Trojan.Encoder.37628

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'BrowserUpdateCheck' = '%LOCALAPPDATA%\<File name>.exe'

Creates the following files on removable media

<Drive name for removable media>:\correct.avi
<Drive name for removable media>:\indogerman2010.pptx
<Drive name for removable media>:\waterresourcesag.pptx
<Drive name for removable media>:\stoc13_ml_quoc_le.pptx
<Drive name for removable media>:\samieee_obiee_presentation.pptx
<Drive name for removable media>:\iso27k_isms_implementation_and_certification_process_overview_v2.pptx
<Drive name for removable media>:\jre-7u75-windows-i586-iftw.exe
<Drive name for removable media>:\calc.exe
<Drive name for removable media>:\508softwareandos.doc
<Drive name for removable media>:\february_catalogue__2015.doc
<Drive name for removable media>:\fi51.doc
<Drive name for removable media>:\contoso_1.cer
<Drive name for removable media>:\sdksampleprivdeveloper.cer
<Drive name for removable media>:\testee.cer
<Drive name for removable media>:\contoso.cer
<Drive name for removable media>:\asaprojectcompetition.pptx
<Drive name for removable media>:\contosoroot.cer
<Drive name for removable media>:\sdksampleunprivdeveloper.cer
<Drive name for removable media>:\sdkfailsafeemulator.cer
<Drive name for removable media>:\dashborder_120.bmp
<Drive name for removable media>:\coffee.bmp
<Drive name for removable media>:\default.bmp
<Drive name for removable media>:\dial.bmp
<Drive name for removable media>:\dialmap.bmp
<Drive name for removable media>:\dashborder_192.bmp
<Drive name for removable media>:\dashborder_96.bmp
<Drive name for removable media>:\split.avi
<Drive name for removable media>:\000814251_video_01.avi
<Drive name for removable media>:\join.avi
<Drive name for removable media>:\archer.avi
<Drive name for removable media>:\how_to_back_files.html
<Drive name for removable media>:\pmd.cer
<Drive name for removable media>:\gruenspecht_02172016.pptx

Malicious functions

Reads files which store third party applications passwords

%HOMEPATH%\desktop\adhd_and_obesity.docx
%APPDATA%\thunderbird\profiles.ini
%HOMEPATH%\desktop\testee.cer
%HOMEPATH%\desktop\testcertificate.cer
%HOMEPATH%\desktop\sdksampleprivdeveloper.cer
%HOMEPATH%\desktop\sdkfailsafeemulator.cer
%HOMEPATH%\desktop\hanni_umami_chapter.doc
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
%APPDATA%\opera software\opera stable\login data
%HOMEPATH%\desktop\fi51.doc
%HOMEPATH%\desktop\default.bmp
%HOMEPATH%\desktop\dashborder_192.bmp
%HOMEPATH%\desktop\dashborder_144.bmp
%HOMEPATH%\desktop\dashborder_120.bmp
%HOMEPATH%\desktop\contoso_1.cer
%HOMEPATH%\desktop\applicantform_en.doc
%HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
%HOMEPATH%\desktop\dial.bmp
%APPDATA%\mozilla\firefox\profiles.ini

Modifies file system

Creates the following files

%LOCALAPPDATA%\<File name>.exe
%APPDATA%\opera software\opera stable\how_to_back_files.html
%APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\how_to_back_files.html
%APPDATA%\opera software\opera stable\storage\ext\sync-login\def\how_to_back_files.html
%APPDATA%\opera software\opera stable\storage\ext\sync-login\def\gpucache\how_to_back_files.html
%APPDATA%\opera software\opera stable\storage\ext\sync-login\def\databases\how_to_back_files.html
%APPDATA%\opera software\opera stable\local storage\how_to_back_files.html
%APPDATA%\opera software\opera stable\jump list iconsold\how_to_back_files.html
%APPDATA%\opera software\opera stable\jump list icons\how_to_back_files.html
%APPDATA%\opera software\opera stable\extension state\how_to_back_files.html
%APPDATA%\opera software\opera stable\dictionaries\how_to_back_files.html
%APPDATA%\opera software\opera stable\databases\how_to_back_files.html
%APPDATA%\mra\how_to_back_files.html
%APPDATA%\mra\update\how_to_back_files.html
%APPDATA%\mra\base\how_to_back_files.html
%APPDATA%\mozilla\firefox\how_to_back_files.html
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\how_to_back_files.html
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\webapps\how_to_back_files.html
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\storage\permanent\moz-safe-about+home\how_to_back_files.html
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\storage\permanent\moz-safe-about+home\idb\how_to_back_files.html
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessionstore-backups\how_to_back_files.html
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\gmp-gmpopenh264\1.5.3\how_to_back_files.html
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\gmp-gmpopenh264\1.3\how_to_back_files.html
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\datareporting\how_to_back_files.html
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\crashes\how_to_back_files.html
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\bookmarkbackups\how_to_back_files.html
%APPDATA%\mozilla\firefox\crash reports\how_to_back_files.html
%APPDATA%\mirc\how_to_back_files.html
%APPDATA%\qipguard\how_to_back_files.html
%APPDATA%\mirc\scripts\how_to_back_files.html
%APPDATA%\telegram desktop\tdata\d877f783d5d3ef8c\how_to_back_files.html
%APPDATA%\telegram desktop\how_to_back_files.html
C:\users\public\f86b44fb67c1c4900d11c9b53bc050d33feac6e6f5d6371ad55e443ffccb64fb
D:\how_to_back_files.html
C:\users\how_to_back_files.html
%HOMEPATH%\how_to_back_files.html
D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\how_to_back_files.html
%HOMEPATH%\videos\how_to_back_files.html
%HOMEPATH%\searches\how_to_back_files.html
%HOMEPATH%\saved games\how_to_back_files.html
%HOMEPATH%\pictures\how_to_back_files.html
%HOMEPATH%\music\how_to_back_files.html
%HOMEPATH%\links\how_to_back_files.html
%HOMEPATH%\favorites\how_to_back_files.html
%HOMEPATH%\favorites\windows live\how_to_back_files.html
%HOMEPATH%\favorites\msn websites\how_to_back_files.html
%HOMEPATH%\favorites\microsoft websites\how_to_back_files.html
%HOMEPATH%\favorites\links for united states\how_to_back_files.html
%HOMEPATH%\favorites\links\how_to_back_files.html
%HOMEPATH%\downloads\how_to_back_files.html
%HOMEPATH%\documents\how_to_back_files.html
%HOMEPATH%\desktop\how_to_back_files.html
%HOMEPATH%\contacts\how_to_back_files.html
%APPDATA%\winamp\how_to_back_files.html
%APPDATA%\winamp\plugins\milkdrop2\how_to_back_files.html
%APPDATA%\thunderbird\how_to_back_files.html
%APPDATA%\thunderbird\profiles\wjj9aet2.default\how_to_back_files.html
%APPDATA%\thunderbird\profiles\wjj9aet2.default\crashes\how_to_back_files.html
%APPDATA%\thunderbird\crash reports\how_to_back_files.html
%APPDATA%\telegram desktop\tdata\how_to_back_files.html
%APPDATA%\mail.ru\agent\how_to_back_files.html

Moves the following files

from %APPDATA%\winamp\demo.mp3 to %APPDATA%\winamp\demo.mp3.suffering
from %APPDATA%\mra\update\languages.dict to %APPDATA%\mra\update\languages.dict.suffering
from %APPDATA%\mra\update\languages.hash to %APPDATA%\mra\update\languages.hash.suffering
from %APPDATA%\mra\update\ver.txt to %APPDATA%\mra\update\ver.txt.suffering
from %APPDATA%\mra\base\mra.dbs to %APPDATA%\mra\base\mra.dbs.suffering
from %APPDATA%\mra\base\opt.dbs to %APPDATA%\mra\base\opt.dbs.suffering
from %APPDATA%\mozilla\firefox\profiles.ini to %APPDATA%\mozilla\firefox\profiles.ini.suffering
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\addons.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\addons.json.suffering
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\compatibility.ini to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\compatibility.ini.suffering
from %APPDATA%\opera software\opera stable\jump list icons\514d.tmp to %APPDATA%\opera software\opera stable\jump list icons\514d.tmp.suffering
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions.ini to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions.ini.suffering
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\healthreport.sqlite to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\healthreport.sqlite.suffering
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\prefs.js to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\prefs.js.suffering
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\revocations.txt to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\revocations.txt.suffering
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\search.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\search.json.suffering
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessioncheckpoints.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessioncheckpoints.json.suffering
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sitesecurityservicestate.txt to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sitesecurityservicestate.txt.suffering
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\times.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\times.json.suffering
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\user.js to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\user.js.suffering
from %APPDATA%\opera software\opera stable\databases\databases.db-journal to %APPDATA%\opera software\opera stable\databases\databases.db-journal.suffering
from %APPDATA%\mra\update\languages.aff to %APPDATA%\mra\update\languages.aff.suffering
from %APPDATA%\opera software\opera stable\extension state\manifest-000001 to %APPDATA%\opera software\opera stable\extension state\manifest-000001.suffering
from %APPDATA%\opera software\opera stable\extension state\log.old to %APPDATA%\opera software\opera stable\extension state\log.old.suffering
from %APPDATA%\opera software\opera stable\extension state\log to %APPDATA%\opera software\opera stable\extension state\log.suffering
from %APPDATA%\opera software\opera stable\local storage\opera_startpage_0.localstorage-journal to %APPDATA%\opera software\opera stable\local storage\opera_startpage_0.localstorage-journal.suffering
from %APPDATA%\opera software\opera stable\jump list iconsold\3651.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\3651.tmp.suffering
from %APPDATA%\opera software\opera stable\jump list iconsold\36a1.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\36a1.tmp.suffering
from %APPDATA%\opera software\opera stable\jump list iconsold\36c3.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\36c3.tmp.suffering
from %APPDATA%\opera software\opera stable\jump list iconsold\3703.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\3703.tmp.suffering
from %APPDATA%\opera software\opera stable\jump list iconsold\3724.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\3724.tmp.suffering
from %APPDATA%\opera software\opera stable\jump list iconsold\3765.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\3765.tmp.suffering
from %APPDATA%\opera software\opera stable\jump list iconsold\3796.tmp to %APPDATA%\opera software\opera stable\jump list iconsold\3796.tmp.suffering
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\xulstore.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\xulstore.json.suffering
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions.json.suffering
from %APPDATA%\opera software\opera stable\jump list icons\50ed.tmp to %APPDATA%\opera software\opera stable\jump list icons\50ed.tmp.suffering
from %APPDATA%\opera software\opera stable\jump list icons\51ce.tmp to %APPDATA%\opera software\opera stable\jump list icons\51ce.tmp.suffering
from %APPDATA%\opera software\opera stable\jump list icons\51ff.tmp to %APPDATA%\opera software\opera stable\jump list icons\51ff.tmp.suffering
from %APPDATA%\opera software\opera stable\jump list icons\524f.tmp to %APPDATA%\opera software\opera stable\jump list icons\524f.tmp.suffering
from %APPDATA%\opera software\opera stable\jump list icons\529f.tmp to %APPDATA%\opera software\opera stable\jump list icons\529f.tmp.suffering
from %APPDATA%\opera software\opera stable\extension state\000003.ldb to %APPDATA%\opera software\opera stable\extension state\000003.ldb.suffering
from %APPDATA%\opera software\opera stable\extension state\000006.ldb to %APPDATA%\opera software\opera stable\extension state\000006.ldb.suffering
from %APPDATA%\opera software\opera stable\extension state\000007.log to %APPDATA%\opera software\opera stable\extension state\000007.log.suffering
from %APPDATA%\opera software\opera stable\extension state\current to %APPDATA%\opera software\opera stable\extension state\current.suffering
from %APPDATA%\opera software\opera stable\local storage\opera_startpage_0.localstorage to %APPDATA%\opera software\opera stable\local storage\opera_startpage_0.localstorage.suffering
from %APPDATA%\opera software\opera stable\jump list icons\516e.tmp to %APPDATA%\opera software\opera stable\jump list icons\516e.tmp.suffering
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\webapps\webapps.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\webapps\webapps.json.suffering
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\storage\permanent\moz-safe-about+home\.metadata to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\storage\permanent\moz-safe-about+home\.metadata.suffering
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.sqlite to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.sqlite.suffering
from %APPDATA%\mail.ru\agent\mra\sounds\busy.wav to %APPDATA%\mail.ru\agent\mra\sounds\busy.wav.suffering
from %APPDATA%\mail.ru\agent\mra\sounds\call_in.wav to %APPDATA%\mail.ru\agent\mra\sounds\call_in.wav.suffering
from %APPDATA%\mail.ru\agent\mra\sounds\call_waiting.wav to %APPDATA%\mail.ru\agent\mra\sounds\call_waiting.wav.suffering
from %APPDATA%\mail.ru\agent\mra\sounds\conference.wav to %APPDATA%\mail.ru\agent\mra\sounds\conference.wav.suffering
from %APPDATA%\mail.ru\agent\mra\sounds\error.wav to %APPDATA%\mail.ru\agent\mra\sounds\error.wav.suffering
from %APPDATA%\mail.ru\agent\mra\sounds\letter.wav to %APPDATA%\mail.ru\agent\mra\sounds\letter.wav.suffering
from %APPDATA%\mail.ru\agent\mra\sounds\message.wav to %APPDATA%\mail.ru\agent\mra\sounds\message.wav.suffering
from %APPDATA%\mail.ru\agent\mra\sounds\no_answer.wav to %APPDATA%\mail.ru\agent\mra\sounds\no_answer.wav.suffering
from %APPDATA%\mail.ru\agent\mra\sounds\otprav.wav to %APPDATA%\mail.ru\agent\mra\sounds\otprav.wav.suffering
from %APPDATA%\mail.ru\agent\mra\sounds\start.wav to %APPDATA%\mail.ru\agent\mra\sounds\start.wav.suffering
from %APPDATA%\opera software\opera stable\local storage\https_www.yandex.ru_0.localstorage-journal to %APPDATA%\opera software\opera stable\local storage\https_www.yandex.ru_0.localstorage-journal.suffering
from %APPDATA%\mail.ru\agent\mra\sounds\test_sound.wav to %APPDATA%\mail.ru\agent\mra\sounds\test_sound.wav.suffering
from %APPDATA%\mail.ru\agent\mra\sounds\voiceend.wav to %APPDATA%\mail.ru\agent\mra\sounds\voiceend.wav.suffering
from %APPDATA%\mail.ru\agent\mra\smiles\skin.txt to %APPDATA%\mail.ru\agent\mra\smiles\skin.txt.suffering
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\vk\vkontakte_away.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\vk\vkontakte_away.ico.suffering
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\vk\vkontakte_busy.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\vk\vkontakte_busy.ico.suffering
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\vk\vkontakte_gray.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\vk\vkontakte_gray.ico.suffering
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\vk\vkontakte_offline.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\vk\vkontakte_offline.ico.suffering
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\vk\vkontakte_online.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\vk\vkontakte_online.ico.suffering
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\100.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\100.ico.suffering
from %APPDATA%\mail.ru\agent\mra\sounds\auth.wav to %APPDATA%\mail.ru\agent\mra\sounds\auth.wav.suffering
from %APPDATA%\mozilla\firefox\crash reports\installtime20150415140819 to %APPDATA%\mozilla\firefox\crash reports\installtime20150415140819.suffering
from %APPDATA%\mail.ru\agent\mra\video\video.swf to %APPDATA%\mail.ru\agent\mra\video\video.swf.suffering
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\bookmarkbackups\bookmarks-2022-08-19_14_x5qkry9yysawyostzmcdfa==.jsonlz4 to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\bookmarkbackups\bookmarks-2022-08-19_14_x5qkry9yysawyostzmcdfa==.jsonlz4.suffering
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessionstore-backups\previous.js to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessionstore-backups\previous.js.suffering
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessionstore-backups\recovery.js to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessionstore-backups\recovery.js.suffering
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessionstore-backups\upgrade.js-20150415140819 to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessionstore-backups\upgrade.js-20150415140819.suffering
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\gmp-gmpopenh264\1.5.3\gmpopenh264.dll to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\gmp-gmpopenh264\1.5.3\gmpopenh264.dll.suffering
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\gmp-gmpopenh264\1.5.3\gmpopenh264.info to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\gmp-gmpopenh264\1.5.3\gmpopenh264.info.suffering
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\gmp-gmpopenh264\1.3\gmpopenh264.dll to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\gmp-gmpopenh264\1.3\gmpopenh264.dll.suffering
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\gmp-gmpopenh264\1.3\gmpopenh264.info to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\gmp-gmpopenh264\1.3\gmpopenh264.info.suffering
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\datareporting\state.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\datareporting\state.json.suffering
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\crashes\store.json.mozlz4 to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\crashes\store.json.mozlz4.suffering
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\100_xp.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\100_xp.ico.suffering
from %APPDATA%\mail.ru\agent\sciter32.dll to %APPDATA%\mail.ru\agent\sciter32.dll.suffering
from %APPDATA%\mirc\mirc.ini to %APPDATA%\mirc\mirc.ini.suffering
from %APPDATA%\mirc\servers.ini to %APPDATA%\mirc\servers.ini.suffering
from %APPDATA%\mirc\urls.ini to %APPDATA%\mirc\urls.ini.suffering
from %APPDATA%\mirc\scripts\aliases.ini to %APPDATA%\mirc\scripts\aliases.ini.suffering
from %APPDATA%\mirc\scripts\popups.ini to %APPDATA%\mirc\scripts\popups.ini.suffering
from %APPDATA%\mail.ru\agent\libvoip_x86.dll to %APPDATA%\mail.ru\agent\libvoip_x86.dll.suffering
from %APPDATA%\mail.ru\agent\magent.exe to %APPDATA%\mail.ru\agent\magent.exe.suffering
from %APPDATA%\mail.ru\agent\magentsetup.exe to %APPDATA%\mail.ru\agent\magentsetup.exe.suffering
from %APPDATA%\mail.ru\agent\mrainplaceviewer.dll to %APPDATA%\mail.ru\agent\mrainplaceviewer.dll.suffering
from %APPDATA%\mail.ru\agent\vivo.dll to %APPDATA%\mail.ru\agent\vivo.dll.suffering
from %APPDATA%\mail.ru\agent\mra\sounds\ring.wav to %APPDATA%\mail.ru\agent\mra\sounds\ring.wav.suffering
from %APPDATA%\opera software\opera stable\local storage\https_www.yandex.ru_0.localstorage to %APPDATA%\opera software\opera stable\local storage\https_www.yandex.ru_0.localstorage.suffering
from %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\manifest-000001 to %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\manifest-000001.suffering
from %APPDATA%\telegram desktop\unins000.exe to %APPDATA%\telegram desktop\unins000.exe.suffering
from %APPDATA%\telegram desktop\updater.exe to %APPDATA%\telegram desktop\updater.exe.suffering
from %APPDATA%\telegram desktop\tdata\90ef50e22e92cb8c0 to %APPDATA%\telegram desktop\tdata\90ef50e22e92cb8c0.suffering
from %APPDATA%\telegram desktop\tdata\d877f783d5d3ef8c1 to %APPDATA%\telegram desktop\tdata\d877f783d5d3ef8c1.suffering
from %APPDATA%\telegram desktop\tdata\prefix to %APPDATA%\telegram desktop\tdata\prefix.suffering
from %APPDATA%\telegram desktop\tdata\settings0 to %APPDATA%\telegram desktop\tdata\settings0.suffering
from %APPDATA%\telegram desktop\tdata\shortcuts-custom.json to %APPDATA%\telegram desktop\tdata\shortcuts-custom.json.suffering
from %APPDATA%\telegram desktop\tdata\shortcuts-default.json to %APPDATA%\telegram desktop\tdata\shortcuts-default.json.suffering
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\extensions.json to %APPDATA%\thunderbird\profiles\wjj9aet2.default\extensions.json.suffering
from %APPDATA%\telegram desktop\tdata\usertag to %APPDATA%\telegram desktop\tdata\usertag.suffering
from %APPDATA%\qipguard\cache to %APPDATA%\qipguard\cache.suffering
from %APPDATA%\qipguard\chrome.dll to %APPDATA%\qipguard\chrome.dll.suffering
from %APPDATA%\qipguard\qipguard.exe to %APPDATA%\qipguard\qipguard.exe.suffering
from %APPDATA%\qipguard\qipguard_upd.exe to %APPDATA%\qipguard\qipguard_upd.exe.suffering
from %APPDATA%\qipguard\sqlite3.dll to %APPDATA%\qipguard\sqlite3.dll.suffering
from %APPDATA%\opera software\opera stable\bookmarks to %APPDATA%\opera software\opera stable\bookmarks.suffering
from %APPDATA%\opera software\opera stable\bookmarks.bak to %APPDATA%\opera software\opera stable\bookmarks.bak.suffering
from %APPDATA%\opera software\opera stable\bookmarksextras to %APPDATA%\opera software\opera stable\bookmarksextras.suffering
from %APPDATA%\telegram desktop\log.txt to %APPDATA%\telegram desktop\log.txt.suffering
from %APPDATA%\telegram desktop\telegram.exe to %APPDATA%\telegram desktop\telegram.exe.suffering
from %APPDATA%\thunderbird\crash reports\installtime20150330093429 to %APPDATA%\thunderbird\crash reports\installtime20150330093429.suffering
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\crashes\store.json.mozlz4 to %APPDATA%\thunderbird\profiles\wjj9aet2.default\crashes\store.json.mozlz4.suffering
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\webappsstore.sqlite to %APPDATA%\thunderbird\profiles\wjj9aet2.default\webappsstore.sqlite.suffering
from %APPDATA%\winamp\winamp.m3u8 to %APPDATA%\winamp\winamp.m3u8.suffering
from %APPDATA%\winamp\plugins\milkdrop2\milk2_img.ini to %APPDATA%\winamp\plugins\milkdrop2\milk2_img.ini.suffering
from %APPDATA%\winamp\plugins\milkdrop2\milk2_msg.ini to %APPDATA%\winamp\plugins\milkdrop2\milk2_msg.ini.suffering
from %APPDATA%\thunderbird\profiles.ini to %APPDATA%\thunderbird\profiles.ini.suffering
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\abook.mab to %APPDATA%\thunderbird\profiles\wjj9aet2.default\abook.mab.suffering
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\blist.sqlite to %APPDATA%\thunderbird\profiles\wjj9aet2.default\blist.sqlite.suffering
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\compatibility.ini to %APPDATA%\thunderbird\profiles\wjj9aet2.default\compatibility.ini.suffering
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\cookies.sqlite to %APPDATA%\thunderbird\profiles\wjj9aet2.default\cookies.sqlite.suffering
from %APPDATA%\opera software\opera stable\browser.js to %APPDATA%\opera software\opera stable\browser.js.suffering
from %APPDATA%\telegram desktop\tdata\d877f783d5d3ef8c\map0 to %APPDATA%\telegram desktop\tdata\d877f783d5d3ef8c\map0.suffering
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\extensions.ini to %APPDATA%\thunderbird\profiles\wjj9aet2.default\extensions.ini.suffering
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\global-messages-db.sqlite to %APPDATA%\thunderbird\profiles\wjj9aet2.default\global-messages-db.sqlite.suffering
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\history.mab to %APPDATA%\thunderbird\profiles\wjj9aet2.default\history.mab.suffering
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\permissions.sqlite to %APPDATA%\thunderbird\profiles\wjj9aet2.default\permissions.sqlite.suffering
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\places.sqlite to %APPDATA%\thunderbird\profiles\wjj9aet2.default\places.sqlite.suffering
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\prefs.js to %APPDATA%\thunderbird\profiles\wjj9aet2.default\prefs.js.suffering
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\session.json to %APPDATA%\thunderbird\profiles\wjj9aet2.default\session.json.suffering
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\sessioncheckpoints.json to %APPDATA%\thunderbird\profiles\wjj9aet2.default\sessioncheckpoints.json.suffering
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\times.json to %APPDATA%\thunderbird\profiles\wjj9aet2.default\times.json.suffering
from %APPDATA%\winamp\winamp.ini to %APPDATA%\winamp\winamp.ini.suffering
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\foldertree.json to %APPDATA%\thunderbird\profiles\wjj9aet2.default\foldertree.json.suffering
from %APPDATA%\opera software\opera stable\certificate revocation lists to %APPDATA%\opera software\opera stable\certificate revocation lists.suffering
from %APPDATA%\opera software\opera stable\cookies to %APPDATA%\opera software\opera stable\cookies.suffering
from %APPDATA%\opera software\opera stable\cookies-journal to %APPDATA%\opera software\opera stable\cookies-journal.suffering
from %APPDATA%\opera software\opera stable\transportsecurity to %APPDATA%\opera software\opera stable\transportsecurity.suffering
from %APPDATA%\opera software\opera stable\update_prefs.json to %APPDATA%\opera software\opera stable\update_prefs.json.suffering
from %APPDATA%\opera software\opera stable\visited links to %APPDATA%\opera software\opera stable\visited links.suffering
from %APPDATA%\opera software\opera stable\web data to %APPDATA%\opera software\opera stable\web data.suffering
from %APPDATA%\opera software\opera stable\web data-journal to %APPDATA%\opera software\opera stable\web data-journal.suffering
from %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\000003.ldb to %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\000003.ldb.suffering
from %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\current to %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\current.suffering
from %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\log to %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\log.suffering
from %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\log.old to %APPDATA%\opera software\opera stable\sync extension settings\knohfebhibeknbfioecpdmdkjkjdnjnl\log.old.suffering
from %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\cookies to %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\cookies.suffering
from %APPDATA%\opera software\opera stable\local storage\chrome-extension_knohfebhibeknbfioecpdmdkjkjdnjnl_0.localstorage-journal to %APPDATA%\opera software\opera stable\local storage\chrome-extension_knohfebhibeknbfioecpdmdkjkjdnjnl_0.localstorage-journal.suffering
from %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\cookies-journal to %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\cookies-journal.suffering
from %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\quotamanager to %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\quotamanager.suffering
from %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\quotamanager-journal to %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\quotamanager-journal.suffering
from %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\gpucache\data_0 to %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\gpucache\data_0.suffering
from %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\gpucache\data_1 to %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\gpucache\data_1.suffering
from %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\gpucache\data_2 to %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\gpucache\data_2.suffering
from %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\gpucache\data_3 to %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\gpucache\data_3.suffering
from %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\gpucache\index to %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\gpucache\index.suffering
from %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\databases\databases.db-journal to %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\databases\databases.db-journal.suffering
from %APPDATA%\opera software\opera stable\thumbnails.db-journal to %APPDATA%\opera software\opera stable\thumbnails.db-journal.suffering
from %APPDATA%\opera software\opera stable\opera_shutdown_ms.txt to %APPDATA%\opera software\opera stable\opera_shutdown_ms.txt.suffering
from %APPDATA%\opera software\opera stable\ssdfp2544.3.670597881 to %APPDATA%\opera software\opera stable\ssdfp2544.3.670597881.suffering
from %APPDATA%\opera software\opera stable\opera_autoupdate.log to %APPDATA%\opera software\opera stable\opera_autoupdate.log.suffering
from %APPDATA%\opera software\opera stable\favicons to %APPDATA%\opera software\opera stable\favicons.suffering
from %APPDATA%\opera software\opera stable\favicons-journal to %APPDATA%\opera software\opera stable\favicons-journal.suffering
from %APPDATA%\opera software\opera stable\favorites.db-journal to %APPDATA%\opera software\opera stable\favorites.db-journal.suffering
from %APPDATA%\opera software\opera stable\history to %APPDATA%\opera software\opera stable\history.suffering
from %APPDATA%\opera software\opera stable\history provider cache to %APPDATA%\opera software\opera stable\history provider cache.suffering
from %APPDATA%\opera software\opera stable\history-journal to %APPDATA%\opera software\opera stable\history-journal.suffering
from %APPDATA%\opera software\opera stable\local state to %APPDATA%\opera software\opera stable\local state.suffering
from %APPDATA%\opera software\opera stable\login data to %APPDATA%\opera software\opera stable\login data.suffering
from %APPDATA%\opera software\opera stable\login data-journal to %APPDATA%\opera software\opera stable\login data-journal.suffering
from %APPDATA%\opera software\opera stable\local storage\chrome-extension_knohfebhibeknbfioecpdmdkjkjdnjnl_0.localstorage to %APPDATA%\opera software\opera stable\local storage\chrome-extension_knohfebhibeknbfioecpdmdkjkjdnjnl_0.localstorage.suffering
from %APPDATA%\opera software\opera stable\ssdfp2216.0.2078311798 to %APPDATA%\opera software\opera stable\ssdfp2216.0.2078311798.suffering
from %APPDATA%\opera software\opera stable\origin bound certs to %APPDATA%\opera software\opera stable\origin bound certs.suffering
from %APPDATA%\opera software\opera stable\origin bound certs-journal to %APPDATA%\opera software\opera stable\origin bound certs-journal.suffering
from %APPDATA%\opera software\opera stable\preferences to %APPDATA%\opera software\opera stable\preferences.suffering
from %APPDATA%\opera software\opera stable\quotamanager to %APPDATA%\opera software\opera stable\quotamanager.suffering
from %APPDATA%\opera software\opera stable\quotamanager-journal to %APPDATA%\opera software\opera stable\quotamanager-journal.suffering
from %APPDATA%\opera software\opera stable\session.db-journal to %APPDATA%\opera software\opera stable\session.db-journal.suffering
from %APPDATA%\opera software\opera stable\session.dbak to %APPDATA%\opera software\opera stable\session.dbak.suffering
from %APPDATA%\opera software\opera stable\siteprefs.json to %APPDATA%\opera software\opera stable\siteprefs.json.suffering
from %APPDATA%\opera software\opera stable\ssdfp1652.1.1724122967 to %APPDATA%\opera software\opera stable\ssdfp1652.1.1724122967.suffering
from %APPDATA%\opera software\opera stable\ssdfp2512.4.1739910927 to %APPDATA%\opera software\opera stable\ssdfp2512.4.1739910927.suffering
from %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\101.ico to %APPDATA%\mail.ru\agent\mra\smiles\statuses\set01\101.ico.suffering

Modifies the following files

<Drive name for removable media>:\correct.avi
<Drive name for removable media>:\dashborder_120.bmp
%HOMEPATH%\favorites\desktop.ini
%HOMEPATH%\links\recentplaces.lnk
<Drive name for removable media>:\coffee.bmp
%HOMEPATH%\links\downloads.lnk
<Drive name for removable media>:\default.bmp
%HOMEPATH%\links\desktop.lnk
<Drive name for removable media>:\dial.bmp
<Drive name for removable media>:\dialmap.bmp
%HOMEPATH%\links\desktop.ini
<Drive name for removable media>:\dashborder_192.bmp
%HOMEPATH%\music\desktop.ini
<Drive name for removable media>:\dashborder_96.bmp
%HOMEPATH%\pictures\desktop.ini
<Drive name for removable media>:\split.avi
%HOMEPATH%\saved games\desktop.ini
%HOMEPATH%\searches\indexed locations.search-ms
%HOMEPATH%\searches\everywhere.search-ms
<Drive name for removable media>:\000814251_video_01.avi
%HOMEPATH%\searches\desktop.ini
<Drive name for removable media>:\join.avi
%HOMEPATH%\videos\desktop.ini
%HOMEPATH%\ntuser.pol
D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\desktop.ini
<Drive name for removable media>:\archer.avi
C:\users\desktop.ini
D:\install.log
<Drive name for removable media>:\sdkfailsafeemulator.cer
<Drive name for removable media>:\sdksampleunprivdeveloper.cer

Modifies multiple files.

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial