Trojan.Encoder.37958

Technical Information

To ensure autorun and distribution

Creates the following files on removable media

<Drive name for removable media>:\readme.txt
<Drive name for removable media>:\correct.avi

Modifies file system

Creates the following files

C:\readme.txt
%ProgramFiles(x86)%\microsoft analysis services\readme.txt
%ProgramFiles(x86)%\microsoft office\readme.txt
%ProgramFiles(x86)%\microsoft visual studio 8\readme.txt
%ProgramFiles(x86)%\microsoft.net\readme.txt
%ProgramFiles(x86)%\mozilla firefox\readme.txt
%ProgramFiles(x86)%\msbuild\readme.txt
%ProgramFiles(x86)%\opera\readme.txt
%ProgramFiles(x86)%\reference assemblies\readme.txt
%ProgramFiles(x86)%\steam\readme.txt
%ProgramFiles%\dvd maker\readme.txt
%ProgramFiles(x86)%\uninstall information\readme.txt
%ALLUSERSPROFILE%\microsoft\readme.txt
%ALLUSERSPROFILE%\microsoft help\readme.txt
%ALLUSERSPROFILE%\mozilla\readme.txt
%ALLUSERSPROFILE%\oracle\readme.txt
%ALLUSERSPROFILE%\package cache\readme.txt
%ALLUSERSPROFILE%\sun\readme.txt
C:\recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\readme.txt
C:\users\default\readme.txt
C:\users\public\readme.txt
%CommonProgramFiles(x86)%\readme.txt
%ProgramFiles(x86)%\internet explorer\readme.txt
%ProgramFiles(x86)%\adobe\readme.txt
%ProgramFiles%\uninstall information\readme.txt
%ProgramFiles%\reference assemblies\readme.txt
D:\readme.txt
C:\msocache\readme.txt
<Current directory>\readme.txt
%ProgramFiles%\readme.txt
%ProgramFiles(x86)%\readme.txt
%ALLUSERSPROFILE%\readme.txt
C:\recovery\readme.txt
C:\users\readme.txt
C:\msocache\all users\readme.txt
%HOMEPATH%\readme.txt
%ALLUSERSPROFILE%\adobe\readme.txt
%CommonProgramFiles%\readme.txt
%ProgramFiles%\java\readme.txt
%ProgramFiles%\microsoft analysis services\readme.txt
%ProgramFiles%\microsoft office\readme.txt
%ProgramFiles%\microsoft sql server compact edition\readme.txt
%ProgramFiles%\microsoft sync framework\readme.txt
%ProgramFiles%\microsoft synchronization services\readme.txt
%ProgramFiles%\mozilla firefox\readme.txt
%ProgramFiles%\mozilla thunderbird\readme.txt
%ProgramFiles%\msbuild\readme.txt
C:\kms\readme.txt
%ProgramFiles%\internet explorer\readme.txt
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\readme.txt

Moves the following files

from %ProgramFiles%\desktop.ini to %ProgramFiles%\desktop.ini.exten
from %ProgramFiles%\mozilla thunderbird\updater.ini to %ProgramFiles%\mozilla thunderbird\updater.ini.exten
from %ProgramFiles%\winrar\default.sfx to %ProgramFiles%\winrar\default.sfx.exten
from %ProgramFiles%\winrar\default64.sfx to %ProgramFiles%\winrar\default64.sfx.exten
from %ProgramFiles%\winrar\descript.ion to %ProgramFiles%\winrar\descript.ion.exten
from %ProgramFiles%\winrar\license.txt to %ProgramFiles%\winrar\license.txt.exten
from %ProgramFiles%\winrar\order.htm to %ProgramFiles%\winrar\order.htm.exten
from %ProgramFiles%\winrar\rar.txt to %ProgramFiles%\winrar\rar.txt.exten
from %ProgramFiles%\winrar\rarfiles.lst to %ProgramFiles%\winrar\rarfiles.lst.exten
from %ProgramFiles%\winrar\rarnew.dat to %ProgramFiles%\winrar\rarnew.dat.exten
from %ProgramFiles%\winrar\whatsnew.txt to %ProgramFiles%\winrar\whatsnew.txt.exten
from %ProgramFiles(x86)%\opera\launcher.visualelementsmanifest.xml to %ProgramFiles(x86)%\opera\launcher.visualelementsmanifest.xml.exten
from %ProgramFiles%\winrar\wincon.sfx to %ProgramFiles%\winrar\wincon.sfx.exten
from %ProgramFiles%\winrar\wincon64.sfx to %ProgramFiles%\winrar\wincon64.sfx.exten
from %ProgramFiles%\winrar\winrar.chm to %ProgramFiles%\winrar\winrar.chm.exten
from %ProgramFiles%\winrar\zip.sfx to %ProgramFiles%\winrar\zip.sfx.exten
from %ProgramFiles%\winrar\zip64.sfx to %ProgramFiles%\winrar\zip64.sfx.exten
from %ProgramFiles%\winrar\zipnew.dat to %ProgramFiles%\winrar\zipnew.dat.exten
from %ProgramFiles(x86)%\msbuild\microsoft.office.infopath.targets to %ProgramFiles(x86)%\msbuild\microsoft.office.infopath.targets.exten
from %ProgramFiles(x86)%\opera\installation_status.xml to %ProgramFiles(x86)%\opera\installation_status.xml.exten
from %ProgramFiles(x86)%\opera\installer_prefs.json to %ProgramFiles(x86)%\opera\installer_prefs.json.exten
from %ProgramFiles%\mozilla thunderbird\update-settings.ini to %ProgramFiles%\mozilla thunderbird\update-settings.ini.exten
from %ProgramFiles%\winrar\uninstall.lst to %ProgramFiles%\winrar\uninstall.lst.exten
from %ProgramFiles%\mozilla thunderbird\thunderbird.visualelementsmanifest.xml to %ProgramFiles%\mozilla thunderbird\thunderbird.visualelementsmanifest.xml.exten
from %ProgramFiles%\mozilla firefox\precomplete to %ProgramFiles%\mozilla firefox\precomplete.exten
from %ProgramFiles(x86)%\desktop.ini to %ProgramFiles(x86)%\desktop.ini.exten
from %ProgramFiles%\mozilla firefox\accessible.tlb to %ProgramFiles%\mozilla firefox\accessible.tlb.exten
from %ProgramFiles%\mozilla firefox\application.ini to %ProgramFiles%\mozilla firefox\application.ini.exten
from %ProgramFiles%\mozilla firefox\crashreporter.ini to %ProgramFiles%\mozilla firefox\crashreporter.ini.exten
from %ProgramFiles%\mozilla firefox\dependentlibs.list to %ProgramFiles%\mozilla firefox\dependentlibs.list.exten
from %ProgramFiles%\mozilla firefox\firefox.visualelementsmanifest.xml to %ProgramFiles%\mozilla firefox\firefox.visualelementsmanifest.xml.exten
from %ProgramFiles%\mozilla firefox\install.log to %ProgramFiles%\mozilla firefox\install.log.exten
from %ProgramFiles%\mozilla firefox\omni.ja to %ProgramFiles%\mozilla firefox\omni.ja.exten
from %ProgramFiles%\mozilla firefox\platform.ini to %ProgramFiles%\mozilla firefox\platform.ini.exten
from %ProgramFiles%\mozilla firefox\removed-files to %ProgramFiles%\mozilla firefox\removed-files.exten
from %ProgramFiles%\mozilla thunderbird\precomplete to %ProgramFiles%\mozilla thunderbird\precomplete.exten
from %ProgramFiles%\mozilla firefox\update-settings.ini to %ProgramFiles%\mozilla firefox\update-settings.ini.exten
from %ProgramFiles%\mozilla firefox\updater.ini to %ProgramFiles%\mozilla firefox\updater.ini.exten
from %ProgramFiles%\mozilla thunderbird\accessible.tlb to %ProgramFiles%\mozilla thunderbird\accessible.tlb.exten
from %ProgramFiles%\mozilla thunderbird\application.ini to %ProgramFiles%\mozilla thunderbird\application.ini.exten
from %ProgramFiles%\mozilla thunderbird\crashreporter.ini to %ProgramFiles%\mozilla thunderbird\crashreporter.ini.exten
from %ProgramFiles%\mozilla thunderbird\dependentlibs.list to %ProgramFiles%\mozilla thunderbird\dependentlibs.list.exten
from %ProgramFiles%\mozilla thunderbird\install.log to %ProgramFiles%\mozilla thunderbird\install.log.exten
from %ProgramFiles%\mozilla thunderbird\omni.ja to %ProgramFiles%\mozilla thunderbird\omni.ja.exten
from %ProgramFiles%\mozilla thunderbird\platform.ini to %ProgramFiles%\mozilla thunderbird\platform.ini.exten
from %ProgramFiles%\mozilla thunderbird\removed-files to %ProgramFiles%\mozilla thunderbird\removed-files.exten
from %ProgramFiles(x86)%\opera\resources.pri to %ProgramFiles(x86)%\opera\resources.pri.exten

Modifies the following files

C:\kms\kms_vl_all_aio.cmd
%ProgramFiles%\mozilla thunderbird\removed-files
%ProgramFiles%\mozilla thunderbird\precomplete
%ProgramFiles%\mozilla thunderbird\platform.ini
%ProgramFiles%\mozilla thunderbird\omni.ja
%ProgramFiles%\mozilla thunderbird\install.log
%ProgramFiles%\mozilla thunderbird\dependentlibs.list
%ProgramFiles%\mozilla thunderbird\crashreporter.ini
%ProgramFiles%\mozilla thunderbird\application.ini
%ProgramFiles%\mozilla thunderbird\accessible.tlb
%ProgramFiles%\mozilla firefox\updater.ini
%ProgramFiles%\mozilla firefox\update-settings.ini
%ProgramFiles%\mozilla firefox\removed-files
%ProgramFiles%\mozilla firefox\precomplete
%ProgramFiles%\mozilla firefox\platform.ini
%ProgramFiles%\mozilla firefox\omni.ja
%ProgramFiles%\mozilla firefox\install.log
%ProgramFiles%\mozilla firefox\firefox.visualelementsmanifest.xml
%ProgramFiles%\mozilla firefox\dependentlibs.list
%ProgramFiles%\mozilla firefox\crashreporter.ini
%ProgramFiles%\mozilla firefox\application.ini
%ProgramFiles%\mozilla firefox\accessible.tlb
C:\users\desktop.ini
<Drive name for removable media>:\correct.avi
%ProgramFiles(x86)%\desktop.ini
%ProgramFiles%\desktop.ini
D:\install.log
C:\kms\kms_vl_all_aio_debug.log
%ProgramFiles%\mozilla thunderbird\thunderbird.visualelementsmanifest.xml
%ProgramFiles%\mozilla thunderbird\update-settings.ini

Modifies multiple files.

Changes user data files extensions (Trojan.Encoder).

Network activity

Connects to

'<LOCALNET>.52.0':445
'<LOCALNET>.52.161':445
'<LOCALNET>.52.162':445
'<LOCALNET>.52.163':445
'<LOCALNET>.52.164':445
'<LOCALNET>.52.165':445
'<LOCALNET>.52.166':445
'<LOCALNET>.52.167':445
'<LOCALNET>.52.168':445
'<LOCALNET>.52.169':445
'<LOCALNET>.52.170':445
'<LOCALNET>.52.171':445
'<LOCALNET>.52.172':445
'<LOCALNET>.52.173':445
'<LOCALNET>.52.175':445
'<LOCALNET>.52.189':445
'<LOCALNET>.52.176':445
'<LOCALNET>.52.177':445
'<LOCALNET>.52.178':445
'<LOCALNET>.52.179':445
'<LOCALNET>.52.180':445
'<LOCALNET>.52.181':445
'<LOCALNET>.52.182':445
'<LOCALNET>.52.183':445
'<LOCALNET>.52.184':445
'<LOCALNET>.52.185':445
'<LOCALNET>.52.186':445
'<LOCALNET>.52.187':445
'<LOCALNET>.52.188':445
'<LOCALNET>.52.160':445
'<LOCALNET>.52.174':445
'<LOCALNET>.52.159':445
'<LOCALNET>.52.142':445
'<LOCALNET>.52.129':445
'<LOCALNET>.52.130':445
'<LOCALNET>.52.131':445
'<LOCALNET>.52.132':445
'<LOCALNET>.52.133':445
'<LOCALNET>.52.134':445
'<LOCALNET>.52.135':445
'<LOCALNET>.52.136':445
'<LOCALNET>.52.137':445
'<LOCALNET>.52.138':445
'<LOCALNET>.52.139':445
'<LOCALNET>.52.140':445
'<LOCALNET>.52.141':445
'<LOCALNET>.52.143':445
'<LOCALNET>.52.157':445
'<LOCALNET>.52.144':445
'<LOCALNET>.52.145':445
'<LOCALNET>.52.146':445
'<LOCALNET>.52.147':445
'<LOCALNET>.52.148':445
'<LOCALNET>.52.149':445
'<LOCALNET>.52.150':445
'<LOCALNET>.52.151':445
'<LOCALNET>.52.152':445
'<LOCALNET>.52.153':445
'<LOCALNET>.52.154':445
'<LOCALNET>.52.155':445
'<LOCALNET>.52.156':445
'<LOCALNET>.52.158':445
'<LOCALNET>.52.207':445
'<LOCALNET>.52.253':445
'<LOCALNET>.52.192':445
'<LOCALNET>.52.225':445
'<LOCALNET>.52.226':445
'<LOCALNET>.52.227':445
'<LOCALNET>.52.228':445
'<LOCALNET>.52.229':445
'<LOCALNET>.52.230':445
'<LOCALNET>.52.231':445
'<LOCALNET>.52.232':445
'<LOCALNET>.52.233':445
'<LOCALNET>.52.234':445
'<LOCALNET>.52.235':445
'<LOCALNET>.52.236':445
'<LOCALNET>.52.237':445
'<LOCALNET>.52.239':445
'<LOCALNET>.52.191':445
'<LOCALNET>.52.240':445
'<LOCALNET>.52.241':445
'<LOCALNET>.52.242':445
'<LOCALNET>.52.243':445
'<LOCALNET>.52.244':445
'<LOCALNET>.52.245':445
'<LOCALNET>.52.246':445
'<LOCALNET>.52.247':445
'<LOCALNET>.52.248':445
'<LOCALNET>.52.249':445
'<LOCALNET>.52.250':445
'<LOCALNET>.52.251':445
'<LOCALNET>.52.252':445
'<LOCALNET>.52.224':445
'<LOCALNET>.52.128':445
'<LOCALNET>.52.223':445
'<LOCALNET>.52.206':445
'<LOCALNET>.52.193':445
'<LOCALNET>.52.194':445
'<LOCALNET>.52.195':445
'<LOCALNET>.52.196':445
'<LOCALNET>.52.197':445
'<LOCALNET>.52.198':445
'<LOCALNET>.52.199':445
'<LOCALNET>.52.200':445
'<LOCALNET>.52.201':445
'<LOCALNET>.52.202':445
'<LOCALNET>.52.203':445
'<LOCALNET>.52.204':445
'<LOCALNET>.52.205':445
'<LOCALNET>.52.190':445
'<LOCALNET>.52.221':445
'<LOCALNET>.52.208':445
'<LOCALNET>.52.209':445
'<LOCALNET>.52.210':445
'<LOCALNET>.52.211':445
'<LOCALNET>.52.212':445
'<LOCALNET>.52.213':445
'<LOCALNET>.52.214':445
'<LOCALNET>.52.215':445
'<LOCALNET>.52.216':445
'<LOCALNET>.52.217':445
'<LOCALNET>.52.218':445
'<LOCALNET>.52.219':445
'<LOCALNET>.52.220':445
'<LOCALNET>.52.222':445
'<LOCALNET>.52.238':445
'<LOCALNET>.52.127':445
'<LOCALNET>.52.110':445
'<LOCALNET>.52.33':445
'<LOCALNET>.52.34':445
'<LOCALNET>.52.35':445
'<LOCALNET>.52.36':445
'<LOCALNET>.52.37':445
'<LOCALNET>.52.38':445
'<LOCALNET>.52.39':445
'<LOCALNET>.52.40':445
'<LOCALNET>.52.41':445
'<LOCALNET>.52.42':445
'<LOCALNET>.52.43':445
'<LOCALNET>.52.44':445
'<LOCALNET>.52.45':445
'<LOCALNET>.52.47':445
'<LOCALNET>.52.61':445
'<LOCALNET>.52.48':445
'<LOCALNET>.52.49':445
'<LOCALNET>.52.50':445
'<LOCALNET>.52.51':445
'<LOCALNET>.52.52':445
'<LOCALNET>.52.53':445
'<LOCALNET>.52.54':445
'<LOCALNET>.52.55':445
'<LOCALNET>.52.56':445
'<LOCALNET>.52.57':445
'<LOCALNET>.52.58':445
'<LOCALNET>.52.59':445
'<LOCALNET>.52.60':445
'<LOCALNET>.52.32':445
'<LOCALNET>.52.46':445
'<LOCALNET>.52.31':445
'<LOCALNET>.52.14':445
'<LOCALNET>.52.1':445
'<LOCALNET>.52.2':445
'<LOCALNET>.52.3':445
'<LOCALNET>.52.4':445
'<LOCALNET>.52.5':445
'<LOCALNET>.52.6':445
'<LOCALNET>.52.7':445
'<LOCALNET>.52.8':445
'<LOCALNET>.52.9':445
'<LOCALNET>.52.10':445
'<LOCALNET>.52.11':445
'<LOCALNET>.52.12':445
'<LOCALNET>.52.13':445
'<LOCALNET>.52.15':445
'<LOCALNET>.52.29':445
'<LOCALNET>.52.16':445
'<LOCALNET>.52.17':445
'<LOCALNET>.52.18':445
'<LOCALNET>.52.19':445
'<LOCALNET>.52.20':445
'<LOCALNET>.52.21':445
'<LOCALNET>.52.22':445
'<LOCALNET>.52.23':445
'<LOCALNET>.52.24':445
'<LOCALNET>.52.25':445
'<LOCALNET>.52.26':445
'<LOCALNET>.52.27':445
'<LOCALNET>.52.28':445
'<LOCALNET>.52.30':445
'<LOCALNET>.52.79':445
'<LOCALNET>.52.125':445
'<LOCALNET>.52.64':445
'<LOCALNET>.52.97':445
'<LOCALNET>.52.98':445
'<LOCALNET>.52.99':445
'<LOCALNET>.52.100':445
'<LOCALNET>.52.101':445
'<LOCALNET>.52.102':445
'<LOCALNET>.52.103':445
'<LOCALNET>.52.104':445
'<LOCALNET>.52.105':445
'<LOCALNET>.52.106':445
'<LOCALNET>.52.107':445
'<LOCALNET>.52.108':445
'<LOCALNET>.52.109':445
'<LOCALNET>.52.111':445
'<LOCALNET>.52.63':445
'<LOCALNET>.52.112':445
'<LOCALNET>.52.113':445
'<LOCALNET>.52.114':445
'<LOCALNET>.52.115':445
'<LOCALNET>.52.116':445
'<LOCALNET>.52.117':445
'<LOCALNET>.52.118':445
'<LOCALNET>.52.119':445
'<LOCALNET>.52.120':445
'<LOCALNET>.52.121':445
'<LOCALNET>.52.122':445
'<LOCALNET>.52.123':445
'<LOCALNET>.52.124':445
'<LOCALNET>.52.96':445
'<LOCALNET>.52.126':445
'<LOCALNET>.52.95':445
'<LOCALNET>.52.78':445
'<LOCALNET>.52.65':445
'<LOCALNET>.52.66':445
'<LOCALNET>.52.67':445
'<LOCALNET>.52.68':445
'<LOCALNET>.52.69':445
'<LOCALNET>.52.70':445
'<LOCALNET>.52.71':445
'<LOCALNET>.52.72':445
'<LOCALNET>.52.73':445
'<LOCALNET>.52.74':445
'<LOCALNET>.52.75':445
'<LOCALNET>.52.76':445
'<LOCALNET>.52.77':445
'<LOCALNET>.52.62':445
'<LOCALNET>.52.93':445
'<LOCALNET>.52.80':445
'<LOCALNET>.52.81':445
'<LOCALNET>.52.82':445
'<LOCALNET>.52.83':445
'<LOCALNET>.52.84':445
'<LOCALNET>.52.85':445
'<LOCALNET>.52.86':445
'<LOCALNET>.52.87':445
'<LOCALNET>.52.88':445
'<LOCALNET>.52.89':445
'<LOCALNET>.52.90':445
'<LOCALNET>.52.91':445
'<LOCALNET>.52.92':445
'<LOCALNET>.52.94':445
'<LOCALNET>.52.254':445

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial