Trojan.Encoder.3896

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'addon_v57' = '%WINDIR%\wfxmryfue.exe'

Creates or modifies the following files:

%ALLUSERSPROFILE%\Start Menu\Programs\Startup\RECOVER+ntaxw.HTM
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\RECOVER+ntaxw.TXT
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\RECOVER+ntaxw.PNG

Malicious functions:

Creates and executes the following:

'%WINDIR%\wfxmryfue.exe'

Executes the following:

'<SYSTEM32>\cmd.exe' /c DEL <Full path to virus>

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\cmd.exe

the following user processes:

ecmd.exe

Modifies file system:

Creates the following files:

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\LBMMC3H3\RECOVER+ntaxw.HTM
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\MOE00UY1\RECOVER+ntaxw.PNG
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\MOE00UY1\RECOVER+ntaxw.TXT
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\RECOVER+ntaxw.HTM
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\LBMMC3H3\RECOVER+ntaxw.PNG
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\LBMMC3H3\RECOVER+ntaxw.TXT
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\RECOVER+ntaxw.HTM
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\RECOVER+ntaxw.PNG
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\RECOVER+ntaxw.TXT
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\MOE00UY1\RECOVER+ntaxw.HTM
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\RECOVER+ntaxw.PNG
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\RECOVER+ntaxw.TXT
C:\Documents and Settings\LocalService\Local Settings\History\RECOVER+ntaxw.HTM
C:\Documents and Settings\LocalService\Local Settings\Temp\RECOVER+ntaxw.PNG
C:\Documents and Settings\LocalService\Local Settings\Temp\RECOVER+ntaxw.TXT
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\RECOVER+ntaxw.HTM
C:\Documents and Settings\LocalService\Local Settings\History\RECOVER+ntaxw.PNG
C:\Documents and Settings\LocalService\Local Settings\History\RECOVER+ntaxw.TXT
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\BGGTYMH1\RECOVER+ntaxw.HTM
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\RECOVER+ntaxw.PNG
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\RECOVER+ntaxw.TXT
C:\Documents and Settings\LocalService\Local Settings\Temp\RECOVER+ntaxw.HTM
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\BGGTYMH1\RECOVER+ntaxw.PNG
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\BGGTYMH1\RECOVER+ntaxw.TXT
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\RECOVER+ntaxw.HTM
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\RECOVER+ntaxw.PNG
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\RECOVER+ntaxw.TXT
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\RECOVER+ntaxw.HTM
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\RECOVER+ntaxw.PNG
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\RECOVER+ntaxw.TXT
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\RECOVER+ntaxw.HTM
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\RECOVER+ntaxw.PNG
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\RECOVER+ntaxw.TXT
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\RECOVER+ntaxw.HTM
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\RECOVER+ntaxw.PNG
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\RECOVER+ntaxw.TXT
C:\Documents and Settings\LocalService\Local Settings\RECOVER+ntaxw.HTM
C:\Documents and Settings\LocalService\RECOVER+ntaxw.PNG
C:\Documents and Settings\LocalService\RECOVER+ntaxw.TXT
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\RECOVER+ntaxw.HTM
C:\Documents and Settings\LocalService\Local Settings\RECOVER+ntaxw.PNG
C:\Documents and Settings\LocalService\Local Settings\RECOVER+ntaxw.TXT
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\RECOVER+ntaxw.HTM
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\RECOVER+ntaxw.PNG
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\RECOVER+ntaxw.TXT
C:\Documents and Settings\LocalService\RECOVER+ntaxw.HTM
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\RECOVER+ntaxw.PNG
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\RECOVER+ntaxw.TXT
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\RECOVER+ntaxw.HTM
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\RECOVER+ntaxw.PNG
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\RECOVER+ntaxw.TXT
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\RECOVER+ntaxw.HTM
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\RECOVER+ntaxw.PNG
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\RECOVER+ntaxw.TXT
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\RECOVER+ntaxw.HTM
C:\Documents and Settings\LocalService\Application Data\Microsoft\RECOVER+ntaxw.PNG
C:\Documents and Settings\LocalService\Application Data\Microsoft\RECOVER+ntaxw.TXT
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\RECOVER+ntaxw.HTM
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\RECOVER+ntaxw.PNG
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\RECOVER+ntaxw.TXT
C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\RECOVER+ntaxw.HTM
C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\RECOVER+ntaxw.PNG
C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\RECOVER+ntaxw.TXT
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\RECOVER+ntaxw.HTM
C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\RECOVER+ntaxw.PNG
C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\RECOVER+ntaxw.TXT
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\RECOVER+ntaxw.HTM
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\RECOVER+ntaxw.PNG
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\RECOVER+ntaxw.TXT
C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\RECOVER+ntaxw.HTM
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\RECOVER+ntaxw.PNG
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\RECOVER+ntaxw.TXT
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\RECOVER+ntaxw.HTM
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\RECOVER+ntaxw.PNG
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\RECOVER+ntaxw.TXT
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\RECOVER+ntaxw.HTM
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\RECOVER+ntaxw.PNG
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\RECOVER+ntaxw.TXT
C:\Documents and Settings\LocalService\Local Settings\Application Data\RECOVER+ntaxw.HTM
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\RECOVER+ntaxw.PNG
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\RECOVER+ntaxw.TXT
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\RECOVER+ntaxw.HTM
C:\Documents and Settings\LocalService\Local Settings\Application Data\RECOVER+ntaxw.PNG
C:\Documents and Settings\LocalService\Local Settings\Application Data\RECOVER+ntaxw.TXT
C:\Documents and Settings\LocalService\Application Data\RECOVER+ntaxw.HTM
C:\Documents and Settings\LocalService\Cookies\RECOVER+ntaxw.PNG
C:\Documents and Settings\LocalService\Cookies\RECOVER+ntaxw.TXT
C:\Documents and Settings\LocalService\Application Data\Microsoft\RECOVER+ntaxw.HTM
C:\Documents and Settings\LocalService\Application Data\RECOVER+ntaxw.PNG
C:\Documents and Settings\LocalService\Application Data\RECOVER+ntaxw.TXT
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\RECOVER+ntaxw.HTM
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\RECOVER+ntaxw.PNG
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\RECOVER+ntaxw.TXT
C:\Documents and Settings\LocalService\Cookies\RECOVER+ntaxw.HTM
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\RECOVER+ntaxw.PNG
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\RECOVER+ntaxw.TXT
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\RECOVER+ntaxw.HTM
C:\Documents and Settings\NetworkService\RECOVER+ntaxw.PNG
C:\Documents and Settings\NetworkService\RECOVER+ntaxw.TXT
C:\Documents and Settings\NetworkService\RECOVER+ntaxw.HTM
C:\Documents and Settings\NetworkService\Local Settings\RECOVER+ntaxw.PNG
C:\Documents and Settings\NetworkService\Local Settings\RECOVER+ntaxw.TXT
C:\Documents and Settings\NetworkService\Local Settings\RECOVER+ntaxw.HTM
%APPDATA%\Identities\RECOVER+ntaxw.PNG
%APPDATA%\Identities\RECOVER+ntaxw.TXT
%APPDATA%\Identities\RECOVER+ntaxw.HTM
%APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\RECOVER+ntaxw.PNG
%APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\RECOVER+ntaxw.TXT
%APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\RECOVER+ntaxw.HTM
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\RECOVER+ntaxw.PNG
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\RECOVER+ntaxw.TXT
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\RECOVER+ntaxw.HTM
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\RECOVER+ntaxw.PNG
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\RECOVER+ntaxw.TXT
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\RECOVER+ntaxw.HTM
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\RECOVER+ntaxw.PNG
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\RECOVER+ntaxw.TXT
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\RECOVER+ntaxw.HTM
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\RECOVER+ntaxw.PNG
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\RECOVER+ntaxw.TXT
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\RECOVER+ntaxw.HTM
%APPDATA%\Microsoft\Media Player\RECOVER+ntaxw.PNG
%APPDATA%\Microsoft\Media Player\RECOVER+ntaxw.TXT
%APPDATA%\Microsoft\Media Player\RECOVER+ntaxw.HTM
%APPDATA%\Microsoft\Internet Explorer\RECOVER+ntaxw.PNG
%APPDATA%\Microsoft\Internet Explorer\RECOVER+ntaxw.TXT
%APPDATA%\Microsoft\Internet Explorer\RECOVER+ntaxw.HTM
%APPDATA%\Microsoft\SystemCertificates\My\Certificates\RECOVER+ntaxw.PNG
%APPDATA%\Microsoft\SystemCertificates\My\Certificates\RECOVER+ntaxw.TXT
%APPDATA%\Microsoft\SystemCertificates\My\Certificates\RECOVER+ntaxw.HTM
%APPDATA%\Microsoft\MMC\RECOVER+ntaxw.PNG
%APPDATA%\Microsoft\MMC\RECOVER+ntaxw.TXT
%APPDATA%\Microsoft\MMC\RECOVER+ntaxw.HTM
%APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\RECOVER+ntaxw.PNG
%APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\RECOVER+ntaxw.TXT
%APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\RECOVER+ntaxw.HTM
%APPDATA%\Microsoft\Address Book\RECOVER+ntaxw.PNG
%APPDATA%\Microsoft\Address Book\RECOVER+ntaxw.TXT
%APPDATA%\Microsoft\Address Book\RECOVER+ntaxw.HTM
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\RECOVER+ntaxw.PNG
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\RECOVER+ntaxw.TXT
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\RECOVER+ntaxw.HTM
%APPDATA%\Microsoft\Credentials\RECOVER+ntaxw.PNG
%APPDATA%\Microsoft\Credentials\RECOVER+ntaxw.TXT
%APPDATA%\Microsoft\Credentials\RECOVER+ntaxw.HTM
C:\Documents and Settings\NetworkService\Cookies\RECOVER+ntaxw.PNG
C:\Documents and Settings\NetworkService\Cookies\RECOVER+ntaxw.TXT
C:\Documents and Settings\NetworkService\Cookies\RECOVER+ntaxw.HTM
C:\Documents and Settings\NetworkService\Application Data\RECOVER+ntaxw.PNG
C:\Documents and Settings\NetworkService\Application Data\RECOVER+ntaxw.TXT
C:\Documents and Settings\NetworkService\Application Data\RECOVER+ntaxw.HTM
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\RECOVER+ntaxw.PNG
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\RECOVER+ntaxw.TXT
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\RECOVER+ntaxw.HTM
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\RECOVER+ntaxw.PNG
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\RECOVER+ntaxw.TXT
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\RECOVER+ntaxw.HTM
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\RECOVER+ntaxw.PNG
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\RECOVER+ntaxw.TXT
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\RECOVER+ntaxw.HTM
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\RECOVER+ntaxw.PNG
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\RECOVER+ntaxw.TXT
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\RECOVER+ntaxw.HTM
C:\Documents and Settings\NetworkService\Application Data\Microsoft\RECOVER+ntaxw.PNG
C:\Documents and Settings\NetworkService\Application Data\Microsoft\RECOVER+ntaxw.TXT
C:\Documents and Settings\NetworkService\Application Data\Microsoft\RECOVER+ntaxw.HTM
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\RECOVER+ntaxw.PNG
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\RECOVER+ntaxw.TXT
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\RECOVER+ntaxw.HTM
C:\Documents and Settings\NetworkService\Local Settings\Temp\RECOVER+ntaxw.PNG
C:\Documents and Settings\NetworkService\Local Settings\Temp\RECOVER+ntaxw.TXT
C:\Documents and Settings\NetworkService\Local Settings\Temp\RECOVER+ntaxw.HTM
C:\Documents and Settings\NetworkService\Local Settings\History\RECOVER+ntaxw.PNG
C:\Documents and Settings\NetworkService\Local Settings\History\RECOVER+ntaxw.TXT
C:\Documents and Settings\NetworkService\Local Settings\History\RECOVER+ntaxw.HTM
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\RECOVER+ntaxw.PNG
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\RECOVER+ntaxw.TXT
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\RECOVER+ntaxw.HTM
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\RECOVER+ntaxw.PNG
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\RECOVER+ntaxw.TXT
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\RECOVER+ntaxw.HTM
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\RECOVER+ntaxw.PNG
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\RECOVER+ntaxw.TXT
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\RECOVER+ntaxw.HTM
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\RECOVER+ntaxw.PNG
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\RECOVER+ntaxw.TXT
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\RECOVER+ntaxw.HTM
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\RECOVER+ntaxw.PNG
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\RECOVER+ntaxw.TXT
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\RECOVER+ntaxw.HTM
C:\Documents and Settings\NetworkService\Local Settings\Application Data\RECOVER+ntaxw.PNG
C:\Documents and Settings\NetworkService\Local Settings\Application Data\RECOVER+ntaxw.TXT
C:\Documents and Settings\NetworkService\Local Settings\Application Data\RECOVER+ntaxw.HTM
%ALLUSERSPROFILE%\Start Menu\RECOVER+ntaxw.TXT
%ALLUSERSPROFILE%\Start Menu\RECOVER+ntaxw.HTM
%ALLUSERSPROFILE%\Templates\RECOVER+ntaxw.PNG
%ALLUSERSPROFILE%\Start Menu\Programs\RECOVER+ntaxw.TXT
%ALLUSERSPROFILE%\Start Menu\Programs\RECOVER+ntaxw.HTM
%ALLUSERSPROFILE%\Start Menu\RECOVER+ntaxw.PNG
%ALLUSERSPROFILE%\RECOVER+ntaxw.TXT
%ALLUSERSPROFILE%\RECOVER+ntaxw.HTM
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\RECOVER+ntaxw.PNG
%ALLUSERSPROFILE%\Templates\RECOVER+ntaxw.TXT
%ALLUSERSPROFILE%\Templates\RECOVER+ntaxw.HTM
%ALLUSERSPROFILE%\RECOVER+ntaxw.PNG
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\RECOVER+ntaxw.TXT
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\RECOVER+ntaxw.HTM
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\RECOVER+ntaxw.PNG
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\RECOVER+ntaxw.TXT
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\RECOVER+ntaxw.HTM
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\RECOVER+ntaxw.PNG
%ALLUSERSPROFILE%\Start Menu\Programs\Games\RECOVER+ntaxw.TXT
%ALLUSERSPROFILE%\Start Menu\Programs\Games\RECOVER+ntaxw.HTM
%ALLUSERSPROFILE%\Start Menu\Programs\RECOVER+ntaxw.PNG
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\RECOVER+ntaxw.TXT
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\RECOVER+ntaxw.HTM
%ALLUSERSPROFILE%\Start Menu\Programs\Games\RECOVER+ntaxw.PNG
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\RECOVER+ntaxw.TXT
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\RECOVER+ntaxw.HTM
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\RECOVER+ntaxw.PNG
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\RECOVER+ntaxw.TXT
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\RECOVER+ntaxw.HTM
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\RECOVER+ntaxw.PNG
C:\Documents and Settings\Default User\Application Data\Microsoft\RECOVER+ntaxw.TXT
C:\Documents and Settings\Default User\Application Data\Microsoft\RECOVER+ntaxw.HTM
C:\Documents and Settings\Default User\Application Data\RECOVER+ntaxw.PNG
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\RECOVER+ntaxw.TXT
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\RECOVER+ntaxw.HTM
C:\Documents and Settings\Default User\Application Data\Microsoft\RECOVER+ntaxw.PNG
C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\RECOVER+ntaxw.TXT
C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\RECOVER+ntaxw.HTM
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\RECOVER+ntaxw.PNG
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\RECOVER+ntaxw.TXT
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\RECOVER+ntaxw.HTM
C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\RECOVER+ntaxw.PNG
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\RECOVER+ntaxw.TXT
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\RECOVER+ntaxw.HTM
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\RECOVER+ntaxw.PNG
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\RECOVER+ntaxw.TXT
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\RECOVER+ntaxw.HTM
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\RECOVER+ntaxw.PNG
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\RECOVER+ntaxw.TXT
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\RECOVER+ntaxw.HTM
%ALLUSERSPROFILE%\Documents\My Music\RECOVER+ntaxw.PNG
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\RECOVER+ntaxw.TXT
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\RECOVER+ntaxw.HTM
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\RECOVER+ntaxw.PNG
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\RECOVER+ntaxw.TXT
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\RECOVER+ntaxw.HTM
%ALLUSERSPROFILE%\Documents\My Pictures\RECOVER+ntaxw.PNG
%ALLUSERSPROFILE%\Documents\My Music\RECOVER+ntaxw.TXT
%ALLUSERSPROFILE%\Documents\My Music\RECOVER+ntaxw.HTM
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\RECOVER+ntaxw.PNG
<Current directory>\RECOVER+ntaxw.TXT
<Current directory>\RECOVER+ntaxw.HTM
%ALLUSERSPROFILE%\Documents\My Music\My Playlists\RECOVER+ntaxw.PNG
%WINDIR%\wfxmryfue.exe
%HOMEPATH%\My Documents\recover_file_rrghitaqr.txt
<Current directory>\RECOVER+ntaxw.PNG
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\RECOVER+ntaxw.TXT
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\RECOVER+ntaxw.HTM
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\RECOVER+ntaxw.PNG
%ALLUSERSPROFILE%\Documents\My Music\My Playlists\RECOVER+ntaxw.TXT
%ALLUSERSPROFILE%\Documents\My Music\My Playlists\RECOVER+ntaxw.HTM
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\RECOVER+ntaxw.PNG
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\RECOVER+ntaxw.TXT
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\RECOVER+ntaxw.HTM
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\RECOVER+ntaxw.PNG
%ALLUSERSPROFILE%\Favorites\RECOVER+ntaxw.TXT
%ALLUSERSPROFILE%\Favorites\RECOVER+ntaxw.HTM
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\RECOVER+ntaxw.PNG
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\RECOVER+ntaxw.TXT
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\RECOVER+ntaxw.HTM
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\RECOVER+ntaxw.PNG
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\RECOVER+ntaxw.TXT
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\RECOVER+ntaxw.HTM
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\RECOVER+ntaxw.PNG
%ALLUSERSPROFILE%\Documents\My Videos\RECOVER+ntaxw.TXT
%ALLUSERSPROFILE%\Documents\My Videos\RECOVER+ntaxw.HTM
%ALLUSERSPROFILE%\Documents\RECOVER+ntaxw.PNG
%ALLUSERSPROFILE%\Documents\My Pictures\RECOVER+ntaxw.TXT
%ALLUSERSPROFILE%\Documents\My Pictures\RECOVER+ntaxw.HTM
%ALLUSERSPROFILE%\Documents\My Videos\RECOVER+ntaxw.PNG
%ALLUSERSPROFILE%\DRM\RECOVER+ntaxw.TXT
%ALLUSERSPROFILE%\DRM\RECOVER+ntaxw.HTM
%ALLUSERSPROFILE%\Favorites\RECOVER+ntaxw.PNG
%ALLUSERSPROFILE%\Documents\RECOVER+ntaxw.TXT
%ALLUSERSPROFILE%\Documents\RECOVER+ntaxw.HTM
%ALLUSERSPROFILE%\DRM\RECOVER+ntaxw.PNG
C:\Documents and Settings\Default User\Application Data\RECOVER+ntaxw.TXT
C:\Documents and Settings\Default User\Recent\RECOVER+ntaxw.HTM
C:\Documents and Settings\Default User\SendTo\RECOVER+ntaxw.PNG
C:\Documents and Settings\Default User\SendTo\RECOVER+ntaxw.TXT
C:\Documents and Settings\Default User\PrintHood\RECOVER+ntaxw.HTM
C:\Documents and Settings\Default User\Recent\RECOVER+ntaxw.PNG
C:\Documents and Settings\Default User\Recent\RECOVER+ntaxw.TXT
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\RECOVER+ntaxw.HTM
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\RECOVER+ntaxw.PNG
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\RECOVER+ntaxw.TXT
C:\Documents and Settings\Default User\SendTo\RECOVER+ntaxw.HTM
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\RECOVER+ntaxw.PNG
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\RECOVER+ntaxw.TXT
C:\Documents and Settings\Default User\Local Settings\RECOVER+ntaxw.HTM
C:\Documents and Settings\Default User\My Documents\RECOVER+ntaxw.PNG
C:\Documents and Settings\Default User\My Documents\RECOVER+ntaxw.TXT
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\RECOVER+ntaxw.HTM
C:\Documents and Settings\Default User\Local Settings\RECOVER+ntaxw.PNG
C:\Documents and Settings\Default User\Local Settings\RECOVER+ntaxw.TXT
C:\Documents and Settings\Default User\NetHood\RECOVER+ntaxw.HTM
C:\Documents and Settings\Default User\PrintHood\RECOVER+ntaxw.PNG
C:\Documents and Settings\Default User\PrintHood\RECOVER+ntaxw.TXT
C:\Documents and Settings\Default User\My Documents\RECOVER+ntaxw.HTM
C:\Documents and Settings\Default User\NetHood\RECOVER+ntaxw.PNG
C:\Documents and Settings\Default User\NetHood\RECOVER+ntaxw.TXT
C:\Documents and Settings\Default User\Templates\RECOVER+ntaxw.HTM
C:\Documents and Settings\Default User\RECOVER+ntaxw.PNG
C:\Documents and Settings\Default User\RECOVER+ntaxw.TXT
C:\Documents and Settings\Default User\Start Menu\RECOVER+ntaxw.HTM
C:\Documents and Settings\Default User\Templates\RECOVER+ntaxw.PNG
C:\Documents and Settings\Default User\Templates\RECOVER+ntaxw.TXT
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\RECOVER+ntaxw.HTM
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\RECOVER+ntaxw.PNG
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\RECOVER+ntaxw.TXT
C:\Documents and Settings\Default User\RECOVER+ntaxw.HTM
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\RECOVER+ntaxw.PNG
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\RECOVER+ntaxw.TXT
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\RECOVER+ntaxw.HTM
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\RECOVER+ntaxw.PNG
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\RECOVER+ntaxw.TXT
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\RECOVER+ntaxw.HTM
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\RECOVER+ntaxw.PNG
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\RECOVER+ntaxw.TXT
C:\Documents and Settings\Default User\Start Menu\Programs\RECOVER+ntaxw.HTM
C:\Documents and Settings\Default User\Start Menu\RECOVER+ntaxw.PNG
C:\Documents and Settings\Default User\Start Menu\RECOVER+ntaxw.TXT
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\RECOVER+ntaxw.HTM
C:\Documents and Settings\Default User\Start Menu\Programs\RECOVER+ntaxw.PNG
C:\Documents and Settings\Default User\Start Menu\Programs\RECOVER+ntaxw.TXT
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\RECOVER+ntaxw.HTM
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\RECOVER+ntaxw.PNG
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\RECOVER+ntaxw.TXT
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\RECOVER+ntaxw.HTM
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\RECOVER+ntaxw.PNG
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\RECOVER+ntaxw.TXT
C:\Documents and Settings\Default User\Local Settings\Application Data\RECOVER+ntaxw.HTM
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\RECOVER+ntaxw.PNG
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\RECOVER+ntaxw.TXT
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\RECOVER+ntaxw.HTM
C:\Documents and Settings\Default User\Local Settings\Application Data\RECOVER+ntaxw.PNG
C:\Documents and Settings\Default User\Local Settings\Application Data\RECOVER+ntaxw.TXT
C:\Documents and Settings\Default User\Cookies\RECOVER+ntaxw.HTM
C:\Documents and Settings\Default User\Favorites\RECOVER+ntaxw.PNG
C:\Documents and Settings\Default User\Favorites\RECOVER+ntaxw.TXT
C:\Documents and Settings\Default User\Application Data\RECOVER+ntaxw.HTM
C:\Documents and Settings\Default User\Cookies\RECOVER+ntaxw.PNG
C:\Documents and Settings\Default User\Cookies\RECOVER+ntaxw.TXT
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\RECOVER+ntaxw.HTM
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\RECOVER+ntaxw.PNG
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\RECOVER+ntaxw.TXT
C:\Documents and Settings\Default User\Favorites\RECOVER+ntaxw.HTM
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\RECOVER+ntaxw.PNG
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\RECOVER+ntaxw.TXT
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\RECOVER+ntaxw.HTM
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\RECOVER+ntaxw.PNG
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\RECOVER+ntaxw.TXT
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\RECOVER+ntaxw.HTM
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\RECOVER+ntaxw.PNG
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\RECOVER+ntaxw.TXT
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\RECOVER+ntaxw.HTM
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\RECOVER+ntaxw.PNG
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\RECOVER+ntaxw.TXT
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\RECOVER+ntaxw.HTM
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\RECOVER+ntaxw.PNG
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\RECOVER+ntaxw.TXT
C:\Documents and Settings\Default User\Local Settings\History\RECOVER+ntaxw.HTM
C:\Documents and Settings\Default User\Local Settings\Temp\RECOVER+ntaxw.PNG
C:\Documents and Settings\Default User\Local Settings\Temp\RECOVER+ntaxw.TXT
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\RECOVER+ntaxw.HTM
C:\Documents and Settings\Default User\Local Settings\History\RECOVER+ntaxw.PNG
C:\Documents and Settings\Default User\Local Settings\History\RECOVER+ntaxw.TXT
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\RECOVER+ntaxw.HTM
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\RECOVER+ntaxw.PNG
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\RECOVER+ntaxw.TXT
C:\Documents and Settings\Default User\Local Settings\Temp\RECOVER+ntaxw.HTM
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\RECOVER+ntaxw.PNG
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\RECOVER+ntaxw.TXT

Moves the following files:

from %APPDATA%\Microsoft\Internet Explorer\brndlog.txt to %APPDATA%\Microsoft\Internet Explorer\brndlog.txt.mp3

Deletes itself.

Network activity:

Connects to:

'po####drusgroup.com':80
'bl#####oeenergy.com.au':80
'bu#######gyefficienthomes.com':80
'vo###rgspa.kz':80
'to####nbermuda.co':80
'mo###dit.com':80

TCP:

HTTP POST requests:

http://po####drusgroup.com/components/com_acymailing/views/user/tmpl/mzsys.php
http://bl#####oeenergy.com.au/wp-content/plugins/mzsys.php
http://bu#######gyefficienthomes.com/wp-content/plugins/mzsys.php
http://vo###rgspa.kz/modules/mod_enrola/mzsys.php
http://to####nbermuda.co/plugins/mzsys.php
http://mo###dit.com/mzsys.php

UDP:

DNS ASK po####drusgroup.com
DNS ASK bl#####oeenergy.com.au
DNS ASK bu#######gyefficienthomes.com
DNS ASK vo###rgspa.kz
DNS ASK to####nbermuda.co
DNS ASK mo###dit.com

Miscellaneous:

Searches for the following windows:

ClassName: 'Indicator' WindowName: ''

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial