Trojan.Encoder.26894

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%ALLUSERSPROFILE%\Start Menu\Programs\Startup\xgjylliajlkk.txt
%HOMEPATH%\Start Menu\Programs\Startup\xgjylliajlkk.txt

Creates the following files on removable media:

<Drive name for removable media>:\xgjylliajlkk.txt

Modifies file system:

Creates the following files:

%APPDATA%\Microsoft\Protect\CREDHIST
%HOMEPATH%\Local Settings\History\History.IE5\xgjylliajlkk.txt
%HOMEPATH%\Local Settings\History\xgjylliajlkk.txt
<LS_APPDATA>\VMware\xgjylliajlkk.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\xgjylliajlkk.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\F\xgjylliajlkk.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\E\xgjylliajlkk.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\D\xgjylliajlkk.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\B\xgjylliajlkk.txt
%TEMP%\xgjylliajlkk.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\A\xgjylliajlkk.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\9\xgjylliajlkk.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\8\xgjylliajlkk.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\7\xgjylliajlkk.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\6\xgjylliajlkk.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\5\xgjylliajlkk.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\C\xgjylliajlkk.txt
<LS_APPDATA>\Microsoft\Windows\xgjylliajlkk.txt
%HOMEPATH%\Local Settings\<INETFILES>\xgjylliajlkk.txt
C:\Far2\Addons\xgjylliajlkk.txt
C:\Far2\xgjylliajlkk.txt
%HOMEPATH%\Templates\xgjylliajlkk.txt
%HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\xgjylliajlkk.txt
%HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\xgjylliajlkk.txt
%HOMEPATH%\Start Menu\Programs\Accessories\xgjylliajlkk.txt
%HOMEPATH%\Start Menu\Programs\xgjylliajlkk.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\4\xgjylliajlkk.txt
%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\xgjylliajlkk.txt
%HOMEPATH%\Recent\xgjylliajlkk.txt
%HOMEPATH%\PrintHood\xgjylliajlkk.txt
%HOMEPATH%\NetHood\xgjylliajlkk.txt
%HOMEPATH%\My Documents\My Received Files\xgjylliajlkk.txt
%HOMEPATH%\My Documents\My Pictures\xgjylliajlkk.txt
%HOMEPATH%\My Documents\My Music\xgjylliajlkk.txt
%HOMEPATH%\My Documents\Downloads\xgjylliajlkk.txt
%HOMEPATH%\SendTo\xgjylliajlkk.txt
%HOMEPATH%\My Documents\xgjylliajlkk.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\3\xgjylliajlkk.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\2\xgjylliajlkk.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\1\xgjylliajlkk.txt
%APPDATA%\Mozilla\Extensions\xgjylliajlkk.txt
%HOMEPATH%\Favorites\xgjylliajlkk.txt
%HOMEPATH%\Cookies\xgjylliajlkk.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\xgjylliajlkk.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\xgjylliajlkk.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\xgjylliajlkk.txt
%APPDATA%\Mozilla\Firefox\Profiles\xgjylliajlkk.txt
C:\Far2\Addons\Colors\xgjylliajlkk.txt
%HOMEPATH%\Local Settings\xgjylliajlkk.txt
%APPDATA%\Mozilla\xgjylliajlkk.txt
%APPDATA%\Microsoft\Windows\Themes\xgjylliajlkk.txt
%APPDATA%\Microsoft\Windows\xgjylliajlkk.txt
%APPDATA%\Microsoft\SystemCertificates\My\CTLs\xgjylliajlkk.txt
%APPDATA%\Microsoft\SystemCertificates\My\CRLs\xgjylliajlkk.txt
%APPDATA%\Microsoft\SystemCertificates\My\Certificates\xgjylliajlkk.txt
%APPDATA%\Microsoft\SystemCertificates\My\xgjylliajlkk.txt
%APPDATA%\Mozilla\Firefox\xgjylliajlkk.txt
%HOMEPATH%\Start Menu\xgjylliajlkk.txt
<LS_APPDATA>\xgjylliajlkk.txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\xgjylliajlkk.txt
<LS_APPDATA>\Identities\xgjylliajlkk.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\0\xgjylliajlkk.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\xgjylliajlkk.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\xgjylliajlkk.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\xgjylliajlkk.txt
<LS_APPDATA>\Mozilla\Firefox\xgjylliajlkk.txt
<LS_APPDATA>\Mozilla\xgjylliajlkk.txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\xgjylliajlkk.txt
<LS_APPDATA>\Microsoft\Windows Media\9.0\xgjylliajlkk.txt
%HOMEPATH%\Favorites\Links\xgjylliajlkk.txt
<LS_APPDATA>\Microsoft\Media Player\xgjylliajlkk.txt
<LS_APPDATA>\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\xgjylliajlkk.txt
<LS_APPDATA>\Microsoft\Credentials\xgjylliajlkk.txt
<LS_APPDATA>\Microsoft\CD Burning\xgjylliajlkk.txt
<LS_APPDATA>\Microsoft\xgjylliajlkk.txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\xgjylliajlkk.txt
<LS_APPDATA>\Microsoft\Windows Media\xgjylliajlkk.txt
C:\Far2\Plugins\ExtSearch\xgjylliajlkk.txt
%CommonProgramFiles%\Microsoft Shared\xgjylliajlkk.txt
C:\Far2\Addons\Macros\xgjylliajlkk.txt
C:\Far2\Plugins\WinSCP\packages\filemng\xgjylliajlkk.txt
C:\Far2\Plugins\WinSCP\packages\dragndrop\xgjylliajlkk.txt
C:\Far2\Plugins\WinSCP\packages\xgjylliajlkk.txt
C:\Far2\Plugins\WinSCP\lib\xgjylliajlkk.txt
C:\Far2\Plugins\WinSCP\forms\xgjylliajlkk.txt
C:\Far2\Plugins\WinSCP\filezilla\misc\xgjylliajlkk.txt
C:\Far2\Plugins\WinSCP\filezilla\xgjylliajlkk.txt
C:\Far2\Plugins\WinSCP\far\xgjylliajlkk.txt
C:\Far2\Plugins\WinSCP\packages\tb2k\xgjylliajlkk.txt
C:\Far2\Plugins\WinSCP\dragext\xgjylliajlkk.txt
C:\Far2\Plugins\WinSCP\core\xgjylliajlkk.txt
C:\Far2\Plugins\WinSCP\console\xgjylliajlkk.txt
C:\Far2\Plugins\WinSCP\components\xgjylliajlkk.txt
C:\Far2\Plugins\WinSCP\xgjylliajlkk.txt
C:\Far2\Plugins\TmpPanel\xgjylliajlkk.txt
C:\Far2\Plugins\WinSCP\fari\xgjylliajlkk.txt
C:\Far2\Addons\Colors\Custom Highlighting\xgjylliajlkk.txt
C:\Far2\Plugins\WinSCP\packages\tbx\xgjylliajlkk.txt
%CommonProgramFiles%\xgjylliajlkk.txt
%ProgramFiles%\xgjylliajlkk.txt
C:\Muldrop\WMSDKNS.DTD_3
C:\Muldrop\WMSDKNS.DTD_2
C:\Muldrop\WMSDKNS.DTD_1
C:\Muldrop\WMSDKNS.DTD_0
C:\Muldrop\xgjylliajlkk.txt
C:\Far2\Plugins\ProcList\xgjylliajlkk.txt
C:\Far2\Plugins\WinSCP\packages\my\xgjylliajlkk.txt
C:\Far2\PluginSDK\xgjylliajlkk.txt
C:\Far2\Plugins\WinSCP\windows\xgjylliajlkk.txt
C:\Far2\Plugins\WinSCP\resource\xgjylliajlkk.txt
C:\Far2\Plugins\WinSCP\release\xgjylliajlkk.txt
C:\Far2\Plugins\WinSCP\putty\windows\xgjylliajlkk.txt
C:\Far2\Plugins\WinSCP\putty\charset\xgjylliajlkk.txt
C:\Far2\Plugins\WinSCP\putty\xgjylliajlkk.txt
C:\Far2\PluginSDK\Headers.c\xgjylliajlkk.txt
C:\Far2\Plugins\WinSCP\packages\theme\xgjylliajlkk.txt
C:\Far2\Plugins\Network\xgjylliajlkk.txt
C:\Far2\Plugins\MacroView\xgjylliajlkk.txt
C:\Far2\Plugins\HlfViewer\xgjylliajlkk.txt
C:\Far2\Encyclopedia\xgjylliajlkk.txt
C:\Far2\Plugins\Brackets\xgjylliajlkk.txt
C:\Far2\Plugins\AutoWrap\xgjylliajlkk.txt
C:\Far2\Plugins\arclite\xgjylliajlkk.txt
C:\Far2\Plugins\Align\xgjylliajlkk.txt
C:\Far2\Plugins\7-Zip\xgjylliajlkk.txt
C:\Far2\Plugins\xgjylliajlkk.txt
C:\Far2\Addons\Colors\Default Highlighting\xgjylliajlkk.txt
C:\Far2\Plugins\Colorer\bin\xgjylliajlkk.txt
C:\Far2\Documentation\rus\xgjylliajlkk.txt
C:\Far2\Documentation\eng\xgjylliajlkk.txt
C:\Far2\Documentation\xgjylliajlkk.txt
C:\Far2\Addons\XLat\Russian\xgjylliajlkk.txt
C:\Far2\Addons\XLat\xgjylliajlkk.txt
C:\Far2\Addons\Shell\xgjylliajlkk.txt
C:\Far2\Addons\SetUp\xgjylliajlkk.txt
C:\Far2\FExcept\xgjylliajlkk.txt
%APPDATA%\Microsoft\SystemCertificates\xgjylliajlkk.txt
C:\Far2\Plugins\Colorer\hrc\xgjylliajlkk.txt
C:\Far2\Plugins\Colorer\hrd\xgjylliajlkk.txt
C:\Far2\Plugins\Colorer\hrc\auto\xgjylliajlkk.txt
C:\Far2\Plugins\FTP\lib\xgjylliajlkk.txt
C:\Far2\Plugins\FTP\xgjylliajlkk.txt
C:\Far2\Plugins\FileCase\xgjylliajlkk.txt
C:\Far2\Plugins\FarCmds\xgjylliajlkk.txt
C:\Far2\Plugins\ExtSearch\sources\RegExp\xgjylliajlkk.txt
C:\Far2\Plugins\ExtSearch\sources\xgjylliajlkk.txt
C:\Far2\Plugins\Colorer\hrc\auto\types\xgjylliajlkk.txt
C:\Far2\Plugins\ExtSearch\keys\xgjylliajlkk.txt
C:\Far2\Plugins\Colorer\xgjylliajlkk.txt
C:\Far2\Plugins\EMenu\xgjylliajlkk.txt
C:\Far2\Plugins\EditCase\xgjylliajlkk.txt
C:\Far2\Plugins\DrawLine\xgjylliajlkk.txt
C:\Far2\Plugins\Compare\xgjylliajlkk.txt
C:\Far2\Plugins\Colorer\hrd\console\contrib\xgjylliajlkk.txt
C:\Far2\Plugins\Colorer\hrd\console\xgjylliajlkk.txt
C:\Far2\Plugins\ExtSearch\doc\xgjylliajlkk.txt
C:\Far2\PluginSDK\Headers.pas\xgjylliajlkk.txt
%APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\xgjylliajlkk.txt
%APPDATA%\Microsoft\Credentials\xgjylliajlkk.txt
C:\Documents and Settings\Default User\Cookies\xgjylliajlkk.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\xgjylliajlkk.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\xgjylliajlkk.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\xgjylliajlkk.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\xgjylliajlkk.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\xgjylliajlkk.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\xgjylliajlkk.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\xgjylliajlkk.txt
C:\Documents and Settings\Default User\Favorites\xgjylliajlkk.txt
C:\Documents and Settings\Default User\Application Data\xgjylliajlkk.txt
C:\Documents and Settings\Default User\xgjylliajlkk.txt
%ALLUSERSPROFILE%\Templates\xgjylliajlkk.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Games\xgjylliajlkk.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\xgjylliajlkk.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\xgjylliajlkk.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\xgjylliajlkk.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\xgjylliajlkk.txt
C:\Documents and Settings\Default User\Local Settings\xgjylliajlkk.txt
C:\Documents and Settings\Default User\PrintHood\xgjylliajlkk.txt
C:\Documents and Settings\Default User\NetHood\xgjylliajlkk.txt
C:\Documents and Settings\Default User\My Documents\xgjylliajlkk.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\xgjylliajlkk.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\xgjylliajlkk.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\xgjylliajlkk.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\xgjylliajlkk.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\xgjylliajlkk.txt
C:\Documents and Settings\Default User\Desktop\xgjylliajlkk.txt
C:\Documents and Settings\Default User\Local Settings\Temp\xgjylliajlkk.txt
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\xgjylliajlkk.txt
C:\Documents and Settings\Default User\Local Settings\History\xgjylliajlkk.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\xgjylliajlkk.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\xgjylliajlkk.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\xgjylliajlkk.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\xgjylliajlkk.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\xgjylliajlkk.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\xgjylliajlkk.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\xgjylliajlkk.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\xgjylliajlkk.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\xgjylliajlkk.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\xgjylliajlkk.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Index\xgjylliajlkk.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\HTML Help\xgjylliajlkk.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Dr Watson\xgjylliajlkk.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\xgjylliajlkk.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\xgjylliajlkk.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\xgjylliajlkk.txt
C:\Documents and Settings\Default User\Recent\xgjylliajlkk.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\xgjylliajlkk.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\xgjylliajlkk.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\xgjylliajlkk.txt
%ALLUSERSPROFILE%\Application Data\xgjylliajlkk.txt
%ALLUSERSPROFILE%\xgjylliajlkk.txt
C:\Documents and Settings\xgjylliajlkk.txt
C:\xgjylliajlkk.txt
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\2954d058dced963c3b978d6c327b6880_23ef5514-3059-436f-a4a7-4cefaab20eb1
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\MachineKeys\xgjylliajlkk.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\xgjylliajlkk.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\xgjylliajlkk.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\xgjylliajlkk.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Cm\xgjylliajlkk.txt
%ALLUSERSPROFILE%\Start Menu\Programs\xgjylliajlkk.txt
%ALLUSERSPROFILE%\Start Menu\xgjylliajlkk.txt
%ALLUSERSPROFILE%\Favorites\xgjylliajlkk.txt
%ALLUSERSPROFILE%\DRM\xgjylliajlkk.txt
%ALLUSERSPROFILE%\Documents\My Videos\xgjylliajlkk.txt
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\xgjylliajlkk.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Pbk\xgjylliajlkk.txt
%ALLUSERSPROFILE%\Documents\My Pictures\xgjylliajlkk.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Player\xgjylliajlkk.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\xgjylliajlkk.txt
%ALLUSERSPROFILE%\Documents\My Music\My Playlists\xgjylliajlkk.txt
%ALLUSERSPROFILE%\Documents\My Music\xgjylliajlkk.txt
%ALLUSERSPROFILE%\Documents\xgjylliajlkk.txt
%ALLUSERSPROFILE%\Desktop\xgjylliajlkk.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\xgjylliajlkk.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\xgjylliajlkk.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\xgjylliajlkk.txt
%APPDATA%\Microsoft\MMC\xgjylliajlkk.txt
C:\Documents and Settings\Default User\Start Menu\Programs\xgjylliajlkk.txt
C:\Documents and Settings\NetworkService\Local Settings\Temp\xgjylliajlkk.txt
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\xgjylliajlkk.txt
C:\Documents and Settings\NetworkService\Local Settings\History\xgjylliajlkk.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\xgjylliajlkk.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\xgjylliajlkk.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\xgjylliajlkk.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\xgjylliajlkk.txt
C:\Documents and Settings\NetworkService\Local Settings\xgjylliajlkk.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\xgjylliajlkk.txt
C:\Documents and Settings\NetworkService\Cookies\xgjylliajlkk.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\xgjylliajlkk.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\xgjylliajlkk.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\xgjylliajlkk.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\xgjylliajlkk.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\xgjylliajlkk.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\xgjylliajlkk.txt
C:\Documents and Settings\Default User\SendTo\xgjylliajlkk.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\xgjylliajlkk.txt
%APPDATA%\Microsoft\Media Player\xgjylliajlkk.txt
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\xgjylliajlkk.txt
%APPDATA%\Microsoft\Internet Explorer\xgjylliajlkk.txt
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\xgjylliajlkk.txt
%APPDATA%\Microsoft\Crypto\RSA\xgjylliajlkk.txt
%APPDATA%\Microsoft\Crypto\xgjylliajlkk.txt
%APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\xgjylliajlkk.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\xgjylliajlkk.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\xgjylliajlkk.txt
%APPDATA%\Microsoft\xgjylliajlkk.txt
%APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\xgjylliajlkk.txt
%APPDATA%\Identities\xgjylliajlkk.txt
%APPDATA%\xgjylliajlkk.txt
%HOMEPATH%\xgjylliajlkk.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\xgjylliajlkk.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\xgjylliajlkk.txt
%APPDATA%\Microsoft\Address Book\xgjylliajlkk.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\xgjylliajlkk.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\xgjylliajlkk.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\xgjylliajlkk.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\xgjylliajlkk.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\xgjylliajlkk.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\xgjylliajlkk.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\xgjylliajlkk.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\xgjylliajlkk.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\xgjylliajlkk.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\xgjylliajlkk.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\xgjylliajlkk.txt
C:\Documents and Settings\Default User\Start Menu\xgjylliajlkk.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\xgjylliajlkk.txt
C:\Documents and Settings\LocalService\Application Data\xgjylliajlkk.txt
C:\Documents and Settings\LocalService\xgjylliajlkk.txt
C:\Documents and Settings\Default User\Templates\xgjylliajlkk.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\xgjylliajlkk.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\xgjylliajlkk.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\xgjylliajlkk.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\xgjylliajlkk.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\xgjylliajlkk.txt
%APPDATA%\Microsoft\Protect\xgjylliajlkk.txt
C:\Documents and Settings\LocalService\Cookies\xgjylliajlkk.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\xgjylliajlkk.txt
C:\Documents and Settings\LocalService\Local Settings\xgjylliajlkk.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\xgjylliajlkk.txt
C:\Documents and Settings\NetworkService\Application Data\xgjylliajlkk.txt
C:\Documents and Settings\NetworkService\xgjylliajlkk.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\MOE00UY1\xgjylliajlkk.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\LBMMC3H3\xgjylliajlkk.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\CJCTQ25G\xgjylliajlkk.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\xgjylliajlkk.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\BGGTYMH1\xgjylliajlkk.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\xgjylliajlkk.txt
C:\Documents and Settings\LocalService\Local Settings\Temp\xgjylliajlkk.txt
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\xgjylliajlkk.txt
C:\Documents and Settings\LocalService\Local Settings\History\xgjylliajlkk.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\xgjylliajlkk.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\xgjylliajlkk.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\xgjylliajlkk.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\xgjylliajlkk.txt
%CommonProgramFiles%\Microsoft Shared\DAO\xgjylliajlkk.txt

Deletes the following files:

%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\2954d058dced963c3b978d6c327b6880_23ef5514-3059-436f-a4a7-4cefaab20eb1

Moves the following files:

from %APPDATA%\Microsoft\Internet Explorer\brndlog.bak to %APPDATA%\Microsoft\Internet Explorer\brndlog.bak.g20rl32@LOCKED
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db.g20rl32@LOCKED
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db.g20rl32@LOCKED
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db.g20rl32@LOCKED
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak.g20rl32@LOCKED
from C:\Muldrop\WMSDKNS.DTD_0 to C:\Muldrop\WMSDKNS.DTD_0.g20rl32@LOCKED
from C:\Muldrop\WMSDKNS.DTD_1 to C:\Muldrop\WMSDKNS.DTD_1.g20rl32@LOCKED
from C:\Muldrop\WMSDKNS.DTD_2 to C:\Muldrop\WMSDKNS.DTD_2.g20rl32@LOCKED
from C:\Muldrop\WMSDKNS.DTD_3 to C:\Muldrop\WMSDKNS.DTD_3.g20rl32@LOCKED

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Miscellaneous:

Executes the following:

'<SYSTEM32>\cmd.exe' /C net view
'<SYSTEM32>\net.exe' view

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial