Trojan.Encoder.38166

Technical Information

To ensure autorun and distribution

Creates the following files on removable media

<Drive name for removable media>:\correct.avi
<Drive name for removable media>:\systisoft.pem
<Drive name for removable media>:\irgeek.pem
<Drive name for removable media>:\hhhlcert.pem
<Drive name for removable media>:\delongcacert.pem
<Drive name for removable media>:\ck_ugo.pem
<Drive name for removable media>:\dualectls.pdf
<Drive name for removable media>:\bc01.pdf
<Drive name for removable media>:\7790_preview.pdf
<Drive name for removable media>:\2015-02-patients-topic-work-related-asthma-jobs.pdf
<Drive name for removable media>:\2015-02-worms-nanoparticle-toxicity.pdf
<Drive name for removable media>:\ff_ot_user_guide.pdf
<Drive name for removable media>:\10thingscondoms.pdf
<Drive name for removable media>:\firefly1.mov
<Drive name for removable media>:\etc6_m_1.mov
<Drive name for removable media>:\scan.mov
<Drive name for removable media>:\cert.pem
<Drive name for removable media>:\tunpersonalca1.pem
<Drive name for removable media>:\router_manual.rtf
<Drive name for removable media>:\clip_1080_5sec_10mbps_h264.mp4
<Drive name for removable media>:\myhrvoldhanssenbiharfamine.rtf
<Drive name for removable media>:\waterlandhealthkano.rtf
<Drive name for removable media>:\static_electricity_easy_and_quick_activities.rtf
<Drive name for removable media>:\hypothyroidism_slides.pptx
<Drive name for removable media>:\digest.rdf
<Drive name for removable media>:\contenttypes.rdf
<Drive name for removable media>:\samieee_obiee_presentation.pptx
<Drive name for removable media>:\iso27k_isms_implementation_and_certification_process_overview_v2.pptx
<Drive name for removable media>:\metac.ppt
<Drive name for removable media>:\51.mp4
<Drive name for removable media>:\file1.ppt
<Drive name for removable media>:\writingcompletesarnarrative_1103.ppt
<Drive name for removable media>:\ppswamp.ppt
<Drive name for removable media>:\arrow-down.png
<Drive name for removable media>:\dissolveanother.png
<Drive name for removable media>:\168.jpg
<Drive name for removable media>:\server.pem
<Drive name for removable media>:\dag2_panel1_320_ref.mov
<Drive name for removable media>:\aoc_saq_d_v3_merchant.docx
<Drive name for removable media>:\applicantform_en.doc
<Drive name for removable media>:\508softwareandos.doc
<Drive name for removable media>:\sdksampleunprivdeveloper.cer
<Drive name for removable media>:\testee.cer
<Drive name for removable media>:\contoso.cer
<Drive name for removable media>:\sdkfailsafeemulator.cer
<Drive name for removable media>:\pmd.cer
<Drive name for removable media>:\default.bmp
<Drive name for removable media>:\coffee.bmp
<Drive name for removable media>:\dashborder_120.bmp
<Drive name for removable media>:\tileimage.bmp
<Drive name for removable media>:\dialmap.bmp
<Drive name for removable media>:\delete.avi
<Drive name for removable media>:\toolbar.bmp
<Drive name for removable media>:\dashborder_192.bmp
<Drive name for removable media>:\cveuropeo.doc
<Drive name for removable media>:\holycrosschurchinstructions.docx
<Drive name for removable media>:\1189.jpg
<Drive name for removable media>:\fi51.doc
<Drive name for removable media>:\howto-index.html
<Drive name for removable media>:\region-north-karelia.jpg
<Drive name for removable media>:\2.jpg
<Drive name for removable media>:\parnas_01.jpeg
<Drive name for removable media>:\4f0bf7ff71f28.jpeg
<Drive name for removable media>:\3.jpeg
<Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
<Drive name for removable media>:\region-north-karelia.jpeg
<Drive name for removable media>:\168.jpeg
<Drive name for removable media>:\adadsi.html
<Drive name for removable media>:\browse.html
<Drive name for removable media>:\adhd_and_obesity.docx
<Drive name for removable media>:\ituneshelpunavailable.htm
<Drive name for removable media>:\tree_view.htm
<Drive name for removable media>:\garden.htm
<Drive name for removable media>:\3.jpg
<Drive name for removable media>:\babyboymaintonotesbackground_pal.wmv

Modifies file system

Modifies the following files

<Drive name for removable media>:\correct.avi
%HOMEPATH%\favorites\links\desktop.ini
%HOMEPATH%\favorites\desktop.ini
%LOCALAPPDATA%low\sun\java\jre1.8.0_45_x64\jre1.8.0_45.msi
%LOCALAPPDATA%low\oracle\java\au\au.msi
%LOCALAPPDATA%low\microsoft\internet explorer\services\search_{0633ee93-d776-472f-a0ff-e1416b8b2e3a}.ico
<Drive name for removable media>:\hypothyroidism_slides.pptx
<Drive name for removable media>:\samieee_obiee_presentation.pptx
<Drive name for removable media>:\iso27k_isms_implementation_and_certification_process_overview_v2.pptx
<Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
<Drive name for removable media>:\fi51.doc
<Drive name for removable media>:\cveuropeo.doc
<Drive name for removable media>:\applicantform_en.doc
<Drive name for removable media>:\508softwareandos.doc
<Drive name for removable media>:\testee.cer
<Drive name for removable media>:\contoso.cer
<Drive name for removable media>:\sdkfailsafeemulator.cer
<Drive name for removable media>:\pmd.cer
<Drive name for removable media>:\sdksampleunprivdeveloper.cer
<Drive name for removable media>:\coffee.bmp
<Drive name for removable media>:\default.bmp
<Drive name for removable media>:\dashborder_120.bmp
<Drive name for removable media>:\dialmap.bmp
D:\$recycle.bin\s-1-5-21-3150914307-1777937420-491476919-1000\desktop.ini
<Drive name for removable media>:\tileimage.bmp
<Drive name for removable media>:\toolbar.bmp
<Drive name for removable media>:\dashborder_192.bmp
<Drive name for removable media>:\delete.avi
%HOMEPATH%\favorites\links\web slice gallery.url
%HOMEPATH%\favorites\links for united states\desktop.ini

Modifies multiple files.

Substitutes the following files

D:\$RECYCLE.BIN\S-1-5-21-3150914307-1777937420-491476919-1000\desktop.ini

Modifies user data files (Trojan.Encoder).

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial