Trojan.Encoder.5073

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%HOMEPATH%\Start Menu\Programs\Startup\DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\DECRYPT_YOUR_FILES.HTML

Modifies file system:

Creates the following files:

C:\Far2\Plugins\Colorer\hrc\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\Colorer\hrd\console\contrib\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\Colorer\hrc\auto\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\Colorer\bin\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\Colorer\hrc\auto\types\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\Colorer\hrd\console\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\DrawLine\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\EditCase\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\Compare\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\Colorer\hrd\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\Colorer\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\Brackets\DECRYPT_YOUR_FILES.HTML
C:\Far2\Documentation\rus\DECRYPT_YOUR_FILES.HTML
C:\Far2\Documentation\DECRYPT_YOUR_FILES.HTML
C:\Far2\Documentation\eng\DECRYPT_YOUR_FILES.HTML
C:\Far2\Addons\XLat\DECRYPT_YOUR_FILES.HTML
C:\Far2\Addons\DECRYPT_YOUR_FILES.HTML
C:\Far2\Encyclopedia\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\arclite\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\AutoWrap\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\Align\DECRYPT_YOUR_FILES.HTML
C:\Far2\FExcept\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\7-Zip\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\WinSCP\components\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\WinSCP\console\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\TmpPanel\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\Network\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\ProcList\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\WinSCP\core\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\WinSCP\filezilla\misc\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\WinSCP\filezilla\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\WinSCP\fari\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\WinSCP\dragext\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\WinSCP\far\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\MacroView\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\ExtSearch\sources\RegExp\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\ExtSearch\sources\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\ExtSearch\keys\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\EMenu\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\ExtSearch\doc\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\ExtSearch\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\FTP\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\HlfViewer\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\FTP\lib\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\FarCmds\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\FileCase\DECRYPT_YOUR_FILES.HTML
C:\Far2\Addons\XLat\Russian\DECRYPT_YOUR_FILES.HTML
<LS_APPDATA>\VMware\DECRYPT_YOUR_FILES.HTML
<LS_APPDATA>\DECRYPT_YOUR_FILES.HTML
<LS_APPDATA>\Mozilla\DECRYPT_YOUR_FILES.HTML
<LS_APPDATA>\Mozilla\Firefox\Profiles\DECRYPT_YOUR_FILES.HTML
<LS_APPDATA>\Mozilla\Firefox\DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\Local Settings\Temporary Internet Files\DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\Local Settings\DECRYPT_YOUR_FILES.HTML
%TEMP%\DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\Local Settings\History\History.IE5\DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\Local Settings\History\DECRYPT_YOUR_FILES.HTML
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\DECRYPT_YOUR_FILES.HTML
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\A\DECRYPT_YOUR_FILES.HTML
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\B\DECRYPT_YOUR_FILES.HTML
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\9\DECRYPT_YOUR_FILES.HTML
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\7\DECRYPT_YOUR_FILES.HTML
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\8\DECRYPT_YOUR_FILES.HTML
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\C\DECRYPT_YOUR_FILES.HTML
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\DECRYPT_YOUR_FILES.HTML
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\DECRYPT_YOUR_FILES.HTML
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\F\DECRYPT_YOUR_FILES.HTML
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\D\DECRYPT_YOUR_FILES.HTML
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\E\DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\Templates\DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\Start Menu\Programs\DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\Start Menu\DECRYPT_YOUR_FILES.HTML
C:\Far2\Addons\Colors\Custom Highlighting\DECRYPT_YOUR_FILES.HTML
C:\Far2\Addons\SetUp\DECRYPT_YOUR_FILES.HTML
C:\Far2\Addons\Shell\DECRYPT_YOUR_FILES.HTML
C:\Far2\Addons\Macros\DECRYPT_YOUR_FILES.HTML
C:\Far2\Addons\Colors\Default Highlighting\DECRYPT_YOUR_FILES.HTML
C:\Far2\Addons\Colors\DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\Start Menu\Programs\Accessories\DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\My Documents\My Received Files\DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\My Documents\DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\My Documents\My Pictures\DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\My Documents\Downloads\DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\My Documents\My Music\DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\NetHood\DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\SendTo\DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\PrintHood\DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\Recent\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\MSSoap\Binaries\Resources\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\MSSoap\Binaries\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\MSSoap\Binaries\Resources\1033\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\Microsoft Shared\web server extensions\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\Microsoft Shared\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\MSSoap\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\SpeechEngines\Microsoft\Lexicon\1033\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\SpeechEngines\Microsoft\Lexicon\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\Services\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\ODBC\Data Sources\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\ODBC\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bots\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\isapi\_vti_adm\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bots\vinavbar\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\1033\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\isapi\_vti_aut\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\_vti_bin\_vti_aut\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\_vti_bin\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\_vti_bin\_vti_adm\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\isapi\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\servsupp\DECRYPT_YOUR_FILES.HTML
%ProgramFiles%\FireFox\chrome\browser\content\browser\migration\DECRYPT_YOUR_FILES.HTML
%ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\DECRYPT_YOUR_FILES.HTML
%ProgramFiles%\FireFox\chrome\browser\content\browser\history\DECRYPT_YOUR_FILES.HTML
%ProgramFiles%\FireFox\chrome\browser\content\browser\certerror\DECRYPT_YOUR_FILES.HTML
%ProgramFiles%\FireFox\chrome\browser\content\browser\feeds\DECRYPT_YOUR_FILES.HTML
%ProgramFiles%\FireFox\chrome\browser\content\browser\places\DECRYPT_YOUR_FILES.HTML
%ProgramFiles%\FireFox\chrome\browser\content\browser\DECRYPT_YOUR_FILES.HTML
%ProgramFiles%\FireFox\chrome\browser\content\DECRYPT_YOUR_FILES.HTML
%ProgramFiles%\FireFox\chrome\browser\content\browser\search\DECRYPT_YOUR_FILES.HTML
%ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\DECRYPT_YOUR_FILES.HTML
%ProgramFiles%\FireFox\chrome\browser\content\browser\safebrowsing\DECRYPT_YOUR_FILES.HTML
%ProgramFiles%\FireFox\chrome\browser\content\browser\bookmarks\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\SpeechEngines\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\System\ado\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\SpeechEngines\Microsoft\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\SpeechEngines\Microsoft\TTS\1033\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\SpeechEngines\Microsoft\TTS\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\System\msadc\DECRYPT_YOUR_FILES.HTML
%ProgramFiles%\ComPlus Applications\DECRYPT_YOUR_FILES.HTML
%ProgramFiles%\FireFox\chrome\browser\content\branding\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\System\Ole DB\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\System\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admisapi\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\WinSCP\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\WinSCP\windows\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\WinSCP\release\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\WinSCP\resource\DECRYPT_YOUR_FILES.HTML
C:\Far2\PluginSDK\Headers.c\DECRYPT_YOUR_FILES.HTML
C:\Muldrop\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\Microsoft Shared\DAO\DECRYPT_YOUR_FILES.HTML
C:\Far2\DECRYPT_YOUR_FILES.HTML
C:\Far2\PluginSDK\Headers.pas\DECRYPT_YOUR_FILES.HTML
C:\Far2\PluginSDK\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\WinSCP\putty\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\WinSCP\packages\filemng\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\WinSCP\packages\my\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\WinSCP\packages\dragndrop\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\WinSCP\forms\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\WinSCP\lib\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\WinSCP\packages\tb2k\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\WinSCP\putty\charset\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\WinSCP\putty\windows\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\WinSCP\packages\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\WinSCP\packages\tbx\DECRYPT_YOUR_FILES.HTML
C:\Far2\Plugins\WinSCP\packages\theme\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\Microsoft Shared\TextConv\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\Microsoft Shared\Triedit\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\Microsoft Shared\Stationery\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\Microsoft Shared\Speech\1033\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\Microsoft Shared\Speech\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\Microsoft Shared\VC\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admcgi\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admisapi\scripts\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admcgi\scripts\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\Microsoft Shared\VGX\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\Microsoft Shared\Web Folders\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\Microsoft Shared\MSInfo\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\Microsoft Shared\DW\1033\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\Microsoft Shared\DW\1036\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\Microsoft Shared\DW\1031\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\Microsoft Shared\DW\1025\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\Microsoft Shared\DW\1028\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\Microsoft Shared\DW\1040\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\Microsoft Shared\DW\3082\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\Microsoft Shared\DW\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\Microsoft Shared\DW\2052\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\Microsoft Shared\DW\1041\DECRYPT_YOUR_FILES.HTML
%CommonProgramFiles%\Microsoft Shared\DW\1042\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Local Settings\Temp\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Local Settings\History\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Local Settings\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\My Documents\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Local Settings\Application Data\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Application Data\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Cookies\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Application Data\Microsoft\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Desktop\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Favorites\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\LocalService\Application Data\Microsoft\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\LocalService\Application Data\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\SendTo\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Recent\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\NetHood\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\PrintHood\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Start Menu\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Templates\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Start Menu\Programs\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Pbk\DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Application Data\Microsoft\DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Documents\My Music\My Playlists\DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Application Data\DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Desktop\DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Cm\DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\DECRYPT_YOUR_FILES.HTML
<Current directory>\DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\MachineKeys\DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Index\DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Player\DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Application Data\Microsoft\HTML Help\DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Application Data\Microsoft\Dr Watson\DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Start Menu\Programs\DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Start Menu\DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Start Menu\Programs\Games\DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Templates\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Documents\My Pictures\DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Documents\My Videos\DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Documents\My Music\DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Documents\DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\DRM\DECRYPT_YOUR_FILES.HTML
%ALLUSERSPROFILE%\Favorites\DECRYPT_YOUR_FILES.HTML
%APPDATA%\Mozilla\Extensions\DECRYPT_YOUR_FILES.HTML
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\DECRYPT_YOUR_FILES.HTML
%APPDATA%\Microsoft\DECRYPT_YOUR_FILES.HTML
%APPDATA%\Microsoft\Windows\Themes\DECRYPT_YOUR_FILES.HTML
%APPDATA%\Microsoft\Windows\DECRYPT_YOUR_FILES.HTML
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\DECRYPT_YOUR_FILES.HTML
%APPDATA%\Mozilla\DECRYPT_YOUR_FILES.HTML
%APPDATA%\DECRYPT_YOUR_FILES.HTML
%APPDATA%\Mozilla\Firefox\DECRYPT_YOUR_FILES.HTML
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\DECRYPT_YOUR_FILES.HTML
%APPDATA%\Mozilla\Firefox\Profiles\DECRYPT_YOUR_FILES.HTML
%APPDATA%\Microsoft\SystemCertificates\DECRYPT_YOUR_FILES.HTML
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\DECRYPT_YOUR_FILES.HTML
%APPDATA%\Microsoft\Internet Explorer\DECRYPT_YOUR_FILES.HTML
%APPDATA%\Microsoft\Credentials\DECRYPT_YOUR_FILES.HTML
%APPDATA%\Microsoft\Address Book\DECRYPT_YOUR_FILES.HTML
%APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\DECRYPT_YOUR_FILES.HTML
%APPDATA%\Microsoft\Media Player\DECRYPT_YOUR_FILES.HTML
%APPDATA%\Microsoft\SystemCertificates\My\CTLs\DECRYPT_YOUR_FILES.HTML
%APPDATA%\Microsoft\SystemCertificates\My\DECRYPT_YOUR_FILES.HTML
%APPDATA%\Microsoft\SystemCertificates\My\CRLs\DECRYPT_YOUR_FILES.HTML
%APPDATA%\Microsoft\MMC\DECRYPT_YOUR_FILES.HTML
%APPDATA%\Microsoft\SystemCertificates\My\Certificates\DECRYPT_YOUR_FILES.HTML
<LS_APPDATA>\Microsoft\DECRYPT_YOUR_FILES.HTML
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\0\DECRYPT_YOUR_FILES.HTML
<LS_APPDATA>\Microsoft\Windows Media\DECRYPT_YOUR_FILES.HTML
<LS_APPDATA>\Microsoft\Windows\DECRYPT_YOUR_FILES.HTML
<LS_APPDATA>\Microsoft\Windows Media\9.0\DECRYPT_YOUR_FILES.HTML
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\1\DECRYPT_YOUR_FILES.HTML
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\5\DECRYPT_YOUR_FILES.HTML
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\6\DECRYPT_YOUR_FILES.HTML
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\4\DECRYPT_YOUR_FILES.HTML
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\2\DECRYPT_YOUR_FILES.HTML
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\3\DECRYPT_YOUR_FILES.HTML
<LS_APPDATA>\Microsoft\Media Player\DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\Favorites\DECRYPT_YOUR_FILES.HTML
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\Favorites\Links\DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\Cookies\DECRYPT_YOUR_FILES.HTML
%HOMEPATH%\Desktop\DECRYPT_YOUR_FILES.HTML
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\DECRYPT_YOUR_FILES.HTML
<LS_APPDATA>\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\DECRYPT_YOUR_FILES.HTML
<LS_APPDATA>\Microsoft\Credentials\DECRYPT_YOUR_FILES.HTML
<LS_APPDATA>\Microsoft\CD Burning\DECRYPT_YOUR_FILES.HTML
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\DECRYPT_YOUR_FILES.HTML
<LS_APPDATA>\Identities\DECRYPT_YOUR_FILES.HTML
%APPDATA%\Identities\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\LocalService\Local Settings\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\LocalService\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\MOE00UY1\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\LBMMC3H3\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\LocalService\Cookies\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\LocalService\Local Settings\Application Data\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\BGGTYMH1\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\LocalService\Local Settings\Temp\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\LocalService\Local Settings\History\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\NetworkService\Local Settings\History\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\NetworkService\Local Settings\Temp\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\NetworkService\DECRYPT_YOUR_FILES.HTML
%APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\NetworkService\Local Settings\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\NetworkService\Application Data\Microsoft\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\NetworkService\Application Data\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\NetworkService\Cookies\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\NetworkService\Local Settings\Application Data\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\DECRYPT_YOUR_FILES.HTML
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\DECRYPT_YOUR_FILES.HTML

Moves the following files:

from %ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\pageInfo.xml to %ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\pageInfo.xml.c_locked
from %ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\feeds.xml to %ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\feeds.xml.c_locked
from %ProgramFiles%\FireFox\chrome\browser\content\browser\feeds\subscribe.xml to %ProgramFiles%\FireFox\chrome\browser\content\browser\feeds\subscribe.xml.c_locked
from %ProgramFiles%\FireFox\chrome\browser\content\browser\places\menu.xml to %ProgramFiles%\FireFox\chrome\browser\content\browser\places\menu.xml.c_locked
from %ProgramFiles%\FireFox\chrome\browser\content\browser\search\search.xml to %ProgramFiles%\FireFox\chrome\browser\content\browser\search\search.xml.c_locked
from %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\handlers.xml to %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\handlers.xml.c_locked
from %ProgramFiles%\FireFox\chrome\browser\content\browser\places\tree.xml to %ProgramFiles%\FireFox\chrome\browser\content\browser\places\tree.xml.c_locked
from %ProgramFiles%\FireFox\chrome\browser\content\browser\urlbarBindings.xml to %ProgramFiles%\FireFox\chrome\browser\content\browser\urlbarBindings.xml.c_locked
from %ProgramFiles%\FireFox\README.txt to %ProgramFiles%\FireFox\README.txt.c_locked
from %ProgramFiles%\FireFox\blocklist.xml to %ProgramFiles%\FireFox\blocklist.xml.c_locked
from %APPDATA%\Microsoft\Internet Explorer\brndlog.txt to %APPDATA%\Microsoft\Internet Explorer\brndlog.txt.c_locked
from %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutSyncTabs-bindings.xml to %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutSyncTabs-bindings.xml.c_locked
from %ProgramFiles%\FireFox\chrome\browser\content\browser\tabbrowser.xml to %ProgramFiles%\FireFox\chrome\browser\content\browser\tabbrowser.xml.c_locked
from %ProgramFiles%\FireFox\chrome\browser\content\browser\syncNotification.xml to %ProgramFiles%\FireFox\chrome\browser\content\browser\syncNotification.xml.c_locked
from %ProgramFiles%\FireFox\chrome\browser\content\browser\browser-tabPreviews.xml to %ProgramFiles%\FireFox\chrome\browser\content\browser\browser-tabPreviews.xml.c_locked

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial