Trojan.Encoder.143

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%HOMEPATH%\Start Menu\Programs\Startup\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\HOW TO DECRYPT FILES.txt

Malicious functions:

Executes the following:

<SYSTEM32>\cmd.exe /c ""<Current directory>\ntfs_system.bat" "
<SYSTEM32>\notepad.exe Z:\HOW TO DECRYPT FILES.txt
<SYSTEM32>\taskmgr.exe

Modifies file system :

Creates the following files:

%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\places\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\preferences\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\feeds\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\tabbrowser\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\feeds\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\places\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\tabview\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\search\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\feeds\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\history\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\bookmarks\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\certerror\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\migration\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\preferences\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\safebrowsing\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\pageinfo\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\places\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\preferences\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\sidebar\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser-region\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\preferences\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\safebrowsing\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\alerts\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\dom\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\autoconfig\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\cookie\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\places\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\communicator\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\tabbrowser\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\tabview\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\branding\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\feeds\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\migration\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\downloads\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1042\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\2052\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1040\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1041\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\3082\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\Speech\1033\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\Speech\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\MSInfo\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1036\HOW TO DECRYPT FILES.txt
C:\Far2\PluginSDK\Headers.pas\HOW TO DECRYPT FILES.txt
<Auxiliary element>
C:\Far2\Plugins\WinSCP\HOW TO DECRYPT FILES.txt
C:\Far2\PluginSDK\Headers.c\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DAO\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1031\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1033\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1025\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1028\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\Stationery\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\SpeechEngines\Microsoft\TTS\1033\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\System\ado\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\SpeechEngines\Microsoft\Lexicon\1033\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\SpeechEngines\Microsoft\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\System\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\content\branding\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\System\msadc\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\System\Ole DB\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Services\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\VC\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\VGX\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\TextConv\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\Triedit\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\Web Folders\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\MSSoap\Binaries\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\MSSoap\Binaries\Resources\1033\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\1033\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\media\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\console\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\dirListing\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\printpreview\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\splitter\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\toolbar\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\radio\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\scrollbar\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\checkbox\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\passwordmgr\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\satchel\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\update\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\xpinstall\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\xbl-marquee\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\alerts\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\tree\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\arrow\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\checkbox\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\alerts\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\console\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\media\HOW TO DECRYPT FILES.txt
<Current directory>\ntfs_system.bat
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\dirListing\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\icons\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\xpinstall\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\handling\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\passwordmgr\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\downloads\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\places\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\update\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\viewsource\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\plugins\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\profile\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\profile\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\extensions\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\handling\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-region\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\downloads\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\plugins\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\update\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\xpinstall\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\preferences\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\profile\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\win\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\security\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\svg\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\layout\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\search\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\xml\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\mac\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\unix\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\xpinstall\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\xslt\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\necko\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\svg\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\xml\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\downloads\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\plugins\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\preferences\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\extensions\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\handling\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\alerts\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\pippki\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\places\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\passwordmgr\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\pipnss\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\services\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\cookie\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\feedback\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\pippki\content\pippki\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\TmpPanel\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\History\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\BGGTYMH1\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\LBMMC3H3\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\MOE00UY1\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Start Menu\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\SendTo\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Templates\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Start Menu\Programs\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\HOW TO DECRYPT FILES.txt
%APPDATA%\HOW TO DECRYPT FILES.txt
%APPDATA%\Microsoft\Address Book\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\HOW TO DECRYPT FILES.txt
%APPDATA%\Microsoft\Internet Explorer\HOW TO DECRYPT FILES.txt
%APPDATA%\Microsoft\Windows\Themes\HOW TO DECRYPT FILES.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\HOW TO DECRYPT FILES.txt
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\HOW TO DECRYPT FILES.txt
%APPDATA%\Microsoft\Media Player\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\History\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Documents\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Documents\My Music\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Documents\My Pictures\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\DRM\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Documents\My Videos\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\HOW TO DECRYPT FILES.txt
C:\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Application Data\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Desktop\HOW TO DECRYPT FILES.txt
<Current directory>\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Pbk\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Dr Watson\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Player\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\History\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Application Data\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Games\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\AutoWrap\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Brackets\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Align\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\arclite\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\bin\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\hrc\auto\types\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\hrc\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\hrc\auto\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\7-Zip\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\XLat\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\XLat\Russian\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\SetUp\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\Shell\HOW TO DECRYPT FILES.txt
C:\Far2\HOW TO DECRYPT FILES.txt
C:\Far2\Encyclopedia\HOW TO DECRYPT FILES.txt
C:\Far2\FExcept\HOW TO DECRYPT FILES.txt
C:\Far2\Documentation\eng\HOW TO DECRYPT FILES.txt
C:\Far2\Documentation\rus\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\hrd\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\FileCase\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\FTP\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\ExtSearch\sources\RegExp\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\FarCmds\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\FTP\lib\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Network\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\ProcList\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\HlfViewer\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\MacroView\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\ExtSearch\sources\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Compare\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\DrawLine\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\hrd\console\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\hrd\console\contrib\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\EditCase\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\ExtSearch\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\ExtSearch\keys\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\EMenu\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\ExtSearch\doc\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\Macros\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\VMware\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Local Settings\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Local Settings\History\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Local Settings\History\History.IE5\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\Microsoft\Windows Media\9.0\HOW TO DECRYPT FILES.txt
%APPDATA%\Mozilla\Firefox\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Favorites\HOW TO DECRYPT FILES.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\HOW TO DECRYPT FILES.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Favorites\Links\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\Microsoft\Media Player\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\Microsoft\Windows\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Start Menu\Programs\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Start Menu\Programs\Accessories\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Templates\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\Colors\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\Colors\Custom Highlighting\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\Colors\Default Highlighting\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Start Menu\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Local Settings\Temporary Internet Files\HOW TO DECRYPT FILES.txt
%HOMEPATH%\My Documents\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\HOW TO DECRYPT FILES.txt
%HOMEPATH%\My Documents\My Music\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Recent\HOW TO DECRYPT FILES.txt
%HOMEPATH%\SendTo\HOW TO DECRYPT FILES.txt
%HOMEPATH%\My Documents\My Pictures\HOW TO DECRYPT FILES.txt
%HOMEPATH%\HOW TO DECRYPT FILES.txt

Deletes itself.

Network activity:

Connects to:

'sk#####fect.site40.net':80

TCP:

HTTP POST requests:

sk#####fect.site40.net/gate.php

UDP:

DNS ASK sk#####fect.site40.net

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: '' WindowName: 'Windows Task Manager'

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial