Technical Information
Modifies file system
Moves the following files
- from %APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk to %APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk.plankton
- from %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\private character editor.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\private character editor.lnk.plankton
- from %APPDATA%\microsoft\windows\start menu\programs\google chrome\google chrome.lnk to %APPDATA%\microsoft\windows\start menu\programs\google chrome\google chrome.lnk.plankton
- from %APPDATA%\microsoft\windows\start menu\programs\maintenance\help.lnk to %APPDATA%\microsoft\windows\start menu\programs\maintenance\help.lnk.plankton
- from %APPDATA%\microsoft\windows\start menu\programs\telegram desktop\telegram.lnk to %APPDATA%\microsoft\windows\start menu\programs\telegram desktop\telegram.lnk.plankton
- from %APPDATA%\microsoft\windows\start menu\programs\telegram desktop\uninstall telegram.lnk to %APPDATA%\microsoft\windows\start menu\programs\telegram desktop\uninstall telegram.lnk.plankton
- from %APPDATA%\microsoft\windows\start menu\programs\winrar\console rar manual.lnk to %APPDATA%\microsoft\windows\start menu\programs\winrar\console rar manual.lnk.plankton
- from %APPDATA%\microsoft\windows\start menu\programs\winrar\what is new in the latest version.lnk to %APPDATA%\microsoft\windows\start menu\programs\winrar\what is new in the latest version.lnk.plankton
- from %APPDATA%\microsoft\windows\start menu\programs\winrar\winrar help.lnk to %APPDATA%\microsoft\windows\start menu\programs\winrar\winrar help.lnk.plankton
- from %APPDATA%\microsoft\windows\start menu\programs\winrar\winrar.lnk to %APPDATA%\microsoft\windows\start menu\programs\winrar\winrar.lnk.plankton
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\pkcs11.txt to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\pkcs11.txt.plankton
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\securitypreloadstate.txt to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\securitypreloadstate.txt.plankton
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\prefs.js to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\prefs.js.plankton
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\securitypreloadstate.txt to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\securitypreloadstate.txt.plankton
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sitesecurityservicestate.txt to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sitesecurityservicestate.txt.plankton
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\trrblacklist.txt to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\trrblacklist.txt.plankton
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\user.js to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\user.js.plankton
- from %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\user.js to %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\user.js.plankton
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\alternateservices.txt to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\alternateservices.txt.plankton
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\pkcs11.txt to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\pkcs11.txt.plankton
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\prefs.js to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\prefs.js.plankton
- from %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\internet explorer (no add-ons).lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\internet explorer (no add-ons).lnk.plankton
- from %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\alternateservices.txt to %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\alternateservices.txt.plankton
- from %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\control panel.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\control panel.lnk.plankton
- from %APPDATA%\microsoft\office\recent\templates.lnk to %APPDATA%\microsoft\office\recent\templates.lnk.plankton
- from %APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk to %APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk.plankton
- from %APPDATA%\microsoft\internet explorer\quick launch\shows desktop.lnk to %APPDATA%\microsoft\internet explorer\quick launch\shows desktop.lnk.plankton
- from %APPDATA%\microsoft\internet explorer\quick launch\window switcher.lnk to %APPDATA%\microsoft\internet explorer\quick launch\window switcher.lnk.plankton
- from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\firefox.lnk to %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\firefox.lnk.plankton
- from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\google chrome.lnk to %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\google chrome.lnk.plankton
- from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\internet explorer.lnk to %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\internet explorer.lnk.plankton
- from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\opera.lnk to %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\opera.lnk.plankton
- from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\windows explorer.lnk to %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\windows explorer.lnk.plankton
- from %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\windows media player.lnk to %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\windows media player.lnk.plankton
- from %APPDATA%\microsoft\windows\sendto\fax recipient.lnk to %APPDATA%\microsoft\windows\sendto\fax recipient.lnk.plankton
- from %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\on-screen keyboard.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\on-screen keyboard.lnk.plankton
- from %APPDATA%\microsoft\windows\start menu\programs\internet explorer (64-bit).lnk to %APPDATA%\microsoft\windows\start menu\programs\internet explorer (64-bit).lnk.plankton
- from %APPDATA%\microsoft\windows\start menu\programs\internet explorer.lnk to %APPDATA%\microsoft\windows\start menu\programs\internet explorer.lnk.plankton
- from %APPDATA%\microsoft\windows\start menu\programs\accessories\command prompt.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\command prompt.lnk.plankton
- from %APPDATA%\microsoft\windows\start menu\programs\accessories\notepad.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\notepad.lnk.plankton
- from %APPDATA%\microsoft\windows\start menu\programs\accessories\run.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\run.lnk.plankton
- from %APPDATA%\microsoft\windows\start menu\programs\accessories\windows explorer.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\windows explorer.lnk.plankton
- from %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\ease of access.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\ease of access.lnk.plankton
- from %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\magnify.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\magnify.lnk.plankton
- from %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\narrator.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\narrator.lnk.plankton
- from %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\computer.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\computer.lnk.plankton
- from %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\sitesecurityservicestate.txt to %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\sitesecurityservicestate.txt.plankton
Modifies the following files
- %ALLUSERSPROFILE%\microsoft\office\assetlibrary.ico.plankton
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\snipping tool.lnk.plankton
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\remote desktop connection.lnk.plankton
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\paint.lnk.plankton
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\networkprojection.lnk.plankton
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\mobility center.lnk.plankton
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\math input panel.lnk.plankton
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\displayswitch.lnk.plankton
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\calculator.lnk.plankton
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\xps viewer.lnk.plankton
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\windows media player.lnk.plankton
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\windows fax and scan.lnk.plankton
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\windows dvd maker.lnk.plankton
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sidebar.lnk.plankton
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\opera.lnk.plankton
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\mozilla thunderbird.lnk.plankton
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\media center.lnk.plankton
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\firefox.lnk.plankton
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\acrobat reader dc.lnk.plankton
- %ALLUSERSPROFILE%\microsoft\windows\start menu\windows update.lnk.plankton
- %ALLUSERSPROFILE%\microsoft\windows\start menu\default programs.lnk.plankton
- %ALLUSERSPROFILE%\microsoft\user account pictures\user.bmp.plankton
- %ALLUSERSPROFILE%\microsoft\user account pictures\guest.bmp.plankton
- %ALLUSERSPROFILE%\microsoft\office\sharepointteamsite.ico.plankton
- %ALLUSERSPROFILE%\microsoft\office\sharepointportalsite.ico.plankton
- %ALLUSERSPROFILE%\microsoft\office\mysite.ico.plankton
- %ALLUSERSPROFILE%\microsoft\office\mysharepoints.ico.plankton
- %ALLUSERSPROFILE%\microsoft\office\documentrepository.ico.plankton
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\sound recorder.lnk.plankton
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\sticky notes.lnk.plankton
Modifies multiple files.
Changes user data files extensions (Trojan.Encoder).
