Trojan.Encoder.25080

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'DP_Main' = '%APPDATA%\DP\DP_Main.exe'

Creates or modifies the following files

%ALLUSERSPROFILE%\start menu\programs\startup\desktop.ini
%ALLUSERSPROFILE%\start menu\programs\startup\#decrypt my files#.html

Infects the following executable files

%APPDATA%\icqm\icqsetup.exe

Creates the following files on removable media

<Drive name for removable media>:\correct.avi
<Drive name for removable media>:\taxus_baccata.rdf
<Drive name for removable media>:\indogerman2010.pptx
<Drive name for removable media>:\stoc13_ml_quoc_le.pptx
<Drive name for removable media>:\iso27k_isms_implementation_and_certification_process_overview_v2.pptx
<Drive name for removable media>:\asaprojectcompetition.pptx
<Drive name for removable media>:\hypothyroidism_slides.pptx
<Drive name for removable media>:\accountsreceivable.ppt
<Drive name for removable media>:\sacs_presentation_sacs_qep_improving_rt_education_final.ppt
<Drive name for removable media>:\sim_gametheory_to_finance.ppt
<Drive name for removable media>:\metac.ppt
<Drive name for removable media>:\fil_20060629111052.pdf
<Drive name for removable media>:\writingcompletesarnarrative_1103.ppt
<Drive name for removable media>:\background.png
<Drive name for removable media>:\cbz.png
<Drive name for removable media>:\dissolveanother.png
<Drive name for removable media>:\systisoft.pem
<Drive name for removable media>:\tunpersonalca1.pem
<Drive name for removable media>:\investmentbankca_ca8.pem
<Drive name for removable media>:\lom602.pdf
<Drive name for removable media>:\10thingscondoms.pdf
<Drive name for removable media>:\2015-02-worms-nanoparticle-toxicity.pdf
<Drive name for removable media>:\7790_preview.pdf
<Drive name for removable media>:\cleanlyrics.png
<Drive name for removable media>:\bc01.pdf
<Drive name for removable media>:\contenttypes.rdf
<Drive name for removable media>:\guide_reorganization_mapping.xls
<Drive name for removable media>:\contractualdeadlines.zip
<Drive name for removable media>:\1sm_price.zip
<Drive name for removable media>:\fiche_inscription_2015.zip
<Drive name for removable media>:\price030215.zip
<Drive name for removable media>:\al.xlsx
<Drive name for removable media>:\applicant.xlsx
<Drive name for removable media>:\suspendedcompanies.xlsx
<Drive name for removable media>:\2013_smccc_competition_points_jul2013.xlsx
<Drive name for removable media>:\national_autism_preparation_programs.xlsx
<Drive name for removable media>:\cee_mmsprogram_summary_public.xlsx
<Drive name for removable media>:\sioc.rdf
<Drive name for removable media>:\20140114.rdf
<Drive name for removable media>:\subjectclassification.xls
<Drive name for removable media>:\price030215.xls
<Drive name for removable media>:\babyboymaintoscenesbackground.wmv
<Drive name for removable media>:\babyboymaintoscenesbackground_pal.wmv
<Drive name for removable media>:\myhrvoldhanssenbiharfamine.rtf
<Drive name for removable media>:\fungalnameauthors.rtf
<Drive name for removable media>:\pubnet_855.rtf
<Drive name for removable media>:\router_manual.rtf
<Drive name for removable media>:\pandp.rtf
<Drive name for removable media>:\foaf.rdf
<Drive name for removable media>:\calculatorworksheet.xls
<Drive name for removable media>:\video_1.mp4
<Drive name for removable media>:\video.mp4
<Drive name for removable media>:\clip_480_5sec_6mbps_h264.mp4
<Drive name for removable media>:\nwfieldnotes1966.docx
<Drive name for removable media>:\glidescope_review_rev_010.docx
<Drive name for removable media>:\ovp25012015.doc
<Drive name for removable media>:\508softwareandos.doc
<Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
<Drive name for removable media>:\applicantform_en.doc
<Drive name for removable media>:\february_catalogue__2015.doc
<Drive name for removable media>:\hanni_umami_chapter.doc
<Drive name for removable media>:\pmd.cer
<Drive name for removable media>:\thlps_keeper_mayer_1965.docx
<Drive name for removable media>:\sdksampleunprivdeveloper.cer
<Drive name for removable media>:\sdksampleprivdeveloper.cer
<Drive name for removable media>:\sdkfailsafeemulator.cer
<Drive name for removable media>:\dashborder_144.bmp
<Drive name for removable media>:\dashborder_96.bmp
<Drive name for removable media>:\coffee.bmp
<Drive name for removable media>:\dial.bmp
<Drive name for removable media>:\dialmap.bmp
<Drive name for removable media>:\archer.avi
<Drive name for removable media>:\delete.avi
<Drive name for removable media>:\split.avi
<Drive name for removable media>:\contosoroot.cer
<Drive name for removable media>:\utorrent.exe
<Drive name for removable media>:\adhd_and_obesity.docx
<Drive name for removable media>:\chromesetup.exe
<Drive name for removable media>:\dag2_panel1_320_ref.mov
<Drive name for removable media>:\ituneshelpunavailable.html
<Drive name for removable media>:\etc6_m_1.mov
<Drive name for removable media>:\scan.mov
<Drive name for removable media>:\1189.jpg
<Drive name for removable media>:\2.jpg
<Drive name for removable media>:\3.jpg
<Drive name for removable media>:\pushkin.jpg
<Drive name for removable media>:\2.jpeg
<Drive name for removable media>:\4f0bf7ff71f28.jpeg
<Drive name for removable media>:\pushkin.jpeg
<Drive name for removable media>:\13.jpeg
<Drive name for removable media>:\about.html
<Drive name for removable media>:\dotnetfx45_full_setup.exe
<Drive name for removable media>:\alert.html
<Drive name for removable media>:\tree_view.htm
<Drive name for removable media>:\garden.htm
<Drive name for removable media>:\iisstart.htm
<Drive name for removable media>:\alert.htm
<Drive name for removable media>:\browse.htm
<Drive name for removable media>:\about.htm
<Drive name for removable media>:\jre-7u75-windows-i586-iftw.exe
<Drive name for removable media>:\calc.exe
<Drive name for removable media>:\winmine.exe
<Drive name for removable media>:\subjectclassification.zip
<Drive name for removable media>:\#decrypt my files#.html

Modifies file system

Creates the following files

%APPDATA%\dp\runasadmin.dp
C:\documents and settings\networkservice\local settings\temp\#decrypt my files#.html
C:\documents and settings\networkservice\local settings\history\history.ie5\#decrypt my files#.html
C:\documents and settings\networkservice\local settings\history\#decrypt my files#.html
C:\documents and settings\networkservice\local settings\application data\microsoft\credentials\s-1-5-20\#decrypt my files#.html
C:\documents and settings\networkservice\local settings\application data\microsoft\credentials\#decrypt my files#.html
C:\documents and settings\networkservice\local settings\application data\microsoft\#decrypt my files#.html
C:\documents and settings\networkservice\local settings\<INETFILES>\#decrypt my files#.html
C:\documents and settings\networkservice\local settings\application data\#decrypt my files#.html
C:\documents and settings\networkservice\cookies\#decrypt my files#.html
C:\documents and settings\networkservice\application data\microsoft\systemcertificates\my\ctls\#decrypt my files#.html
C:\documents and settings\networkservice\application data\microsoft\systemcertificates\my\crls\#decrypt my files#.html
C:\documents and settings\networkservice\application data\microsoft\systemcertificates\my\certificates\#decrypt my files#.html
C:\documents and settings\networkservice\application data\microsoft\systemcertificates\my\#decrypt my files#.html
C:\documents and settings\networkservice\application data\microsoft\systemcertificates\#decrypt my files#.html
C:\documents and settings\networkservice\local settings\#decrypt my files#.html
%APPDATA%\.purple\certificates\#decrypt my files#.html
%APPDATA%\adobe\acrobat\10.0\forms\#decrypt my files#.html
C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\etuaii8e\#decrypt my files#.html
%APPDATA%\adobe\acrobat\10.0\collab\#decrypt my files#.html
%APPDATA%\adobe\acrobat\10.0\#decrypt my files#.html
%APPDATA%\adobe\acrobat\#decrypt my files#.html
%APPDATA%\adobe\#decrypt my files#.html
%APPDATA%\.purple\smileys\#decrypt my files#.html
%APPDATA%\.purple\certificates\x509\tls_peers\#decrypt my files#.html
C:\documents and settings\networkservice\application data\microsoft\media player\#decrypt my files#.html
%APPDATA%\.purple\certificates\x509\#decrypt my files#.html
%APPDATA%\.purple\#decrypt my files#.html
%APPDATA%\#decrypt my files#.html
%HOMEPATH%\.oracle_jre_usage\#decrypt my files#.html
%HOMEPATH%\#decrypt my files#.html
C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\z9pmdpek\#decrypt my files#.html
C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\h8mbgrq8\#decrypt my files#.html
C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\#decrypt my files#.html
C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\ee7gwdg8\#decrypt my files#.html
C:\documents and settings\networkservice\application data\microsoft\internet explorer\#decrypt my files#.html
C:\documents and settings\localservice\local settings\application data\#decrypt my files#.html
C:\documents and settings\localservice\application data\microsoft\systemcertificates\my\ctls\#decrypt my files#.html
C:\documents and settings\localservice\application data\microsoft\systemcertificates\my\crls\#decrypt my files#.html
C:\documents and settings\localservice\application data\microsoft\systemcertificates\my\certificates\#decrypt my files#.html
C:\documents and settings\localservice\application data\microsoft\systemcertificates\my\#decrypt my files#.html
C:\documents and settings\localservice\application data\microsoft\systemcertificates\#decrypt my files#.html
C:\documents and settings\localservice\application data\microsoft\media player\#decrypt my files#.html
C:\documents and settings\localservice\cookies\#decrypt my files#.html
C:\documents and settings\localservice\application data\microsoft\internet explorer\#decrypt my files#.html
C:\documents and settings\localservice\application data\microsoft\credentials\#decrypt my files#.html
C:\documents and settings\localservice\application data\microsoft\#decrypt my files#.html
C:\documents and settings\localservice\application data\#decrypt my files#.html
C:\documents and settings\localservice\#decrypt my files#.html
C:\documents and settings\default user\templates\#decrypt my files#.html
C:\documents and settings\default user\start menu\programs\startup\#decrypt my files#.html
C:\documents and settings\localservice\application data\microsoft\credentials\s-1-5-19\#decrypt my files#.html
C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\#decrypt my files#.html
C:\documents and settings\networkservice\application data\microsoft\credentials\#decrypt my files#.html
C:\documents and settings\localservice\local settings\application data\microsoft\#decrypt my files#.html
C:\documents and settings\networkservice\application data\microsoft\#decrypt my files#.html
C:\documents and settings\networkservice\application data\#decrypt my files#.html
C:\documents and settings\networkservice\#decrypt my files#.html
C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\qiszf4kx\#decrypt my files#.html
C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\o4q6sqop\#decrypt my files#.html
C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\mqraz07n\#decrypt my files#.html
C:\documents and settings\networkservice\application data\microsoft\credentials\s-1-5-20\#decrypt my files#.html
C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\9stcdn6y\#decrypt my files#.html
C:\documents and settings\localservice\local settings\<INETFILES>\#decrypt my files#.html
C:\documents and settings\localservice\local settings\temp\#decrypt my files#.html
C:\documents and settings\localservice\local settings\history\history.ie5\#decrypt my files#.html
C:\documents and settings\localservice\local settings\history\#decrypt my files#.html
C:\documents and settings\localservice\local settings\application data\microsoft\credentials\s-1-5-19\#decrypt my files#.html
C:\documents and settings\localservice\local settings\application data\microsoft\credentials\#decrypt my files#.html
C:\documents and settings\localservice\local settings\#decrypt my files#.html
%APPDATA%\icqm\icq\graphics\#decrypt my files#.html
%APPDATA%\icqm\icq\skin_cache\#decrypt my files#.html
%APPDATA%\adobe\acrobat\10.0\security\crlcache\#decrypt my files#.html
%APPDATA%\icqm\icq\html\pt\jabber\#decrypt my files#.html
%APPDATA%\icqm\icq\html\pt\error\#decrypt my files#.html
%APPDATA%\icqm\icq\html\pt\#decrypt my files#.html
%APPDATA%\icqm\icq\html\kz\loading\#decrypt my files#.html
%APPDATA%\icqm\icq\html\kz\jabber\#decrypt my files#.html
%APPDATA%\icqm\icq\html\kz\error\#decrypt my files#.html
%APPDATA%\icqm\icq\html\pt\loading\#decrypt my files#.html
%APPDATA%\icqm\icq\html\kz\#decrypt my files#.html
%APPDATA%\icqm\icq\html\en\jabber\#decrypt my files#.html
%APPDATA%\icqm\icq\html\en\error\#decrypt my files#.html
%APPDATA%\icqm\icq\html\en\#decrypt my files#.html
%APPDATA%\icqm\icq\html\de\loading\#decrypt my files#.html
%APPDATA%\icqm\icq\html\de\jabber\#decrypt my files#.html
%APPDATA%\icqm\icq\html\de\error\#decrypt my files#.html
%APPDATA%\icqm\icq\html\en\loading\#decrypt my files#.html
%APPDATA%\icqm\icq\html\ua\error\#decrypt my files#.html
%APPDATA%\adobe\acrobat\10.0\security\#decrypt my files#.html
%APPDATA%\icqm\icq\html\ru\jabber\#decrypt my files#.html
%APPDATA%\icqm\icq\skin\#decrypt my files#.html
%APPDATA%\icqm\icq\html\uz\loading\#decrypt my files#.html
%APPDATA%\icqm\icq\html\uz\jabber\#decrypt my files#.html
%APPDATA%\icqm\icq\html\uz\error\#decrypt my files#.html
%APPDATA%\icqm\icq\html\uz\#decrypt my files#.html
%APPDATA%\icqm\icq\html\ua\loading\#decrypt my files#.html
%APPDATA%\icqm\icq\html\de\#decrypt my files#.html
%APPDATA%\icqm\icq\html\ua\jabber\#decrypt my files#.html
%APPDATA%\icqm\icq\html\ua\#decrypt my files#.html
%APPDATA%\icqm\icq\html\tr\loading\#decrypt my files#.html
%APPDATA%\icqm\icq\html\tr\jabber\#decrypt my files#.html
%APPDATA%\icqm\icq\html\tr\error\#decrypt my files#.html
%APPDATA%\icqm\icq\html\tr\#decrypt my files#.html
%APPDATA%\icqm\icq\html\ru\loading\#decrypt my files#.html
%APPDATA%\icqm\icq\html\ru\#decrypt my files#.html
C:\documents and settings\default user\start menu\programs\accessories\entertainment\#decrypt my files#.html
%APPDATA%\icqm\icq\html\cz\loading\#decrypt my files#.html
%APPDATA%\icq-profile\base\#decrypt my files#.html
%APPDATA%\adobe\linguistics\dictionaries\adobe custom dictionary\eng\#decrypt my files#.html
%APPDATA%\adobe\linguistics\dictionaries\adobe custom dictionary\can\#decrypt my files#.html
%APPDATA%\adobe\linguistics\dictionaries\adobe custom dictionary\brt\#decrypt my files#.html
%APPDATA%\adobe\linguistics\dictionaries\adobe custom dictionary\all\#decrypt my files#.html
%APPDATA%\adobe\linguistics\dictionaries\adobe custom dictionary\#decrypt my files#.html
%APPDATA%\adobe\linguistics\dictionaries\#decrypt my files#.html
%APPDATA%\adobe\logtransport2\#decrypt my files#.html
%APPDATA%\adobe\linguistics\#decrypt my files#.html
%APPDATA%\adobe\flash player\assetcache\mc4yk349\#decrypt my files#.html
%APPDATA%\adobe\flash player\assetcache\#decrypt my files#.html
%APPDATA%\adobe\flash player\#decrypt my files#.html
%APPDATA%\adobe\acrobat\9.0\javascripts\#decrypt my files#.html
%APPDATA%\adobe\acrobat\9.0\forms\#decrypt my files#.html
%APPDATA%\adobe\acrobat\9.0\#decrypt my files#.html
%APPDATA%\adobe\headlights\#decrypt my files#.html
%APPDATA%\adobe\acrobat\10.0\javascripts\#decrypt my files#.html
%APPDATA%\icqm\icq\html\cz\error\#decrypt my files#.html
%APPDATA%\icq-profile\update\#decrypt my files#.html
%APPDATA%\icqm\icq\html\cz\#decrypt my files#.html
%APPDATA%\icqm\icq\html\bg\loading\#decrypt my files#.html
%APPDATA%\icqm\icq\html\bg\jabber\#decrypt my files#.html
%APPDATA%\icqm\icq\html\bg\error\#decrypt my files#.html
%APPDATA%\icqm\icq\html\bg\#decrypt my files#.html
%APPDATA%\icqm\icq\html\#decrypt my files#.html
%APPDATA%\icqm\icq\html\cz\jabber\#decrypt my files#.html
%APPDATA%\icqm\icq\graphics\phone\#decrypt my files#.html
%APPDATA%\icqm\icq\fonts\#decrypt my files#.html
%APPDATA%\icqm\icq\dll\#decrypt my files#.html
%APPDATA%\icqm\icq\database\#decrypt my files#.html
%APPDATA%\icqm\icq\#decrypt my files#.html
%APPDATA%\icqm\#decrypt my files#.html
%APPDATA%\icq-profile\update\splash_banner\#decrypt my files#.html
%APPDATA%\icq-profile\#decrypt my files#.html
%APPDATA%\icqm\icq\html\ru\error\#decrypt my files#.html
C:\documents and settings\default user\start menu\programs\accessories\accessibility\#decrypt my files#.html
C:\documents and settings\default user\local settings\application data\microsoft\media player\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\microsoft\msdn\8.0\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\3082\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\2052\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1050\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1049\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1046\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\microsoft\network\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1042\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1040\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1036\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1033\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1031\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1028\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1041\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\microsoft help\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\microsoft\network\connections\pbk\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\package cache\{615bc16d-60f5-482e-91b3-b51d8130963b}\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\package cache\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\package cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\package cache\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\oracle\java\installcache\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\oracle\java\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\microsoft\msdn\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\oracle\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\microsoft\user account pictures\default pictures\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\microsoft\user account pictures\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\microsoft\office\groove\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\microsoft\office\data\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\microsoft\office\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\microsoft\network\downloader\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\microsoft\network\connections\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\microsoft\network\connections\cm\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\microsoft\msdaipp\offline\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\adobe\arm\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\adobe\acrobat\10.0\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\adobe\acrobat\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\adobe\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\#decrypt my files#.html
%ALLUSERSPROFILE%\#decrypt my files#.html
C:\documents and settings\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\adobe\acrobat\10.0\replicate\#decrypt my files#.html
C:\#decrypt my files#.html
<Current directory>\#decrypt my files#.html
%APPDATA%\dp\dp_main.exe
%ProgramFiles%\dp\decryptioninfo.auth
%HOMEPATH%\my documents\decryptioninfo.auth
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1229272821-842925246-1060284298-1003\52f52430291a79091001f78800ce341f_5f9fe710-99e6-4c04-be62-a7f1b8b321d1
<Current directory>\id.dp
D:\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\microsoft\crypto\rsa\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\microsoft\media player\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\adobe\setup\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\microsoft\media index\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\microsoft\html help\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\microsoft\dbgclr\7.1\1033\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\microsoft\dbgclr\7.1\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\microsoft\dbgclr\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\microsoft\crypto\rsa\s-1-5-18\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\microsoft\msdaipp\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\microsoft\crypto\rsa\machinekeys\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\microsoft\crypto\dss\machinekeys\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\microsoft\crypto\dss\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\microsoft\crypto\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\microsoft\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\adobe\updater6\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\adobe\setup\{ac76ba86-7ad7-1033-7b44-aa1000000001}\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\adobe\acrobat\10.0\replicate\security\#decrypt my files#.html
%ALLUSERSPROFILE%\start menu\programs\accessories\entertainment\#decrypt my files#.html
C:\documents and settings\default user\start menu\programs\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\packages\vcruntimeminimum_x86\#decrypt my files#.html
C:\documents and settings\default user\local settings\#decrypt my files#.html
C:\documents and settings\default user\favorites\#decrypt my files#.html
C:\documents and settings\default user\desktop\#decrypt my files#.html
C:\documents and settings\default user\cookies\#decrypt my files#.html
C:\documents and settings\default user\application data\microsoft\systemcertificates\my\ctls\#decrypt my files#.html
C:\documents and settings\default user\application data\microsoft\systemcertificates\my\crls\#decrypt my files#.html
C:\documents and settings\default user\local settings\application data\#decrypt my files#.html
C:\documents and settings\default user\application data\microsoft\systemcertificates\my\certificates\#decrypt my files#.html
C:\documents and settings\default user\application data\microsoft\systemcertificates\#decrypt my files#.html
C:\documents and settings\default user\application data\microsoft\media player\#decrypt my files#.html
C:\documents and settings\default user\application data\microsoft\internet explorer\#decrypt my files#.html
C:\documents and settings\default user\application data\microsoft\#decrypt my files#.html
C:\documents and settings\default user\application data\#decrypt my files#.html
C:\documents and settings\default user\#decrypt my files#.html
C:\documents and settings\default user\application data\microsoft\systemcertificates\my\#decrypt my files#.html
C:\documents and settings\default user\local settings\<INETFILES>\content.ie5\h8mbgrq8\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\packages\#decrypt my files#.html
C:\documents and settings\default user\local settings\history\#decrypt my files#.html
C:\documents and settings\default user\start menu\#decrypt my files#.html
C:\documents and settings\default user\sendto\#decrypt my files#.html
C:\documents and settings\default user\recent\#decrypt my files#.html
C:\documents and settings\default user\printhood\#decrypt my files#.html
C:\documents and settings\default user\nethood\#decrypt my files#.html
C:\documents and settings\default user\my documents\#decrypt my files#.html
%ALLUSERSPROFILE%\templates\#decrypt my files#.html
C:\documents and settings\default user\local settings\<INETFILES>\content.ie5\z9pmdpek\#decrypt my files#.html
C:\documents and settings\default user\local settings\<INETFILES>\content.ie5\etuaii8e\#decrypt my files#.html
C:\documents and settings\default user\local settings\<INETFILES>\content.ie5\ee7gwdg8\#decrypt my files#.html
C:\documents and settings\default user\local settings\<INETFILES>\content.ie5\#decrypt my files#.html
C:\documents and settings\default user\local settings\<INETFILES>\#decrypt my files#.html
C:\documents and settings\default user\local settings\temp\#decrypt my files#.html
C:\documents and settings\default user\local settings\history\history.ie5\#decrypt my files#.html
C:\documents and settings\default user\local settings\application data\microsoft\#decrypt my files#.html
C:\documents and settings\default user\start menu\programs\accessories\#decrypt my files#.html
%ALLUSERSPROFILE%\start menu\programs\winrar\#decrypt my files#.html
%ALLUSERSPROFILE%\documents\my videos\#decrypt my files#.html
%ALLUSERSPROFILE%\documents\my music\sample playlists\00107ff6\#decrypt my files#.html
%ALLUSERSPROFILE%\documents\my music\sample playlists\#decrypt my files#.html
%ALLUSERSPROFILE%\documents\my music\sample music\#decrypt my files#.html
%ALLUSERSPROFILE%\documents\my music\my playlists\#decrypt my files#.html
%ALLUSERSPROFILE%\documents\my music\#decrypt my files#.html
%ALLUSERSPROFILE%\documents\#decrypt my files#.html
%ALLUSERSPROFILE%\documents\my pictures\#decrypt my files#.html
%ALLUSERSPROFILE%\desktop\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\sun\java\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\sun\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\package cache\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\vcruntimeadditional_x86\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\sun\java\java update\#decrypt my files#.html
%ALLUSERSPROFILE%\application data\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\#decrypt my files#.html
%ALLUSERSPROFILE%\start menu\programs\qip 2012\#decrypt my files#.html
%ALLUSERSPROFILE%\drm\#decrypt my files#.html
%ALLUSERSPROFILE%\start menu\programs\mirc\#decrypt my files#.html
%ALLUSERSPROFILE%\start menu\programs\microsoft office\microsoft office tools\#decrypt my files#.html
%ALLUSERSPROFILE%\start menu\programs\microsoft office\#decrypt my files#.html
%ALLUSERSPROFILE%\start menu\programs\microsoft .net framework sdk v1.1\#decrypt my files#.html
%ALLUSERSPROFILE%\start menu\programs\games\#decrypt my files#.html
%ALLUSERSPROFILE%\start menu\programs\administrative tools\#decrypt my files#.html
%ALLUSERSPROFILE%\start menu\programs\steam\#decrypt my files#.html
%ALLUSERSPROFILE%\start menu\programs\accessories\system tools\#decrypt my files#.html
%ALLUSERSPROFILE%\start menu\programs\accessories\communications\#decrypt my files#.html
%ALLUSERSPROFILE%\start menu\programs\accessories\accessibility\#decrypt my files#.html
%ALLUSERSPROFILE%\start menu\programs\accessories\#decrypt my files#.html
%ALLUSERSPROFILE%\start menu\programs\#decrypt my files#.html
%ALLUSERSPROFILE%\start menu\#decrypt my files#.html
%ALLUSERSPROFILE%\favorites\#decrypt my files#.html
%ALLUSERSPROFILE%\documents\my pictures\sample pictures\#decrypt my files#.html
%APPDATA%\icqm\icq\smiles\#decrypt my files#.html

Moves the following files

from %APPDATA%\desktop.ini to %APPDATA%\desktop.ini[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\ru\jabber\jabber.html to %APPDATA%\icqm\icq\html\ru\jabber\jabber.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\ru\jabber\vkontakte.html to %APPDATA%\icqm\icq\html\ru\jabber\vkontakte.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\ru\jabber\warning.png to %APPDATA%\icqm\icq\html\ru\jabber\warning.png[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\ru\loading\loading.html to %APPDATA%\icqm\icq\html\ru\loading\loading.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\ru\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\ru\loading\progress_agent.gif[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\tr\error\error_general.html to %APPDATA%\icqm\icq\html\tr\error\error_general.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\tr\error\error_news.html to %APPDATA%\icqm\icq\html\tr\error\error_news.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\tr\error\error_update.html to %APPDATA%\icqm\icq\html\tr\error\error_update.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\tr\error\exclamation.jpg to %APPDATA%\icqm\icq\html\tr\error\exclamation.jpg[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\tr\jabber\facebook.html to %APPDATA%\icqm\icq\html\tr\jabber\facebook.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\tr\jabber\gtalk.html to %APPDATA%\icqm\icq\html\tr\jabber\gtalk.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\tr\jabber\jabber.html to %APPDATA%\icqm\icq\html\tr\jabber\jabber.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\tr\jabber\vkontakte.html to %APPDATA%\icqm\icq\html\tr\jabber\vkontakte.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\tr\jabber\warning.png to %APPDATA%\icqm\icq\html\tr\jabber\warning.png[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\tr\loading\loading.html to %APPDATA%\icqm\icq\html\tr\loading\loading.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\tr\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\tr\loading\progress_agent.gif[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\ua\error\error_general.html to %APPDATA%\icqm\icq\html\ua\error\error_general.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\ua\error\error_news.html to %APPDATA%\icqm\icq\html\ua\error\error_news.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\ua\error\error_update.html to %APPDATA%\icqm\icq\html\ua\error\error_update.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\ua\error\exclamation.jpg to %APPDATA%\icqm\icq\html\ua\error\exclamation.jpg[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\ua\jabber\facebook.html to %APPDATA%\icqm\icq\html\ua\jabber\facebook.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\ru\jabber\gtalk.html to %APPDATA%\icqm\icq\html\ru\jabber\gtalk.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\ua\jabber\gtalk.html to %APPDATA%\icqm\icq\html\ua\jabber\gtalk.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\ru\jabber\facebook.html to %APPDATA%\icqm\icq\html\ru\jabber\facebook.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\ru\error\error_update.html to %APPDATA%\icqm\icq\html\ru\error\error_update.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\kz\error\exclamation.jpg to %APPDATA%\icqm\icq\html\kz\error\exclamation.jpg[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\kz\jabber\facebook.html to %APPDATA%\icqm\icq\html\kz\jabber\facebook.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\kz\jabber\gtalk.html to %APPDATA%\icqm\icq\html\kz\jabber\gtalk.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\kz\jabber\jabber.html to %APPDATA%\icqm\icq\html\kz\jabber\jabber.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\kz\jabber\vkontakte.html to %APPDATA%\icqm\icq\html\kz\jabber\vkontakte.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\kz\jabber\warning.png to %APPDATA%\icqm\icq\html\kz\jabber\warning.png[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\kz\loading\loading.html to %APPDATA%\icqm\icq\html\kz\loading\loading.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\kz\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\kz\loading\progress_agent.gif[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\pt\error\error_general.html to %APPDATA%\icqm\icq\html\pt\error\error_general.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\pt\error\error_news.html to %APPDATA%\icqm\icq\html\pt\error\error_news.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\pt\error\error_update.html to %APPDATA%\icqm\icq\html\pt\error\error_update.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\pt\error\exclamation.jpg to %APPDATA%\icqm\icq\html\pt\error\exclamation.jpg[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\pt\jabber\facebook.html to %APPDATA%\icqm\icq\html\pt\jabber\facebook.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\pt\jabber\gtalk.html to %APPDATA%\icqm\icq\html\pt\jabber\gtalk.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\pt\jabber\jabber.html to %APPDATA%\icqm\icq\html\pt\jabber\jabber.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\pt\jabber\vkontakte.html to %APPDATA%\icqm\icq\html\pt\jabber\vkontakte.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\pt\jabber\warning.png to %APPDATA%\icqm\icq\html\pt\jabber\warning.png[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\pt\loading\loading.html to %APPDATA%\icqm\icq\html\pt\loading\loading.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\pt\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\pt\loading\progress_agent.gif[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\ru\error\error_general.html to %APPDATA%\icqm\icq\html\ru\error\error_general.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\ru\error\error_news.html to %APPDATA%\icqm\icq\html\ru\error\error_news.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\ru\error\exclamation.jpg to %APPDATA%\icqm\icq\html\ru\error\exclamation.jpg[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\smiles\mrasmileslang_uz.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_uz.xml[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\smiles\flash\drako_love.swf to %APPDATA%\icqm\icq\smiles\flash\drako_love.swf[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\ua\jabber\warning.png to %APPDATA%\icqm\icq\html\ua\jabber\warning.png[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\smiles\flash\akitaka.swf to %APPDATA%\icqm\icq\smiles\flash\akitaka.swf[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\smiles\flash\angel.png to %APPDATA%\icqm\icq\smiles\flash\angel.png[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\smiles\flash\angel.swf to %APPDATA%\icqm\icq\smiles\flash\angel.swf[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\smiles\flash\bad_cold.png to %APPDATA%\icqm\icq\smiles\flash\bad_cold.png[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\smiles\flash\bad_cold.swf to %APPDATA%\icqm\icq\smiles\flash\bad_cold.swf[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\smiles\flash\beback.png to %APPDATA%\icqm\icq\smiles\flash\beback.png[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\smiles\flash\beback.swf to %APPDATA%\icqm\icq\smiles\flash\beback.swf[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\smiles\flash\beer.swf to %APPDATA%\icqm\icq\smiles\flash\beer.swf[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\smiles\flash\bodun.swf to %APPDATA%\icqm\icq\smiles\flash\bodun.swf[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\smiles\flash\boo.png to %APPDATA%\icqm\icq\smiles\flash\boo.png[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\smiles\flash\boo.swf to %APPDATA%\icqm\icq\smiles\flash\boo.swf[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\smiles\flash\canthearu.png to %APPDATA%\icqm\icq\smiles\flash\canthearu.png[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\smiles\flash\canthearu.swf to %APPDATA%\icqm\icq\smiles\flash\canthearu.swf[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\smiles\flash\chillout.png to %APPDATA%\icqm\icq\smiles\flash\chillout.png[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\smiles\flash\chillout.swf to %APPDATA%\icqm\icq\smiles\flash\chillout.swf[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\smiles\flash\devochka.swf to %APPDATA%\icqm\icq\smiles\flash\devochka.swf[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\smiles\flash\drako_bolnoy.png to %APPDATA%\icqm\icq\smiles\flash\drako_bolnoy.png[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\smiles\flash\drako_bolnoy.swf to %APPDATA%\icqm\icq\smiles\flash\drako_bolnoy.swf[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\smiles\flash\drako_koster.png to %APPDATA%\icqm\icq\smiles\flash\drako_koster.png[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\smiles\flash\drako_koster.swf to %APPDATA%\icqm\icq\smiles\flash\drako_koster.swf[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\smiles\flash\drako_love.png to %APPDATA%\icqm\icq\smiles\flash\drako_love.png[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\smiles\flash\akitaka.png to %APPDATA%\icqm\icq\smiles\flash\akitaka.png[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\kz\error\error_update.html to %APPDATA%\icqm\icq\html\kz\error\error_update.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\smiles\skin.txt to %APPDATA%\icqm\icq\smiles\skin.txt[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\smiles\mrasmileslang_ua.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_ua.xml[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\ua\loading\loading.html to %APPDATA%\icqm\icq\html\ua\loading\loading.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\ua\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\ua\loading\progress_agent.gif[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\uz\error\error_general.html to %APPDATA%\icqm\icq\html\uz\error\error_general.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\uz\error\error_news.html to %APPDATA%\icqm\icq\html\uz\error\error_news.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\uz\error\error_update.html to %APPDATA%\icqm\icq\html\uz\error\error_update.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\uz\error\exclamation.jpg to %APPDATA%\icqm\icq\html\uz\error\exclamation.jpg[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\uz\jabber\facebook.html to %APPDATA%\icqm\icq\html\uz\jabber\facebook.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\uz\jabber\gtalk.html to %APPDATA%\icqm\icq\html\uz\jabber\gtalk.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\uz\jabber\jabber.html to %APPDATA%\icqm\icq\html\uz\jabber\jabber.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\uz\jabber\vkontakte.html to %APPDATA%\icqm\icq\html\uz\jabber\vkontakte.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\uz\jabber\warning.png to %APPDATA%\icqm\icq\html\uz\jabber\warning.png[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\uz\loading\loading.html to %APPDATA%\icqm\icq\html\uz\loading\loading.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\uz\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\uz\loading\progress_agent.gif[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\smiles\mrasmileslang_bg.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_bg.xml[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\smiles\mrasmileslang_cz.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_cz.xml[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\smiles\mrasmileslang_de.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_de.xml[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\smiles\mrasmileslang_en.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_en.xml[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\smiles\mrasmileslang_kz.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_kz.xml[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\smiles\mrasmileslang_pt.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_pt.xml[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\smiles\mrasmileslang_ru.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_ru.xml[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\smiles\mrasmileslang_tr.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_tr.xml[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\ua\jabber\jabber.html to %APPDATA%\icqm\icq\html\ua\jabber\jabber.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\ua\jabber\vkontakte.html to %APPDATA%\icqm\icq\html\ua\jabber\vkontakte.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\kz\error\error_news.html to %APPDATA%\icqm\icq\html\kz\error\error_news.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\graphics\phone\screen-decline.bmp to %APPDATA%\icqm\icq\graphics\phone\screen-decline.bmp[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\database\citylist_kz.csv to %APPDATA%\icqm\icq\database\citylist_kz.csv[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\database\citylist_ru.csv to %APPDATA%\icqm\icq\database\citylist_ru.csv[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\database\citylist_tr.csv to %APPDATA%\icqm\icq\database\citylist_tr.csv[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\database\citylist_ua.csv to %APPDATA%\icqm\icq\database\citylist_ua.csv[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\database\citylist_uz.csv to %APPDATA%\icqm\icq\database\citylist_uz.csv[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\dll\altergeo.msi to %APPDATA%\icqm\icq\dll\altergeo.msi[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\dll\mailrusputnik.exe to %APPDATA%\icqm\icq\dll\mailrusputnik.exe[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\dll\mousephone.dll to %APPDATA%\icqm\icq\dll\mousephone.dll[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\dll\mratag.dll to %APPDATA%\icqm\icq\dll\mratag.dll[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\fonts\segoesc.ttf to %APPDATA%\icqm\icq\fonts\segoesc.ttf[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\graphics\phone\agent_offline.bmp to %APPDATA%\icqm\icq\graphics\phone\agent_offline.bmp[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\graphics\phone\agent_offline_inv.bmp to %APPDATA%\icqm\icq\graphics\phone\agent_offline_inv.bmp[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\graphics\phone\agent_online.bmp to %APPDATA%\icqm\icq\graphics\phone\agent_online.bmp[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\graphics\phone\agent_online_inv.bmp to %APPDATA%\icqm\icq\graphics\phone\agent_online_inv.bmp[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\graphics\phone\icq_offline.bmp to %APPDATA%\icqm\icq\graphics\phone\icq_offline.bmp[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\graphics\phone\icq_offline_inv.bmp to %APPDATA%\icqm\icq\graphics\phone\icq_offline_inv.bmp[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\graphics\phone\icq_online.bmp to %APPDATA%\icqm\icq\graphics\phone\icq_online.bmp[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\graphics\phone\icq_online_inv.bmp to %APPDATA%\icqm\icq\graphics\phone\icq_online_inv.bmp[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\graphics\phone\phone.bmp to %APPDATA%\icqm\icq\graphics\phone\phone.bmp[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\graphics\phone\phone_inv.bmp to %APPDATA%\icqm\icq\graphics\phone\phone_inv.bmp[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\graphics\phone\screen-busy-mouse.bmp to %APPDATA%\icqm\icq\graphics\phone\screen-busy-mouse.bmp[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\database\citylist_en.csv to %APPDATA%\icqm\icq\database\citylist_en.csv[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\graphics\phone\screen-busy.bmp to %APPDATA%\icqm\icq\graphics\phone\screen-busy.bmp[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\sciter32.dll to %APPDATA%\icqm\sciter32.dll[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icq-profile\update\languages.hash to %APPDATA%\icq-profile\update\languages.hash[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\.purple\prefs.xml to %APPDATA%\.purple\prefs.xml[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\.purple\status.xml to %APPDATA%\.purple\status.xml[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\adobe\acrobat\10.0\rdrmessage.zip to %APPDATA%\adobe\acrobat\10.0\rdrmessage.zip[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\adobe\acrobat\10.0\readermessages to %APPDATA%\adobe\acrobat\10.0\readermessages[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\adobe\acrobat\10.0\tmdocs.sav to %APPDATA%\adobe\acrobat\10.0\tmdocs.sav[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\adobe\acrobat\10.0\tmgrpprm.sav to %APPDATA%\adobe\acrobat\10.0\tmgrpprm.sav[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\adobe\acrobat\10.0\javascripts\glob.js to %APPDATA%\adobe\acrobat\10.0\javascripts\glob.js[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\adobe\acrobat\10.0\javascripts\glob.settings.js to %APPDATA%\adobe\acrobat\10.0\javascripts\glob.settings.js[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\adobe\acrobat\10.0\security\addressbook.acrodata to %APPDATA%\adobe\acrobat\10.0\security\addressbook.acrodata[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\adobe\acrobat\10.0\security\crlcache\48b76449f3d5fefa1133aa805e420f0fca643651.crl to %APPDATA%\adobe\acrobat\10.0\security\crlcache\48b76449f3d5fefa1133aa805e420f0fca643651.crl[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\adobe\acrobat\10.0\security\crlcache\a9b8213768adc68af64fcc6409e8be414726687f.crl to %APPDATA%\adobe\acrobat\10.0\security\crlcache\a9b8213768adc68af64fcc6409e8be414726687f.crl[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\adobe\acrobat\9.0\adobecmapfnt09.lst to %APPDATA%\adobe\acrobat\9.0\adobecmapfnt09.lst[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\adobe\acrobat\9.0\adobesysfnt09.lst to %APPDATA%\adobe\acrobat\9.0\adobesysfnt09.lst[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\adobe\acrobat\9.0\shareddataevents to %APPDATA%\adobe\acrobat\9.0\shareddataevents[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\adobe\acrobat\9.0\usercache.bin to %APPDATA%\adobe\acrobat\9.0\usercache.bin[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\adobe\acrobat\9.0\javascripts\glob.js to %APPDATA%\adobe\acrobat\9.0\javascripts\glob.js[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\adobe\acrobat\9.0\javascripts\glob.settings.js to %APPDATA%\adobe\acrobat\9.0\javascripts\glob.settings.js[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icq-profile\installerlang.xml to %APPDATA%\icq-profile\installerlang.xml[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icq-profile\base\mra.dbs to %APPDATA%\icq-profile\base\mra.dbs[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icq-profile\update\languages.aff to %APPDATA%\icq-profile\update\languages.aff[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icq-profile\update\languages.dict to %APPDATA%\icq-profile\update\languages.dict[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icqsetup.exe to %APPDATA%\icqm\icqsetup.exe[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\cz\jabber\warning.png to %APPDATA%\icqm\icq\html\cz\jabber\warning.png[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\en\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\en\loading\progress_agent.gif[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\graphics\phone\screen-offline-inv.bmp to %APPDATA%\icqm\icq\graphics\phone\screen-offline-inv.bmp[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\de\error\error_general.html to %APPDATA%\icqm\icq\html\de\error\error_general.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\de\error\error_news.html to %APPDATA%\icqm\icq\html\de\error\error_news.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\de\error\error_update.html to %APPDATA%\icqm\icq\html\de\error\error_update.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\de\error\exclamation.jpg to %APPDATA%\icqm\icq\html\de\error\exclamation.jpg[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\de\jabber\facebook.html to %APPDATA%\icqm\icq\html\de\jabber\facebook.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\de\jabber\gtalk.html to %APPDATA%\icqm\icq\html\de\jabber\gtalk.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\de\jabber\jabber.html to %APPDATA%\icqm\icq\html\de\jabber\jabber.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\de\jabber\vkontakte.html to %APPDATA%\icqm\icq\html\de\jabber\vkontakte.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\de\jabber\warning.png to %APPDATA%\icqm\icq\html\de\jabber\warning.png[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\de\loading\loading.html to %APPDATA%\icqm\icq\html\de\loading\loading.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\de\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\de\loading\progress_agent.gif[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\en\error\error_general.html to %APPDATA%\icqm\icq\html\en\error\error_general.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\en\error\error_news.html to %APPDATA%\icqm\icq\html\en\error\error_news.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\en\error\error_update.html to %APPDATA%\icqm\icq\html\en\error\error_update.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\en\error\exclamation.jpg to %APPDATA%\icqm\icq\html\en\error\exclamation.jpg[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\en\jabber\facebook.html to %APPDATA%\icqm\icq\html\en\jabber\facebook.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\en\jabber\gtalk.html to %APPDATA%\icqm\icq\html\en\jabber\gtalk.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\en\jabber\jabber.html to %APPDATA%\icqm\icq\html\en\jabber\jabber.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\en\jabber\vkontakte.html to %APPDATA%\icqm\icq\html\en\jabber\vkontakte.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\en\jabber\warning.png to %APPDATA%\icqm\icq\html\en\jabber\warning.png[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\en\loading\loading.html to %APPDATA%\icqm\icq\html\en\loading\loading.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\cz\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\cz\loading\progress_agent.gif[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\kz\error\error_general.html to %APPDATA%\icqm\icq\html\kz\error\error_general.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\cz\loading\loading.html to %APPDATA%\icqm\icq\html\cz\loading\loading.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\cz\jabber\vkontakte.html to %APPDATA%\icqm\icq\html\cz\jabber\vkontakte.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\graphics\phone\screen-offline.bmp to %APPDATA%\icqm\icq\graphics\phone\screen-offline.bmp[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\graphics\phone\screen-online-inv.bmp to %APPDATA%\icqm\icq\graphics\phone\screen-online-inv.bmp[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\graphics\phone\screen-online.bmp to %APPDATA%\icqm\icq\graphics\phone\screen-online.bmp[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\bg\error\error_general.html to %APPDATA%\icqm\icq\html\bg\error\error_general.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\bg\error\error_news.html to %APPDATA%\icqm\icq\html\bg\error\error_news.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\bg\error\error_update.html to %APPDATA%\icqm\icq\html\bg\error\error_update.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\bg\error\exclamation.jpg to %APPDATA%\icqm\icq\html\bg\error\exclamation.jpg[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\bg\jabber\facebook.html to %APPDATA%\icqm\icq\html\bg\jabber\facebook.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\bg\jabber\gtalk.html to %APPDATA%\icqm\icq\html\bg\jabber\gtalk.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\bg\jabber\jabber.html to %APPDATA%\icqm\icq\html\bg\jabber\jabber.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\bg\jabber\vkontakte.html to %APPDATA%\icqm\icq\html\bg\jabber\vkontakte.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\bg\jabber\warning.png to %APPDATA%\icqm\icq\html\bg\jabber\warning.png[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\bg\loading\loading.html to %APPDATA%\icqm\icq\html\bg\loading\loading.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\bg\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\bg\loading\progress_agent.gif[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\cz\error\error_general.html to %APPDATA%\icqm\icq\html\cz\error\error_general.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\cz\error\error_news.html to %APPDATA%\icqm\icq\html\cz\error\error_news.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\cz\error\error_update.html to %APPDATA%\icqm\icq\html\cz\error\error_update.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\cz\error\exclamation.jpg to %APPDATA%\icqm\icq\html\cz\error\exclamation.jpg[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\cz\jabber\facebook.html to %APPDATA%\icqm\icq\html\cz\jabber\facebook.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\cz\jabber\gtalk.html to %APPDATA%\icqm\icq\html\cz\jabber\gtalk.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\html\cz\jabber\jabber.html to %APPDATA%\icqm\icq\html\cz\jabber\jabber.html[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\graphics\phone\screen-decline-mouse.bmp to %APPDATA%\icqm\icq\graphics\phone\screen-decline-mouse.bmp[id-hwtwjmvi].[helpfile@asia.com].prt
from %APPDATA%\icqm\icq\smiles\flash\drako_opyatnica.png to %APPDATA%\icqm\icq\smiles\flash\drako_opyatnica.png[id-hwtwjmvi].[helpfile@asia.com].prt

Modifies user data files (Trojan.Encoder).

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial