Trojan.Encoder.25165

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%ALLUSERSPROFILE%\Start Menu\Programs\Startup\ifaailjmgp.jpg
%HOMEPATH%\Start Menu\Programs\Startup\ifaailjmgp.jpg

Modifies file system:

Creates the following files:

%APPDATA%\Microsoft\Protect\CREDHIST
%HOMEPATH%\Favorites\ifaailjmgp.jpg
%HOMEPATH%\Favorites\Links\ifaailjmgp.jpg
%HOMEPATH%\Local Settings\ifaailjmgp.jpg
<LS_APPDATA>\ifaailjmgp.jpg
<LS_APPDATA>\Identities\ifaailjmgp.jpg
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\ifaailjmgp.jpg
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\ifaailjmgp.jpg
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\ifaailjmgp.jpg
<LS_APPDATA>\Microsoft\ifaailjmgp.jpg
<LS_APPDATA>\Microsoft\CD Burning\ifaailjmgp.jpg
<LS_APPDATA>\Microsoft\Credentials\ifaailjmgp.jpg
<LS_APPDATA>\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\ifaailjmgp.jpg
<LS_APPDATA>\Microsoft\Media Player\ifaailjmgp.jpg
<LS_APPDATA>\Microsoft\Windows\ifaailjmgp.jpg
<LS_APPDATA>\Microsoft\Windows Media\9.0\ifaailjmgp.jpg
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\9\ifaailjmgp.jpg
<LS_APPDATA>\Mozilla\ifaailjmgp.jpg
<LS_APPDATA>\Mozilla\Firefox\ifaailjmgp.jpg
<LS_APPDATA>\Mozilla\Firefox\Profiles\ifaailjmgp.jpg
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\ifaailjmgp.jpg
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\ifaailjmgp.jpg
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\0\ifaailjmgp.jpg
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\1\ifaailjmgp.jpg
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\2\ifaailjmgp.jpg
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\3\ifaailjmgp.jpg
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\4\ifaailjmgp.jpg
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\5\ifaailjmgp.jpg
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\6\ifaailjmgp.jpg
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\7\ifaailjmgp.jpg
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\8\ifaailjmgp.jpg
%HOMEPATH%\Cookies\ifaailjmgp.jpg
<LS_APPDATA>\Microsoft\Windows Media\ifaailjmgp.jpg
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\ifaailjmgp.jpg
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\ifaailjmgp.jpg
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\ifaailjmgp.jpg
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\ifaailjmgp.jpg
%HOMEPATH%\ifaailjmgp.jpg
%APPDATA%\ifaailjmgp.jpg
%APPDATA%\Identities\ifaailjmgp.jpg
%APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\ifaailjmgp.jpg
%APPDATA%\Microsoft\ifaailjmgp.jpg
%APPDATA%\Microsoft\Address Book\ifaailjmgp.jpg
%APPDATA%\Microsoft\Credentials\ifaailjmgp.jpg
%APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\ifaailjmgp.jpg
%APPDATA%\Microsoft\Crypto\ifaailjmgp.jpg
%APPDATA%\Microsoft\Crypto\RSA\ifaailjmgp.jpg
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\ifaailjmgp.jpg
%APPDATA%\Microsoft\Internet Explorer\ifaailjmgp.jpg
%APPDATA%\Microsoft\Media Player\ifaailjmgp.jpg
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\ifaailjmgp.jpg
%APPDATA%\Microsoft\MMC\ifaailjmgp.jpg
%APPDATA%\Microsoft\Protect\ifaailjmgp.jpg
%APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\ifaailjmgp.jpg
%APPDATA%\Microsoft\SystemCertificates\ifaailjmgp.jpg
%APPDATA%\Microsoft\SystemCertificates\My\ifaailjmgp.jpg
%APPDATA%\Microsoft\SystemCertificates\My\Certificates\ifaailjmgp.jpg
%APPDATA%\Microsoft\SystemCertificates\My\CRLs\ifaailjmgp.jpg
%APPDATA%\Microsoft\SystemCertificates\My\CTLs\ifaailjmgp.jpg
%APPDATA%\Microsoft\Windows\ifaailjmgp.jpg
%APPDATA%\Microsoft\Windows\Themes\ifaailjmgp.jpg
%APPDATA%\Mozilla\ifaailjmgp.jpg
%APPDATA%\Mozilla\Extensions\ifaailjmgp.jpg
%APPDATA%\Mozilla\Firefox\ifaailjmgp.jpg
%APPDATA%\Mozilla\Firefox\Profiles\ifaailjmgp.jpg
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\ifaailjmgp.jpg
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\A\ifaailjmgp.jpg
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\B\ifaailjmgp.jpg
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\C\ifaailjmgp.jpg
C:\Far2\Documentation\eng\ifaailjmgp.jpg
C:\Far2\Documentation\rus\ifaailjmgp.jpg
C:\Far2\Encyclopedia\ifaailjmgp.jpg
C:\Far2\FExcept\ifaailjmgp.jpg
