Trojan.Encoder.42543

Technical Information

To ensure autorun and distribution

Modifies master boot record (MBR).

Modifies file system

Creates the following files

%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\abcpy.ini.jm
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acrordrdcupd1501020056.msp.jm
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acroread.msi.jm
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\data1.cab.jm
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\setup.exe.jm
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\setup.ini.jm
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\help_cvalidator.h1d.jm
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\help_mkwd_assetid.h1w.jm
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\help_mkwd_bestbet.h1w.jm
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\help_mtoc_help.h1h.jm
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\help_mvalidator.h1d.jm
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\help_mvalidator.lck.jm
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\help{9daa54e8-cd95-4107-8e7f-ba3f24732d95}.h1q.jm
%ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\6d14e4b1d8ca773bab785d1be032546e_0cb67e2f-dc95-45ca-8fb8-69bde8e3f814.jm
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.jm
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml.jm
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.jm
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.jm
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.jm
%ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.jm
%ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml.jm
%ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.jm
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\folder.ico.jm
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\netfol.ico.jm
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\pictures.ico.jm
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml.jm
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ringtones.ico.jm
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\settings.ico.jm
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\sync.ico.jm
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml.jm
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\wmp.ico.jm
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-us\resource.xml.jm
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\folder.ico.jm
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_pref.ico.jm
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_property.ico.jm
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_queue.ico.jm
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_.ico.jm
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_property.ico.jm
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_settings.ico.jm
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml.jm
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-us\resource.xml.jm
%ALLUSERSPROFILE%\microsoft\identitycrl\ppcrlconfig.dll.jm
%ALLUSERSPROFILE%\microsoft\identitycrl\ppcrlui.dll.jm
%ALLUSERSPROFILE%\microsoft\mf\active.grl.jm
%ALLUSERSPROFILE%\microsoft\mf\pending.grl.jm
%ALLUSERSPROFILE%\microsoft\office\assetlibrary.ico.jm
%ALLUSERSPROFILE%\microsoft\office\documentrepository.ico.jm
%ALLUSERSPROFILE%\microsoft\office\mysharepoints.ico.jm
%ALLUSERSPROFILE%\microsoft\office\mysite.ico.jm
%ALLUSERSPROFILE%\microsoft\office\sharepointportalsite.ico.jm
%ALLUSERSPROFILE%\microsoft\office\sharepointteamsite.ico.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\envelopr.dll.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\grintl32.dll.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\grintl32.rest.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\mapir.dll.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\mor6int.rest.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\msointl.dll.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\msointl.rest.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\omsintl.dll.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\onintl.dll.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\onintl.rest.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\outllibr.dll.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\outllibr.rest.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\outlwvw.dll.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\ppintl.dll.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\ppintl.rest.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\pub6intl.dll.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\pub6intl.rest.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\pubwzint.rest.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\sgres.dll.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\stintl.dll.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\visbrres.dll.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\visintl.dll.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\wwintl.dll.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\wwintl.rest.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\xlintl32.dll.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\xlintl32.rest.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\xlslicer.dll.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\envelopr.dll.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\grintl32.dll.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\grintl32.rest.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\mapir.dll.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\mor6int.rest.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\msointl.dll.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\msointl.rest.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\omsintl.dll.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\onintl.dll.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\onintl.rest.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\outllibr.dll.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\outllibr.rest.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\outlwvw.dll.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\ppintl.dll.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\ppintl.rest.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\pub6intl.dll.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\pub6intl.rest.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\pubwzint.rest.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\sgres.dll.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\stintl.dll.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\visbrres.dll.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\visintl.dll.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\wwintl.dll.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\wwintl.rest.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\xlintl32.dll.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\xlintl32.rest.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\xlslicer.dll.trx_dll.jm
%ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\tokens.dat.jm
%ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\cache\cache.dat.jm
%ALLUSERSPROFILE%\microsoft\rac\publisheddata\racwmidatabase.sdf.jm
%ALLUSERSPROFILE%\microsoft\rac\statedata\racdatabase.sdf.jm
%ALLUSERSPROFILE%\microsoft\rac\statedata\racmetadata.dat.jm
%ALLUSERSPROFILE%\microsoft\rac\statedata\racwmidatabookmarks.dat.jm
%ALLUSERSPROFILE%\microsoft\rac\statedata\racwmieventdata.dat.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\mss.chk.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\mss.log.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\mss00001.log.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\mss00002.log.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\mssres00001.jrs.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\mssres00002.jrs.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\windows.edb.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\gatherlogs\systemindex\systemindex.1.crwl.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\gatherlogs\systemindex\systemindex.1.gthr.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\00010001.ci.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\00010001.dir.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\00010001.wid.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\00010002.ci.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\00010002.dir.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\00010002.wid.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\00010003.ci.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\00010003.dir.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\00010003.wid.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\00010003.wsb.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\00010004.ci.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\00010004.dir.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\00010004.wid.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\00010005.ci.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\00010005.dir.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\00010005.wid.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\00010006.ci.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\00010006.dir.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\00010006.wid.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\00010007.ci.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\00010007.dir.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\00010007.wid.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciab0001.000.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciab0001.001.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciab0001.002.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciab0002.000.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciab0002.001.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciab0002.002.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciad0002.000.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciad0002.001.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciad0002.002.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\index.000.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\index.001.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\index.002.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\settings.dia.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\propmap\cipt0000.000.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\propmap\cipt0000.001.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\propmap\cipt0000.002.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\secstore\cist0000.000.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\secstore\cist0000.001.jm
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\secstore\cist0000.002.jm
%ALLUSERSPROFILE%\microsoft\windows\devicemetadatastore\en-us\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms.jm
%ALLUSERSPROFILE%\microsoft\windows\devicemetadatastore\en-us\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\default programs.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\windows update.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\acrobat reader dc.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\firefox.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\media center.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\mozilla thunderbird.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\opera.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sidebar.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\windows dvd maker.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\windows fax and scan.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\windows media player.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\xps viewer.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\calculator.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\desktop.ini.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\displayswitch.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\math input panel.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\mobility center.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\networkprojection.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\paint.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\remote desktop connection.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\snipping tool.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\sound recorder.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\sticky notes.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\sync center.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\welcome center.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\wordpad.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\accessibility\desktop.ini.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\accessibility\speech recognition.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\character map.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\desktop.ini.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\dfrgui.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\disk cleanup.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\resource monitor.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\system information.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\system restore.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\task scheduler.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\windows easy transfer reports.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\windows easy transfer.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\tablet pc\desktop.ini.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\tablet pc\shapecollector.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\tablet pc\tabtip.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\tablet pc\windows journal.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\windows powershell\windows powershell (x86).lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\windows powershell\windows powershell ise (x86).lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\windows powershell\windows powershell ise.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\windows powershell\windows powershell.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\component services.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\computer management.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\data sources (odbc).lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\event viewer.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\iscsi initiator.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\memory diagnostics tool.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\performance monitor.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\print management.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\security configuration management.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\services.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\system configuration.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\task scheduler.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\windows firewall with advanced security.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\windows powershell modules.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\games\gameexplorer.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\java\about java.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\java\check for updates.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\java\configure java.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\java\get help.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\java\visit java.com.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\maintenance\backup and restore center.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\maintenance\create recovery disc.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\maintenance\desktop.ini.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\maintenance\remote assistance.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft access 2010.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft excel 2010.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft infopath designer 2010.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft infopath filler 2010.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft onenote 2010.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft outlook 2010.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft powerpoint 2010.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft publisher 2010.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft sharepoint workspace 2010.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft word 2010.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\digital certificate for vba projects.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\microsoft clip organizer.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\microsoft office 2010 language preferences.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\microsoft office 2010 upload center.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\microsoft office picture manager.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sharepoint\microsoft sharepoint workspace 2010.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\steam\steam support center.url.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\steam\steam.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\winrar\console rar manual.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\winrar\what is new in the latest version.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\winrar\winrar help.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\winrar\winrar.lnk.jm
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\noncritical_x64_4017a4527469f9d5b499a101a973ca853f881d9_cab_05e13e2d\report.wer.jm
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\noncritical_x64_4a8ed64bf1962bf234c1a7153259451034e674_cab_0709c464\report.wer.jm
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\noncritical_x64_528c94ccf5464e2e06249b41105333fcda5052_cab_05e13dfe\display.inf.jm
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\noncritical_x64_528c94ccf5464e2e06249b41105333fcda5052_cab_05e13dfe\log3def.tmp.jm
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\noncritical_x64_528c94ccf5464e2e06249b41105333fcda5052_cab_05e13dfe\report.wer.jm
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\mpasbase.vdm.jm
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\mpasdlta.vdm.jm
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\mpengine.dll.jm
%ALLUSERSPROFILE%\microsoft\windows defender\support\mplog-07132009-221054.log.jm
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\common coverpages\en-us\confident.cov.jm
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\common coverpages\en-us\fyi.cov.jm
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\common coverpages\en-us\generic.cov.jm
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\common coverpages\en-us\urgent.cov.jm
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\en-us\welcomefax.tif.jm
%ALLUSERSPROFILE%\microsoft help\hx.hxn.jm
%ALLUSERSPROFILE%\microsoft help\ms.excel.14.1033.hxn.jm
%ALLUSERSPROFILE%\microsoft help\ms.excel.dev.14.1033.hxn.jm
%ALLUSERSPROFILE%\microsoft help\ms.graph.14.1033.hxn.jm
%ALLUSERSPROFILE%\microsoft help\ms.groove.14.1033.hxn.jm
%ALLUSERSPROFILE%\microsoft help\ms.infopath.14.1033.hxn.jm
%ALLUSERSPROFILE%\microsoft help\ms.infopatheditor.14.1033.hxn.jm
%ALLUSERSPROFILE%\microsoft help\ms.msaccess.14.1033.hxn.jm
%ALLUSERSPROFILE%\microsoft help\ms.msaccess.dev.14.1033.hxn.jm
%ALLUSERSPROFILE%\microsoft help\ms.msouc.14.1033.hxn.jm
%ALLUSERSPROFILE%\microsoft help\ms.mspub.14.1033.hxn.jm
%ALLUSERSPROFILE%\microsoft help\ms.mspub.dev.14.1033.hxn.jm
%ALLUSERSPROFILE%\microsoft help\ms.mstore.14.1033.hxn.jm
%ALLUSERSPROFILE%\microsoft help\ms.ois.14.1033.hxn.jm
%ALLUSERSPROFILE%\microsoft help\ms.onenote.14.1033.hxn.jm
%ALLUSERSPROFILE%\microsoft help\ms.outlook.14.1033.hxn.jm
%ALLUSERSPROFILE%\microsoft help\ms.outlook.dev.14.1033.hxn.jm
%ALLUSERSPROFILE%\microsoft help\ms.powerpnt.14.1033.hxn.jm
%ALLUSERSPROFILE%\microsoft help\ms.powerpnt.dev.14.1033.hxn.jm
%ALLUSERSPROFILE%\microsoft help\ms.setlang.14.1033.hxn.jm
%ALLUSERSPROFILE%\microsoft help\ms.winword.14.1033.hxn.jm
%ALLUSERSPROFILE%\microsoft help\ms.winword.dev.14.1033.hxn.jm
%ALLUSERSPROFILE%\microsoft help\nslist.hxl.jm
%ALLUSERSPROFILE%\mozilla\updates\308046b0af4a39cb\update-config.json.jm
%ALLUSERSPROFILE%\mozilla\updates\d78bf5dd33499ec2\update-config.json.jm

Moves itself

from <Full path to file> to %TEMP%\_@af9f.tmp

Changes user data files extensions (Trojan.Encoder).

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial