Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\RyukReadMe.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\desktop.ini
- %HOMEPATH%\Start Menu\Programs\Startup\RyukReadMe.txt
- %HOMEPATH%\Start Menu\Programs\Startup\Shortcut to startup_local.lnk
- %HOMEPATH%\Start Menu\Programs\Startup\desktop.ini
Infects the following executable files:
- C:\Far2\Plugins\arclite\7zSD.sfx
- C:\Far2\Plugins\arclite\7z.sfx
- C:\Far2\Plugins\arclite\7zS2.sfx
- C:\Far2\Plugins\arclite\7zS2con.sfx
- C:\Far2\Plugins\arclite\7zCon.sfx
- C:\Far2\Plugins\FTP\lib\ftpDirList.fll
- C:\Far2\Plugins\FTP\lib\ftpProgress.fll
- %CommonProgramFiles%\Microsoft Shared\Speech\sapi.cpl
- %CommonProgramFiles%\Microsoft Shared\MSInfo\IEINFO5.OCX
- %CommonProgramFiles%\Microsoft Shared\TextConv\mswrd632.wpc
- %CommonProgramFiles%\Microsoft Shared\TextConv\mswrd832.cnv
- %CommonProgramFiles%\Microsoft Shared\TextConv\html32.cnv
- %CommonProgramFiles%\Microsoft Shared\TextConv\write32.wpc
- %CommonProgramFiles%\Microsoft Shared\Triedit\DHTMLED.OCX
Malicious functions:
Injects code into
the following system processes:
- <SYSTEM32>\ctfmon.exe
a large number of user processes.
Modifies file system:
Creates the following files:
- C:\Documents and Settings\Default User\dwkBD.exe
- C:\Far2\Plugins\WinSCP\filezilla\RyukReadMe.txt
- C:\Far2\Plugins\WinSCP\fari\RyukReadMe.txt
- C:\Far2\Plugins\WinSCP\far\RyukReadMe.txt
- C:\Far2\Plugins\WinSCP\dragext\RyukReadMe.txt
- C:\Far2\Plugins\WinSCP\core\RyukReadMe.txt
- C:\Far2\Plugins\WinSCP\console\RyukReadMe.txt
- C:\Far2\Plugins\WinSCP\components\RyukReadMe.txt
- C:\Far2\Plugins\WinSCP\RyukReadMe.txt
- C:\Far2\Plugins\TmpPanel\RyukReadMe.txt
- C:\Muldrop\exlBD.fyf_0
- C:\Far2\Plugins\ProcList\RyukReadMe.txt
- C:\Far2\Plugins\MacroView\RyukReadMe.txt
- C:\Far2\Plugins\HlfViewer\RyukReadMe.txt
- C:\Far2\Plugins\FTP\lib\RyukReadMe.txt
- C:\Far2\Plugins\FTP\RyukReadMe.txt
- C:\Far2\Plugins\FileCase\RyukReadMe.txt
- C:\Far2\Plugins\FarCmds\RyukReadMe.txt
- C:\Far2\Plugins\ExtSearch\sources\RegExp\RyukReadMe.txt
- C:\Far2\Plugins\ExtSearch\sources\RyukReadMe.txt
- C:\Far2\Plugins\ExtSearch\keys\RyukReadMe.txt
- C:\Far2\Plugins\Network\RyukReadMe.txt
- C:\Far2\Plugins\ExtSearch\doc\RyukReadMe.txt
- C:\Far2\Plugins\ExtSearch\RyukReadMe.txt
- C:\Far2\Plugins\WinSCP\packages\RyukReadMe.txt
- C:\Far2\Plugins\WinSCP\forms\RyukReadMe.txt
- %ProgramFiles%\RyukReadMe.txt
- C:\Muldrop\dmp_0x184_0x20000
- C:\Muldrop\RyukReadMe.txt
- C:\Muldrop\dmp_0x184_0x10000
- C:\Far2\PluginSDK\Headers.pas\RyukReadMe.txt
- C:\Far2\PluginSDK\Headers.c\RyukReadMe.txt
- C:\Far2\PluginSDK\RyukReadMe.txt
- C:\Far2\Plugins\WinSCP\windows\RyukReadMe.txt
- C:\Far2\Plugins\WinSCP\lib\RyukReadMe.txt
- C:\Far2\Plugins\WinSCP\resource\RyukReadMe.txt
- C:\Far2\Plugins\WinSCP\filezilla\misc\RyukReadMe.txt
- C:\Far2\Plugins\WinSCP\putty\charset\RyukReadMe.txt
- C:\Far2\Plugins\WinSCP\putty\RyukReadMe.txt
- C:\Far2\Plugins\WinSCP\packages\theme\RyukReadMe.txt
- C:\Far2\Plugins\WinSCP\packages\tbx\RyukReadMe.txt
- C:\Far2\Plugins\WinSCP\packages\tb2k\RyukReadMe.txt
- C:\Far2\Plugins\WinSCP\packages\my\RyukReadMe.txt
- C:\Far2\Plugins\WinSCP\packages\filemng\RyukReadMe.txt
- C:\Far2\Plugins\WinSCP\packages\dragndrop\RyukReadMe.txt
- C:\Far2\Plugins\WinSCP\release\RyukReadMe.txt
- %HOMEPATH%\My Documents\RyukReadMe.txt
- C:\Far2\Plugins\WinSCP\putty\windows\RyukReadMe.txt
- C:\Far2\Plugins\AutoWrap\RyukReadMe.txt
- C:\Far2\Addons\SetUp\RyukReadMe.txt
- C:\Far2\Addons\Macros\RyukReadMe.txt
- C:\Far2\Addons\Colors\Default Highlighting\RyukReadMe.txt
- C:\Far2\Addons\Colors\Custom Highlighting\RyukReadMe.txt
- C:\Far2\Addons\Colors\RyukReadMe.txt
- C:\Far2\Addons\RyukReadMe.txt
- C:\Far2\RyukReadMe.txt
- %HOMEPATH%\Templates\RyukReadMe.txt
- %HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\RyukReadMe.txt
- C:\Far2\Plugins\DrawLine\RyukReadMe.txt
- %HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\RyukReadMe.txt
- %HOMEPATH%\Start Menu\Programs\RyukReadMe.txt
- %HOMEPATH%\Start Menu\RyukReadMe.txt
- %HOMEPATH%\SendTo\RyukReadMe.txt
- %HOMEPATH%\Recent\RyukReadMe.txt
- %HOMEPATH%\PrintHood\RyukReadMe.txt
- %HOMEPATH%\NetHood\RyukReadMe.txt
- %HOMEPATH%\My Documents\My Received Files\RyukReadMe.txt
- %HOMEPATH%\My Documents\My Pictures\RyukReadMe.txt
- %HOMEPATH%\My Documents\My Music\RyukReadMe.txt
- %HOMEPATH%\Start Menu\Programs\Accessories\RyukReadMe.txt
- C:\Far2\Plugins\EMenu\RyukReadMe.txt
- C:\Far2\Plugins\EditCase\RyukReadMe.txt
- C:\Far2\Documentation\RyukReadMe.txt
- C:\Far2\Addons\XLat\RyukReadMe.txt
- C:\Far2\Plugins\Compare\RyukReadMe.txt
- C:\Far2\Plugins\Colorer\hrd\console\contrib\RyukReadMe.txt
- C:\Far2\Plugins\Colorer\hrd\console\RyukReadMe.txt
- C:\Far2\Plugins\Colorer\hrd\RyukReadMe.txt
- C:\Far2\Plugins\Colorer\hrc\auto\types\RyukReadMe.txt
- C:\Far2\Plugins\Colorer\hrc\auto\RyukReadMe.txt
- C:\Far2\Plugins\Colorer\hrc\RyukReadMe.txt
- C:\Far2\Plugins\Colorer\bin\RyukReadMe.txt
- C:\Far2\Addons\XLat\Russian\RyukReadMe.txt
- C:\Far2\Plugins\Colorer\RyukReadMe.txt
- C:\Far2\Addons\Shell\RyukReadMe.txt
- C:\Far2\Plugins\arclite\RyukReadMe.txt
- C:\Far2\Plugins\Align\RyukReadMe.txt
- C:\Far2\Plugins\7-Zip\RyukReadMe.txt
- C:\Far2\Plugins\RyukReadMe.txt
- C:\Far2\FExcept\RyukReadMe.txt
- C:\Far2\Encyclopedia\RyukReadMe.txt
- C:\Far2\Documentation\rus\RyukReadMe.txt
- C:\Far2\Documentation\eng\RyukReadMe.txt
- C:\Far2\Plugins\Brackets\RyukReadMe.txt
- %HOMEPATH%\My Documents\Downloads\RyukReadMe.txt
- C:\Muldrop\dmp_0x2c8_0x30000000
- C:\Muldrop\dmp_0x3d0_0x30000000
- C:\Muldrop\dmp_0x4a8_0x30000000
- C:\Muldrop\dmp_0x470_0x30000000
- C:\Muldrop\dmp_0x480_0x30000000
- C:\Muldrop\dmp_0x4e8_0x30000000
- C:\Muldrop\dmp_0x390_0x30000000
- C:\Muldrop\dmp_0x410_0x30000000
- C:\Muldrop\dmp_0x3a8_0x30000000
- C:\Muldrop\dmp_0x3b8_0x30000000
- C:\Muldrop\dmp_0x448_0x30000000
- C:\Muldrop\dmp_0x3d8_0x30000000
- C:\Muldrop\dmp_0x3c8_0x30000000
- C:\Muldrop\dmp_0x318_0x30000000
- C:\Muldrop\dmp_0x428_0x30000000
- C:\Muldrop\dmp_0x478_0x30000000
- C:\Muldrop\dmp_0x360_0x30000000
- C:\Muldrop\dmp_0x430_0x30000000
- %CommonProgramFiles%\Microsoft Shared\Speech\1033\RyukReadMe.txt
- C:\Muldrop\dmp_0x7c_0x30000000
- C:\Muldrop\dmp_0x488_0x30000000
- %CommonProgramFiles%\Microsoft Shared\Speech\RyukReadMe.txt
- C:\Muldrop\dmp_0x2b8_0x30000000
- C:\Muldrop\dmp_0x4d8_0x30000000
- C:\Muldrop\dmp_0x4b0_0x30000000
- C:\Muldrop\dmp_0x460_0x30000000
- %CommonProgramFiles%\Microsoft Shared\VGX\RyukReadMe.txt
- %CommonProgramFiles%\Microsoft Shared\VC\RyukReadMe.txt
- %CommonProgramFiles%\Microsoft Shared\Triedit\RyukReadMe.txt
- %CommonProgramFiles%\Microsoft Shared\TextConv\RyukReadMe.txt
- %CommonProgramFiles%\Microsoft Shared\Stationery\RyukReadMe.txt
- C:\Muldrop\dmp_0x3e8_0x30000000
- C:\Muldrop\dmp_0x468_0x30000000
- C:\Muldrop\dmp_0x348_0x30000000
- C:\Muldrop\dmp_0x4e0_0x30000000
- C:\Muldrop\dmp_0x418_0x30000000
- C:\Muldrop\dmp_0x398_0x30000000
- C:\Muldrop\dmp_0x3a0_0x30000000
- C:\Muldrop\dmp_0x4c8_0x30000000
- C:\Muldrop\dmp_0x2c4_0x30000000
- C:\Muldrop\dmp_0x440_0x30000000
- C:\Muldrop\dmp_0x388_0x30000000
- C:\Muldrop\dmp_0x328_0x30000000
- C:\Muldrop\dmp_0x4d0_0x30000000
- C:\Muldrop\dmp_0x2f8_0x30000000
- C:\Muldrop\dmp_0x4c0_0x30000000
- C:\Muldrop\dmp_0x370_0x30000000
- %CommonProgramFiles%\RyukReadMe.txt
- C:\Muldrop\dmp_0x380_0x30000000
- C:\Muldrop\dmp_0x438_0x30000000
- C:\Muldrop\dmp_0x408_0x30000000
- C:\Muldrop\dmp_0x4a0_0x30000000
- %CommonProgramFiles%\Microsoft Shared\DW\1028\RyukReadMe.txt
- %CommonProgramFiles%\Microsoft Shared\DW\1025\RyukReadMe.txt
- C:\Muldrop\dmp_0x3f0_0x30000000
- C:\Muldrop\dmp_0x340_0x30000000
- C:\Muldrop\dmp_0x2d8_0x30000000
- C:\Muldrop\dmp_0x2e0_0x30000000
- C:\Muldrop\dmp_0x400_0x30000000
- C:\Muldrop\dmp_0x368_0x30000000
- C:\Muldrop\dmp_0x310_0x30000000
- %CommonProgramFiles%\Microsoft Shared\MSInfo\RyukReadMe.txt
- C:\Muldrop\dmp_0x2f0_0x30000000
- C:\Muldrop\dmp_0x308_0x30000000
- %CommonProgramFiles%\Microsoft Shared\DW\RyukReadMe.txt
- %CommonProgramFiles%\Microsoft Shared\DAO\RyukReadMe.txt
- C:\Muldrop\dmp_0x320_0x30000000
- C:\Muldrop\dmp_0x358_0x30000000
- %CommonProgramFiles%\Microsoft Shared\RyukReadMe.txt
- C:\Muldrop\dmp_0x330_0x30000000
- C:\Muldrop\dmp_0x350_0x30000000
- C:\Muldrop\dmp_0x420_0x30000000
- C:\Muldrop\dmp_0x3c0_0x30000000
- C:\Muldrop\dmp_0x300_0x30000000
- %CommonProgramFiles%\Microsoft Shared\DW\1041\RyukReadMe.txt
- C:\Muldrop\dmp_0x2d0_0x30000000
- C:\Muldrop\dmp_0x338_0x30000000
- %CommonProgramFiles%\Microsoft Shared\DW\3082\RyukReadMe.txt
- %CommonProgramFiles%\Microsoft Shared\DW\2052\RyukReadMe.txt
- C:\Muldrop\dmp_0x498_0x30000000
- %CommonProgramFiles%\Microsoft Shared\DW\1042\RyukReadMe.txt
- C:\Muldrop\dmp_0x3b0_0x30000000
- C:\Muldrop\dmp_0x3e0_0x30000000
- C:\Muldrop\dmp_0x4f0_0x30000000
- C:\Muldrop\dmp_0x378_0x30000000
- %CommonProgramFiles%\Microsoft Shared\DW\1031\RyukReadMe.txt
- %CommonProgramFiles%\Microsoft Shared\DW\1040\RyukReadMe.txt
- C:\Muldrop\dmp_0x4b8_0x30000000
- C:\Muldrop\dmp_0x458_0x30000000
- %CommonProgramFiles%\Microsoft Shared\DW\1036\RyukReadMe.txt
- %CommonProgramFiles%\Microsoft Shared\DW\1033\RyukReadMe.txt
- C:\Muldrop\dmp_0x2e8_0x30000000
- C:\Muldrop\dmp_0x490_0x30000000
- C:\Muldrop\dmp_0x450_0x30000000
- C:\Muldrop\dmp_0x3f8_0x30000000
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\RyukReadMe.txt
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\RyukReadMe.txt
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\RyukReadMe.txt
- C:\Documents and Settings\Default User\Local Settings\Temp\RyukReadMe.txt
- C:\Documents and Settings\Default User\Local Settings\History\History.IE5\RyukReadMe.txt
- C:\Documents and Settings\Default User\Local Settings\History\RyukReadMe.txt
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\RyukReadMe.txt
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\RyukReadMe.txt
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\RyukReadMe.txt
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\RyukReadMe.txt
- C:\Documents and Settings\Default User\Local Settings\Application Data\RyukReadMe.txt
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\RyukReadMe.txt
- C:\Documents and Settings\Default User\Local Settings\RyukReadMe.txt
- C:\Documents and Settings\Default User\Desktop\RyukReadMe.txt
- C:\Documents and Settings\Default User\Cookies\RyukReadMe.txt
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\RyukReadMe.txt
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\RyukReadMe.txt
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\RyukReadMe.txt
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\RyukReadMe.txt
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\RyukReadMe.txt
- C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\RyukReadMe.txt
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\RyukReadMe.txt
- C:\Documents and Settings\Default User\Favorites\RyukReadMe.txt
- C:\Documents and Settings\Default User\Application Data\Microsoft\RyukReadMe.txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\RyukReadMe.txt
- C:\Documents and Settings\Default User\Application Data\RyukReadMe.txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\RyukReadMe.txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\RyukReadMe.txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\RyukReadMe.txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\RyukReadMe.txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\RyukReadMe.txt
- C:\Documents and Settings\LocalService\Application Data\RyukReadMe.txt
- C:\Documents and Settings\LocalService\RyukReadMe.txt
- C:\Documents and Settings\Default User\Templates\RyukReadMe.txt
- C:\Documents and Settings\Default User\Start Menu\Programs\Startup\RyukReadMe.txt
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\RyukReadMe.txt
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\RyukReadMe.txt
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\RyukReadMe.txt
- C:\Documents and Settings\Default User\Start Menu\Programs\RyukReadMe.txt
- C:\Documents and Settings\Default User\Start Menu\RyukReadMe.txt
- C:\Documents and Settings\Default User\SendTo\RyukReadMe.txt
- C:\Documents and Settings\Default User\Recent\RyukReadMe.txt
- C:\Documents and Settings\Default User\PrintHood\RyukReadMe.txt
- C:\Documents and Settings\Default User\NetHood\RyukReadMe.txt
- C:\Documents and Settings\Default User\My Documents\RyukReadMe.txt
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\RyukReadMe.txt
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\RyukReadMe.txt
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\RyukReadMe.txt
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\RyukReadMe.txt
- %ALLUSERSPROFILE%\Templates\RyukReadMe.txt
- %ALLUSERSPROFILE%\Favorites\RyukReadMe.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\RyukReadMe.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\Network\RyukReadMe.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\Media Player\RyukReadMe.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\Media Index\RyukReadMe.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\HTML Help\RyukReadMe.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\Dr Watson\RyukReadMe.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\RyukReadMe.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\RyukReadMe.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Pbk\RyukReadMe.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\RyukReadMe.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\RyukReadMe.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RyukReadMe.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\RyukReadMe.txt
- %ALLUSERSPROFILE%\Application Data\RyukReadMe.txt
- %ALLUSERSPROFILE%\RyukReadMe.txt
- C:\Documents and Settings\RyukReadMe.txt
- <Current directory>\RyukReadMe.txt
- C:\RyukReadMe.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\MachineKeys\RyukReadMe.txt
- C:\Documents and Settings\Default User\RyukReadMe.txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\RyukReadMe.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Cm\RyukReadMe.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\Games\RyukReadMe.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\RyukReadMe.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\RyukReadMe.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\RyukReadMe.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\RyukReadMe.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\RyukReadMe.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\RyukReadMe.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\RyukReadMe.txt
- %ALLUSERSPROFILE%\Start Menu\RyukReadMe.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\RyukReadMe.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\RyukReadMe.txt
- %ALLUSERSPROFILE%\Documents\My Videos\RyukReadMe.txt
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\RyukReadMe.txt
- %ALLUSERSPROFILE%\Documents\My Pictures\RyukReadMe.txt
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\RyukReadMe.txt
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\RyukReadMe.txt
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\RyukReadMe.txt
- %ALLUSERSPROFILE%\Documents\My Music\My Playlists\RyukReadMe.txt
- %ALLUSERSPROFILE%\Documents\My Music\RyukReadMe.txt
- %ALLUSERSPROFILE%\Documents\RyukReadMe.txt
- %ALLUSERSPROFILE%\DRM\RyukReadMe.txt
- %ALLUSERSPROFILE%\Desktop\RyukReadMe.txt
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\RyukReadMe.txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\RyukReadMe.txt
- %HOMEPATH%\Desktop\RyukReadMe.txt
- %APPDATA%\Microsoft\MMC\RyukReadMe.txt
- %HOMEPATH%\Cookies\RyukReadMe.txt
- %APPDATA%\Microsoft\Windows\Themes\RyukReadMe.txt
- %APPDATA%\Microsoft\Windows\RyukReadMe.txt
- %APPDATA%\Microsoft\SystemCertificates\My\CTLs\RyukReadMe.txt
- %APPDATA%\Microsoft\SystemCertificates\My\CRLs\RyukReadMe.txt
- %APPDATA%\Microsoft\SystemCertificates\My\Certificates\RyukReadMe.txt
- %APPDATA%\Microsoft\SystemCertificates\My\RyukReadMe.txt
- %APPDATA%\Microsoft\SystemCertificates\RyukReadMe.txt
- %APPDATA%\RyukReadMe.txt
- %HOMEPATH%\Favorites\RyukReadMe.txt
- %APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\RyukReadMe.txt
- %APPDATA%\Microsoft\Internet Explorer\RyukReadMe.txt
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\RyukReadMe.txt
- %APPDATA%\Microsoft\Crypto\RSA\RyukReadMe.txt
- %APPDATA%\Microsoft\Crypto\RyukReadMe.txt
- %APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\RyukReadMe.txt
- %APPDATA%\Microsoft\Credentials\RyukReadMe.txt
- %APPDATA%\Microsoft\Address Book\RyukReadMe.txt
- %APPDATA%\Microsoft\RyukReadMe.txt
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\RyukReadMe.txt
- %APPDATA%\Microsoft\Media Player\RyukReadMe.txt
- %HOMEPATH%\Favorites\Links\RyukReadMe.txt
- <LS_APPDATA>\Microsoft\Windows\RyukReadMe.txt
- <LS_APPDATA>\Microsoft\Windows Media\RyukReadMe.txt
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\RyukReadMe.txt
- %HOMEPATH%\Local Settings\<INETFILES>\RyukReadMe.txt
- %TEMP%\RyukReadMe.txt
- %HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\RyukReadMe.txt
- %HOMEPATH%\Local Settings\History\History.IE5\RyukReadMe.txt
- %HOMEPATH%\Local Settings\History\RyukReadMe.txt
- <LS_APPDATA>\VMware\RyukReadMe.txt
- <LS_APPDATA>\Microsoft\Windows Media\9.0\RyukReadMe.txt
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\RyukReadMe.txt
- %HOMEPATH%\Local Settings\RyukReadMe.txt
- <LS_APPDATA>\RyukReadMe.txt
- <LS_APPDATA>\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\RyukReadMe.txt
- <LS_APPDATA>\Microsoft\Credentials\RyukReadMe.txt
- <LS_APPDATA>\Microsoft\CD Burning\RyukReadMe.txt
- <LS_APPDATA>\Microsoft\RyukReadMe.txt
- <LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\RyukReadMe.txt
- <LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\RyukReadMe.txt
- <LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\RyukReadMe.txt
- <LS_APPDATA>\Identities\RyukReadMe.txt
- <LS_APPDATA>\Microsoft\Media Player\RyukReadMe.txt
- %APPDATA%\Identities\RyukReadMe.txt
- %HOMEPATH%\RyukReadMe.txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\RyukReadMe.txt
- C:\Documents and Settings\NetworkService\Application Data\RyukReadMe.txt
- C:\Documents and Settings\NetworkService\RyukReadMe.txt
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\MOE00UY1\RyukReadMe.txt
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\LBMMC3H3\RyukReadMe.txt
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\CJCTQ25G\RyukReadMe.txt
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\BGGTYMH1\RyukReadMe.txt
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\RyukReadMe.txt
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\RyukReadMe.txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\RyukReadMe.txt
- C:\Documents and Settings\LocalService\Local Settings\Temp\RyukReadMe.txt
- C:\Documents and Settings\LocalService\Local Settings\History\RyukReadMe.txt
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\RyukReadMe.txt
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\RyukReadMe.txt
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\RyukReadMe.txt
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\RyukReadMe.txt
- C:\Documents and Settings\LocalService\Local Settings\Application Data\RyukReadMe.txt
- C:\Documents and Settings\LocalService\Local Settings\RyukReadMe.txt
- C:\Documents and Settings\LocalService\Cookies\RyukReadMe.txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\RyukReadMe.txt
- C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\RyukReadMe.txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\RyukReadMe.txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\RyukReadMe.txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\RyukReadMe.txt
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\RyukReadMe.txt
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\RyukReadMe.txt
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\RyukReadMe.txt
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\RyukReadMe.txt
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\RyukReadMe.txt
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\RyukReadMe.txt
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\RyukReadMe.txt
- C:\Documents and Settings\NetworkService\Local Settings\Temp\RyukReadMe.txt
- C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\RyukReadMe.txt
- C:\Documents and Settings\NetworkService\Local Settings\History\RyukReadMe.txt
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\RyukReadMe.txt
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\RyukReadMe.txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\RyukReadMe.txt
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\RyukReadMe.txt
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\RyukReadMe.txt
- C:\Documents and Settings\NetworkService\Local Settings\RyukReadMe.txt
- C:\Documents and Settings\NetworkService\Cookies\RyukReadMe.txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\RyukReadMe.txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\RyukReadMe.txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\RyukReadMe.txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\RyukReadMe.txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\RyukReadMe.txt
- %CommonProgramFiles%\Microsoft Shared\Web Folders\RyukReadMe.txt
- %CommonProgramFiles%\Microsoft Shared\web server extensions\RyukReadMe.txt
Deletes the following files:
- <Full path to file>
Moves the following files:
- from %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_23ef5514-3059-436f-a4a7-4cefaab20eb1 to %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_23ef5514-3059-436f-a4a7-4cefaab20eb1.RYK
- from %APPDATA%\Microsoft\Address Book\%USERNAME%.wab~ to %APPDATA%\Microsoft\Address Book\%USERNAME%.wab~.RYK
- from %APPDATA%\desktop.ini to %APPDATA%\desktop.ini.RYK
- from %APPDATA%\Microsoft\Address Book\%USERNAME%.wab to %APPDATA%\Microsoft\Address Book\%USERNAME%.wab.RYK
- from %APPDATA%\Microsoft\Internet Explorer\brndlog.bak to %APPDATA%\Microsoft\Internet Explorer\brndlog.bak.RYK
- from %APPDATA%\Microsoft\Internet Explorer\Desktop.htt to %APPDATA%\Microsoft\Internet Explorer\Desktop.htt.RYK
- from %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf to %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf.RYK
- from %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk to %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk.RYK
- from %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk to %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk.RYK
- from %APPDATA%\Microsoft\Internet Explorer\brndlog.txt to %APPDATA%\Microsoft\Internet Explorer\brndlog.txt.RYK
- from %APPDATA%\Microsoft\Internet Explorer\Quick Launch\desktop.ini to %APPDATA%\Microsoft\Internet Explorer\Quick Launch\desktop.ini.RYK
- from %APPDATA%\Microsoft\Media Player\0007F0B7.wpl to %APPDATA%\Microsoft\Media Player\0007F0B7.wpl.RYK
- from %APPDATA%\winscp.rnd to %APPDATA%\winscp.rnd.RYK
- from C:\Muldrop\dmp_0x184_0x20000 to C:\Muldrop\dmp_0x184_0x20000.RYK
- from C:\Muldrop\exlBD.fyf_0 to C:\Muldrop\exlBD.fyf_0.RYK
- from C:\Muldrop\dmp_0x184_0x10000 to C:\Muldrop\dmp_0x184_0x10000.RYK
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Miscellaneous:
Creates and executes the following:
- 'C:\Documents and Settings\Default User\dwkBD.exe' <Full path to file>