C:\Far2\Plugins\ifaailjmgp.jpg
C:\Far2\Plugins\7-Zip\ifaailjmgp.jpg
C:\Far2\Plugins\Align\ifaailjmgp.jpg
C:\Far2\Plugins\arclite\ifaailjmgp.jpg
C:\Far2\Plugins\AutoWrap\ifaailjmgp.jpg
C:\Far2\Plugins\Brackets\ifaailjmgp.jpg
C:\Far2\Plugins\Colorer\ifaailjmgp.jpg
C:\Far2\Plugins\Colorer\bin\ifaailjmgp.jpg
C:\Far2\Plugins\Colorer\hrc\ifaailjmgp.jpg
C:\Far2\Addons\XLat\Russian\ifaailjmgp.jpg
C:\Far2\Documentation\ifaailjmgp.jpg
C:\Far2\Plugins\Colorer\hrc\auto\ifaailjmgp.jpg
C:\Far2\Plugins\Colorer\hrc\auto\types\ifaailjmgp.jpg
C:\Far2\Plugins\FileCase\ifaailjmgp.jpg
C:\Far2\Plugins\FarCmds\ifaailjmgp.jpg
C:\Far2\Plugins\ExtSearch\sources\RegExp\ifaailjmgp.jpg
C:\Far2\Plugins\ExtSearch\sources\ifaailjmgp.jpg
C:\Far2\Plugins\ExtSearch\keys\ifaailjmgp.jpg
C:\Far2\Plugins\FTP\ifaailjmgp.jpg
C:\Far2\Plugins\ExtSearch\doc\ifaailjmgp.jpg
C:\Far2\Plugins\EMenu\ifaailjmgp.jpg
C:\Far2\Plugins\EditCase\ifaailjmgp.jpg
C:\Far2\Plugins\DrawLine\ifaailjmgp.jpg
C:\Far2\Plugins\Compare\ifaailjmgp.jpg
C:\Far2\Plugins\Colorer\hrd\console\contrib\ifaailjmgp.jpg
C:\Far2\Plugins\Colorer\hrd\console\ifaailjmgp.jpg
C:\Far2\Plugins\Colorer\hrd\ifaailjmgp.jpg
C:\Far2\Addons\XLat\ifaailjmgp.jpg
C:\Far2\Addons\Shell\ifaailjmgp.jpg
C:\Far2\Addons\SetUp\ifaailjmgp.jpg
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\E\ifaailjmgp.jpg
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\F\ifaailjmgp.jpg
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\ifaailjmgp.jpg
<LS_APPDATA>\VMware\ifaailjmgp.jpg
%HOMEPATH%\Local Settings\History\ifaailjmgp.jpg
%HOMEPATH%\Local Settings\History\History.IE5\ifaailjmgp.jpg
%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\ifaailjmgp.jpg
%TEMP%\ifaailjmgp.jpg
%HOMEPATH%\Local Settings\<INETFILES>\ifaailjmgp.jpg
%HOMEPATH%\My Documents\ifaailjmgp.jpg
%HOMEPATH%\My Documents\Downloads\ifaailjmgp.jpg
%HOMEPATH%\My Documents\My Music\ifaailjmgp.jpg
%HOMEPATH%\My Documents\My Pictures\ifaailjmgp.jpg
%HOMEPATH%\My Documents\My Received Files\ifaailjmgp.jpg
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\D\ifaailjmgp.jpg
%HOMEPATH%\NetHood\ifaailjmgp.jpg
C:\Far2\Addons\Macros\ifaailjmgp.jpg
%HOMEPATH%\PrintHood\ifaailjmgp.jpg
%HOMEPATH%\Recent\ifaailjmgp.jpg
%HOMEPATH%\SendTo\ifaailjmgp.jpg
%HOMEPATH%\Start Menu\ifaailjmgp.jpg
%HOMEPATH%\Start Menu\Programs\ifaailjmgp.jpg
%HOMEPATH%\Start Menu\Programs\Accessories\ifaailjmgp.jpg
%HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\ifaailjmgp.jpg
%HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\ifaailjmgp.jpg
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\ifaailjmgp.jpg
C:\Far2\ifaailjmgp.jpg
C:\Far2\Addons\ifaailjmgp.jpg
C:\Far2\Addons\Colors\ifaailjmgp.jpg
C:\Far2\Addons\Colors\Custom Highlighting\ifaailjmgp.jpg
C:\Far2\Addons\Colors\Default Highlighting\ifaailjmgp.jpg
%HOMEPATH%\Templates\ifaailjmgp.jpg
C:\Far2\Plugins\ExtSearch\ifaailjmgp.jpg
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\ifaailjmgp.jpg
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\ifaailjmgp.jpg
%ALLUSERSPROFILE%\Start Menu\Programs\ifaailjmgp.jpg
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\ifaailjmgp.jpg
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\ifaailjmgp.jpg
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\ifaailjmgp.jpg
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\ifaailjmgp.jpg
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\ifaailjmgp.jpg
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\ifaailjmgp.jpg
%ALLUSERSPROFILE%\Start Menu\Programs\Games\ifaailjmgp.jpg
%ALLUSERSPROFILE%\Templates\ifaailjmgp.jpg
C:\Documents and Settings\Default User\ifaailjmgp.jpg
C:\Documents and Settings\Default User\Application Data\ifaailjmgp.jpg
C:\Documents and Settings\Default User\Application Data\Microsoft\ifaailjmgp.jpg
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\ifaailjmgp.jpg
C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\ifaailjmgp.jpg
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\ifaailjmgp.jpg
C:\Documents and Settings\Default User\Local Settings\Temp\ifaailjmgp.jpg
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\ifaailjmgp.jpg
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\ifaailjmgp.jpg
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\ifaailjmgp.jpg
C:\Documents and Settings\Default User\Cookies\ifaailjmgp.jpg
C:\Documents and Settings\Default User\Desktop\ifaailjmgp.jpg
C:\Documents and Settings\Default User\Favorites\ifaailjmgp.jpg
C:\Documents and Settings\Default User\Local Settings\ifaailjmgp.jpg
C:\Documents and Settings\Default User\Local Settings\Application Data\ifaailjmgp.jpg
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\ifaailjmgp.jpg
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\ifaailjmgp.jpg
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\ifaailjmgp.jpg
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\ifaailjmgp.jpg
C:\Documents and Settings\Default User\Local Settings\History\ifaailjmgp.jpg
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\ifaailjmgp.jpg
%ALLUSERSPROFILE%\Start Menu\ifaailjmgp.jpg
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\ifaailjmgp.jpg
%ALLUSERSPROFILE%\Favorites\ifaailjmgp.jpg
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Player\ifaailjmgp.jpg
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\5035fadf3995ce6a501e2aff2d198b6d_23ef5514-3059-436f-a4a7-4cefaab20eb1
C:\Documents and Settings\ifaailjmgp.jpg
%ALLUSERSPROFILE%\ifaailjmgp.jpg
%ALLUSERSPROFILE%\Application Data\ifaailjmgp.jpg
%ALLUSERSPROFILE%\Application Data\Microsoft\ifaailjmgp.jpg
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\ifaailjmgp.jpg
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\ifaailjmgp.jpg
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\MachineKeys\ifaailjmgp.jpg
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\ifaailjmgp.jpg
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\ifaailjmgp.jpg
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\ifaailjmgp.jpg
%ALLUSERSPROFILE%\Application Data\Microsoft\Dr Watson\ifaailjmgp.jpg
%ALLUSERSPROFILE%\Application Data\Microsoft\HTML Help\ifaailjmgp.jpg
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Index\ifaailjmgp.jpg
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\ifaailjmgp.jpg
%ALLUSERSPROFILE%\Documents\My Videos\ifaailjmgp.jpg
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\ifaailjmgp.jpg
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Cm\ifaailjmgp.jpg
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Pbk\ifaailjmgp.jpg
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\ifaailjmgp.jpg
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ifaailjmgp.jpg
%ALLUSERSPROFILE%\Desktop\ifaailjmgp.jpg
%ALLUSERSPROFILE%\Documents\ifaailjmgp.jpg
%ALLUSERSPROFILE%\Documents\My Music\ifaailjmgp.jpg
%ALLUSERSPROFILE%\Documents\My Music\My Playlists\ifaailjmgp.jpg
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\ifaailjmgp.jpg
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\ifaailjmgp.jpg
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\ifaailjmgp.jpg
%ALLUSERSPROFILE%\Documents\My Pictures\ifaailjmgp.jpg
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\ifaailjmgp.jpg
%ALLUSERSPROFILE%\DRM\ifaailjmgp.jpg
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\ifaailjmgp.jpg
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\ifaailjmgp.jpg
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\ifaailjmgp.jpg
C:\Documents and Settings\LocalService\Local Settings\Temp\ifaailjmgp.jpg
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\ifaailjmgp.jpg
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\ifaailjmgp.jpg
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\BGGTYMH1\ifaailjmgp.jpg
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\CJCTQ25G\ifaailjmgp.jpg
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\LBMMC3H3\ifaailjmgp.jpg
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\MOE00UY1\ifaailjmgp.jpg
C:\Documents and Settings\NetworkService\ifaailjmgp.jpg
C:\Documents and Settings\NetworkService\Application Data\ifaailjmgp.jpg
C:\Documents and Settings\NetworkService\Application Data\Microsoft\ifaailjmgp.jpg
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\ifaailjmgp.jpg
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\ifaailjmgp.jpg
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\ifaailjmgp.jpg
C:\Documents and Settings\LocalService\Local Settings\History\ifaailjmgp.jpg
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\ifaailjmgp.jpg
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\ifaailjmgp.jpg
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\ifaailjmgp.jpg
C:\Documents and Settings\NetworkService\Local Settings\Temp\ifaailjmgp.jpg
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\ifaailjmgp.jpg
C:\Documents and Settings\NetworkService\Local Settings\History\ifaailjmgp.jpg
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\ifaailjmgp.jpg
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\ifaailjmgp.jpg
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\ifaailjmgp.jpg
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\ifaailjmgp.jpg
C:\Documents and Settings\NetworkService\Local Settings\Application Data\ifaailjmgp.jpg
C:\Documents and Settings\NetworkService\Local Settings\ifaailjmgp.jpg
C:\Documents and Settings\NetworkService\Cookies\ifaailjmgp.jpg
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\ifaailjmgp.jpg
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\ifaailjmgp.jpg
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\ifaailjmgp.jpg
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\ifaailjmgp.jpg
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\ifaailjmgp.jpg
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\ifaailjmgp.jpg
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\ifaailjmgp.jpg
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\ifaailjmgp.jpg
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\ifaailjmgp.jpg
C:\Documents and Settings\Default User\My Documents\ifaailjmgp.jpg
C:\Documents and Settings\Default User\NetHood\ifaailjmgp.jpg
C:\Documents and Settings\Default User\PrintHood\ifaailjmgp.jpg
C:\Documents and Settings\Default User\Recent\ifaailjmgp.jpg
C:\Documents and Settings\Default User\SendTo\ifaailjmgp.jpg
C:\Documents and Settings\Default User\Start Menu\ifaailjmgp.jpg
C:\Documents and Settings\Default User\Start Menu\Programs\ifaailjmgp.jpg
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\ifaailjmgp.jpg
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\ifaailjmgp.jpg
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\ifaailjmgp.jpg
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\ifaailjmgp.jpg
C:\Documents and Settings\Default User\Templates\ifaailjmgp.jpg
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\ifaailjmgp.jpg
C:\Documents and Settings\LocalService\ifaailjmgp.jpg
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\ifaailjmgp.jpg
C:\Documents and Settings\LocalService\Application Data\ifaailjmgp.jpg
C:\Documents and Settings\LocalService\Application Data\Microsoft\ifaailjmgp.jpg
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\ifaailjmgp.jpg
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\ifaailjmgp.jpg
C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\ifaailjmgp.jpg
C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\ifaailjmgp.jpg
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\ifaailjmgp.jpg
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\ifaailjmgp.jpg
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\ifaailjmgp.jpg
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\ifaailjmgp.jpg
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\ifaailjmgp.jpg
C:\Documents and Settings\LocalService\Cookies\ifaailjmgp.jpg
C:\Documents and Settings\LocalService\Local Settings\ifaailjmgp.jpg
C:\Documents and Settings\LocalService\Local Settings\Application Data\ifaailjmgp.jpg
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\ifaailjmgp.jpg
C:\Far2\Plugins\FTP\lib\ifaailjmgp.jpg

Deletes the following files:

%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\5035fadf3995ce6a501e2aff2d198b6d_23ef5514-3059-436f-a4a7-4cefaab20eb1

Moves the following files:

from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8-akkg28iqjl24dkq.db
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3-akkg28iqjl24dkq.db
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod-akkg28iqjl24dkq.db

Modifies user data files (Trojan.Encoder).

Miscellaneous:

Executes the following:

'<SYSTEM32>\cmd.exe' /C net view
'<SYSTEM32>\net.exe' view

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial