Trojan.Encoder.716

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%ALLUSERSPROFILE%\Start Menu\Programs\Startup\readme!!.txt
%HOMEPATH%\Start Menu\Programs\Startup\readme!!.txt
%HOMEPATH%\Start Menu\Programs\Startup\svhost.exe

Modifies file system :

Creates the following files:

<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\readme!!.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\0\readme!!.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\readme!!.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\readme!!.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\3\readme!!.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\4\readme!!.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\1\readme!!.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\2\readme!!.txt
<LS_APPDATA>\Mozilla\Firefox\readme!!.txt
<LS_APPDATA>\Microsoft\Credentials\readme!!.txt
<LS_APPDATA>\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\readme!!.txt
<LS_APPDATA>\Microsoft\readme!!.txt
<LS_APPDATA>\Microsoft\CD Burning\readme!!.txt
<LS_APPDATA>\Microsoft\Windows Media\9.0\readme!!.txt
<LS_APPDATA>\Mozilla\readme!!.txt
<LS_APPDATA>\Microsoft\Media Player\readme!!.txt
<LS_APPDATA>\Microsoft\Windows Media\readme!!.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\readme!!.txt
<LS_APPDATA>\VMware\readme!!.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\E\readme!!.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\F\readme!!.txt
%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\readme!!.txt
%TEMP%\readme!!.txt
%HOMEPATH%\Local Settings\History\readme!!.txt
%HOMEPATH%\Local Settings\History\History.IE5\readme!!.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\D\readme!!.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\7\readme!!.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\8\readme!!.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\5\readme!!.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\6\readme!!.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\B\readme!!.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\C\readme!!.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\9\readme!!.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\A\readme!!.txt
%APPDATA%\Microsoft\MMC\readme!!.txt
%APPDATA%\Microsoft\SystemCertificates\readme!!.txt
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\readme!!.txt
%APPDATA%\Microsoft\Media Player\readme!!.txt
%APPDATA%\Microsoft\SystemCertificates\My\CRLs\readme!!.txt
%APPDATA%\Microsoft\SystemCertificates\My\CTLs\readme!!.txt
%APPDATA%\Microsoft\SystemCertificates\My\readme!!.txt
%APPDATA%\Microsoft\SystemCertificates\My\Certificates\readme!!.txt
%APPDATA%\Microsoft\Internet Explorer\readme!!.txt
%APPDATA%\Identities\readme!!.txt
%APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\readme!!.txt
%HOMEPATH%\readme!!.txt
%APPDATA%\readme!!.txt
%APPDATA%\Microsoft\Credentials\readme!!.txt
%APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\readme!!.txt
%APPDATA%\Microsoft\readme!!.txt
%APPDATA%\Microsoft\Address Book\readme!!.txt
%HOMEPATH%\Local Settings\readme!!.txt
<LS_APPDATA>\readme!!.txt
%HOMEPATH%\Favorites\readme!!.txt
%HOMEPATH%\Favorites\Links\readme!!.txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\readme!!.txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\readme!!.txt
<LS_APPDATA>\Identities\readme!!.txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\readme!!.txt
%HOMEPATH%\Desktop\readme!!.txt
%APPDATA%\Mozilla\Firefox\readme!!.txt
%APPDATA%\Mozilla\Firefox\Profiles\readme!!.txt
%APPDATA%\Mozilla\readme!!.txt
%APPDATA%\Mozilla\Extensions\readme!!.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\readme!!.txt
%HOMEPATH%\Cookies\readme!!.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\readme!!.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\readme!!.txt
%HOMEPATH%\Local Settings\Temporary Internet Files\readme!!.txt
C:\Far2\Plugins\Colorer\hrc\auto\types\readme!!.txt
C:\Far2\Plugins\Colorer\hrd\readme!!.txt
C:\Far2\Plugins\Colorer\hrc\readme!!.txt
C:\Far2\Plugins\Colorer\hrc\auto\readme!!.txt
C:\Far2\Plugins\Compare\readme!!.txt
C:\Far2\Plugins\DrawLine\readme!!.txt
C:\Far2\Plugins\Colorer\hrd\console\readme!!.txt
C:\Far2\Plugins\Colorer\hrd\console\contrib\readme!!.txt
C:\Far2\Plugins\Colorer\bin\readme!!.txt
C:\Far2\Plugins\7-Zip\readme!!.txt
C:\Far2\Plugins\Align\readme!!.txt
C:\Far2\FExcept\readme!!.txt
C:\Far2\Plugins\readme!!.txt
C:\Far2\Plugins\Brackets\readme!!.txt
C:\Far2\Plugins\Colorer\readme!!.txt
C:\Far2\Plugins\arclite\readme!!.txt
C:\Far2\Plugins\AutoWrap\readme!!.txt
C:\Far2\Plugins\HlfViewer\readme!!.txt
C:\Far2\Plugins\MacroView\readme!!.txt
C:\Far2\Plugins\FTP\readme!!.txt
C:\Far2\Plugins\FTP\lib\readme!!.txt
C:\Far2\Plugins\TmpPanel\readme!!.txt
C:\Far2\Plugins\WinSCP\readme!!.txt
C:\Far2\Plugins\Network\readme!!.txt
C:\Far2\Plugins\ProcList\readme!!.txt
C:\Far2\Plugins\FileCase\readme!!.txt
C:\Far2\Plugins\ExtSearch\readme!!.txt
C:\Far2\Plugins\ExtSearch\doc\readme!!.txt
C:\Far2\Plugins\EditCase\readme!!.txt
C:\Far2\Plugins\EMenu\readme!!.txt
C:\Far2\Plugins\ExtSearch\sources\RegExp\readme!!.txt
C:\Far2\Plugins\FarCmds\readme!!.txt
C:\Far2\Plugins\ExtSearch\keys\readme!!.txt
C:\Far2\Plugins\ExtSearch\sources\readme!!.txt
%HOMEPATH%\PrintHood\readme!!.txt
%HOMEPATH%\Recent\readme!!.txt
%HOMEPATH%\My Documents\My Received Files\readme!!.txt
%HOMEPATH%\NetHood\readme!!.txt
%HOMEPATH%\Start Menu\Programs\readme!!.txt
%HOMEPATH%\Start Menu\Programs\Accessories\readme!!.txt
%HOMEPATH%\SendTo\readme!!.txt
%HOMEPATH%\Start Menu\readme!!.txt
%HOMEPATH%\My Documents\My Pictures\readme!!.txt
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\readme!!.txt
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\readme!!.txt
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\readme!!.txt
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\readme!!.txt
%HOMEPATH%\My Documents\Downloads\readme!!.txt
%HOMEPATH%\My Documents\My Music\readme!!.txt
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\readme!!.txt
%HOMEPATH%\My Documents\readme!!.txt
C:\Far2\Addons\XLat\readme!!.txt
C:\Far2\Addons\XLat\Russian\readme!!.txt
C:\Far2\Addons\SetUp\readme!!.txt
C:\Far2\Addons\Shell\readme!!.txt
C:\Far2\Documentation\rus\readme!!.txt
C:\Far2\Encyclopedia\readme!!.txt
C:\Far2\Documentation\readme!!.txt
C:\Far2\Documentation\eng\readme!!.txt
C:\Far2\Addons\Macros\readme!!.txt
%HOMEPATH%\Templates\readme!!.txt
C:\Far2\readme!!.txt
%HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\readme!!.txt
%HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\readme!!.txt
C:\Far2\Addons\Colors\Custom Highlighting\readme!!.txt
C:\Far2\Addons\Colors\Default Highlighting\readme!!.txt
C:\Far2\Addons\readme!!.txt
C:\Far2\Addons\Colors\readme!!.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\readme!!.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\readme!!.txt
C:\Documents and Settings\Default User\readme!!.txt
C:\Documents and Settings\Default User\Application Data\readme!!.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\readme!!.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\readme!!.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\readme!!.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\readme!!.txt
%ALLUSERSPROFILE%\Templates\readme!!.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\readme!!.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\readme!!.txt
%ALLUSERSPROFILE%\Start Menu\Programs\readme!!.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\readme!!.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\readme!!.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Games\readme!!.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\readme!!.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\readme!!.txt
C:\Documents and Settings\Default User\Local Settings\History\readme!!.txt
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\readme!!.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\readme!!.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\readme!!.txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\readme!!.txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\readme!!.txt
C:\Documents and Settings\Default User\Local Settings\Temp\readme!!.txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\readme!!.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\readme!!.txt
C:\Documents and Settings\Default User\Cookies\readme!!.txt
C:\Documents and Settings\Default User\Desktop\readme!!.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\readme!!.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\readme!!.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\readme!!.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\readme!!.txt
C:\Documents and Settings\Default User\Favorites\readme!!.txt
C:\Documents and Settings\Default User\Local Settings\readme!!.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Dr Watson\readme!!.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\HTML Help\readme!!.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\readme!!.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\readme!!.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\readme!!.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\readme!!.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Index\readme!!.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Player\readme!!.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\readme!!.txt
%ALLUSERSPROFILE%\readme!!.txt
%ALLUSERSPROFILE%\Application Data\readme!!.txt
<Current directory>\readme!!.txt
C:\Documents and Settings\readme!!.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\readme!!.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\MachineKeys\readme!!.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\readme!!.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\readme!!.txt
%ALLUSERSPROFILE%\Documents\My Pictures\readme!!.txt
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\readme!!.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\readme!!.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\readme!!.txt
%ALLUSERSPROFILE%\Favorites\readme!!.txt
%ALLUSERSPROFILE%\Start Menu\readme!!.txt
%ALLUSERSPROFILE%\Documents\My Videos\readme!!.txt
%ALLUSERSPROFILE%\DRM\readme!!.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\readme!!.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\readme!!.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\readme!!.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Cm\readme!!.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Pbk\readme!!.txt
%ALLUSERSPROFILE%\Documents\My Music\readme!!.txt
%ALLUSERSPROFILE%\Documents\My Music\My Playlists\readme!!.txt
%ALLUSERSPROFILE%\Desktop\readme!!.txt
%ALLUSERSPROFILE%\Documents\readme!!.txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\readme!!.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\readme!!.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\readme!!.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\readme!!.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\readme!!.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\readme!!.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\readme!!.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\readme!!.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\readme!!.txt
C:\Documents and Settings\NetworkService\Application Data\readme!!.txt
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\readme!!.txt
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\BGGTYMH1\readme!!.txt
C:\Documents and Settings\LocalService\Local Settings\Temp\readme!!.txt
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\readme!!.txt
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\MOE00UY1\readme!!.txt
C:\Documents and Settings\NetworkService\readme!!.txt
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\readme!!.txt
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\LBMMC3H3\readme!!.txt
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\readme!!.txt
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\readme!!.txt
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\readme!!.txt
C:\Documents and Settings\NetworkService\Local Settings\Temp\readme!!.txt
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\readme!!.txt
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\readme!!.txt
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\readme!!.txt
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\readme!!.txt
C:\Documents and Settings\NetworkService\Local Settings\History\readme!!.txt
C:\Documents and Settings\NetworkService\Cookies\readme!!.txt
C:\Documents and Settings\NetworkService\Local Settings\readme!!.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\readme!!.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\readme!!.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\readme!!.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\readme!!.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\readme!!.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\readme!!.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\readme!!.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\readme!!.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\readme!!.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\readme!!.txt
C:\Documents and Settings\LocalService\Application Data\readme!!.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\readme!!.txt
C:\Documents and Settings\Default User\Templates\readme!!.txt
C:\Documents and Settings\LocalService\readme!!.txt
C:\Documents and Settings\Default User\Start Menu\Programs\readme!!.txt
C:\Documents and Settings\Default User\My Documents\readme!!.txt
C:\Documents and Settings\Default User\NetHood\readme!!.txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\readme!!.txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\readme!!.txt
C:\Documents and Settings\Default User\SendTo\readme!!.txt
C:\Documents and Settings\Default User\Start Menu\readme!!.txt
C:\Documents and Settings\Default User\PrintHood\readme!!.txt
C:\Documents and Settings\Default User\Recent\readme!!.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\readme!!.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\readme!!.txt
C:\Documents and Settings\LocalService\Cookies\readme!!.txt
C:\Documents and Settings\LocalService\Local Settings\readme!!.txt
C:\Documents and Settings\LocalService\Local Settings\History\readme!!.txt
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\readme!!.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\readme!!.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\readme!!.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\readme!!.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\readme!!.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\readme!!.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\readme!!.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\readme!!.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\readme!!.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\readme!!.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\readme!!.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\readme!!.txt

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: '(null)'

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial