW TO DECRYPT FILES.txt
%HOMEPATH%\My Documents\My Pictures\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\DRM\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Documents\My Videos\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Documents\My Pictures\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\History\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Documents\My Music\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Documents\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Pbk\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Player\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Dr Watson\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Application Data\HOW TO DECRYPT FILES.txt
<Current directory>\HOW TO DECRYPT FILES.txt
C:\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Games\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Cookies\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Application Data\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Cookies\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Templates\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Start Menu\Programs\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Start Menu\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\SendTo\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\History\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\HOW TO DECRYPT FILES.txt
<SYSTEM32>\dllcache\shvlzm.exe.new
%HOMEPATH%\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Start Menu\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Services\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\MSSoap\Binaries\Resources\1033\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\MSSoap\Binaries\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\1033\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\Web Folders\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\VGX\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\VC\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\Triedit\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\TextConv\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\Stationery\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Recent\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\Speech\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\MSInfo\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\3082\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\2052\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1042\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1041\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1040\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1036\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1033\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1031\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1028\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\Speech\1033\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1025\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DAO\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\System\ado\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\SpeechEngines\Microsoft\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\tabbrowser\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\preferences\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\places\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\feeds\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\search\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\safebrowsing\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\places\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\SpeechEngines\Microsoft\TTS\1033\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\migration\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\SpeechEngines\Microsoft\Lexicon\1033\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\certerror\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\bookmarks\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\Speech\sapisvr.exe.new
%ProgramFiles%\FireFox\chrome\browser\content\branding\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\MSInfo\msinfo32.exe.new
%ProgramFiles%\FireFox\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\System\Ole DB\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\System\msadc\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\System\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\history\HOW TO DECRYPT FILES.txt
%HOMEPATH%\SendTo\HOW TO DECRYPT FILES.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\feeds\HOW TO DECRYPT FILES.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Brackets\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\AutoWrap\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\arclite\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Align\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\7-Zip\HOW TO DECRYPT FILES.txt
C:\Far2\FExcept\HOW TO DECRYPT FILES.txt
C:\Far2\Encyclopedia\HOW TO DECRYPT FILES.txt
C:\Far2\Documentation\rus\HOW TO DECRYPT FILES.txt
C:\Far2\Documentation\eng\HOW TO DECRYPT FILES.txt
C:\Far2\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\XLat\Russian\HOW TO DECRYPT FILES.txt
C:\Far2\PluginSDK\Headers.c\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\XLat\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\SetUp\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\Macros\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\Colors\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\Colors\Default Highlighting\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\Colors\Custom Highlighting\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Templates\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Start Menu\Programs\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Start Menu\Programs\Accessories\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\Shell\HOW TO DECRYPT FILES.txt
C:\Muldrop\HOW TO DECRYPT FILES.txt
C:\Far2\PluginSDK\Headers.pas\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\hrc\auto\types\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\WinSCP\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\TmpPanel\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\ProcList\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Network\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\MacroView\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\HlfViewer\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\FTP\lib\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\FTP\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\FileCase\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\FarCmds\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\hrc\auto\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\ExtSearch\sources\RegExp\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\bin\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\ExtSearch\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\ExtSearch\doc\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\EMenu\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\EditCase\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\DrawLine\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Compare\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\hrd\console\contrib\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\hrd\console\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\hrd\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\hrc\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\ExtSearch\sources\HOW TO DECRYPT FILES.txt
<STUBS_DIR>\AVP32\HOW TO DECRYPT FILES.txt

Sets the 'hidden' attribute to the following files:

<Full path to file>

Moves the following files:

from %APPDATA%\Microsoft\Internet Explorer\brndlog.txt to %APPDATA%\Microsoft\Internet Explorer\brndlog.txt.XmUyNTrN
from %ProgramFiles%\NetMeeting\TestSnd.wav to %ProgramFiles%\NetMeeting\TestSnd.wav.XmUyNTrN
from %ProgramFiles%\NetMeeting\wb32.exe to %ProgramFiles%\NetMeeting\wb32.exe.XmUyNTrN
from %ProgramFiles%\Online Services\Refer me to more Internet Service Providers.lnk to %ProgramFiles%\Online Services\Refer me to more Internet Service Providers.lnk.XmUyNTrN
from %ProgramFiles%\Online Services\Use MSN Explorer to sign up for Internet Access (US only).lnk to %ProgramFiles%\Online Services\Use MSN Explorer to sign up for Internet Access (US only).lnk.XmUyNTrN
from %ProgramFiles%\Outlook Express\msimn.exe to %ProgramFiles%\Outlook Express\msimn.exe.XmUyNTrN
from %ProgramFiles%\Outlook Express\msoe.txt to %ProgramFiles%\Outlook Express\msoe.txt.XmUyNTrN
from %ProgramFiles%\Outlook Express\oemig50.exe to %ProgramFiles%\Outlook Express\oemig50.exe.XmUyNTrN
from %ProgramFiles%\Outlook Express\setup50.exe to %ProgramFiles%\Outlook Express\setup50.exe.XmUyNTrN
from %ProgramFiles%\Outlook Express\wab.exe to %ProgramFiles%\Outlook Express\wab.exe.XmUyNTrN
from %ProgramFiles%\Outlook Express\wabmig.exe to %ProgramFiles%\Outlook Express\wabmig.exe.XmUyNTrN
from %ProgramFiles%\Windows Media Player\migrate.exe to %ProgramFiles%\Windows Media Player\migrate.exe.XmUyNTrN
from %ProgramFiles%\Windows Media Player\mplayer2.exe to %ProgramFiles%\Windows Media Player\mplayer2.exe.XmUyNTrN
from %ProgramFiles%\Windows Media Player\setup_wm.exe to %ProgramFiles%\Windows Media Player\setup_wm.exe.XmUyNTrN
from %ProgramFiles%\Windows Media Player\wmplayer.exe to %ProgramFiles%\Windows Media Player\wmplayer.exe.XmUyNTrN
from %ProgramFiles%\Windows NT\Accessories\wordpad.exe to %ProgramFiles%\Windows NT\Accessories\wordpad.exe.XmUyNTrN
from %ProgramFiles%\Windows NT\dialer.exe to %ProgramFiles%\Windows NT\dialer.exe.XmUyNTrN
from %ProgramFiles%\Windows NT\hypertrm.exe to %ProgramFiles%\Windows NT\hypertrm.exe.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\PINBALL.EXE to %ProgramFiles%\Windows NT\Pinball\PINBALL.EXE.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND1.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND1.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND104.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND104.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND105.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND105.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND108.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND108.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND111.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND111.WAV.XmUyNTrN
from %ProgramFiles%\NetMeeting\conf.exe to %ProgramFiles%\NetMeeting\conf.exe.XmUyNTrN
from %ProgramFiles%\Internet Explorer\Connection Wizard\icwconn2.exe to %ProgramFiles%\Internet Explorer\Connection Wizard\icwconn2.exe.XmUyNTrN
from %ProgramFiles%\NetMeeting\cb32.exe to %ProgramFiles%\NetMeeting\cb32.exe.XmUyNTrN
from %ProgramFiles%\MSN Gaming Zone\Windows\zClientm.exe to %ProgramFiles%\MSN Gaming Zone\Windows\zClientm.exe.XmUyNTrN
from %ProgramFiles%\Internet Explorer\Connection Wizard\icwtutor.exe to %ProgramFiles%\Internet Explorer\Connection Wizard\icwtutor.exe.XmUyNTrN
from %ProgramFiles%\Internet Explorer\Connection Wizard\inetwiz.exe to %ProgramFiles%\Internet Explorer\Connection Wizard\inetwiz.exe.XmUyNTrN
from %ProgramFiles%\Internet Explorer\Connection Wizard\isignup.exe to %ProgramFiles%\Internet Explorer\Connection Wizard\isignup.exe.XmUyNTrN
from %ProgramFiles%\Internet Explorer\iedw.exe to %ProgramFiles%\Internet Explorer\iedw.exe.XmUyNTrN
from %ProgramFiles%\Internet Explorer\IEXPLORE.EXE to %ProgramFiles%\Internet Explorer\IEXPLORE.EXE.XmUyNTrN
from %ProgramFiles%\Messenger\logowin.gif to %ProgramFiles%\Messenger\logowin.gif.XmUyNTrN
from %ProgramFiles%\Messenger\lvback.gif to %ProgramFiles%\Messenger\lvback.gif.XmUyNTrN
from %ProgramFiles%\Messenger\msmsgs.exe to %ProgramFiles%\Messenger\msmsgs.exe.XmUyNTrN
from %ProgramFiles%\Messenger\newalert.wav to %ProgramFiles%\Messenger\newalert.wav.XmUyNTrN
from %ProgramFiles%\Messenger\newemail.wav to %ProgramFiles%\Messenger\newemail.wav.XmUyNTrN
from %ProgramFiles%\Messenger\online.wav to %ProgramFiles%\Messenger\online.wav.XmUyNTrN
from %ProgramFiles%\Messenger\type.wav to %ProgramFiles%\Messenger\type.wav.XmUyNTrN
from %ProgramFiles%\Movie Maker\moviemk.exe to %ProgramFiles%\Movie Maker\moviemk.exe.XmUyNTrN
from %ProgramFiles%\Movie Maker\Shared\Empty.txt to %ProgramFiles%\Movie Maker\Shared\Empty.txt.XmUyNTrN
from %ProgramFiles%\Movie Maker\Shared\Profiles\Blank.txt to %ProgramFiles%\Movie Maker\Shared\Profiles\Blank.txt.XmUyNTrN
from %ProgramFiles%\MSN\MSNCoreFiles\Install\MSN9Components\Digcore.exe to %ProgramFiles%\MSN\MSNCoreFiles\Install\MSN9Components\Digcore.exe.XmUyNTrN
from %ProgramFiles%\MSN\MSNCoreFiles\Install\MSN9Components\Msncli.exe to %ProgramFiles%\MSN\MSNCoreFiles\Install\MSN9Components\Msncli.exe.XmUyNTrN
from %ProgramFiles%\MSN\MSNCoreFiles\Install\msnsusii.exe to %ProgramFiles%\MSN\MSNCoreFiles\Install\msnsusii.exe.XmUyNTrN
from %ProgramFiles%\MSN Gaming Zone\Windows\bckgzm.exe to %ProgramFiles%\MSN Gaming Zone\Windows\bckgzm.exe.XmUyNTrN
from %ProgramFiles%\MSN Gaming Zone\Windows\chkrzm.exe to %ProgramFiles%\MSN Gaming Zone\Windows\chkrzm.exe.XmUyNTrN
from %ProgramFiles%\MSN Gaming Zone\Windows\hrtzzm.exe to %ProgramFiles%\MSN Gaming Zone\Windows\hrtzzm.exe.XmUyNTrN
from %ProgramFiles%\MSN Gaming Zone\Windows\Rvsezm.exe to %ProgramFiles%\MSN Gaming Zone\Windows\Rvsezm.exe.XmUyNTrN
from %ProgramFiles%\MSN Gaming Zone\Windows\shvlzm.exe to %ProgramFiles%\MSN Gaming Zone\Windows\shvlzm.exe.XmUyNTrN
from %ProgramFiles%\NetMeeting\Blip.wav to %ProgramFiles%\NetMeeting\Blip.wav.XmUyNTrN
from %ProgramFiles%\Internet Explorer\Connection Wizard\icwrmind.exe to %ProgramFiles%\Internet Explorer\Connection Wizard\icwrmind.exe.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND112.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND112.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND136.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND136.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND43.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND43.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND45.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND45.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND49.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND49.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND49D.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND49D.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND5.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND5.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND50.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND50.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND528.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND528.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND53.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND53.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND54.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND54.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND55.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND55.WAV.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\radio\radio-check.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\radio\radio-check.gif.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND560.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND560.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND57.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND57.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND58.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND58.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND6.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND6.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND65.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND65.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND68.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND68.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND7.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND7.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND713.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND713.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND735.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND735.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND8.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND8.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND827.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND827.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND4.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND4.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND42.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND42.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND13.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND13.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND12.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND12.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND36.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND36.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND14.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND14.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND16.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND16.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND17.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND17.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND18.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND18.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND181.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND181.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND19.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND19.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND20.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND20.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND21.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND21.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND22.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND22.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND24.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND24.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND240.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND240.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND243.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND243.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND25.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND25.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND26.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND26.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND27.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND27.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND28.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND28.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND29.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND29.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND3.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND3.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND30.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND30.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND34.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND34.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND35.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND35.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND38.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND38.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND131.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND131.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND39.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND39.WAV.XmUyNTrN
from %ProgramFiles%\Internet Explorer\Connection Wizard\icwconn1.exe to %ProgramFiles%\Internet Explorer\Connection Wizard\icwconn1.exe.XmUyNTrN
from %ProgramFiles%\FireFox\xpt_link.exe to %ProgramFiles%\FireFox\xpt_link.exe.XmUyNTrN
from %ProgramFiles%\FireFox\xpt_dump.exe to %ProgramFiles%\FireFox\xpt_dump.exe.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\Close.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\Close.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\Minimize.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\Minimize.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\Restore.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\Restore.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\radio\radio-check-dis.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\radio\radio-check-dis.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\radio\radio-check.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\radio\radio-check.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\scrollbar\slider.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\scrollbar\slider.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\splitter\grip-bottom.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\splitter\grip-bottom.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\splitter\grip-left.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\splitter\grip-left.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\splitter\grip-right.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\splitter\grip-right.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\splitter\grip-top.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\splitter\grip-top.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\toolbar\chevron.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\toolbar\chevron.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\tree\columnpicker.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\tree\columnpicker.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-dn-dis.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-dn-dis.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-dn-hov.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-dn-hov.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-dn-sharp.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-dn-sharp.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-dn.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-dn.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-lft-dis.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-lft-dis.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-lft-hov.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-lft-hov.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-lft-sharp-end.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-lft-sharp-end.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-lft-sharp.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-lft-sharp.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-lft.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-lft.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-rit-dis.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-rit-dis.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\console\console-error-caret.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\console\console-error-caret.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-rit-hov.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-rit-hov.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\checkbox\cbox-check.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\checkbox\cbox-check.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-up.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-up.gif.XmUyNTrN
from %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk to %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk.XmUyNTrN
from %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk to %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk.XmUyNTrN
from %TEMP%\rB0BQ15r0UNhapw.exe to %TEMP%\rB0BQ15r0UNhapw.exe.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\content\global\notfound.wav to %ProgramFiles%\FireFox\chrome\toolkit\content\global\notfound.wav.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\res\arrow.gif to %ProgramFiles%\FireFox\chrome\toolkit\res\arrow.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\res\arrowd.gif to %ProgramFiles%\FireFox\chrome\toolkit\res\arrowd.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-dn-dis.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-dn-dis.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-dn-hov.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-dn-hov.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-dn-sharp.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-dn-sharp.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-dn.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-dn.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-lft-dis.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-lft-dis.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-lft-hov.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-lft-hov.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-lft-sharp-end.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-lft-sharp-end.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-lft-sharp.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-lft-sharp.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-lft.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-lft.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-rit-dis.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-rit-dis.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-rit-hov.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-rit-hov.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-rit-sharp-end.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-rit-sharp-end.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-rit-sharp.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-rit-sharp.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-rit.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-rit.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-up-dis.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-up-dis.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-up-hov.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-up-hov.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-up-sharp.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-up-sharp.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\checkbox\cbox-check-dis.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\checkbox\cbox-check-dis.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-rit-sharp-end.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-rit-sharp-end.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\console\console-error-dash.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\console\console-error-dash.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-rit-sharp.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-rit-sharp.gif.XmUyNTrN
from %ProgramFiles%\FireFox\res\table-add-column-after-active.gif to %ProgramFiles%\FireFox\res\table-add-column-after-active.gif.XmUyNTrN
from %ProgramFiles%\FireFox\res\table-add-column-after.gif to %ProgramFiles%\FireFox\res\table-add-column-after.gif.XmUyNTrN
from %ProgramFiles%\FireFox\res\table-add-column-before-active.gif to %ProgramFiles%\FireFox\res\table-add-column-before-active.gif.XmUyNTrN
from %ProgramFiles%\FireFox\res\table-add-column-before-hover.gif to %ProgramFiles%\FireFox\res\table-add-column-before-hover.gif.XmUyNTrN
from %ProgramFiles%\FireFox\res\table-add-column-before.gif to %ProgramFiles%\FireFox\res\table-add-column-before.gif.XmUyNTrN
from %ProgramFiles%\FireFox\res\table-add-row-after-active.gif to %ProgramFiles%\FireFox\res\table-add-row-after-active.gif.XmUyNTrN
from %ProgramFiles%\FireFox\res\table-add-row-after-hover.gif to %ProgramFiles%\FireFox\res\table-add-row-after-hover.gif.XmUyNTrN
from %ProgramFiles%\FireFox\res\table-add-row-after.gif to %ProgramFiles%\FireFox\res\table-add-row-after.gif.XmUyNTrN
from %ProgramFiles%\FireFox\res\table-add-row-before-active.gif to %ProgramFiles%\FireFox\res\table-add-row-before-active.gif.XmUyNTrN
from %ProgramFiles%\FireFox\res\table-add-row-before-hover.gif to %ProgramFiles%\FireFox\res\table-add-row-before-hover.gif.XmUyNTrN
from %ProgramFiles%\FireFox\res\table-add-row-before.gif to %ProgramFiles%\FireFox\res\table-add-row-before.gif.XmUyNTrN
from %ProgramFiles%\FireFox\res\table-remove-column-active.gif to %ProgramFiles%\FireFox\res\table-remove-column-active.gif.XmUyNTrN
from %ProgramFiles%\FireFox\res\table-remove-column-hover.gif to %ProgramFiles%\FireFox\res\table-remove-column-hover.gif.XmUyNTrN
from %ProgramFiles%\FireFox\res\table-remove-column.gif to %ProgramFiles%\FireFox\res\table-remove-column.gif.XmUyNTrN
from %ProgramFiles%\FireFox\res\table-remove-row-active.gif to %ProgramFiles%\FireFox\res\table-remove-row-active.gif.XmUyNTrN
from %ProgramFiles%\FireFox\res\table-remove-row-hover.gif to %ProgramFiles%\FireFox\res\table-remove-row-hover.gif.XmUyNTrN
from %ProgramFiles%\FireFox\res\table-remove-row.gif to %ProgramFiles%\FireFox\res\table-remove-row.gif.XmUyNTrN
from %ProgramFiles%\FireFox\shlibsign.exe to %ProgramFiles%\FireFox\shlibsign.exe.XmUyNTrN
from %ProgramFiles%\FireFox\uninstall\helper.exe to %ProgramFiles%\FireFox\uninstall\helper.exe.XmUyNTrN
from %ProgramFiles%\FireFox\updater.exe to %ProgramFiles%\FireFox\updater.exe.XmUyNTrN
from %ProgramFiles%\FireFox\xpcshell.exe to %ProgramFiles%\FireFox\xpcshell.exe.XmUyNTrN
from %ProgramFiles%\FireFox\xpidl.exe to %ProgramFiles%\FireFox\xpidl.exe.XmUyNTrN
from %ProgramFiles%\FireFox\res\grabber.gif to %ProgramFiles%\FireFox\res\grabber.gif.XmUyNTrN
from %ProgramFiles%\FireFox\plugin-container.exe to %ProgramFiles%\FireFox\plugin-container.exe.XmUyNTrN
from %ProgramFiles%\FireFox\res\table-add-column-after-hover.gif to %ProgramFiles%\FireFox\res\table-add-column-after-hover.gif.XmUyNTrN
from %ProgramFiles%\FireFox\README.txt to %ProgramFiles%\FireFox\README.txt.XmUyNTrN
from %ProgramFiles%\FireFox\nsinstall.exe to %ProgramFiles%\FireFox\nsinstall.exe.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-rit.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-rit.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-up-hov.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-up-hov.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-up-sharp.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-up-sharp.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-up.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-up.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\checkbox\cbox-check-dis.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\checkbox\cbox-check-dis.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\checkbox\cbox-check.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\checkbox\cbox-check.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\console\console-error-caret.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\console\console-error-caret.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\console\console-error-dash.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\console\console-error-dash.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\Close.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\Close.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\Minimize.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\Minimize.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\Restore.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\Restore.gif.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND9.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND9.WAV.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND563.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND563.WAV.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\radio\radio-check-dis.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\radio\radio-check-dis.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\splitter\grip-bottom.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\splitter\grip-bottom.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\splitter\grip-left.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\splitter\grip-left.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\splitter\grip-right.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\splitter\grip-right.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\splitter\grip-top.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\splitter\grip-top.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\toolbar\chevron.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\toolbar\chevron.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\tree\columnpicker.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\tree\columnpicker.gif.XmUyNTrN
from %ProgramFiles%\FireFox\crashreporter.exe to %ProgramFiles%\FireFox\crashreporter.exe.XmUyNTrN
from %ProgramFiles%\FireFox\firefox.exe to %ProgramFiles%\FireFox\firefox.exe.XmUyNTrN
from %ProgramFiles%\FireFox\js.exe to %ProgramFiles%\FireFox\js.exe.XmUyNTrN
from %ProgramFiles%\FireFox\mangle.exe to %ProgramFiles%\FireFox\mangle.exe.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-up-dis.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-up-dis.gif.XmUyNTrN
from %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\scrollbar\slider.gif to %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\scrollbar\slider.gif.XmUyNTrN
from %ProgramFiles%\Windows NT\Pinball\SOUND999.WAV to %ProgramFiles%\Windows NT\Pinball\SOUND999.WAV.XmUyNTrN

Substitutes the following files:

<SYSTEM32>\dllcache\msinfo32.exe.new
<SYSTEM32>\dllcache\rvsezm.exe.new
<SYSTEM32>\dllcache\hrtzzm.exe.new
<SYSTEM32>\dllcache\chkrzm.exe.new
<SYSTEM32>\dllcache\bckgzm.exe.new
<SYSTEM32>\dllcache\moviemk.exe.new
<SYSTEM32>\dllcache\iexplore.exe.new
<SYSTEM32>\dllcache\shvlzm.exe.new
<SYSTEM32>\dllcache\iedw.exe.new
<SYSTEM32>\dllcache\inetwiz.exe.new
<SYSTEM32>\dllcache\icwtutor.exe.new
<SYSTEM32>\dllcache\icwrmind.exe.new
<SYSTEM32>\dllcache\icwconn2.exe.new
<SYSTEM32>\dllcache\icwconn1.exe.new
<SYSTEM32>\dllcache\sapisvr.exe.new
<SYSTEM32>\dllcache\isignup.exe.new
<SYSTEM32>\dllcache\zclientm.exe.new

Creates ransom message files (Trojan.Encoder).

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Miscellaneous:

Executes the following:

'%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe'

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial