Trojan.Encoder.29479

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%ALLUSERSPROFILE%\start menu\programs\startup\ryukreadme.html

Modifies file system

Creates the following files

<Current directory>\lsqzciv.exe
C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\h8mbgrq8\ryukreadme.html
C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\etuaii8e\ryukreadme.html
C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\ee7gwdg8\ryukreadme.html
C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\ryukreadme.html
C:\documents and settings\networkservice\local settings\<INETFILES>\ryukreadme.html
C:\documents and settings\networkservice\local settings\temp\ryukreadme.html
C:\documents and settings\networkservice\application data\microsoft\systemcertificates\my\ctls\ryukreadme.html
C:\documents and settings\networkservice\local settings\history\history.ie5\ryukreadme.html
C:\documents and settings\networkservice\local settings\application data\microsoft\windows\ryukreadme.html
C:\documents and settings\networkservice\local settings\application data\microsoft\credentials\s-1-5-20\ryukreadme.html
C:\documents and settings\networkservice\local settings\application data\microsoft\credentials\ryukreadme.html
C:\documents and settings\networkservice\local settings\application data\microsoft\ryukreadme.html
C:\documents and settings\networkservice\local settings\application data\ryukreadme.html
C:\documents and settings\networkservice\local settings\ryukreadme.html
C:\documents and settings\networkservice\local settings\history\ryukreadme.html
C:\documents and settings\networkservice\cookies\ryukreadme.html
C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\z9pmdpek\ryukreadme.html
%APPDATA%\adobe\ryukreadme.html
%APPDATA%\adobe\acrobat\10.0\security\crlcache\ryukreadme.html
%APPDATA%\adobe\acrobat\10.0\security\ryukreadme.html
%APPDATA%\adobe\acrobat\10.0\javascripts\ryukreadme.html
%APPDATA%\adobe\acrobat\10.0\forms\ryukreadme.html
%APPDATA%\adobe\acrobat\10.0\collab\ryukreadme.html
%APPDATA%\adobe\acrobat\10.0\ryukreadme.html
%HOMEPATH%\.oracle_jre_usage\ryukreadme.html
%HOMEPATH%\ryukreadme.html
%APPDATA%\.purple\smileys\ryukreadme.html
%APPDATA%\.purple\certificates\x509\tls_peers\ryukreadme.html
%APPDATA%\.purple\certificates\x509\ryukreadme.html
%APPDATA%\.purple\certificates\ryukreadme.html
%APPDATA%\.purple\ryukreadme.html
%APPDATA%\ryukreadme.html
%APPDATA%\adobe\acrobat\ryukreadme.html
C:\documents and settings\networkservice\application data\microsoft\systemcertificates\my\crls\ryukreadme.html
C:\documents and settings\networkservice\application data\microsoft\systemcertificates\my\certificates\ryukreadme.html
C:\documents and settings\networkservice\application data\microsoft\systemcertificates\my\ryukreadme.html
C:\documents and settings\localservice\local settings\application data\microsoft\ryukreadme.html
C:\documents and settings\localservice\local settings\application data\ryukreadme.html
C:\documents and settings\localservice\local settings\ryukreadme.html
C:\documents and settings\localservice\cookies\ryukreadme.html
C:\documents and settings\localservice\application data\microsoft\systemcertificates\my\ctls\ryukreadme.html
C:\documents and settings\localservice\local settings\application data\microsoft\credentials\s-1-5-19\ryukreadme.html
C:\documents and settings\localservice\application data\microsoft\systemcertificates\my\crls\ryukreadme.html
C:\documents and settings\localservice\application data\microsoft\systemcertificates\my\ryukreadme.html
C:\documents and settings\localservice\application data\microsoft\systemcertificates\ryukreadme.html
C:\documents and settings\localservice\application data\microsoft\media player\ryukreadme.html
C:\documents and settings\localservice\application data\microsoft\internet explorer\ryukreadme.html
C:\documents and settings\localservice\application data\microsoft\credentials\s-1-5-19\ryukreadme.html
C:\documents and settings\localservice\application data\microsoft\credentials\ryukreadme.html
C:\documents and settings\localservice\application data\microsoft\systemcertificates\my\certificates\ryukreadme.html
C:\documents and settings\localservice\local settings\application data\microsoft\windows\ryukreadme.html
C:\documents and settings\localservice\local settings\application data\microsoft\credentials\ryukreadme.html
C:\documents and settings\localservice\local settings\history\ryukreadme.html
C:\documents and settings\networkservice\application data\microsoft\systemcertificates\ryukreadme.html
C:\documents and settings\networkservice\ryukreadme.html
C:\documents and settings\networkservice\application data\microsoft\media player\ryukreadme.html
C:\documents and settings\networkservice\application data\microsoft\internet explorer\ryukreadme.html
C:\documents and settings\networkservice\application data\microsoft\credentials\s-1-5-20\ryukreadme.html
C:\documents and settings\networkservice\application data\microsoft\credentials\ryukreadme.html
C:\documents and settings\networkservice\application data\microsoft\ryukreadme.html
C:\documents and settings\networkservice\application data\ryukreadme.html
C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\qiszf4kx\ryukreadme.html
C:\documents and settings\localservice\local settings\history\history.ie5\ryukreadme.html
C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\o4q6sqop\ryukreadme.html
C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\mqraz07n\ryukreadme.html
C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\9stcdn6y\ryukreadme.html
C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\ryukreadme.html
C:\documents and settings\localservice\local settings\<INETFILES>\ryukreadme.html
C:\documents and settings\localservice\local settings\temp\ryukreadme.html
%APPDATA%\adobe\acrobat\9.0\ryukreadme.html
%APPDATA%\adobe\acrobat\9.0\forms\ryukreadme.html
%APPDATA%\adobe\acrobat\9.0\javascripts\ryukreadme.html
%APPDATA%\adobe\flash player\ryukreadme.html
%APPDATA%\icqm\icq\html\ru\loading\ryukreadme.html
%APPDATA%\icqm\icq\html\ru\jabber\ryukreadme.html
%APPDATA%\icqm\icq\html\ru\error\ryukreadme.html
%APPDATA%\icqm\icq\html\ru\ryukreadme.html
%APPDATA%\icqm\icq\html\pt\loading\ryukreadme.html
%APPDATA%\icqm\icq\html\pt\jabber\ryukreadme.html
%APPDATA%\icqm\icq\html\tr\ryukreadme.html
%APPDATA%\icqm\icq\html\pt\error\ryukreadme.html
%APPDATA%\icqm\icq\html\kz\loading\ryukreadme.html
%APPDATA%\icqm\icq\html\kz\jabber\ryukreadme.html
%APPDATA%\icqm\icq\html\kz\error\ryukreadme.html
%APPDATA%\icqm\icq\html\kz\ryukreadme.html
%APPDATA%\icqm\icq\html\en\loading\ryukreadme.html
%APPDATA%\icqm\icq\html\en\jabber\ryukreadme.html
%APPDATA%\icqm\icq\html\pt\ryukreadme.html
%APPDATA%\icqm\icq\html\tr\error\ryukreadme.html
%APPDATA%\icqm\icq\html\tr\jabber\ryukreadme.html
%APPDATA%\icqm\icq\html\tr\loading\ryukreadme.html
%APPDATA%\icqm\icq\smiles\smiles\animated\ryukreadme.html
%APPDATA%\icqm\icq\smiles\smiles\8march\ryukreadme.html
%APPDATA%\icqm\icq\smiles\smiles\ryukreadme.html
%APPDATA%\icqm\icq\smiles\flash\ryukreadme.html
%APPDATA%\icqm\icq\smiles\ryukreadme.html
%APPDATA%\icqm\icq\skin_cache\ryukreadme.html
%APPDATA%\icqm\icq\skin\ryukreadme.html
%APPDATA%\icqm\icq\html\uz\loading\ryukreadme.html
%APPDATA%\icqm\icq\html\uz\jabber\ryukreadme.html
%APPDATA%\icqm\icq\html\uz\error\ryukreadme.html
%APPDATA%\icqm\icq\html\uz\ryukreadme.html
%APPDATA%\icqm\icq\html\ua\loading\ryukreadme.html
%APPDATA%\icqm\icq\html\ua\jabber\ryukreadme.html
%APPDATA%\icqm\icq\html\ua\error\ryukreadme.html
%APPDATA%\icqm\icq\html\ua\ryukreadme.html
%APPDATA%\icqm\icq\html\en\error\ryukreadme.html
%APPDATA%\icqm\icq\html\de\loading\ryukreadme.html
%APPDATA%\icqm\icq\html\en\ryukreadme.html
%APPDATA%\icqm\icq\html\de\jabber\ryukreadme.html
%APPDATA%\icq-profile\update\ryukreadme.html
%APPDATA%\icq-profile\base\ryukreadme.html
%APPDATA%\icq-profile\ryukreadme.html
%APPDATA%\adobe\logtransport2\ryukreadme.html
%APPDATA%\adobe\linguistics\dictionaries\adobe custom dictionary\eng\ryukreadme.html
%APPDATA%\adobe\linguistics\dictionaries\adobe custom dictionary\can\ryukreadme.html
%APPDATA%\icq-profile\update\splash_banner\ryukreadme.html
%APPDATA%\adobe\linguistics\dictionaries\adobe custom dictionary\brt\ryukreadme.html
%APPDATA%\adobe\linguistics\dictionaries\adobe custom dictionary\ryukreadme.html
%APPDATA%\adobe\linguistics\dictionaries\ryukreadme.html
%APPDATA%\adobe\linguistics\ryukreadme.html
%APPDATA%\adobe\headlights\ryukreadme.html
%APPDATA%\adobe\flash player\assetcache\mc4yk349\ryukreadme.html
%APPDATA%\adobe\flash player\assetcache\ryukreadme.html
%APPDATA%\adobe\linguistics\dictionaries\adobe custom dictionary\all\ryukreadme.html
%APPDATA%\icqm\ryukreadme.html
%APPDATA%\icqm\icq\ryukreadme.html
%APPDATA%\icqm\icq\database\ryukreadme.html
%APPDATA%\icqm\icq\html\de\error\ryukreadme.html
%APPDATA%\icqm\icq\html\de\ryukreadme.html
%APPDATA%\icqm\icq\html\cz\loading\ryukreadme.html
%APPDATA%\icqm\icq\html\cz\jabber\ryukreadme.html
%APPDATA%\icqm\icq\html\cz\error\ryukreadme.html
%APPDATA%\icqm\icq\html\cz\ryukreadme.html
%APPDATA%\icqm\icq\html\bg\loading\ryukreadme.html
%APPDATA%\icqm\icq\html\bg\jabber\ryukreadme.html
%APPDATA%\icqm\icq\html\bg\error\ryukreadme.html
%APPDATA%\icqm\icq\html\bg\ryukreadme.html
%APPDATA%\icqm\icq\html\ryukreadme.html
%APPDATA%\icqm\icq\graphics\phone\ryukreadme.html
%APPDATA%\icqm\icq\graphics\ryukreadme.html
%APPDATA%\icqm\icq\fonts\ryukreadme.html
%APPDATA%\icqm\icq\dll\ryukreadme.html
%APPDATA%\icqm\icq\smiles\smiles\cat\ryukreadme.html
C:\documents and settings\localservice\application data\microsoft\ryukreadme.html
C:\documents and settings\localservice\application data\ryukreadme.html
C:\documents and settings\localservice\ryukreadme.html
%ALLUSERSPROFILE%\application data\microsoft\office\ryukreadme.html
%ALLUSERSPROFILE%\application data\microsoft\network\downloader\ryukreadme.html
%ALLUSERSPROFILE%\application data\microsoft\network\connections\pbk\ryukreadme.html
%ALLUSERSPROFILE%\application data\microsoft\network\connections\cm\ryukreadme.html
%ALLUSERSPROFILE%\application data\microsoft\network\connections\ryukreadme.html
%ALLUSERSPROFILE%\application data\microsoft\network\ryukreadme.html
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1036\ryukreadme.html
%ALLUSERSPROFILE%\application data\microsoft\msdn\8.0\ryukreadme.html
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\2052\ryukreadme.html
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1050\ryukreadme.html
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1049\ryukreadme.html
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1046\ryukreadme.html
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1042\ryukreadme.html
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1041\ryukreadme.html
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\3082\ryukreadme.html
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1040\ryukreadme.html
%ALLUSERSPROFILE%\application data\microsoft\office\data\ryukreadme.html
%ALLUSERSPROFILE%\application data\package cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\ryukreadme.html
%ALLUSERSPROFILE%\application data\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\ryukreadme.html
%ALLUSERSPROFILE%\application data\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\packages\vcruntimeminimum_x86\ryukreadme.html
%ALLUSERSPROFILE%\application data\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\packages\ryukreadme.html
%ALLUSERSPROFILE%\application data\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\ryukreadme.html
%ALLUSERSPROFILE%\application data\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\ryukreadme.html
%ALLUSERSPROFILE%\application data\package cache\{615bc16d-60f5-482e-91b3-b51d8130963b}\ryukreadme.html
%ALLUSERSPROFILE%\application data\microsoft\user account pictures\ryukreadme.html
%ALLUSERSPROFILE%\application data\microsoft\office\groove\ryukreadme.html
%ALLUSERSPROFILE%\application data\package cache\ryukreadme.html
%ALLUSERSPROFILE%\application data\oracle\java\installcache\ryukreadme.html
%ALLUSERSPROFILE%\application data\oracle\java\ryukreadme.html
%ALLUSERSPROFILE%\application data\oracle\ryukreadme.html
%ALLUSERSPROFILE%\application data\microsoft help\ryukreadme.html
%ALLUSERSPROFILE%\application data\microsoft\user account pictures\default pictures\ryukreadme.html
%ALLUSERSPROFILE%\application data\package cache\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\ryukreadme.html
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1033\ryukreadme.html
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1031\ryukreadme.html
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1028\ryukreadme.html
%ALLUSERSPROFILE%\application data\adobe\arm\ryukreadme.html
%ALLUSERSPROFILE%\application data\adobe\acrobat\10.0\replicate\security\ryukreadme.html
%ALLUSERSPROFILE%\application data\adobe\acrobat\10.0\replicate\ryukreadme.html
%ALLUSERSPROFILE%\application data\adobe\acrobat\10.0\ryukreadme.html
%ALLUSERSPROFILE%\application data\adobe\acrobat\ryukreadme.html
%ALLUSERSPROFILE%\application data\adobe\setup\{ac76ba86-7ad7-1033-7b44-aa1000000001}\ryukreadme.html
%ALLUSERSPROFILE%\application data\adobe\ryukreadme.html
%ALLUSERSPROFILE%\ryukreadme.html
C:\documents and settings\ryukreadme.html
C:\ryukreadme.html
D:\ryukreadme.html
%TEMP%\ryukreadme.html
%ALLUSERSPROFILE%\application data\microsoft\crypto\rsa\machinekeys\08e575673cce10c72090304839888e02_5f9fe710-99e6-4c04-be62-a7f1b8b321d1
%ALLUSERSPROFILE%\application data\ryukreadme.html
%ALLUSERSPROFILE%\application data\adobe\updater6\ryukreadme.html
%ALLUSERSPROFILE%\application data\adobe\setup\ryukreadme.html
%ALLUSERSPROFILE%\application data\microsoft\ryukreadme.html
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\ryukreadme.html
%ALLUSERSPROFILE%\application data\microsoft\dbgclr\7.1\1033\ryukreadme.html
%ALLUSERSPROFILE%\application data\microsoft\msdn\ryukreadme.html
%ALLUSERSPROFILE%\application data\microsoft\msdaipp\offline\ryukreadme.html
%ALLUSERSPROFILE%\application data\microsoft\msdaipp\ryukreadme.html
%ALLUSERSPROFILE%\application data\microsoft\media player\ryukreadme.html
%ALLUSERSPROFILE%\application data\microsoft\media index\ryukreadme.html
%ALLUSERSPROFILE%\application data\microsoft\html help\ryukreadme.html
%ALLUSERSPROFILE%\application data\microsoft\dbgclr\7.1\ryukreadme.html
%ALLUSERSPROFILE%\application data\microsoft\crypto\ryukreadme.html
%ALLUSERSPROFILE%\application data\microsoft\dbgclr\ryukreadme.html
%ALLUSERSPROFILE%\application data\microsoft\crypto\rsa\s-1-5-18\ryukreadme.html
%ALLUSERSPROFILE%\application data\microsoft\crypto\rsa\machinekeys\ryukreadme.html
%ALLUSERSPROFILE%\application data\microsoft\crypto\rsa\ryukreadme.html
%ALLUSERSPROFILE%\application data\microsoft\crypto\dss\machinekeys\ryukreadme.html
%ALLUSERSPROFILE%\application data\microsoft\crypto\dss\ryukreadme.html
%ALLUSERSPROFILE%\application data\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\ryukreadme.html
%ALLUSERSPROFILE%\application data\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\vcruntimeadditional_x86\ryukreadme.html
%ALLUSERSPROFILE%\application data\package cache\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\ryukreadme.html
%ALLUSERSPROFILE%\application data\sun\ryukreadme.html
C:\documents and settings\default user\local settings\history\ryukreadme.html
C:\documents and settings\default user\local settings\application data\microsoft\windows media\9.0\ryukreadme.html
C:\documents and settings\default user\local settings\application data\microsoft\windows media\ryukreadme.html
C:\documents and settings\default user\local settings\application data\microsoft\media player\ryukreadme.html
C:\documents and settings\default user\local settings\application data\microsoft\ryukreadme.html
C:\documents and settings\default user\local settings\application data\ryukreadme.html
C:\documents and settings\default user\local settings\history\history.ie5\ryukreadme.html
C:\documents and settings\default user\local settings\ryukreadme.html
C:\documents and settings\default user\desktop\ryukreadme.html
C:\documents and settings\default user\cookies\ryukreadme.html
C:\documents and settings\default user\application data\microsoft\systemcertificates\my\ctls\ryukreadme.html
C:\documents and settings\default user\application data\microsoft\systemcertificates\my\crls\ryukreadme.html
C:\documents and settings\default user\application data\microsoft\systemcertificates\my\certificates\ryukreadme.html
C:\documents and settings\default user\application data\microsoft\systemcertificates\my\ryukreadme.html
C:\documents and settings\default user\favorites\ryukreadme.html
C:\documents and settings\default user\local settings\temp\ryukreadme.html
C:\documents and settings\default user\local settings\<INETFILES>\ryukreadme.html
C:\documents and settings\default user\local settings\<INETFILES>\content.ie5\ryukreadme.html
C:\documents and settings\default user\start menu\programs\startup\ryukreadme.html
C:\documents and settings\default user\start menu\programs\accessories\entertainment\ryukreadme.html
C:\documents and settings\default user\start menu\programs\accessories\accessibility\ryukreadme.html
C:\documents and settings\default user\start menu\programs\accessories\ryukreadme.html
C:\documents and settings\default user\start menu\programs\ryukreadme.html
C:\documents and settings\default user\start menu\ryukreadme.html
C:\documents and settings\default user\sendto\ryukreadme.html
C:\documents and settings\default user\recent\ryukreadme.html
C:\documents and settings\default user\printhood\ryukreadme.html
C:\documents and settings\default user\nethood\ryukreadme.html
C:\documents and settings\default user\my documents\ryukreadme.html
C:\documents and settings\default user\local settings\<INETFILES>\content.ie5\z9pmdpek\ryukreadme.html
C:\documents and settings\default user\local settings\<INETFILES>\content.ie5\h8mbgrq8\ryukreadme.html
C:\documents and settings\default user\local settings\<INETFILES>\content.ie5\etuaii8e\ryukreadme.html
C:\documents and settings\default user\local settings\<INETFILES>\content.ie5\ee7gwdg8\ryukreadme.html
C:\documents and settings\default user\application data\microsoft\systemcertificates\ryukreadme.html
C:\documents and settings\default user\application data\microsoft\internet explorer\ryukreadme.html
C:\documents and settings\default user\application data\microsoft\media player\ryukreadme.html
C:\documents and settings\default user\application data\microsoft\ryukreadme.html
%ALLUSERSPROFILE%\favorites\ryukreadme.html
%ALLUSERSPROFILE%\drm\ryukreadme.html
%ALLUSERSPROFILE%\documents\my videos\ryukreadme.html
%ALLUSERSPROFILE%\documents\my pictures\sample pictures\ryukreadme.html
%ALLUSERSPROFILE%\documents\my pictures\ryukreadme.html
%ALLUSERSPROFILE%\documents\my music\sample playlists\00107ff6\ryukreadme.html
%ALLUSERSPROFILE%\start menu\ryukreadme.html
%ALLUSERSPROFILE%\documents\my music\sample playlists\ryukreadme.html
%ALLUSERSPROFILE%\documents\my music\my playlists\ryukreadme.html
%ALLUSERSPROFILE%\documents\my music\ryukreadme.html
%ALLUSERSPROFILE%\documents\ryukreadme.html
%ALLUSERSPROFILE%\desktop\ryukreadme.html
%ALLUSERSPROFILE%\application data\sun\java\java update\ryukreadme.html
%ALLUSERSPROFILE%\application data\sun\java\ryukreadme.html
%ALLUSERSPROFILE%\documents\my music\sample music\ryukreadme.html
%ALLUSERSPROFILE%\start menu\programs\ryukreadme.html
%ALLUSERSPROFILE%\start menu\programs\accessories\ryukreadme.html
%ALLUSERSPROFILE%\start menu\programs\accessories\accessibility\ryukreadme.html
C:\documents and settings\default user\application data\ryukreadme.html
C:\documents and settings\default user\ryukreadme.html
%ALLUSERSPROFILE%\templates\ryukreadme.html
%ALLUSERSPROFILE%\start menu\programs\winrar\ryukreadme.html
%ALLUSERSPROFILE%\start menu\programs\steam\ryukreadme.html
%ALLUSERSPROFILE%\start menu\programs\qip 2012\ryukreadme.html
%ALLUSERSPROFILE%\start menu\programs\mirc\ryukreadme.html
%ALLUSERSPROFILE%\start menu\programs\microsoft office\microsoft office tools\ryukreadme.html
%ALLUSERSPROFILE%\start menu\programs\microsoft office\ryukreadme.html
%ALLUSERSPROFILE%\start menu\programs\microsoft .net framework sdk v1.1\ryukreadme.html
%ALLUSERSPROFILE%\start menu\programs\games\ryukreadme.html
%ALLUSERSPROFILE%\start menu\programs\administrative tools\ryukreadme.html
%ALLUSERSPROFILE%\start menu\programs\accessories\system tools\ryukreadme.html
%ALLUSERSPROFILE%\start menu\programs\accessories\entertainment\ryukreadme.html
%ALLUSERSPROFILE%\start menu\programs\accessories\communications\ryukreadme.html
C:\documents and settings\default user\templates\ryukreadme.html
volume{6a9759b0-c6f5-11e6-92ae-0800279ec8ab}\system volume information\tracking.log.tmp

Moves the following files

from %ALLUSERSPROFILE%\application data\microsoft\crypto\rsa\machinekeys\08e575673cce10c72090304839888e02_5f9fe710-99e6-4c04-be62-a7f1b8b321d1 to %ALLUSERSPROFILE%\application data\microsoft\crypto\rsa\machinekeys\08e575673cce10c72090304839888e02_5f9fe710-99e6-4c04-be62-a7f1b8b321d1.ryk
from %APPDATA%\icqm\icq\smiles\smiles\8march\ring.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\ring.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\8march\shoes.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\shoes.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\8march\new_dress.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\new_dress.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\8march\car.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\car.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\8march\cat.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\cat.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\8march\love.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\love.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\animated\book.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\book.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\8march\perfume.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\perfume.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\8march\sunburn.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\sunburn.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\8march\joy.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\joy.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\8march\cookie.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\cookie.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\8march\doll.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\doll.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\8march\hug.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\hug.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\8march\flowers.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\flowers.gif.ryk
from %APPDATA%\icqm\icq\smiles\mrasmileslang_uz.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_uz.xml.ryk
from %APPDATA%\icqm\icq\smiles\mrasmileslang_ru.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_ru.xml.ryk
from %APPDATA%\icqm\icq\smiles\smiles\8march\mad.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\mad.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\8march\drink.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\drink.gif.ryk
from %APPDATA%\icqm\icq\smiles\mrasmileslang_pt.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_pt.xml.ryk
from %APPDATA%\icqm\icq\smiles\flash\smeh.swf to %APPDATA%\icqm\icq\smiles\flash\smeh.swf.ryk
from %APPDATA%\icqm\icq\smiles\flash\wf_love_sdaus.swf to %APPDATA%\icqm\icq\smiles\flash\wf_love_sdaus.swf.ryk
from %APPDATA%\icqm\icq\smiles\flash\rabotaet.swf to %APPDATA%\icqm\icq\smiles\flash\rabotaet.swf.ryk
from %APPDATA%\icqm\icq\smiles\flash\tank.swf to %APPDATA%\icqm\icq\smiles\flash\tank.swf.ryk
from %APPDATA%\icqm\icq\smiles\flash\sorry.swf to %APPDATA%\icqm\icq\smiles\flash\sorry.swf.ryk
from %APPDATA%\icqm\icq\smiles\flash\wf_love_srazila.swf to %APPDATA%\icqm\icq\smiles\flash\wf_love_srazila.swf.ryk
from %APPDATA%\icqm\icq\smiles\flash\serdze.swf to %APPDATA%\icqm\icq\smiles\flash\serdze.swf.ryk
from %APPDATA%\icqm\icq\smiles\mrasmileslang_en.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_en.xml.ryk
from %APPDATA%\icqm\icq\smiles\skin.txt to %APPDATA%\icqm\icq\smiles\skin.txt.ryk
from %APPDATA%\icqm\icq\smiles\mrasmileslang_bg.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_bg.xml.ryk
from %APPDATA%\icqm\icq\smiles\mrasmileslang_kz.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_kz.xml.ryk
from %APPDATA%\icqm\icq\smiles\mrasmileslang_cz.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_cz.xml.ryk
from %APPDATA%\icqm\icq\smiles\mrasmileslang_de.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_de.xml.ryk
from %APPDATA%\icqm\icq\smiles\mrasmileslang_tr.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_tr.xml.ryk
from %APPDATA%\icqm\icq\smiles\flash\zadolbal.swf to %APPDATA%\icqm\icq\smiles\flash\zadolbal.swf.ryk
from %APPDATA%\icqm\icq\smiles\mrasmileslang_ua.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_ua.xml.ryk
from %APPDATA%\icqm\icq\smiles\flash\angel.swf to %APPDATA%\icqm\icq\smiles\flash\angel.swf.ryk
from %APPDATA%\icqm\icq\smiles\smiles\animated\red.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\red.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\animated\flowr.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\flowr.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\animated\poison.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\poison.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\animated\victory.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\victory.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\animated\tongue.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\tongue.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\animated\sing.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\sing.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\animated\smile.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\smile.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\animated\skuka.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\skuka.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\animated\history.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\history.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\animated\sleep.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\sleep.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_mouse.gif to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_mouse.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_hand.gif to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_hand.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_meow.gif to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_meow.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_paper.gif to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_paper.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_lick.gif to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_lick.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\animated\fight.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\fight.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\animated\angel.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\angel.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\animated\gg.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\gg.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\animated\blew.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\blew.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\animated\beauty.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\beauty.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\animated\hungry.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\hungry.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\animated\devil.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\devil.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\animated\dance.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\dance.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\animated\beer.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\beer.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\animated\could.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\could.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\animated\appl.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\appl.gif.ryk
from %APPDATA%\icqm\icq\smiles\flash\sobaka.swf to %APPDATA%\icqm\icq\smiles\flash\sobaka.swf.ryk
from %APPDATA%\icqm\icq\smiles\smiles\animated\gg2.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\gg2.gif.ryk
from %APPDATA%\icqm\icq\smiles\flash\rosy.swf to %APPDATA%\icqm\icq\smiles\flash\rosy.swf.ryk
from %APPDATA%\icqm\icq\smiles\smiles\animated\fingal.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\fingal.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\animated\sad.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\sad.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\animated\rainbow.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\rainbow.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\animated\love.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\love.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\animated\cry.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\cry.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\animated\gift.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\gift.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\animated\eat.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\eat.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\animated\kiss.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\kiss.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\animated\pistolet.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\pistolet.gif.ryk
from %APPDATA%\icqm\icq\smiles\flash\sobaka_strelyaet.swf to %APPDATA%\icqm\icq\smiles\flash\sobaka_strelyaet.swf.ryk
from %APPDATA%\icqm\icq\smiles\flash\love_bear_rose.swf to %APPDATA%\icqm\icq\smiles\flash\love_bear_rose.swf.ryk
from %APPDATA%\icqm\icq\smiles\flash\skratch.swf to %APPDATA%\icqm\icq\smiles\flash\skratch.swf.ryk
from %APPDATA%\icqm\icq\database\citylist_ru.csv to %APPDATA%\icqm\icq\database\citylist_ru.csv.ryk
from %APPDATA%\icqm\icq\database\citylist_kz.csv to %APPDATA%\icqm\icq\database\citylist_kz.csv.ryk
from %APPDATA%\icqm\icq\database\citylist_ua.csv to %APPDATA%\icqm\icq\database\citylist_ua.csv.ryk
from %APPDATA%\icqm\icq\fonts\segoesc.ttf to %APPDATA%\icqm\icq\fonts\segoesc.ttf.ryk
from %APPDATA%\icqm\icq\html\bg\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\bg\loading\progress_agent.gif.ryk
from %APPDATA%\icqm\icq\dll\altergeo.msi to %APPDATA%\icqm\icq\dll\altergeo.msi.ryk
from %APPDATA%\icqm\icq\html\cz\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\cz\loading\progress_agent.gif.ryk
from %APPDATA%\icqm\icq\html\de\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\de\loading\progress_agent.gif.ryk
from %APPDATA%\icq-profile\update\languages.dict to %APPDATA%\icq-profile\update\languages.dict.ryk
from %APPDATA%\icq-profile\update\languages.hash to %APPDATA%\icq-profile\update\languages.hash.ryk
from %APPDATA%\icqm\icq\html\en\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\en\loading\progress_agent.gif.ryk
from %APPDATA%\icqm\icq\html\kz\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\kz\loading\progress_agent.gif.ryk
from %APPDATA%\icqm\icq\html\pt\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\pt\loading\progress_agent.gif.ryk
from %APPDATA%\icq-profile\base\mra.dbs to %APPDATA%\icq-profile\base\mra.dbs.ryk
from %APPDATA%\icq-profile\update\languages.aff to %APPDATA%\icq-profile\update\languages.aff.ryk
from %APPDATA%\icqm\icq\database\citylist_uz.csv to %APPDATA%\icqm\icq\database\citylist_uz.csv.ryk
from %APPDATA%\icqm\icq\database\citylist_tr.csv to %APPDATA%\icqm\icq\database\citylist_tr.csv.ryk
from %APPDATA%\icq-profile\installerlang.xml to %APPDATA%\icq-profile\installerlang.xml.ryk
from %APPDATA%\adobe\acrobat\10.0\tmdocs.sav to %APPDATA%\adobe\acrobat\10.0\tmdocs.sav.ryk
from %APPDATA%\adobe\acrobat\10.0\javascripts\glob.js to %APPDATA%\adobe\acrobat\10.0\javascripts\glob.js.ryk
from %APPDATA%\.purple\prefs.xml to %APPDATA%\.purple\prefs.xml.ryk
from %APPDATA%\adobe\acrobat\10.0\readermessages to %APPDATA%\adobe\acrobat\10.0\readermessages.ryk
from %APPDATA%\adobe\acrobat\10.0\security\addressbook.acrodata to %APPDATA%\adobe\acrobat\10.0\security\addressbook.acrodata.ryk
from %APPDATA%\adobe\acrobat\10.0\javascripts\glob.settings.js to %APPDATA%\adobe\acrobat\10.0\javascripts\glob.settings.js.ryk
from %APPDATA%\adobe\acrobat\10.0\security\crlcache\48b76449f3d5fefa1133aa805e420f0fca643651.crl to %APPDATA%\adobe\acrobat\10.0\security\crlcache\48b76449f3d5fefa1133aa805e420f0fca643651.crl.ryk
from %APPDATA%\icqm\icq\html\ru\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\ru\loading\progress_agent.gif.ryk
from %APPDATA%\icqm\icq\smiles\smiles\animated\wonder.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\wonder.gif.ryk
from %APPDATA%\adobe\acrobat\10.0\security\crlcache\a9b8213768adc68af64fcc6409e8be414726687f.crl to %APPDATA%\adobe\acrobat\10.0\security\crlcache\a9b8213768adc68af64fcc6409e8be414726687f.crl.ryk
from %APPDATA%\adobe\acrobat\9.0\adobesysfnt09.lst to %APPDATA%\adobe\acrobat\9.0\adobesysfnt09.lst.ryk
from %APPDATA%\adobe\acrobat\9.0\adobecmapfnt09.lst to %APPDATA%\adobe\acrobat\9.0\adobecmapfnt09.lst.ryk
from %APPDATA%\adobe\acrobat\9.0\javascripts\glob.js to %APPDATA%\adobe\acrobat\9.0\javascripts\glob.js.ryk
from %APPDATA%\adobe\acrobat\9.0\shareddataevents to %APPDATA%\adobe\acrobat\9.0\shareddataevents.ryk
from %APPDATA%\adobe\acrobat\9.0\javascripts\glob.settings.js to %APPDATA%\adobe\acrobat\9.0\javascripts\glob.settings.js.ryk
from %APPDATA%\adobe\acrobat\9.0\usercache.bin to %APPDATA%\adobe\acrobat\9.0\usercache.bin.ryk
from %APPDATA%\.purple\status.xml to %APPDATA%\.purple\status.xml.ryk
from %APPDATA%\adobe\acrobat\10.0\tmgrpprm.sav to %APPDATA%\adobe\acrobat\10.0\tmgrpprm.sav.ryk
from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_attack.gif to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_attack.gif.ryk
from %APPDATA%\icqm\icq\html\tr\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\tr\loading\progress_agent.gif.ryk
from %APPDATA%\icqm\icq\smiles\flash\bodun.swf to %APPDATA%\icqm\icq\smiles\flash\bodun.swf.ryk
from %APPDATA%\icqm\icq\smiles\flash\kot_nedutza.swf to %APPDATA%\icqm\icq\smiles\flash\kot_nedutza.swf.ryk
from %APPDATA%\icqm\icq\smiles\flash\kot_obida.swf to %APPDATA%\icqm\icq\smiles\flash\kot_obida.swf.ryk
from %APPDATA%\icqm\icq\smiles\flash\drako_zombie.swf to %APPDATA%\icqm\icq\smiles\flash\drako_zombie.swf.ryk
from %APPDATA%\icqm\icq\smiles\flash\kot_goodbye.swf to %APPDATA%\icqm\icq\smiles\flash\kot_goodbye.swf.ryk
from %APPDATA%\icqm\icq\smiles\flash\kot_spasibo.swf to %APPDATA%\icqm\icq\smiles\flash\kot_spasibo.swf.ryk
from %APPDATA%\icqm\icq\database\citylist_en.csv to %APPDATA%\icqm\icq\database\citylist_en.csv.ryk
from %APPDATA%\icqm\icq\smiles\flash\missyou.swf to %APPDATA%\icqm\icq\smiles\flash\missyou.swf.ryk
from %APPDATA%\icqm\icq\smiles\flash\krizis.swf to %APPDATA%\icqm\icq\smiles\flash\krizis.swf.ryk
from %APPDATA%\icqm\icq\smiles\flash\laugh.swf to %APPDATA%\icqm\icq\smiles\flash\laugh.swf.ryk
from %APPDATA%\icqm\icq\smiles\flash\mad dog.swf to %APPDATA%\icqm\icq\smiles\flash\mad dog.swf.ryk
from %APPDATA%\icqm\icq\smiles\flash\love_bear_kiss.swf to %APPDATA%\icqm\icq\smiles\flash\love_bear_kiss.swf.ryk
from %APPDATA%\icqm\icq\smiles\flash\likeu.swf to %APPDATA%\icqm\icq\smiles\flash\likeu.swf.ryk
from %APPDATA%\icqm\icq\smiles\flash\love_bear_hugs.swf to %APPDATA%\icqm\icq\smiles\flash\love_bear_hugs.swf.ryk
from %APPDATA%\icqm\icq\smiles\flash\guby.swf to %APPDATA%\icqm\icq\smiles\flash\guby.swf.ryk
from %APPDATA%\icqm\icq\smiles\flash\kot_wow.swf to %APPDATA%\icqm\icq\smiles\flash\kot_wow.swf.ryk
from %APPDATA%\icqm\icq\smiles\flash\drako_opyatnica.swf to %APPDATA%\icqm\icq\smiles\flash\drako_opyatnica.swf.ryk
from %APPDATA%\icqm\icq\smiles\flash\drako_snegyrka.swf to %APPDATA%\icqm\icq\smiles\flash\drako_snegyrka.swf.ryk
from %APPDATA%\icqm\icq\smiles\flash\duh.swf to %APPDATA%\icqm\icq\smiles\flash\duh.swf.ryk
from %APPDATA%\icqm\icq\smiles\flash\kot_cool.swf to %APPDATA%\icqm\icq\smiles\flash\kot_cool.swf.ryk
from %APPDATA%\icqm\icq\smiles\flash\beer.swf to %APPDATA%\icqm\icq\smiles\flash\beer.swf.ryk
from %APPDATA%\icqm\icq\smiles\flash\beback.swf to %APPDATA%\icqm\icq\smiles\flash\beback.swf.ryk
from %APPDATA%\icqm\icq\smiles\flash\bad_cold.swf to %APPDATA%\icqm\icq\smiles\flash\bad_cold.swf.ryk
from %APPDATA%\icqm\icq\smiles\flash\boo.swf to %APPDATA%\icqm\icq\smiles\flash\boo.swf.ryk
from %APPDATA%\icqm\icq\smiles\flash\chillout.swf to %APPDATA%\icqm\icq\smiles\flash\chillout.swf.ryk
from %APPDATA%\icqm\icq\html\ua\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\ua\loading\progress_agent.gif.ryk
from %APPDATA%\icqm\icq\smiles\flash\devochka.swf to %APPDATA%\icqm\icq\smiles\flash\devochka.swf.ryk
from %APPDATA%\icqm\icq\smiles\flash\akitaka.swf to %APPDATA%\icqm\icq\smiles\flash\akitaka.swf.ryk
from %APPDATA%\icqm\icq\smiles\flash\drako_bolnoy.swf to %APPDATA%\icqm\icq\smiles\flash\drako_bolnoy.swf.ryk
from %APPDATA%\icqm\icq\smiles\flash\kisses.swf to %APPDATA%\icqm\icq\smiles\flash\kisses.swf.ryk
from %APPDATA%\icqm\icq\smiles\flash\joy.swf to %APPDATA%\icqm\icq\smiles\flash\joy.swf.ryk
from %APPDATA%\icqm\icq\smiles\flash\gangsta.swf to %APPDATA%\icqm\icq\smiles\flash\gangsta.swf.ryk
from %APPDATA%\icqm\icq\smiles\flash\drako_koster.swf to %APPDATA%\icqm\icq\smiles\flash\drako_koster.swf.ryk
from %APPDATA%\icqm\icq\smiles\flash\drako_love.swf to %APPDATA%\icqm\icq\smiles\flash\drako_love.swf.ryk
from %APPDATA%\icqm\icq\html\uz\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\uz\loading\progress_agent.gif.ryk
from %APPDATA%\icqm\icq\smiles\flash\information.swf to %APPDATA%\icqm\icq\smiles\flash\information.swf.ryk
from %APPDATA%\icqm\icq\smiles\flash\canthearu.swf to %APPDATA%\icqm\icq\smiles\flash\canthearu.swf.ryk
from volume{6a9759b0-c6f5-11e6-92ae-0800279ec8ab}\system volume information\tracking.log.tmp to volume{6a9759b0-c6f5-11e6-92ae-0800279ec8ab}\system volume information\tracking.log

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Creates and executes the following

'<Current directory>\lsqzciv.exe' 8 LAN
'<Current directory>\lsqzciv.exe' 8 LAN' (with hidden window)

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial