Trojan.Encoder.29688

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\] 'unlock' = '"c:\Decoding help.hta"'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\] 'searchfiles' = '%WINDIR%\searchfiles.exe'
[<HKLM>\Software\Classes\.[ID]MUsnD0o3adbBXHM9[ID]\shell\open\command] '' = '%WINDIR%\SysWow64\mshta.exe "c:\Decoding help.hta"'

Infects the following executable files

%CommonProgramFiles(x86)%\steam\steamservice.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles(x86)%\k-lite codec pack\filters\vsfilter.dll.[id]musnd0o3adbbxhm9[id]
%ProgramFiles(x86)%\k-lite codec pack\tools\codectweaktool.exe.[id]musnd0o3adbbxhm9[id]
%CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\osppobjs.dll.[id]musnd0o3adbbxhm9[id]
%CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\osppsvc.exe.[id]musnd0o3adbbxhm9[id]
%CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\osppwmi.dll.[id]musnd0o3adbbxhm9[id]
%ProgramFiles(x86)%\k-lite codec pack\mpc-hc64\d3dcompiler_43.dll.[id]musnd0o3adbbxhm9[id]
%CommonProgramFiles(x86)%\microsoft shared\help\msenv.dll.[id]musnd0o3adbbxhm9[id]
%CommonProgramFiles(x86)%\microsoft shared\textconv\wksconv\wkconv.exe.[id]musnd0o3adbbxhm9[id]
%ProgramFiles(x86)%\microsoft analysis services\as oledb\10\msmdlocal.dll.[id]musnd0o3adbbxhm9[id]

Creates the following files on removable media

<Drive name for removable media>:\decoding help.hta
<Drive name for removable media>:\split.avi
<Drive name for removable media>:\000814251_video_01.avi
<Drive name for removable media>:\join.avi
<Drive name for removable media>:\default.bmp
<Drive name for removable media>:\dialmap.bmp
<Drive name for removable media>:\coffee.bmp
<Drive name for removable media>:\dashborder_192.bmp
<Drive name for removable media>:\sdksampleprivdeveloper.cer
<Drive name for removable media>:\sdkfailsafeemulator.cer
<Drive name for removable media>:\contoso.cer
<Drive name for removable media>:\tcm851ax32.exe

Malicious functions

To complicate detection of its presence in the operating system,

blocks the following features:

User Account Control (UAC)

deletes volume shadow copies.

Modifies file system

Creates the following files

%WINDIR%\searchfiles.exe
%ProgramFiles%\avpm\decoding help.hta
%ProgramFiles%\avpcc\decoding help.hta
%ProgramFiles%\avnotify\decoding help.hta
%ProgramFiles%\avkwctl\decoding help.hta
%ProgramFiles%\avkservice\decoding help.hta
%ProgramFiles%\btini\decoding help.hta
%ProgramFiles%\bdnews\decoding help.hta
%ProgramFiles%\blindman\decoding help.hta
%ProgramFiles%\bdagent\decoding help.hta
%ProgramFiles%\blackd\decoding help.hta
%ProgramFiles%\bdswitch\decoding help.hta
%ProgramFiles%\bdsurvey\decoding help.hta
%ProgramFiles%\bdsubmitwiz\decoding help.hta
%ProgramFiles%\bdsubmit\decoding help.hta
%ProgramFiles%\cavoar\decoding help.hta
%ProgramFiles%\cavmud\decoding help.hta
%ProgramFiles%\blackice\decoding help.hta
%ProgramFiles%\cavaud\decoding help.hta
%ProgramFiles%\bdwizreg\decoding help.hta
%ProgramFiles%\bdmcon\decoding help.hta
%ProgramFiles%\bdoesrv\decoding help.hta
%ProgramFiles%\bdss\decoding help.hta
%ProgramFiles%\autostartexplorer\decoding help.hta
%ProgramFiles%\autodown\decoding help.hta
%ProgramFiles%\aswupdsv\decoding help.hta
%ProgramFiles%\avgnpsvc\decoding help.hta
%ProgramFiles%\avgnpdln\decoding help.hta
%ProgramFiles%\avginet\decoding help.hta
%ProgramFiles%\avgfwsrv\decoding help.hta
%ProgramFiles%\avadmin\decoding help.hta
%ProgramFiles%\avgcc\decoding help.hta
%ProgramFiles%\avconsol\decoding help.hta
%ProgramFiles%\avconfig\decoding help.hta
%ProgramFiles%\avkserv\decoding help.hta
%ProgramFiles%\avinitnt\decoding help.hta
%ProgramFiles%\avgwizfw\decoding help.hta
%ProgramFiles%\avgupsvc\decoding help.hta
%ProgramFiles%\avgupden\decoding help.hta
%ProgramFiles%\avgscan\decoding help.hta
%ProgramFiles%\avgamsvr\decoding help.hta
%ProgramFiles%\avgrssvc\decoding help.hta
%ProgramFiles%\avciman\decoding help.hta
%ProgramFiles%\autotrace\decoding help.hta
%ProgramFiles%\cavasm\decoding help.hta
%ProgramFiles%\btinint\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\information retrieval\decoding help.hta
%PROGRAMDATA%\microsoft\user account pictures\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\ink\decoding help.hta
C:\far2\encyclopedia\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\ink\1.7\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\ink\1.0\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\stationery\decoding help.hta
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\dao\decoding help.hta
%ProgramFiles(x86)%\mozilla firefox\decoding help.hta
C:\far2\fexcept\decoding help.hta
%PROGRAMDATA%\microsoft\identitycrl\decoding help.hta
%CommonProgramFiles(x86)%\adobe\helpcfg\en_us\decoding help.hta
%PROGRAMDATA%\microsoft\network\downloader\decoding help.hta
%PROGRAMDATA%\microsoft\user account pictures\default pictures\decoding help.hta
%PROGRAMDATA%\microsoft\ilscache\decoding help.hta
C:\users\all users\microsoft toolkit\settings.xml.[id]musnd0o3adbbxhm9[id]
C:\users\all users\microsoft help\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\help\decoding help.hta
%CommonProgramFiles(x86)%\adobe\arm\1.0\cache\decoding help.hta
%ProgramFiles(x86)%\adobe\acrobat reader dc\resource\decoding help.hta
%ProgramFiles%\alsvc\decoding help.hta
%ProgramFiles%\cavsn\decoding help.hta
%ProgramFiles%\cavse\decoding help.hta
%ProgramFiles%\cavscons\decoding help.hta
%ProgramFiles%\cavq\decoding help.hta
%ProgramFiles%\cavumas\decoding help.hta
%ProgramFiles%\cavsubmit\decoding help.hta
%ProgramFiles%\cavsub\decoding help.hta
%ProgramFiles%\ccapp\decoding help.hta
%ProgramFiles%\cavvl\decoding help.hta
%ProgramFiles%\cavuserupd\decoding help.hta
%ProgramFiles%\ccsetmgr\decoding help.hta
%ProgramFiles%\ccproxy\decoding help.hta
%ProgramFiles%\ccleaner\decoding help.hta
%ProgramFiles%\ccevtmgr\decoding help.hta
%ProgramFiles%\clamwin\decoding help.hta
%ProgramFiles%\chrome\decoding help.hta
%ProgramFiles%\cemrep\decoding help.hta
%ProgramFiles%\cavapp\decoding help.hta
%ProgramFiles%\cabalmain\decoding help.hta
%ProgramFiles%\cafix\decoding help.hta
%ProgramFiles%\avcenter\decoding help.hta
%ProgramFiles%\avcmd\decoding help.hta
%ProgramFiles%\ashquick\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\ink\en-us\decoding help.hta
%ProgramFiles(x86)%\adobe\acrobat reader dc\esl\decoding help.hta
%ProgramFiles%\decoding help.hta
%ProgramFiles%\avgdiag\decoding help.hta
%ProgramFiles%\aswregsvr\decoding help.hta
%ProgramFiles%\ashwebsv\decoding help.hta
C:\users\default\decoding help.hta
%ProgramFiles%\ackwin32\decoding help.hta
C:\far2\decoding help.hta
%ProgramFiles%\a2cmd\decoding help.hta
%ProgramFiles%\dekaron\decoding help.hta
%ProgramFiles%\cpd\decoding help.hta
%ProgramFiles%\cavmr\decoding help.hta
%ProgramFiles%\cavemsrv\decoding help.hta
%ProgramFiles%\backweb-4476822\decoding help.hta
%ProgramFiles%\b2\decoding help.hta
%ProgramFiles%\about\decoding help.hta
C:\users\decoding help.hta
%ProgramFiles%\360tray\decoding help.hta
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\decoding help.hta
%PROGRAMDATA%\microsoft\officesoftwareprotectionplatform\cache\decoding help.hta
%WINDIR%\ncler.txt
D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\decoding help.hta
%PROGRAMDATA%\decoding help.hta
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\decoding help.hta
%ProgramFiles(x86)%\decoding help.hta
<Current directory>\decoding help.hta
%ProgramFiles(x86)%\adobe\acrobat reader dc\decoding help.hta
%CommonProgramFiles(x86)%\services\decoding help.hta
%CommonProgramFiles(x86)%\steam\decoding help.hta
C:\decoding help.hta
%CommonProgramFiles(x86)%\adobe\arm\1.0\decoding help.hta
%PROGRAMDATA%\microsoft\officesoftwareprotectionplatform\decoding help.hta
C:\totalcmd\decoding help.hta
%ProgramFiles(x86)%\internet explorer\decoding help.hta
%ProgramFiles(x86)%\k-lite codec pack\decoding help.hta
%CommonProgramFiles(x86)%\system\decoding help.hta
%CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\decoding help.hta
%CommonProgramFiles(x86)%\java\java update\decoding help.hta
%ProgramFiles%\avsynmgr\decoding help.hta
%CommonProgramFiles(x86)%\px storage engine\decoding help.hta
%ProgramFiles%\avscan\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\help\1040\decoding help.hta
%ProgramFiles%\avgw\decoding help.hta
%ProgramFiles%\aoltbserver\decoding help.hta
%ProgramFiles%\anti-trojan\decoding help.hta
%ProgramFiles%\amsn\decoding help.hta
%ProgramFiles%\ashpopwz\decoding help.hta
%ProgramFiles%\ashmaisv\decoding help.hta
%ProgramFiles%\ashlogv\decoding help.hta
%ProgramFiles%\ashenhcd\decoding help.hta
%ProgramFiles%\ashdug\decoding help.hta
%ProgramFiles%\ashdisp\decoding help.hta
%ProgramFiles%\ashchest\decoding help.hta
%ProgramFiles%\ashavsrv\decoding help.hta
%ProgramFiles%\ash_updatemediator\decoding help.hta
%ProgramFiles%\ashupd\decoding help.hta
%ProgramFiles%\ashskpck\decoding help.hta
%ProgramFiles%\ashskpcc\decoding help.hta
%ProgramFiles%\ashsimpl\decoding help.hta
%ProgramFiles%\ashsimp2\decoding help.hta
%ProgramFiles%\ashserv\decoding help.hta
%ProgramFiles%\armor2net\decoding help.hta
%ProgramFiles%\avgvv\decoding help.hta
%ProgramFiles%\antivirus\decoding help.hta
%PROGRAMDATA%\microsoft\mf\decoding help.hta
C:\users\all users\mozilla\logs\maintenanceservice-install.log.[id]musnd0o3adbbxhm9[id]
%ProgramFiles%\ash\decoding help.hta
%ProgramFiles%\admunch\decoding help.hta
%ProgramFiles%\aavshield\decoding help.hta
%ProgramFiles%\a2wizard\decoding help.hta
%ProgramFiles%\a2upd\decoding help.hta
%ProgramFiles%\airdefense\decoding help.hta
%ProgramFiles%\aimpro\decoding help.hta
%ProgramFiles%\aim6\decoding help.hta
%ProgramFiles%\ahnsd\decoding help.hta
%ProgramFiles%\avgemc\decoding help.hta
%ProgramFiles%\ageofconan\decoding help.hta
%ProgramFiles%\a2scan\decoding help.hta
%ProgramFiles%\a2service\decoding help.hta
%ProgramFiles%\a2guard\decoding help.hta
%ProgramFiles%\a2hijackfree\decoding help.hta
%ProgramFiles%\amon\decoding help.hta
%ProgramFiles%\almon\decoding help.hta
%ProgramFiles%\agb5\decoding help.hta
%ProgramFiles%\ashavast\decoding help.hta
%ProgramFiles%\a2start\decoding help.hta
%ProgramFiles%\armorsurf\decoding help.hta
C:\users\all users\mozilla\logs\maintenanceservice-uninstall.log.[id]musnd0o3adbbxhm9[id]

Moves the following files

from %ProgramFiles(x86)%\desktop.ini to %ProgramFiles(x86)%\desktop.ini.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\avkwctl\avkwctl.exe to %ProgramFiles%\avkwctl\avkwctl.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\avkservice\avkservice.exe to %ProgramFiles%\avkservice\avkservice.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\btini\btini.exe to %ProgramFiles%\btini\btini.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\blindman\blindman.exe to %ProgramFiles%\blindman\blindman.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\blackice\blackice.exe to %ProgramFiles%\blackice\blackice.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\blackd\blackd.exe to %ProgramFiles%\blackd\blackd.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\bdwizreg\bdwizreg.exe to %ProgramFiles%\bdwizreg\bdwizreg.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\bdswitch\bdswitch.exe to %ProgramFiles%\bdswitch\bdswitch.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\bdsurvey\bdsurvey.exe to %ProgramFiles%\bdsurvey\bdsurvey.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\bdsubmitwiz\bdsubmitwiz.exe to %ProgramFiles%\bdsubmitwiz\bdsubmitwiz.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\bdsubmit\bdsubmit.exe to %ProgramFiles%\bdsubmit\bdsubmit.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\cavoar\cavoar.exe to %ProgramFiles%\cavoar\cavoar.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\cavmud\cavmud.exe to %ProgramFiles%\cavmud\cavmud.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\cavaud\cavaud.exe to %ProgramFiles%\cavaud\cavaud.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\cavasm\cavasm.exe to %ProgramFiles%\cavasm\cavasm.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\avnotify\avnotify.exe to %ProgramFiles%\avnotify\avnotify.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\cavapp\cavapp.exe to %ProgramFiles%\cavapp\cavapp.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\avpcc\avpcc.exe to %ProgramFiles%\avpcc\avpcc.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\bdagent\bdagent.exe to %ProgramFiles%\bdagent\bdagent.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\avgcc\avgcc.exe to %ProgramFiles%\avgcc\avgcc.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\avgamsvr\avgamsvr.exe to %ProgramFiles%\avgamsvr\avgamsvr.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\avconsol\avconsol.exe to %ProgramFiles%\avconsol\avconsol.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\avconfig\avconfig.exe to %ProgramFiles%\avconfig\avconfig.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\avkserv\avkserv.exe to %ProgramFiles%\avkserv\avkserv.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\avinitnt\avinitnt.exe to %ProgramFiles%\avinitnt\avinitnt.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\avgwizfw\avgwizfw.exe to %ProgramFiles%\avgwizfw\avgwizfw.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\avgupsvc\avgupsvc.exe to %ProgramFiles%\avgupsvc\avgupsvc.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\avgupden\avgupden.exe to %ProgramFiles%\avgupden\avgupden.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\avgscan\avgscan.exe to %ProgramFiles%\avgscan\avgscan.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\avgrssvc\avgrssvc.exe to %ProgramFiles%\avgrssvc\avgrssvc.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\bdss\bdss.exe to %ProgramFiles%\bdss\bdss.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\bdoesrv\bdoesrv.exe to %ProgramFiles%\bdoesrv\bdoesrv.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\bdnews\bdnews.exe to %ProgramFiles%\bdnews\bdnews.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\bdmcon\bdmcon.exe to %ProgramFiles%\bdmcon\bdmcon.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\avpm\avpm.exe to %ProgramFiles%\avpm\avpm.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\cemrep\cemrep.exe to %ProgramFiles%\cemrep\cemrep.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\pavprsrv\pavprsrv.exe to %ProgramFiles%\pavprsrv\pavprsrv.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\btinint\btinint.exe to %ProgramFiles%\btinint\btinint.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles(x86)%\k-lite codec pack\filters\vsfilter.dll to %ProgramFiles(x86)%\k-lite codec pack\filters\vsfilter.dll.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles(x86)%\k-lite codec pack\tools\codectweaktool-1.bin to %ProgramFiles(x86)%\k-lite codec pack\tools\codectweaktool-1.bin.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles(x86)%\k-lite codec pack\tools\codectweaktool.exe to %ProgramFiles(x86)%\k-lite codec pack\tools\codectweaktool.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles(x86)%\k-lite codec pack\mpc-hc64\d3dcompiler_43.dll to %ProgramFiles(x86)%\k-lite codec pack\mpc-hc64\d3dcompiler_43.dll.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles(x86)%\k-lite codec pack\info\faq.css to %ProgramFiles(x86)%\k-lite codec pack\info\faq.css.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\clamtray\clamtray.exe to %ProgramFiles%\clamtray\clamtray.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\clamscan\clamscan.exe to %ProgramFiles%\clamscan\clamscan.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\msmdlocal.dll to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\msmdlocal.dll.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\partinfo\partinfo.exe to %ProgramFiles%\partinfo\partinfo.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\partin9x\partin9x.exe to %ProgramFiles%\partin9x\partin9x.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\partin\partin.exe to %ProgramFiles%\partin\partin.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\outpost\outpost.exe to %ProgramFiles%\outpost\outpost.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\pccntmon\pccntmon.exe to %ProgramFiles%\pccntmon\pccntmon.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\pccguide\pccguide.exe to %ProgramFiles%\pccguide\pccguide.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\pavsrv51\pavsrv51.exe to %ProgramFiles%\pavsrv51\pavsrv51.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles(x86)%\internet explorer\signup\install.ins to %ProgramFiles(x86)%\internet explorer\signup\install.ins.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\avgfwsrv\avgfwsrv.exe to %ProgramFiles%\avgfwsrv\avgfwsrv.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles(x86)%\k-lite codec pack\tools\codectweaktool-0.bin to %ProgramFiles(x86)%\k-lite codec pack\tools\codectweaktool-0.bin.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\chrome\chrome.exe to %ProgramFiles%\chrome\chrome.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\cavsn\cavsn.exe to %ProgramFiles%\cavsn\cavsn.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\cavse\cavse.exe to %ProgramFiles%\cavse\cavse.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\cavscons\cavscons.exe to %ProgramFiles%\cavscons\cavscons.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\cavq\cavq.exe to %ProgramFiles%\cavq\cavq.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\cavumas\cavumas.exe to %ProgramFiles%\cavumas\cavumas.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\cavsubmit\cavsubmit.exe to %ProgramFiles%\cavsubmit\cavsubmit.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\cavsub\cavsub.exe to %ProgramFiles%\cavsub\cavsub.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\ccapp\ccapp.exe to %ProgramFiles%\ccapp\ccapp.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\cavvl\cavvl.exe to %ProgramFiles%\cavvl\cavvl.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\cavuserupd\cavuserupd.exe to %ProgramFiles%\cavuserupd\cavuserupd.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\ccsetmgr\ccsetmgr.exe to %ProgramFiles%\ccsetmgr\ccsetmgr.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\ccproxy\ccproxy.exe to %ProgramFiles%\ccproxy\ccproxy.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\ccleaner\ccleaner.exe to %ProgramFiles%\ccleaner\ccleaner.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\ccevtmgr\ccevtmgr.exe to %ProgramFiles%\ccevtmgr\ccevtmgr.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\clamwin\clamwin.exe to %ProgramFiles%\clamwin\clamwin.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\cafix\cafix.exe to %ProgramFiles%\cafix\cafix.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\cabalmain\cabalmain.exe to %ProgramFiles%\cabalmain\cabalmain.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\avginet\avginet.exe to %ProgramFiles%\avginet\avginet.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\amon\amon.exe to %ProgramFiles%\amon\amon.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\avgw\avgw.exe to %ProgramFiles%\avgw\avgw.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\avgvv\avgvv.exe to %ProgramFiles%\avgvv\avgvv.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\avgemc\avgemc.exe to %ProgramFiles%\avgemc\avgemc.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\admunch\admunch.exe to %ProgramFiles%\admunch\admunch.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\aavshield\aavshield.exe to %ProgramFiles%\aavshield\aavshield.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\a2wizard\a2wizard.exe to %ProgramFiles%\a2wizard\a2wizard.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\a2upd\a2upd.exe to %ProgramFiles%\a2upd\a2upd.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\airdefense\airdefense.exe to %ProgramFiles%\airdefense\airdefense.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\aimpro\aimpro.exe to %ProgramFiles%\aimpro\aimpro.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\aim6\aim6.exe to %ProgramFiles%\aim6\aim6.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\ahnsd\ahnsd.exe to %ProgramFiles%\ahnsd\ahnsd.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\ageofconan\ageofconan.exe to %ProgramFiles%\ageofconan\ageofconan.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\a2start\a2start.exe to %ProgramFiles%\a2start\a2start.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\a2scan\a2scan.exe to %ProgramFiles%\a2scan\a2scan.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\a2service\a2service.exe to %ProgramFiles%\a2service\a2service.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\avscan\avscan.exe to %ProgramFiles%\avscan\avscan.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\a2guard\a2guard.exe to %ProgramFiles%\a2guard\a2guard.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\avsynmgr\avsynmgr.exe to %ProgramFiles%\avsynmgr\avsynmgr.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\backweb-4476822\backweb-4476822.exe to %ProgramFiles%\backweb-4476822\backweb-4476822.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles(x86)%\adobe\acrobat reader dc\readme.htm to %ProgramFiles(x86)%\adobe\acrobat reader dc\readme.htm.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles(x86)%\k-lite codec pack\unins000.dat to %ProgramFiles(x86)%\k-lite codec pack\unins000.dat.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\desktop.ini to %ProgramFiles%\desktop.ini.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles(x86)%\adobe\acrobat reader dc\esl\aiodlite.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\esl\aiodlite.dll.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\avgdiag\avgdiag.exe to %ProgramFiles%\avgdiag\avgdiag.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\aswregsvr\aswregsvr.exe to %ProgramFiles%\aswregsvr\aswregsvr.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\ashwebsv\ashwebsv.exe to %ProgramFiles%\ashwebsv\ashwebsv.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\ackwin32\ackwin32.exe to %ProgramFiles%\ackwin32\ackwin32.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\about\about.exe to %ProgramFiles%\about\about.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\a2cmd\a2cmd.exe to %ProgramFiles%\a2cmd\a2cmd.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\360tray\360tray.exe to %ProgramFiles%\360tray\360tray.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\dekaron\dekaron.exe to %ProgramFiles%\dekaron\dekaron.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\cpd\cpd.exe to %ProgramFiles%\cpd\cpd.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\cavmr\cavmr.exe to %ProgramFiles%\cavmr\cavmr.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\cavemsrv\cavemsrv.exe to %ProgramFiles%\cavemsrv\cavemsrv.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\b2\b2.exe to %ProgramFiles%\b2\b2.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\ashchest\ashchest.exe to %ProgramFiles%\ashchest\ashchest.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\avgnpsvc\avgnpsvc.exe to %ProgramFiles%\avgnpsvc\avgnpsvc.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\almon\almon.exe to %ProgramFiles%\almon\almon.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\ashupd\ashupd.exe to %ProgramFiles%\ashupd\ashupd.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\ashskpck\ashskpck.exe to %ProgramFiles%\ashskpck\ashskpck.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\ashskpcc\ashskpcc.exe to %ProgramFiles%\ashskpcc\ashskpcc.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\ashsimpl\ashsimpl.exe to %ProgramFiles%\ashsimpl\ashsimpl.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\ashsimp2\ashsimp2.exe to %ProgramFiles%\ashsimp2\ashsimp2.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\ashserv\ashserv.exe to %ProgramFiles%\ashserv\ashserv.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\ashquick\ashquick.exe to %ProgramFiles%\ashquick\ashquick.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\avcmd\avcmd.exe to %ProgramFiles%\avcmd\avcmd.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\avcenter\avcenter.exe to %ProgramFiles%\avcenter\avcenter.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\avciman\avciman.exe to %ProgramFiles%\avciman\avciman.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\avadmin\avadmin.exe to %ProgramFiles%\avadmin\avadmin.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\autotrace\autotrace.exe to %ProgramFiles%\autotrace\autotrace.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\autostartexplorer\autostartexplorer.exe to %ProgramFiles%\autostartexplorer\autostartexplorer.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\autodown\autodown.exe to %ProgramFiles%\autodown\autodown.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\aswupdsv\aswupdsv.exe to %ProgramFiles%\aswupdsv\aswupdsv.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\ash_updatemediator\ash_updatemediator.exe to %ProgramFiles%\ash_updatemediator\ash_updatemediator.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\avgnpdln\avgnpdln.exe to %ProgramFiles%\avgnpdln\avgnpdln.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\ashavsrv\ashavsrv.exe to %ProgramFiles%\ashavsrv\ashavsrv.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\ashdisp\ashdisp.exe to %ProgramFiles%\ashdisp\ashdisp.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\agb5\agb5.exe to %ProgramFiles%\agb5\agb5.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\ashavast\ashavast.exe to %ProgramFiles%\ashavast\ashavast.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\ash\ash.exe to %ProgramFiles%\ash\ash.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\alsvc\alsvc.exe to %ProgramFiles%\alsvc\alsvc.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\armorsurf\armorsurf.exe to %ProgramFiles%\armorsurf\armorsurf.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\armor2net\armor2net.exe to %ProgramFiles%\armor2net\armor2net.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\aoltbserver\aoltbserver.exe to %ProgramFiles%\aoltbserver\aoltbserver.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\antivirus\antivirus.exe to %ProgramFiles%\antivirus\antivirus.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\anti-trojan\anti-trojan.exe to %ProgramFiles%\anti-trojan\anti-trojan.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\amsn\amsn.exe to %ProgramFiles%\amsn\amsn.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\ashpopwz\ashpopwz.exe to %ProgramFiles%\ashpopwz\ashpopwz.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\ashmaisv\ashmaisv.exe to %ProgramFiles%\ashmaisv\ashmaisv.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\ashlogv\ashlogv.exe to %ProgramFiles%\ashlogv\ashlogv.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\ashenhcd\ashenhcd.exe to %ProgramFiles%\ashenhcd\ashenhcd.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\ashdug\ashdug.exe to %ProgramFiles%\ashdug\ashdug.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\a2hijackfree\a2hijackfree.exe to %ProgramFiles%\a2hijackfree\a2hijackfree.exe.[id]musnd0o3adbbxhm9[id]
from %ProgramFiles%\pavproxy\pavproxy.exe to %ProgramFiles%\pavproxy\pavproxy.exe.[id]musnd0o3adbbxhm9[id]

Substitutes the following executable files

<Full path to file>
%CommonProgramFiles%\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL
%CommonProgramFiles%\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

Substitutes the following files

%CommonProgramFiles(x86)%\Services\verisign.bmp

Moves itself

from <Full path to file> to <Full path to file>.[id]musnd0o3adbbxhm9[id]

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Creates and executes the following

'%WINDIR%\syswow64\cmd.exe' /c vssadmin delete shadows /all' (with hidden window)
'%WINDIR%\syswow64\werfault.exe' -u -p 2316 -s 628' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c vssadmin delete shadows /all

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial