Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Trojan.Encoder.35460

Added to the Dr.Web virus database: 2022-06-15

Virus description added:

Technical Information

Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
  • Command Prompt (CMD)
  • Windows Task Manager (Taskmgr)
  • Registry Editor (RegEdit)
modifies the following system settings:
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000001'
Reads files which store third party applications passwords
  • %HOMEPATH%\desktop\about.html
  • %HOMEPATH%\desktop\adhd_and_obesity.docx
  • %HOMEPATH%\desktop\advice_process.htm
  • %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
  • %HOMEPATH%\desktop\browse.htm
  • %LOCALAPPDATA%\google\chrome\user data\default\cookies
  • %LOCALAPPDATA%\google\chrome\user data\default\login data
Modifies file system
Creates the following files
  • %HOMEPATH%\desktop\pagame lo que me debes perra1.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra74.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra73.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra72.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra71.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra70.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra69.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra68.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra67.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra66.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra65.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra64.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra63.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra62.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra61.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra60.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra59.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra58.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra57.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra56.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra55.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra54.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra52.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra53.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra75.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra76.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra98.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra97.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra96.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra95.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra94.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra93.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra92.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra91.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra90.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra89.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra87.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra37.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra86.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra85.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra84.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra83.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra82.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra81.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra80.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra79.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra78.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra77.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra51.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra50.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra49.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra21.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra20.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra19.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra18.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra17.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra16.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra15.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra14.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra13.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra12.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra11.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra10.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra9.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra8.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra7.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra6.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra5.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra4.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra3.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra2.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra23.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra24.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra22.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra25.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra48.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra26.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra47.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra46.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra45.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra44.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra43.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra42.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra41.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra40.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra39.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra88.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra99.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra36.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra35.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra34.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra33.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra32.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra31.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra30.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra29.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra28.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra27.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra38.txt
  • %HOMEPATH%\desktop\pagame lo que me debes perra100.txt
Modifies the following files
  • %HOMEPATH%\desktop\about.html
  • %LOCALAPPDATA%\google\chrome\user data\default\cookies-journal
  • %LOCALAPPDATA%\google\chrome\user data\default\current session
  • %LOCALAPPDATA%\google\chrome\user data\default\current tabs
  • %LOCALAPPDATA%\google\chrome\user data\default\databases\databases.db
  • %LOCALAPPDATA%\google\chrome\user data\default\databases\databases.db-journal
  • %LOCALAPPDATA%\google\chrome\user data\default\extension state\000003.ldb
  • %LOCALAPPDATA%\google\chrome\user data\default\extension state\000006.ldb
  • %LOCALAPPDATA%\google\chrome\user data\default\extension state\000007.log
  • %LOCALAPPDATA%\google\chrome\user data\default\extension state\current
  • %LOCALAPPDATA%\google\chrome\user data\default\extension state\lock
  • %LOCALAPPDATA%\google\chrome\user data\default\extension state\log
  • %LOCALAPPDATA%\google\chrome\user data\default\extension state\log.old
  • %LOCALAPPDATA%\google\chrome\user data\default\extension state\manifest-000001
  • %LOCALAPPDATA%\adobe\acrocef\dc\acrobat\cache\chromedwritefontcache
  • %LOCALAPPDATA%\adobe\color\profiles\wscrgb.icc
  • %LOCALAPPDATA%\adobe\acrocef\dc\acrobat\cache\data_0
  • %LOCALAPPDATA%\adobe\color\acecache11.lst
  • %LOCALAPPDATA%\adobe\acrocef\dc\acrobat\cache\data_1
  • %LOCALAPPDATA%\adobe\acrocef\dc\acrobat\cookie\cookies-journal
  • %LOCALAPPDATA%\adobe\acrocef\dc\acrobat\cache\data_2
  • %LOCALAPPDATA%\adobe\acrocef\dc\acrobat\cookie\cookies
  • %LOCALAPPDATA%\adobe\acrocef\dc\acrobat\cache\index
  • %LOCALAPPDATA%\adobe\acrocef\dc\acrobat\cache\data_3
  • %HOMEPATH%\desktop\browse.htm
  • %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
  • %HOMEPATH%\desktop\advice_process.htm
  • %HOMEPATH%\desktop\adhd_and_obesity.docx
  • %LOCALAPPDATA%\google\chrome\user data\default\cookies
  • %LOCALAPPDATA%\google\chrome\user data\default\chromedwritefontcache
Modifies multiple files.
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Network activity
Connects to
  • 'di##ord.com':443
TCP
Other
  • 'di##ord.com':443
UDP
  • DNS ASK di##ord.com

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android