Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Trojan.Encoder.33482

Added to the Dr.Web virus database: 2021-02-17

Virus description added:

Technical Information

To ensure autorun and distribution
Creates the following files on removable media
  • <Drive name for removable media>:\readme.txt
Modifies file system
Creates the following files
  • C:\readme.txt
  • %ProgramFiles%\preupd\readme.txt
  • %ProgramFiles%\prevsrv\readme.txt
  • %ProgramFiles%\prevxsetup\readme.txt
  • %ProgramFiles%\privatebrowser\readme.txt
  • %ProgramFiles%\processviewer\readme.txt
  • %ProgramFiles%\protect\readme.txt
  • %ProgramFiles%\ps\readme.txt
  • %ProgramFiles%\psctrls\readme.txt
  • %ProgramFiles%\pshost\readme.txt
  • %ProgramFiles%\psimsvc\readme.txt
  • %ProgramFiles%\pxagent\readme.txt
  • %ProgramFiles%\pxconsole\readme.txt
  • %ProgramFiles%\pxl\readme.txt
  • %ProgramFiles%\pxl1\readme.txt
  • %ProgramFiles%\pxreset\readme.txt
  • %ProgramFiles%\pxsupport\readme.txt
  • %ProgramFiles%\python\readme.txt
  • %ProgramFiles%\preconfig\readme.txt
  • %ProgramFiles%\qhwscsvc\readme.txt
  • %ProgramFiles%\pqpent\readme.txt
  • %ProgramFiles%\pqpe\readme.txt
  • %ProgramFiles%\pccguide\readme.txt
  • %ProgramFiles%\pccntmon\readme.txt
  • %ProgramFiles%\pccpfw\readme.txt
  • %ProgramFiles%\pcctlcom\readme.txt
  • %ProgramFiles%\pctav\readme.txt
  • %ProgramFiles%\pertsk\readme.txt
  • %ProgramFiles%\pidgin\readme.txt
  • %ProgramFiles%\pm\readme.txt
  • %ProgramFiles%\pm8flash\readme.txt
  • %ProgramFiles%\pmagic\readme.txt
  • %ProgramFiles%\pmagic9x\readme.txt
  • %ProgramFiles%\pmagicbt\readme.txt
  • %ProgramFiles%\pmagicnt\readme.txt
  • %ProgramFiles%\polutil\readme.txt
  • %ProgramFiles%\postinstall\readme.txt
  • %ProgramFiles%\ppfw\readme.txt
  • %ProgramFiles%\pqbw\readme.txt
  • %ProgramFiles%\pqpe9x\readme.txt
  • %ProgramFiles%\rulaunch\readme.txt
  • %ProgramFiles%\seccenter\readme.txt
  • %ProgramFiles%\qrtfix\readme.txt
  • %ProgramFiles%\sarcli\readme.txt
  • %ProgramFiles%\sargui\readme.txt
  • %ProgramFiles%\savadminservice\readme.txt
  • %ProgramFiles%\savmain\readme.txt
  • %ProgramFiles%\savprogress\readme.txt
  • %ProgramFiles%\savscan\readme.txt
  • %ProgramFiles%\sbase\readme.txt
  • %ProgramFiles%\scalc\readme.txt
  • %ProgramFiles%\scanner\readme.txt
  • %ProgramFiles%\scanningprocess\readme.txt
  • %ProgramFiles%\sched\readme.txt
  • %ProgramFiles%\sdhelp\readme.txt
  • %ProgramFiles%\sdinvoker\readme.txt
  • %ProgramFiles%\sdloader\readme.txt
  • %ProgramFiles%\sdraw\readme.txt
  • %ProgramFiles%\sdtrayapp\readme.txt
  • %ProgramFiles%\seamonkey\readme.txt
  • %ProgramFiles%\safari\readme.txt
  • %ProgramFiles%\pavsrv51\readme.txt
  • %ProgramFiles%\runsetup\readme.txt
  • %ProgramFiles%\rtvscan\readme.txt
  • %ProgramFiles%\quaranti\readme.txt
  • %ProgramFiles%\quickstart\readme.txt
  • %ProgramFiles%\ragexe\readme.txt
  • %ProgramFiles%\ragfree\readme.txt
  • %ProgramFiles%\rapget\readme.txt
  • %ProgramFiles%\rat\readme.txt
  • %ProgramFiles%\ravmon\readme.txt
  • %ProgramFiles%\ravtimer\readme.txt
  • %ProgramFiles%\rcimlby\readme.txt
  • %ProgramFiles%\realmon\readme.txt
  • %ProgramFiles%\reference assemblies\readme.txt
  • %ProgramFiles%\register\readme.txt
  • %ProgramFiles%\removeit\readme.txt
  • %ProgramFiles%\remover\readme.txt
  • %ProgramFiles%\rescue\readme.txt
  • %ProgramFiles%\rfwmain\readme.txt
  • %ProgramFiles%\rq\readme.txt
  • %ProgramFiles%\qip\readme.txt
  • %ProgramFiles%\qklez\readme.txt
  • %ProgramFiles%\pavprsrv\readme.txt
  • %ProgramFiles%\neowatchtray\readme.txt
  • %ProgramFiles%\mp3tray\readme.txt
  • %ProgramFiles%\mpeng\readme.txt
  • %ProgramFiles%\mpftray\readme.txt
  • %ProgramFiles%\mpssvc\readme.txt
  • %ProgramFiles%\msbuild\readme.txt
  • %ProgramFiles%\msimn\readme.txt
  • %ProgramFiles%\msmpsvc\readme.txt
  • %ProgramFiles%\msn6\readme.txt
  • %ProgramFiles%\msnmsgr\readme.txt
  • %ProgramFiles%\mva\readme.txt
  • %ProgramFiles%\mvc\readme.txt
  • %ProgramFiles%\myagtsvc\readme.txt
  • %ProgramFiles%\myagttry\readme.txt
  • %ProgramFiles%\navapsvc\readme.txt
  • %ProgramFiles%\navlu32\readme.txt
  • %ProgramFiles%\navstub\readme.txt
  • %ProgramFiles%\navw32\readme.txt
  • %ProgramFiles%\mp3toystray\readme.txt
  • %ProgramFiles%\navwnt\readme.txt
  • %ProgramFiles%\mp3toys\readme.txt
  • %ProgramFiles%\monsysnt\readme.txt
  • %ProgramFiles%\maxthon\readme.txt
  • %ProgramFiles%\mcmnhdlr\readme.txt
  • %ProgramFiles%\mcregwiz\readme.txt
  • %ProgramFiles%\mcshield\readme.txt
  • %ProgramFiles%\mcupdmgr\readme.txt
  • %ProgramFiles%\mcvsshld\readme.txt
  • %ProgramFiles%\memstring\readme.txt
  • %ProgramFiles%\mfpmp\readme.txt
  • %ProgramFiles%\microsoft analysis services\readme.txt
  • %ProgramFiles%\microsoft office\readme.txt
  • %ProgramFiles%\microsoft sql server compact edition\readme.txt
  • %ProgramFiles%\microsoft sync framework\readme.txt
  • %ProgramFiles%\microsoft synchronization services\readme.txt
  • %ProgramFiles%\mir3game\readme.txt
  • %ProgramFiles%\miranda32\readme.txt
  • %ProgramFiles%\miro\readme.txt
  • %ProgramFiles%\monlite\readme.txt
  • %ProgramFiles%\mp3theater\readme.txt
  • %ProgramFiles%\nvcte\readme.txt
  • %ProgramFiles%\pavprot\readme.txt
  • %ProgramFiles%\netstatviewer\readme.txt
  • %ProgramFiles%\oasrv\readme.txt
  • %ProgramFiles%\oaui\readme.txt
  • %ProgramFiles%\ofcpfwsvc\readme.txt
  • %ProgramFiles%\oget\readme.txt
  • %ProgramFiles%\oladdin\readme.txt
  • %ProgramFiles%\onaccessinstaller\readme.txt
  • %ProgramFiles%\opera\readme.txt
  • %ProgramFiles%\oscheck\readme.txt
  • %ProgramFiles%\outlook\readme.txt
  • %ProgramFiles%\outpost\readme.txt
  • %ProgramFiles%\partin\readme.txt
  • %ProgramFiles%\partin9x\readme.txt
  • %ProgramFiles%\partinfo\readme.txt
  • %ProgramFiles%\partinnt\readme.txt
  • %ProgramFiles%\pavfires\readme.txt
  • %ProgramFiles%\pavfnsvr\readme.txt
  • %ProgramFiles%\pavkre\readme.txt
  • %ProgramFiles%\nwservice\readme.txt
  • %ProgramFiles%\pavproxy\readme.txt
  • %ProgramFiles%\nvcut\readme.txt
  • %ProgramFiles%\nvcod\readme.txt
  • %ProgramFiles%\netxray\readme.txt
  • %ProgramFiles%\nisoptui\readme.txt
  • %ProgramFiles%\nod\readme.txt
  • %ProgramFiles%\nod32\readme.txt
  • %ProgramFiles%\nod32krn\readme.txt
  • %ProgramFiles%\nod32kui\readme.txt
  • %ProgramFiles%\notifyha\readme.txt
  • %ProgramFiles%\notstart\readme.txt
  • %ProgramFiles%\npavtray\readme.txt
  • %ProgramFiles%\npfmsg\readme.txt
  • %ProgramFiles%\nsmdtr\readme.txt
  • %ProgramFiles%\nssserv\readme.txt
  • %ProgramFiles%\nsstray\readme.txt
  • %ProgramFiles%\ntoskrnl\readme.txt
  • %ProgramFiles%\ntrtscan\readme.txt
  • %ProgramFiles%\ntxconfig\readme.txt
  • %ProgramFiles%\nupgrade\readme.txt
  • %ProgramFiles%\neowatchlog\readme.txt
  • %ProgramFiles%\unoinfo\readme.txt
  • C:\far2\addons\colors\readme.txt
  • %ProgramFiles%\simpress\readme.txt
  • %ProgramFiles%\winroute\readme.txt
  • %ProgramFiles%\winss\readme.txt
  • %ProgramFiles%\winssnotify\readme.txt
  • %ProgramFiles%\wish\readme.txt
  • %ProgramFiles%\wlloginproxy\readme.txt
  • %ProgramFiles%\wlmail\readme.txt
  • %ProgramFiles%\wltuser\readme.txt
  • %ProgramFiles%\woool\readme.txt
  • %ProgramFiles%\wow\readme.txt
  • %ProgramFiles%\wradmin\readme.txt
  • %ProgramFiles%\wrctrl\readme.txt
  • %ProgramFiles%\writespid\readme.txt
  • %ProgramFiles%\wsctool\readme.txt
  • %ProgramFiles%\wsftpgui\readme.txt
  • %ProgramFiles%\wsm\readme.txt
  • %ProgramFiles%\xcommsvr\readme.txt
  • %ProgramFiles%\yahoomessenger\readme.txt
  • %ProgramFiles%\winmail\readme.txt
  • %ProgramFiles%\yahoosync\readme.txt
  • %ProgramFiles%\windump\readme.txt
  • %ProgramFiles%\wincmd32\readme.txt
  • %ProgramFiles%\visthlic\readme.txt
  • %ProgramFiles%\visthupd\readme.txt
  • %ProgramFiles%\vrfwsvc\readme.txt
  • %ProgramFiles%\vrmonsvc\readme.txt
  • %ProgramFiles%\vrrw32\readme.txt
  • %ProgramFiles%\vshwin32\readme.txt
  • %ProgramFiles%\vsmon\readme.txt
  • %ProgramFiles%\vsserv\readme.txt
  • %ProgramFiles%\vsstat\readme.txt
  • %ProgramFiles%\wclose\readme.txt
  • %ProgramFiles%\webfiltr\readme.txt
  • %ProgramFiles%\webmoney\readme.txt
  • %ProgramFiles%\webproxy\readme.txt
  • %ProgramFiles%\webscanx\readme.txt
  • %ProgramFiles%\wil\readme.txt
  • %ProgramFiles%\winaw32\readme.txt
  • %ProgramFiles%\winbaram\readme.txt
  • %ProgramFiles%\windowlist\readme.txt
  • %ProgramFiles(x86)%\pidgin\readme.txt
  • %ProgramFiles%\sigtool\readme.txt
  • %ProgramFiles%\zapro\readme.txt
  • %ProgramFiles(x86)%\steam\readme.txt
  • %ProgramFiles(x86)%\uninstall information\readme.txt
  • %ProgramFiles(x86)%\winamp\readme.txt
  • %ALLUSERSPROFILE%\adobe\readme.txt
  • %ALLUSERSPROFILE%\microsoft\readme.txt
  • %ALLUSERSPROFILE%\microsoft help\readme.txt
  • %ALLUSERSPROFILE%\microsoft toolkit\readme.txt
  • %ALLUSERSPROFILE%\mozilla\readme.txt
  • %ALLUSERSPROFILE%\oracle\readme.txt
  • %ALLUSERSPROFILE%\package cache\readme.txt
  • %ALLUSERSPROFILE%\sun\readme.txt
  • C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\readme.txt
  • C:\totalcmd\language\readme.txt
  • D:\readme.txt
  • C:\users\default\readme.txt
  • C:\users\public\readme.txt
  • %HOMEPATH%\readme.txt
  • %ProgramFiles(x86)%\reference assemblies\readme.txt
  • %ProgramFiles%\vistaux\readme.txt
  • %ProgramFiles(x86)%\qip 2012\readme.txt
  • %ProgramFiles(x86)%\opera\readme.txt
  • %ProgramFiles%\zatutor\readme.txt
  • %ProgramFiles%\zauninst\readme.txt
  • %ProgramFiles%\zlclient\readme.txt
  • %ProgramFiles%\zonealarm\readme.txt
  • %ProgramFiles(x86)%\adobe\readme.txt
  • %CommonProgramFiles(x86)%\readme.txt
  • %ProgramFiles(x86)%\google\readme.txt
  • %ProgramFiles(x86)%\internet explorer\readme.txt
  • %ProgramFiles(x86)%\k-lite codec pack\readme.txt
  • %ProgramFiles(x86)%\microsoft analysis services\readme.txt
  • %ProgramFiles(x86)%\microsoft office\readme.txt
  • %ProgramFiles(x86)%\microsoft visual studio .net 2003\readme.txt
  • %ProgramFiles(x86)%\microsoft visual studio 8\readme.txt
  • %ProgramFiles(x86)%\microsoft.net\readme.txt
  • %ProgramFiles(x86)%\mozilla firefox\readme.txt
  • %ProgramFiles(x86)%\mozilla thunderbird\readme.txt
  • %ProgramFiles(x86)%\msbuild\readme.txt
  • %ProgramFiles%\ybclient\readme.txt
  • %ProgramFiles%\maplestory\readme.txt
  • %ProgramFiles%\virusnews\readme.txt
  • %ProgramFiles%\thgnard\readme.txt
  • %ProgramFiles%\streetsolkshim\readme.txt
  • %ProgramFiles%\submitfiles\readme.txt
  • %ProgramFiles%\svcntaux\readme.txt
  • %ProgramFiles%\swagent\readme.txt
  • %ProgramFiles%\swdoctor\readme.txt
  • %ProgramFiles%\swdsvc\readme.txt
  • %ProgramFiles%\sweb\readme.txt
  • %ProgramFiles%\swriter\readme.txt
  • %ProgramFiles%\symantecrootinstaller\readme.txt
  • %ProgramFiles%\symlcsvc\readme.txt
  • %ProgramFiles%\symproxysvc\readme.txt
  • %ProgramFiles%\symsport\readme.txt
  • %ProgramFiles%\symwsc\readme.txt
  • %ProgramFiles%\sysinfo\readme.txt
  • %ProgramFiles%\tbmon\readme.txt
  • %ProgramFiles%\tca\readme.txt
  • %ProgramFiles%\teatimer\readme.txt
  • %ProgramFiles%\stopsignav\readme.txt
  • %ProgramFiles%\tgsvcstp\readme.txt
  • %ProgramFiles%\start_diag\readme.txt
  • %ProgramFiles%\spybotsd\readme.txt
  • %ProgramFiles%\sitecli\readme.txt
  • %ProgramFiles%\skype\readme.txt
  • %ProgramFiles%\skypepm\readme.txt
  • %ProgramFiles%\smartftp\readme.txt
  • %ProgramFiles%\smath\readme.txt
  • %ProgramFiles%\smc\readme.txt
  • %ProgramFiles%\sndsrvc\readme.txt
  • %ProgramFiles%\sniffer\readme.txt
  • %ProgramFiles%\so3d\readme.txt
  • %ProgramFiles%\soffice\readme.txt
  • %ProgramFiles%\spamcfg\readme.txt
  • %ProgramFiles%\spbbcsvc\readme.txt
  • %ProgramFiles%\spider\readme.txt
  • %ProgramFiles%\spiderml\readme.txt
  • %ProgramFiles%\spidernt\readme.txt
  • %ProgramFiles%\spiderui\readme.txt
  • %ProgramFiles%\sporder\readme.txt
  • %ProgramFiles%\sro_client\readme.txt
  • %ProgramFiles%\sfagent\readme.txt
  • %ProgramFiles%\viritsvc\readme.txt
  • %ProgramFiles%\thunderbird\readme.txt
  • %ProgramFiles%\up2date\readme.txt
  • %ProgramFiles%\updater\readme.txt
  • %ProgramFiles%\updaterui\readme.txt
  • %ProgramFiles%\updclient\readme.txt
  • %ProgramFiles%\upgrepl\readme.txt
  • %ProgramFiles%\upsobmaker\readme.txt
  • %ProgramFiles%\usdownloader\readme.txt
  • %ProgramFiles%\uupd\readme.txt
  • %ProgramFiles%\vba32ecm\readme.txt
  • %ProgramFiles%\vba32ifs\readme.txt
  • %ProgramFiles%\vba32ldr\readme.txt
  • %ProgramFiles%\vba32pp3\readme.txt
  • %ProgramFiles%\vbsntw\readme.txt
  • %ProgramFiles%\vchk\readme.txt
  • %ProgramFiles%\vcrmon\readme.txt
  • %ProgramFiles%\vettray\readme.txt
  • %ProgramFiles%\viritexp\readme.txt
  • %ProgramFiles%\unp_test\readme.txt
  • %ProgramFiles%\viruskeeper\readme.txt
  • %ProgramFiles%\unopkg\readme.txt
  • %ProgramFiles%\uninstalllsp\readme.txt
  • %ProgramFiles%\tmas\readme.txt
  • %ProgramFiles%\tmlisten\readme.txt
  • %ProgramFiles%\tmntsrv\readme.txt
  • %ProgramFiles%\tnbutil\readme.txt
  • %ProgramFiles%\totalcmd\readme.txt
  • %ProgramFiles%\tracelog\readme.txt
  • %ProgramFiles%\traymon\readme.txt
  • %ProgramFiles%\trillian\readme.txt
  • %ProgramFiles%\trojanguarder\readme.txt
  • %ProgramFiles%\trojanhunter\readme.txt
  • %ProgramFiles%\trtddptr\readme.txt
  • %ProgramFiles%\twelvesky2\readme.txt
  • %ProgramFiles%\uiscan\readme.txt
  • %ProgramFiles%\una\readme.txt
  • %ProgramFiles%\uninstall information\readme.txt
  • %ProgramFiles%\uninstallcavs\readme.txt
  • %ProgramFiles%\uninstaller\readme.txt
  • %ProgramFiles%\thebat\readme.txt
  • %ProgramFiles%\ymsgr_tray\readme.txt
  • %ProgramFiles%\malwareremoval\readme.txt
  • %ProgramFiles%\inocit\readme.txt
  • %ProgramFiles%\bdsubmitwiz\readme.txt
  • %ProgramFiles%\bdsurvey\readme.txt
  • %ProgramFiles%\bdswitch\readme.txt
  • %ProgramFiles%\bdwizreg\readme.txt
  • %ProgramFiles%\blackd\readme.txt
  • %ProgramFiles%\blackice\readme.txt
  • %ProgramFiles%\blindman\readme.txt
  • %ProgramFiles%\btini\readme.txt
  • %ProgramFiles%\btinint\readme.txt
  • %ProgramFiles%\cabalmain\readme.txt
  • %ProgramFiles%\cafix\readme.txt
  • %ProgramFiles%\cavapp\readme.txt
  • %ProgramFiles%\cavasm\readme.txt
  • %ProgramFiles%\cavaud\readme.txt
  • %ProgramFiles%\cavemsrv\readme.txt
  • %ProgramFiles%\cavmr\readme.txt
  • %ProgramFiles%\cavmud\readme.txt
  • %ProgramFiles%\bdsubmit\readme.txt
  • %ProgramFiles%\cavoar\readme.txt
  • %ProgramFiles%\bdss\readme.txt
  • %ProgramFiles%\bdnews\readme.txt
  • %ProgramFiles%\avgupsvc\readme.txt
  • %ProgramFiles%\avgvv\readme.txt
  • %ProgramFiles%\avgw\readme.txt
  • %ProgramFiles%\avgwizfw\readme.txt
  • %ProgramFiles%\avinitnt\readme.txt
  • %ProgramFiles%\avkserv\readme.txt
  • %ProgramFiles%\avkservice\readme.txt
  • %ProgramFiles%\avkwctl\readme.txt
  • %ProgramFiles%\avnotify\readme.txt
  • %ProgramFiles%\avpcc\readme.txt
  • %ProgramFiles%\avpm\readme.txt
  • %ProgramFiles%\avscan\readme.txt
  • %ProgramFiles%\avsynmgr\readme.txt
  • %ProgramFiles%\b2\readme.txt
  • %ProgramFiles%\backweb-4476822\readme.txt
  • %ProgramFiles%\bdagent\readme.txt
  • %ProgramFiles%\bdmcon\readme.txt
  • %ProgramFiles%\bdoesrv\readme.txt
  • %ProgramFiles%\cleaner\readme.txt
  • %ProgramFiles%\digsby\readme.txt
  • %ProgramFiles%\cavse\readme.txt
  • %ProgramFiles%\clrcche\readme.txt
  • %ProgramFiles%\cmain\readme.txt
  • %ProgramFiles%\cmgrdian\readme.txt
  • %CommonProgramFiles%\readme.txt
  • %ProgramFiles%\copyx64\readme.txt
  • %ProgramFiles%\courier\readme.txt
  • %ProgramFiles%\cpd\readme.txt
  • %ProgramFiles%\csendto\readme.txt
  • %ProgramFiles%\cssexc\readme.txt
  • %ProgramFiles%\custinstall\readme.txt
  • %ProgramFiles%\custsetup\readme.txt
  • %ProgramFiles%\cuteftp\readme.txt
  • %ProgramFiles%\dbconvert\readme.txt
  • %ProgramFiles%\dbtool\readme.txt
  • %ProgramFiles%\defensewall\readme.txt
  • %ProgramFiles%\defwatch\readme.txt
  • %ProgramFiles%\dekaron\readme.txt
  • %ProgramFiles%\clisvc\readme.txt
  • %ProgramFiles%\avgupden\readme.txt
  • %ProgramFiles%\cleaner3\readme.txt
  • %ProgramFiles%\claw95cf\readme.txt
  • %ProgramFiles%\cavsn\readme.txt
  • %ProgramFiles%\cavsub\readme.txt
  • %ProgramFiles%\cavsubmit\readme.txt
  • %ProgramFiles%\cavumas\readme.txt
  • %ProgramFiles%\cavuserupd\readme.txt
  • %ProgramFiles%\cavvl\readme.txt
  • %ProgramFiles%\ccapp\readme.txt
  • %ProgramFiles%\ccevtmgr\readme.txt
  • %ProgramFiles%\ccleaner\readme.txt
  • %ProgramFiles%\ccproxy\readme.txt
  • %ProgramFiles%\ccsetmgr\readme.txt
  • %ProgramFiles%\cemrep\readme.txt
  • %ProgramFiles%\chrome\readme.txt
  • %ProgramFiles%\clamscan\readme.txt
  • %ProgramFiles%\clamtray\readme.txt
  • %ProgramFiles%\clamwin\readme.txt
  • %ProgramFiles%\claw95\readme.txt
  • %ProgramFiles%\cavq\readme.txt
  • %ProgramFiles%\cavscons\readme.txt
  • %ProgramFiles%\avgscan\readme.txt
  • %ProgramFiles%\aoltbserver\readme.txt
  • %ProgramFiles%\a2start\readme.txt
  • %ProgramFiles%\a2upd\readme.txt
  • %ProgramFiles%\a2wizard\readme.txt
  • %ProgramFiles%\aavshield\readme.txt
  • %ProgramFiles%\about\readme.txt
  • %ProgramFiles%\ackwin32\readme.txt
  • %ProgramFiles%\admunch\readme.txt
  • %ProgramFiles%\agb5\readme.txt
  • %ProgramFiles%\ageofconan\readme.txt
  • %ProgramFiles%\ahnsd\readme.txt
  • %ProgramFiles%\aim6\readme.txt
  • %ProgramFiles%\aimpro\readme.txt
  • %ProgramFiles%\airdefense\readme.txt
  • %ProgramFiles%\almon\readme.txt
  • %ProgramFiles%\alsvc\readme.txt
  • %ProgramFiles%\amon\readme.txt
  • %ProgramFiles%\amsn\readme.txt
  • %ProgramFiles%\a2service\readme.txt
  • %ProgramFiles%\anti-trojan\readme.txt
  • %ProgramFiles%\a2scan\readme.txt
  • %ProgramFiles%\a2guard\readme.txt
  • C:\far2\readme.txt
  • <Current directory>\readme.txt
  • C:\msocache\readme.txt
  • %ProgramFiles%\readme.txt
  • %ProgramFiles(x86)%\readme.txt
  • %ALLUSERSPROFILE%\readme.txt
  • C:\recovery\readme.txt
  • C:\totalcmd\readme.txt
  • C:\users\readme.txt
  • C:\far2\documentation\readme.txt
  • C:\far2\encyclopedia\readme.txt
  • C:\far2\fexcept\readme.txt
  • C:\far2\plugins\readme.txt
  • C:\far2\pluginsdk\readme.txt
  • C:\msocache\all users\readme.txt
  • %ProgramFiles%\360tray\readme.txt
  • %ProgramFiles%\a2cmd\readme.txt
  • %ProgramFiles%\a2hijackfree\readme.txt
  • %ProgramFiles%\ashwebsv\readme.txt
  • %ProgramFiles%\avgnpsvc\readme.txt
  • %ProgramFiles%\armor2net\readme.txt
  • %ProgramFiles%\aswupdsv\readme.txt
  • %ProgramFiles%\autodown\readme.txt
  • %ProgramFiles%\autostartexplorer\readme.txt
  • %ProgramFiles%\autotrace\readme.txt
  • %ProgramFiles%\avadmin\readme.txt
  • %ProgramFiles%\avcenter\readme.txt
  • %ProgramFiles%\avciman\readme.txt
  • %ProgramFiles%\avcmd\readme.txt
  • %ProgramFiles%\avconfig\readme.txt
  • %ProgramFiles%\avconsol\readme.txt
  • %ProgramFiles%\avgamsvr\readme.txt
  • %ProgramFiles%\avgcc\readme.txt
  • %ProgramFiles%\avgdiag\readme.txt
  • %ProgramFiles%\avgemc\readme.txt
  • %ProgramFiles%\avgfwsrv\readme.txt
  • %ProgramFiles%\avginet\readme.txt
  • %ProgramFiles%\avgnpdln\readme.txt
  • %ProgramFiles%\aswregsvr\readme.txt
  • %ProgramFiles%\avgrssvc\readme.txt
  • %ProgramFiles%\ash_updatemediator\readme.txt
  • %ProgramFiles%\ashupd\readme.txt
  • %ProgramFiles%\armorsurf\readme.txt
  • %ProgramFiles%\ash\readme.txt
  • %ProgramFiles%\ashavast\readme.txt
  • %ProgramFiles%\ashavsrv\readme.txt
  • %ProgramFiles%\ashchest\readme.txt
  • %ProgramFiles%\ashdisp\readme.txt
  • %ProgramFiles%\ashdug\readme.txt
  • %ProgramFiles%\ashenhcd\readme.txt
  • %ProgramFiles%\ashlogv\readme.txt
  • %ProgramFiles%\ashmaisv\readme.txt
  • %ProgramFiles%\ashpopwz\readme.txt
  • %ProgramFiles%\ashquick\readme.txt
  • %ProgramFiles%\ashserv\readme.txt
  • %ProgramFiles%\ashsimp2\readme.txt
  • %ProgramFiles%\ashsimpl\readme.txt
  • %ProgramFiles%\ashskpcc\readme.txt
  • %ProgramFiles%\ashskpck\readme.txt
  • %ProgramFiles%\antivirus\readme.txt
  • %ProgramFiles%\fsdiagui\readme.txt
  • %ProgramFiles%\luupdate\readme.txt
  • %ProgramFiles%\dislite\readme.txt
  • %ProgramFiles%\hipsdiag\readme.txt
  • %ProgramFiles%\hregmon\readme.txt
  • %ProgramFiles%\hrres\readme.txt
  • %ProgramFiles%\hsockpe\readme.txt
  • %ProgramFiles%\httplook\readme.txt
  • %ProgramFiles%\iamapp\readme.txt
  • %ProgramFiles%\iamserv\readme.txt
  • %ProgramFiles%\icq\readme.txt
  • %ProgramFiles%\icqlite\readme.txt
  • %ProgramFiles%\ieregfix\readme.txt
  • %ProgramFiles%\ieuser\readme.txt
  • %ProgramFiles%\iexplore\readme.txt
  • %ProgramFiles%\ih8\readme.txt
  • %ProgramFiles%\ih8run\readme.txt
  • %ProgramFiles%\ilaunchr\readme.txt
  • %ProgramFiles%\imapp\readme.txt
  • %ProgramFiles%\imnotfy\readme.txt
  • %ProgramFiles%\helper\readme.txt
  • %ProgramFiles%\impcnt\readme.txt
  • %ProgramFiles%\helpctr\readme.txt
  • %ProgramFiles%\guardnt\readme.txt
  • %ProgramFiles%\fssw\readme.txt
  • %ProgramFiles%\fstlui\readme.txt
  • %ProgramFiles%\fsuninst\readme.txt
  • %ProgramFiles%\fsus\readme.txt
  • %ProgramFiles%\ftpte\readme.txt
  • %ProgramFiles%\gc\readme.txt
  • %ProgramFiles%\gcasdtserv\readme.txt
  • %ProgramFiles%\gcasserv\readme.txt
  • %ProgramFiles%\ge\readme.txt
  • %ProgramFiles%\gg\readme.txt
  • %ProgramFiles%\giantantispywaremain\readme.txt
  • %ProgramFiles%\giantantispywareupdater\readme.txt
  • %ProgramFiles%\gnotify\readme.txt
  • %ProgramFiles%\googledesktop\readme.txt
  • %ProgramFiles%\googletalk\readme.txt
  • %ProgramFiles%\googleupdate\readme.txt
  • %ProgramFiles%\guardgni\readme.txt
  • %ProgramFiles%\gw\readme.txt
  • %ProgramFiles%\k-meleon\readme.txt
  • %ProgramFiles%\directftp\readme.txt
  • %ProgramFiles%\inorpc\readme.txt
  • %ProgramFiles%\kavpf\readme.txt
  • %ProgramFiles%\kavpfw\readme.txt
  • %ProgramFiles%\kavstart\readme.txt
  • %ProgramFiles%\kavsvc\readme.txt
  • %ProgramFiles%\konnekt\readme.txt
  • %ProgramFiles%\launcher\readme.txt
  • %ProgramFiles%\licmgr\readme.txt
  • %ProgramFiles%\livesrv\readme.txt
  • %ProgramFiles%\liveupdate\readme.txt
  • %ProgramFiles%\logwatnt\readme.txt
  • %ProgramFiles%\lotroclient\readme.txt
  • %ProgramFiles%\lpfw\readme.txt
  • %ProgramFiles%\lucallbackproxy\readme.txt
  • %ProgramFiles%\lucheck\readme.txt
  • %ProgramFiles%\luconfig\readme.txt
  • %ProgramFiles%\luinit\readme.txt
  • %ProgramFiles%\luna\readme.txt
  • %ProgramFiles%\kavmm\readme.txt
  • %ProgramFiles%\fsstm\readme.txt
  • %ProgramFiles%\kav\readme.txt
  • %ProgramFiles%\java\readme.txt
  • %ProgramFiles%\inort\readme.txt
  • %ProgramFiles%\inotask\readme.txt
  • %ProgramFiles%\inouptng\readme.txt
  • %ProgramFiles%\inphasenxd\readme.txt
  • %ProgramFiles%\installcavs\readme.txt
  • %ProgramFiles%\installlicense\readme.txt
  • %ProgramFiles%\installlsp\readme.txt
  • %ProgramFiles%\instlsp\readme.txt
  • %ProgramFiles%\internet explorer\readme.txt
  • %ProgramFiles%\iris\readme.txt
  • %ProgramFiles%\iron\readme.txt
  • %ProgramFiles%\isafe\readme.txt
  • %ProgramFiles%\ispnews\readme.txt
  • %ProgramFiles%\ispwdsvc\readme.txt
  • %ProgramFiles%\issvc\readme.txt
  • %ProgramFiles%\isuac\readme.txt
  • %ProgramFiles%\itunes\readme.txt
  • %ProgramFiles%\incmail\readme.txt
  • %ProgramFiles%\magent\readme.txt
  • %ProgramFiles%\fssm32\readme.txt
  • %ProgramFiles%\fprottray\readme.txt
  • %ProgramFiles%\ewidoctrl\readme.txt
  • %ProgramFiles%\exit_av\readme.txt
  • %ProgramFiles%\ezantivirusregistrationcheck\readme.txt
  • %ProgramFiles%\f-sched\readme.txt
  • %ProgramFiles%\fameh32\readme.txt
  • %ProgramFiles%\far\readme.txt
  • %ProgramFiles%\fch32\readme.txt
  • %ProgramFiles%\fdm\readme.txt
  • %ProgramFiles%\fdmwi\readme.txt
  • %ProgramFiles%\filezilla\readme.txt
  • %ProgramFiles%\firebird\readme.txt
  • %ProgramFiles%\firesvc\readme.txt
  • %ProgramFiles%\firetray\readme.txt
  • %ProgramFiles%\flashfxp\readme.txt
  • %ProgramFiles%\flashgot\readme.txt
  • %ProgramFiles%\flock\readme.txt
  • %ProgramFiles%\foxit\readme.txt
  • %ProgramFiles%\eudora\readme.txt
  • %ProgramFiles%\fpavserver\readme.txt
  • %ProgramFiles%\etherd\readme.txt
  • %ProgramFiles%\ekrn\readme.txt
  • %ProgramFiles%\dnf\readme.txt
  • %ProgramFiles%\dpatrolq\readme.txt
  • %ProgramFiles%\drvctl\readme.txt
  • %ProgramFiles%\drvirus\readme.txt
  • %ProgramFiles%\drvmap\readme.txt
  • %ProgramFiles%\drwadins\readme.txt
  • %ProgramFiles%\drweb\readme.txt
  • %ProgramFiles%\drweb32w\readme.txt
  • %ProgramFiles%\drweb386\readme.txt
  • %ProgramFiles%\drwebscd\readme.txt
  • %ProgramFiles%\drwebupw\readme.txt
  • %ProgramFiles%\drwebwcl\readme.txt
  • %ProgramFiles%\drwreg\readme.txt
  • %ProgramFiles%\dvd maker\readme.txt
  • %ProgramFiles%\ecmd\readme.txt
  • %ProgramFiles%\egni\readme.txt
  • %ProgramFiles%\ehsniffer\readme.txt
  • %ProgramFiles%\elementclient\readme.txt
  • %ProgramFiles%\digsby-app\readme.txt
  • %ProgramFiles%\fssf\readme.txt
  • %ProgramFiles%\fpscan\readme.txt
  • %ProgramFiles%\fsgetwab\readme.txt
  • %ProgramFiles%\fsgk32\readme.txt
  • %ProgramFiles%\fsgk32st\readme.txt
  • %ProgramFiles%\fsguidll\readme.txt
  • %ProgramFiles%\fsguiexe\readme.txt
  • %ProgramFiles%\fshdll32\readme.txt
  • %ProgramFiles%\fshelp\readme.txt
  • %ProgramFiles%\fshotfix\readme.txt
  • %ProgramFiles%\fsihcomp\readme.txt
  • %ProgramFiles%\fsihs\readme.txt
  • %ProgramFiles%\fslaunch\readme.txt
  • %ProgramFiles%\fsm32\readme.txt
  • %ProgramFiles%\fsma32\readme.txt
  • %ProgramFiles%\fsmb32\readme.txt
  • %ProgramFiles%\fspc\readme.txt
  • %ProgramFiles%\fspex\readme.txt
  • %ProgramFiles%\fsqh\readme.txt
  • %ProgramFiles%\fsfwwscr\readme.txt
  • %ProgramFiles%\fssg\readme.txt
  • %ProgramFiles%\fsfwwsch\readme.txt
  • %ProgramFiles%\fsdiag\readme.txt
  • %ProgramFiles%\fptrayproc\readme.txt
  • %ProgramFiles%\fpwin\readme.txt
  • %ProgramFiles%\freshclam\readme.txt
  • %ProgramFiles%\fsample\readme.txt
  • %ProgramFiles%\fsaua\readme.txt
  • %ProgramFiles%\fsauach\readme.txt
  • %ProgramFiles%\fsav\readme.txt
  • %ProgramFiles%\fsav32\readme.txt
  • %ProgramFiles%\fsavaui\readme.txt
  • %ProgramFiles%\fsavgui\readme.txt
  • %ProgramFiles%\fsavstrt\readme.txt
  • %ProgramFiles%\fsavwsch\readme.txt
  • %ProgramFiles%\fsavwscr\readme.txt
  • %ProgramFiles%\fsbwsys\readme.txt
  • %ProgramFiles%\fsdbuh\readme.txt
  • %ProgramFiles%\fsdc\readme.txt
  • %ProgramFiles%\fsdfwd\readme.txt
  • %ProgramFiles%\fpavupdm\readme.txt
  • C:\far2\addons\macros\readme.txt
Moves the following files
  • from %ProgramFiles%\desktop.ini to %ProgramFiles%\desktop.ini.ancif
  • from %ProgramFiles(x86)%\mozilla thunderbird\dependentlibs.list to %ProgramFiles(x86)%\mozilla thunderbird\dependentlibs.list.ancif
  • from %ProgramFiles(x86)%\mozilla thunderbird\crashreporter.ini to %ProgramFiles(x86)%\mozilla thunderbird\crashreporter.ini.ancif
  • from %ProgramFiles(x86)%\mozilla thunderbird\application.ini to %ProgramFiles(x86)%\mozilla thunderbird\application.ini.ancif
  • from %ProgramFiles(x86)%\mozilla firefox\voucher.bin to %ProgramFiles(x86)%\mozilla firefox\voucher.bin.ancif
  • from %ProgramFiles(x86)%\mozilla firefox\updater.ini to %ProgramFiles(x86)%\mozilla firefox\updater.ini.ancif
  • from %ProgramFiles(x86)%\mozilla firefox\update-settings.ini to %ProgramFiles(x86)%\mozilla firefox\update-settings.ini.ancif
  • from %ProgramFiles(x86)%\mozilla thunderbird\freebl3.chk to %ProgramFiles(x86)%\mozilla thunderbird\freebl3.chk.ancif
  • from %ProgramFiles(x86)%\mozilla firefox\softokn3.chk to %ProgramFiles(x86)%\mozilla firefox\softokn3.chk.ancif
  • from %ProgramFiles(x86)%\mozilla firefox\precomplete to %ProgramFiles(x86)%\mozilla firefox\precomplete.ancif
  • from %ProgramFiles(x86)%\mozilla firefox\platform.ini to %ProgramFiles(x86)%\mozilla firefox\platform.ini.ancif
  • from %ProgramFiles(x86)%\mozilla firefox\omni.ja to %ProgramFiles(x86)%\mozilla firefox\omni.ja.ancif
  • from %ProgramFiles(x86)%\mozilla firefox\nssdbm3.chk to %ProgramFiles(x86)%\mozilla firefox\nssdbm3.chk.ancif
  • from %ProgramFiles(x86)%\mozilla firefox\install.log to %ProgramFiles(x86)%\mozilla firefox\install.log.ancif
  • from %ProgramFiles(x86)%\mozilla firefox\freebl3.chk to %ProgramFiles(x86)%\mozilla firefox\freebl3.chk.ancif
  • from %ProgramFiles(x86)%\mozilla firefox\removed-files to %ProgramFiles(x86)%\mozilla firefox\removed-files.ancif
  • from %ProgramFiles(x86)%\msbuild\microsoft.office.infopath.targets to %ProgramFiles(x86)%\msbuild\microsoft.office.infopath.targets.ancif
  • from %ProgramFiles(x86)%\winamp\pconfig.dcf to %ProgramFiles(x86)%\winamp\pconfig.dcf.ancif
  • from %ProgramFiles(x86)%\mozilla thunderbird\omni.ja to %ProgramFiles(x86)%\mozilla thunderbird\omni.ja.ancif
  • from %ProgramFiles(x86)%\winamp\paths.ini to %ProgramFiles(x86)%\winamp\paths.ini.ancif
  • from %ProgramFiles(x86)%\winamp\install.ini to %ProgramFiles(x86)%\winamp\install.ini.ancif
  • from %ProgramFiles(x86)%\steam\thirdpartylegalnotices.css to %ProgramFiles(x86)%\steam\thirdpartylegalnotices.css.ancif
  • from %ProgramFiles(x86)%\qip 2012\unins000.msg to %ProgramFiles(x86)%\qip 2012\unins000.msg.ancif
  • from %ProgramFiles(x86)%\opera\server_tracking_data to %ProgramFiles(x86)%\opera\server_tracking_data.ancif
  • from %ProgramFiles(x86)%\opera\resources.pri to %ProgramFiles(x86)%\opera\resources.pri.ancif
  • from %ProgramFiles(x86)%\mozilla firefox\dependentlibs.list to %ProgramFiles(x86)%\mozilla firefox\dependentlibs.list.ancif
  • from %ProgramFiles(x86)%\opera\installer_prefs.json to %ProgramFiles(x86)%\opera\installer_prefs.json.ancif
  • from %ProgramFiles(x86)%\mozilla thunderbird\updater.ini to %ProgramFiles(x86)%\mozilla thunderbird\updater.ini.ancif
  • from %ProgramFiles(x86)%\mozilla thunderbird\update-settings.ini to %ProgramFiles(x86)%\mozilla thunderbird\update-settings.ini.ancif
  • from %ProgramFiles(x86)%\mozilla thunderbird\softokn3.chk to %ProgramFiles(x86)%\mozilla thunderbird\softokn3.chk.ancif
  • from %ProgramFiles(x86)%\mozilla thunderbird\removed-files to %ProgramFiles(x86)%\mozilla thunderbird\removed-files.ancif
  • from %ProgramFiles(x86)%\mozilla thunderbird\precomplete to %ProgramFiles(x86)%\mozilla thunderbird\precomplete.ancif
  • from %ProgramFiles(x86)%\mozilla thunderbird\platform.ini to %ProgramFiles(x86)%\mozilla thunderbird\platform.ini.ancif
  • from %ProgramFiles(x86)%\mozilla thunderbird\install.log to %ProgramFiles(x86)%\mozilla thunderbird\install.log.ancif
  • from %ProgramFiles(x86)%\mozilla thunderbird\nssdbm3.chk to %ProgramFiles(x86)%\mozilla thunderbird\nssdbm3.chk.ancif
  • from %ProgramFiles(x86)%\mozilla firefox\crashreporter.ini to %ProgramFiles(x86)%\mozilla firefox\crashreporter.ini.ancif
  • from %ProgramFiles%\winrar\default.sfx to %ProgramFiles%\winrar\default.sfx.ancif
  • from %ProgramFiles%\firefox\update.locale to %ProgramFiles%\firefox\update.locale.ancif
  • from %ProgramFiles%\firefox\softokn3.chk to %ProgramFiles%\firefox\softokn3.chk.ancif
  • from %ProgramFiles%\firefox\platform.ini to %ProgramFiles%\firefox\platform.ini.ancif
  • from %ProgramFiles%\firefox\nssdbm3.chk to %ProgramFiles%\firefox\nssdbm3.chk.ancif
  • from %ProgramFiles%\firefox\js.log to %ProgramFiles%\firefox\js.log.ancif
  • from %ProgramFiles%\firefox\greprefs.js to %ProgramFiles%\firefox\greprefs.js.ancif
  • from %ProgramFiles%\firefox\updater.ini to %ProgramFiles%\firefox\updater.ini.ancif
  • from %ProgramFiles%\firefox\freebl3.chk to %ProgramFiles%\firefox\freebl3.chk.ancif
  • from %ProgramFiles%\firefox\crashreporter_override.ini to %ProgramFiles%\firefox\crashreporter_override.ini.ancif
  • from %ProgramFiles%\firefox\crashreporter.ini to %ProgramFiles%\firefox\crashreporter.ini.ancif
  • from %ProgramFiles%\firefox\chrome.manifest to %ProgramFiles%\firefox\chrome.manifest.ancif
  • from %ProgramFiles%\firefox\blocklist.xml to %ProgramFiles%\firefox\blocklist.xml.ancif
  • from %ProgramFiles%\firefox\application.ini to %ProgramFiles%\firefox\application.ini.ancif
  • from %ProgramFiles(x86)%\desktop.ini to %ProgramFiles(x86)%\desktop.ini.ancif
  • from %ProgramFiles%\firefox\dependentlibs.list to %ProgramFiles%\firefox\dependentlibs.list.ancif
  • from %ProgramFiles%\winrar\whatsnew.txt to %ProgramFiles%\winrar\whatsnew.txt.ancif
  • from %ProgramFiles(x86)%\mirc\versions.txt to %ProgramFiles(x86)%\mirc\versions.txt.ancif
  • from %ProgramFiles%\winrar\default64.sfx to %ProgramFiles%\winrar\default64.sfx.ancif
  • from %ProgramFiles(x86)%\mirc\mirc.chm to %ProgramFiles(x86)%\mirc\mirc.chm.ancif
  • from %ProgramFiles(x86)%\mirc\ircintro.chm to %ProgramFiles(x86)%\mirc\ircintro.chm.ancif
  • from %ProgramFiles%\winrar\zip64.sfx to %ProgramFiles%\winrar\zip64.sfx.ancif
  • from %ProgramFiles%\winrar\zip.sfx to %ProgramFiles%\winrar\zip.sfx.ancif
  • from %ProgramFiles%\winrar\winrar.chm to %ProgramFiles%\winrar\winrar.chm.ancif
  • from %ProgramFiles%\winrar\wincon64.sfx to %ProgramFiles%\winrar\wincon64.sfx.ancif
  • from %ProgramFiles(x86)%\mozilla firefox\application.ini to %ProgramFiles(x86)%\mozilla firefox\application.ini.ancif
  • from %ProgramFiles%\winrar\wincon.sfx to %ProgramFiles%\winrar\wincon.sfx.ancif
  • from %ProgramFiles%\winrar\uninstall.lst to %ProgramFiles%\winrar\uninstall.lst.ancif
  • from %ProgramFiles%\winrar\rarfiles.lst to %ProgramFiles%\winrar\rarfiles.lst.ancif
  • from %ProgramFiles%\winrar\rar.txt to %ProgramFiles%\winrar\rar.txt.ancif
  • from %ProgramFiles%\winrar\order.htm to %ProgramFiles%\winrar\order.htm.ancif
  • from %ProgramFiles%\winrar\license.txt to %ProgramFiles%\winrar\license.txt.ancif
  • from %ProgramFiles%\winrar\descript.ion to %ProgramFiles%\winrar\descript.ion.ancif
  • from %ProgramFiles%\foxit\foxit to %ProgramFiles%\foxit\foxit.ancif
  • from %ProgramFiles(x86)%\winamp\whatsnew.txt to %ProgramFiles(x86)%\winamp\whatsnew.txt.ancif
Modifies the following files
  • C:\far2\changelog
  • C:\totalcmd\tcunin64.wul
  • C:\totalcmd\size!.txt
  • C:\totalcmd\register.rtf
  • C:\totalcmd\no.bar
  • C:\totalcmd\keyboard.txt
  • C:\totalcmd\history.txt
  • C:\totalcmd\descript.ion
  • C:\totalcmd\default.bar
  • %ALLUSERSPROFILE%\ntuser.pol
  • %ProgramFiles(x86)%\desktop.ini
  • %ProgramFiles%\desktop.ini
  • C:\far2\savesettings.cmd
  • C:\far2\restoresettings.cmd
  • C:\far2\file_id.diz
  • C:\far2\farspa.lng
  • C:\far2\farrus.lng
  • C:\far2\farrus.hlf
  • C:\far2\farpol.lng
  • C:\far2\farhun.lng
  • C:\far2\farhun.hlf
  • C:\far2\farger.lng
  • C:\far2\fareng.lng
  • C:\far2\fareng.hlf
  • C:\far2\farcze.lng
  • C:\far2\far.map
  • C:\far2\clearpluginscache.cmd
  • C:\far2\changelog_eng
  • C:\totalcmd\tcuninst.wul
  • C:\totalcmd\totalcmd.chm
Modifies multiple files.
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Network activity
Connects to
  • '<LOCALNET>.2.0':445
  • '<LOCALNET>.2.161':445
  • '<LOCALNET>.2.162':445
  • '<LOCALNET>.2.163':445
  • '<LOCALNET>.2.164':445
  • '<LOCALNET>.2.165':445
  • '<LOCALNET>.2.166':445
  • '<LOCALNET>.2.167':445
  • '<LOCALNET>.2.168':445
  • '<LOCALNET>.2.169':445
  • '<LOCALNET>.2.170':445
  • '<LOCALNET>.2.171':445
  • '<LOCALNET>.2.172':445
  • '<LOCALNET>.2.173':445
  • '<LOCALNET>.2.175':445
  • '<LOCALNET>.2.189':445
  • '<LOCALNET>.2.176':445
  • '<LOCALNET>.2.177':445
  • '<LOCALNET>.2.178':445
  • '<LOCALNET>.2.179':445
  • '<LOCALNET>.2.180':445
  • '<LOCALNET>.2.181':445
  • '<LOCALNET>.2.182':445
  • '<LOCALNET>.2.183':445
  • '<LOCALNET>.2.184':445
  • '<LOCALNET>.2.185':445
  • '<LOCALNET>.2.186':445
  • '<LOCALNET>.2.187':445
  • '<LOCALNET>.2.188':445
  • '<LOCALNET>.2.160':445
  • '<LOCALNET>.2.174':445
  • '<LOCALNET>.2.159':445
  • '<LOCALNET>.2.142':445
  • '<LOCALNET>.2.129':445
  • '<LOCALNET>.2.130':445
  • '<LOCALNET>.2.131':445
  • '<LOCALNET>.2.132':445
  • '<LOCALNET>.2.133':445
  • '<LOCALNET>.2.134':445
  • '<LOCALNET>.2.135':445
  • '<LOCALNET>.2.136':445
  • '<LOCALNET>.2.137':445
  • '<LOCALNET>.2.138':445
  • '<LOCALNET>.2.139':445
  • '<LOCALNET>.2.140':445
  • '<LOCALNET>.2.141':445
  • '<LOCALNET>.2.143':445
  • '<LOCALNET>.2.157':445
  • '<LOCALNET>.2.144':445
  • '<LOCALNET>.2.145':445
  • '<LOCALNET>.2.146':445
  • '<LOCALNET>.2.147':445
  • '<LOCALNET>.2.148':445
  • '<LOCALNET>.2.149':445
  • '<LOCALNET>.2.150':445
  • '<LOCALNET>.2.151':445
  • '<LOCALNET>.2.152':445
  • '<LOCALNET>.2.153':445
  • '<LOCALNET>.2.154':445
  • '<LOCALNET>.2.155':445
  • '<LOCALNET>.2.156':445
  • '<LOCALNET>.2.158':445
  • '<LOCALNET>.2.207':445
  • '<LOCALNET>.2.253':445
  • '<LOCALNET>.2.192':445
  • '<LOCALNET>.2.225':445
  • '<LOCALNET>.2.226':445
  • '<LOCALNET>.2.227':445
  • '<LOCALNET>.2.228':445
  • '<LOCALNET>.2.229':445
  • '<LOCALNET>.2.230':445
  • '<LOCALNET>.2.231':445
  • '<LOCALNET>.2.232':445
  • '<LOCALNET>.2.233':445
  • '<LOCALNET>.2.234':445
  • '<LOCALNET>.2.235':445
  • '<LOCALNET>.2.236':445
  • '<LOCALNET>.2.237':445
  • '<LOCALNET>.2.239':445
  • '<LOCALNET>.2.191':445
  • '<LOCALNET>.2.240':445
  • '<LOCALNET>.2.241':445
  • '<LOCALNET>.2.242':445
  • '<LOCALNET>.2.243':445
  • '<LOCALNET>.2.244':445
  • '<LOCALNET>.2.245':445
  • '<LOCALNET>.2.246':445
  • '<LOCALNET>.2.247':445
  • '<LOCALNET>.2.248':445
  • '<LOCALNET>.2.249':445
  • '<LOCALNET>.2.250':445
  • '<LOCALNET>.2.251':445
  • '<LOCALNET>.2.252':445
  • '<LOCALNET>.2.224':445
  • '<LOCALNET>.2.128':445
  • '<LOCALNET>.2.223':445
  • '<LOCALNET>.2.206':445
  • '<LOCALNET>.2.193':445
  • '<LOCALNET>.2.194':445
  • '<LOCALNET>.2.195':445
  • '<LOCALNET>.2.196':445
  • '<LOCALNET>.2.197':445
  • '<LOCALNET>.2.198':445
  • '<LOCALNET>.2.199':445
  • '<LOCALNET>.2.200':445
  • '<LOCALNET>.2.201':445
  • '<LOCALNET>.2.202':445
  • '<LOCALNET>.2.203':445
  • '<LOCALNET>.2.204':445
  • '<LOCALNET>.2.205':445
  • '<LOCALNET>.2.190':445
  • '<LOCALNET>.2.221':445
  • '<LOCALNET>.2.208':445
  • '<LOCALNET>.2.209':445
  • '<LOCALNET>.2.210':445
  • '<LOCALNET>.2.211':445
  • '<LOCALNET>.2.212':445
  • '<LOCALNET>.2.213':445
  • '<LOCALNET>.2.214':445
  • '<LOCALNET>.2.215':445
  • '<LOCALNET>.2.216':445
  • '<LOCALNET>.2.217':445
  • '<LOCALNET>.2.218':445
  • '<LOCALNET>.2.219':445
  • '<LOCALNET>.2.220':445
  • '<LOCALNET>.2.222':445
  • '<LOCALNET>.2.238':445
  • '<LOCALNET>.2.127':445
  • '<LOCALNET>.2.110':445
  • '<LOCALNET>.2.33':445
  • '<LOCALNET>.2.34':445
  • '<LOCALNET>.2.35':445
  • '<LOCALNET>.2.36':445
  • '<LOCALNET>.2.37':445
  • '<LOCALNET>.2.38':445
  • '<LOCALNET>.2.39':445
  • '<LOCALNET>.2.40':445
  • '<LOCALNET>.2.41':445
  • '<LOCALNET>.2.42':445
  • '<LOCALNET>.2.43':445
  • '<LOCALNET>.2.44':445
  • '<LOCALNET>.2.45':445
  • '<LOCALNET>.2.47':445
  • '<LOCALNET>.2.61':445
  • '<LOCALNET>.2.48':445
  • '<LOCALNET>.2.49':445
  • '<LOCALNET>.2.50':445
  • '<LOCALNET>.2.51':445
  • '<LOCALNET>.2.52':445
  • '<LOCALNET>.2.53':445
  • '<LOCALNET>.2.54':445
  • '<LOCALNET>.2.55':445
  • '<LOCALNET>.2.56':445
  • '<LOCALNET>.2.57':445
  • '<LOCALNET>.2.58':445
  • '<LOCALNET>.2.59':445
  • '<LOCALNET>.2.60':445
  • '<LOCALNET>.2.32':445
  • '<LOCALNET>.2.46':445
  • '<LOCALNET>.2.31':445
  • '<LOCALNET>.2.14':445
  • '<LOCALNET>.2.1':445
  • '<LOCALNET>.2.2':445
  • '<LOCALNET>.2.3':445
  • '<LOCALNET>.2.4':445
  • '<LOCALNET>.2.5':445
  • '<LOCALNET>.2.6':445
  • '<LOCALNET>.2.7':445
  • '<LOCALNET>.2.8':445
  • '<LOCALNET>.2.9':445
  • '<LOCALNET>.2.10':445
  • '<LOCALNET>.2.11':445
  • '<LOCALNET>.2.12':445
  • '<LOCALNET>.2.13':445
  • '<LOCALNET>.2.15':445
  • '<LOCALNET>.2.29':445
  • '<LOCALNET>.2.16':445
  • '<LOCALNET>.2.17':445
  • '<LOCALNET>.2.18':445
  • '<LOCALNET>.2.19':445
  • '<LOCALNET>.2.20':445
  • '<LOCALNET>.2.21':445
  • '<LOCALNET>.2.22':445
  • '<LOCALNET>.2.23':445
  • '<LOCALNET>.2.24':445
  • '<LOCALNET>.2.25':445
  • '<LOCALNET>.2.26':445
  • '<LOCALNET>.2.27':445
  • '<LOCALNET>.2.28':445
  • '<LOCALNET>.2.30':445
  • '<LOCALNET>.2.79':445
  • '<LOCALNET>.2.125':445
  • '<LOCALNET>.2.64':445
  • '<LOCALNET>.2.97':445
  • '<LOCALNET>.2.98':445
  • '<LOCALNET>.2.99':445
  • '<LOCALNET>.2.100':445
  • '<LOCALNET>.2.101':445
  • '<LOCALNET>.2.102':445
  • '<LOCALNET>.2.103':445
  • '<LOCALNET>.2.104':445
  • '<LOCALNET>.2.105':445
  • '<LOCALNET>.2.106':445
  • '<LOCALNET>.2.107':445
  • '<LOCALNET>.2.108':445
  • '<LOCALNET>.2.109':445
  • '<LOCALNET>.2.111':445
  • '<LOCALNET>.2.63':445
  • '<LOCALNET>.2.112':445
  • '<LOCALNET>.2.113':445
  • '<LOCALNET>.2.114':445
  • '<LOCALNET>.2.115':445
  • '<LOCALNET>.2.116':445
  • '<LOCALNET>.2.117':445
  • '<LOCALNET>.2.118':445
  • '<LOCALNET>.2.119':445
  • '<LOCALNET>.2.120':445
  • '<LOCALNET>.2.121':445
  • '<LOCALNET>.2.122':445
  • '<LOCALNET>.2.123':445
  • '<LOCALNET>.2.124':445
  • '<LOCALNET>.2.96':445
  • '<LOCALNET>.2.126':445
  • '<LOCALNET>.2.95':445
  • '<LOCALNET>.2.78':445
  • '<LOCALNET>.2.65':445
  • '<LOCALNET>.2.66':445
  • '<LOCALNET>.2.67':445
  • '<LOCALNET>.2.68':445
  • '<LOCALNET>.2.69':445
  • '<LOCALNET>.2.70':445
  • '<LOCALNET>.2.71':445
  • '<LOCALNET>.2.72':445
  • '<LOCALNET>.2.73':445
  • '<LOCALNET>.2.74':445
  • '<LOCALNET>.2.75':445
  • '<LOCALNET>.2.76':445
  • '<LOCALNET>.2.77':445
  • '<LOCALNET>.2.62':445
  • '<LOCALNET>.2.93':445
  • '<LOCALNET>.2.80':445
  • '<LOCALNET>.2.81':445
  • '<LOCALNET>.2.82':445
  • '<LOCALNET>.2.83':445
  • '<LOCALNET>.2.84':445
  • '<LOCALNET>.2.85':445
  • '<LOCALNET>.2.86':445
  • '<LOCALNET>.2.87':445
  • '<LOCALNET>.2.88':445
  • '<LOCALNET>.2.89':445
  • '<LOCALNET>.2.90':445
  • '<LOCALNET>.2.91':445
  • '<LOCALNET>.2.92':445
  • '<LOCALNET>.2.94':445
  • '<LOCALNET>.2.254':445

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android