Trojan.Encoder.25786

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%ALLUSERSPROFILE%\Start Menu\Programs\Startup\nbuiumavjcklbqt.txt
%HOMEPATH%\Start Menu\Programs\Startup\nbuiumavjcklbqt.txt

Modifies file system:

Creates the following files:

%APPDATA%\Microsoft\Protect\CREDHIST
%APPDATA%\Mozilla\Firefox\nbuiumavjcklbqt.txt
%APPDATA%\Mozilla\Firefox\Profiles\nbuiumavjcklbqt.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\nbuiumavjcklbqt.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\nbuiumavjcklbqt.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\nbuiumavjcklbqt.txt
%HOMEPATH%\Cookies\nbuiumavjcklbqt.txt
%HOMEPATH%\Favorites\nbuiumavjcklbqt.txt
%HOMEPATH%\Favorites\Links\nbuiumavjcklbqt.txt
%HOMEPATH%\Local Settings\nbuiumavjcklbqt.txt
<LS_APPDATA>\nbuiumavjcklbqt.txt
<LS_APPDATA>\Identities\nbuiumavjcklbqt.txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\nbuiumavjcklbqt.txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\nbuiumavjcklbqt.txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\nbuiumavjcklbqt.txt
<LS_APPDATA>\Microsoft\nbuiumavjcklbqt.txt
<LS_APPDATA>\Microsoft\CD Burning\nbuiumavjcklbqt.txt
<LS_APPDATA>\Microsoft\Credentials\nbuiumavjcklbqt.txt
<LS_APPDATA>\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\nbuiumavjcklbqt.txt
<LS_APPDATA>\Microsoft\Media Player\nbuiumavjcklbqt.txt
<LS_APPDATA>\Microsoft\Windows\nbuiumavjcklbqt.txt
<LS_APPDATA>\Microsoft\Windows Media\nbuiumavjcklbqt.txt
<LS_APPDATA>\Microsoft\Windows Media\9.0\nbuiumavjcklbqt.txt
<LS_APPDATA>\Mozilla\nbuiumavjcklbqt.txt
<LS_APPDATA>\Mozilla\Firefox\nbuiumavjcklbqt.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\nbuiumavjcklbqt.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\nbuiumavjcklbqt.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\nbuiumavjcklbqt.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\0\nbuiumavjcklbqt.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\1\nbuiumavjcklbqt.txt
%APPDATA%\Mozilla\Extensions\nbuiumavjcklbqt.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\2\nbuiumavjcklbqt.txt
%APPDATA%\Mozilla\nbuiumavjcklbqt.txt
%APPDATA%\Microsoft\Windows\nbuiumavjcklbqt.txt
C:\Documents and Settings\NetworkService\Local Settings\Temp\nbuiumavjcklbqt.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\nbuiumavjcklbqt.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\nbuiumavjcklbqt.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\nbuiumavjcklbqt.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\nbuiumavjcklbqt.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\nbuiumavjcklbqt.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\nbuiumavjcklbqt.txt
%HOMEPATH%\nbuiumavjcklbqt.txt
%APPDATA%\nbuiumavjcklbqt.txt
%APPDATA%\Identities\nbuiumavjcklbqt.txt
%APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\nbuiumavjcklbqt.txt
%APPDATA%\Microsoft\nbuiumavjcklbqt.txt
%APPDATA%\Microsoft\Address Book\nbuiumavjcklbqt.txt
%APPDATA%\Microsoft\Credentials\nbuiumavjcklbqt.txt
%APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\nbuiumavjcklbqt.txt
%APPDATA%\Microsoft\Crypto\nbuiumavjcklbqt.txt
%APPDATA%\Microsoft\Crypto\RSA\nbuiumavjcklbqt.txt
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\nbuiumavjcklbqt.txt
%APPDATA%\Microsoft\Internet Explorer\nbuiumavjcklbqt.txt
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\nbuiumavjcklbqt.txt
%APPDATA%\Microsoft\Media Player\nbuiumavjcklbqt.txt
%APPDATA%\Microsoft\MMC\nbuiumavjcklbqt.txt
%APPDATA%\Microsoft\Protect\nbuiumavjcklbqt.txt
%APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\nbuiumavjcklbqt.txt
%APPDATA%\Microsoft\SystemCertificates\nbuiumavjcklbqt.txt
%APPDATA%\Microsoft\SystemCertificates\My\nbuiumavjcklbqt.txt
%APPDATA%\Microsoft\SystemCertificates\My\Certificates\nbuiumavjcklbqt.txt
%APPDATA%\Microsoft\SystemCertificates\My\CRLs\nbuiumavjcklbqt.txt
%APPDATA%\Microsoft\SystemCertificates\My\CTLs\nbuiumavjcklbqt.txt
%APPDATA%\Microsoft\Windows\Themes\nbuiumavjcklbqt.txt
%HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\nbuiumavjcklbqt.txt
C:\Far2\Plugins\DrawLine\nbuiumavjcklbqt.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\5\nbuiumavjcklbqt.txt
C:\Far2\Addons\nbuiumavjcklbqt.txt
C:\Far2\Addons\Colors\nbuiumavjcklbqt.txt
C:\Far2\Addons\Colors\Custom Highlighting\nbuiumavjcklbqt.txt
C:\Far2\Addons\Colors\Default Highlighting\nbuiumavjcklbqt.txt
C:\Far2\Addons\Macros\nbuiumavjcklbqt.txt
C:\Far2\Addons\SetUp\nbuiumavjcklbqt.txt
C:\Far2\Addons\Shell\nbuiumavjcklbqt.txt
C:\Far2\Addons\XLat\nbuiumavjcklbqt.txt
C:\Far2\Addons\XLat\Russian\nbuiumavjcklbqt.txt
C:\Far2\Documentation\nbuiumavjcklbqt.txt
C:\Far2\Documentation\eng\nbuiumavjcklbqt.txt
C:\Far2\Documentation\rus\nbuiumavjcklbqt.txt
C:\Far2\Encyclopedia\nbuiumavjcklbqt.txt
C:\Far2\FExcept\nbuiumavjcklbqt.txt
C:\Far2\Plugins\nbuiumavjcklbqt.txt
C:\Far2\Plugins\7-Zip\nbuiumavjcklbqt.txt
C:\Far2\Plugins\Align\nbuiumavjcklbqt.txt
C:\Far2\Plugins\arclite\nbuiumavjcklbqt.txt
C:\Far2\Plugins\AutoWrap\nbuiumavjcklbqt.txt
C:\Far2\Plugins\Brackets\nbuiumavjcklbqt.txt
C:\Far2\Plugins\Colorer\nbuiumavjcklbqt.txt
C:\Far2\Plugins\Colorer\bin\nbuiumavjcklbqt.txt
C:\Far2\Plugins\Colorer\hrc\nbuiumavjcklbqt.txt
C:\Far2\Plugins\Colorer\hrc\auto\nbuiumavjcklbqt.txt
C:\Far2\Plugins\Colorer\hrc\auto\types\nbuiumavjcklbqt.txt
C:\Far2\Plugins\Colorer\hrd\nbuiumavjcklbqt.txt
C:\Far2\Plugins\Colorer\hrd\console\nbuiumavjcklbqt.txt
C:\Far2\Plugins\Colorer\hrd\console\contrib\nbuiumavjcklbqt.txt
C:\Far2\Plugins\Compare\nbuiumavjcklbqt.txt
C:\Far2\nbuiumavjcklbqt.txt
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\nbuiumavjcklbqt.txt
%HOMEPATH%\Templates\nbuiumavjcklbqt.txt
%HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\nbuiumavjcklbqt.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\6\nbuiumavjcklbqt.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\7\nbuiumavjcklbqt.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\8\nbuiumavjcklbqt.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\9\nbuiumavjcklbqt.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\A\nbuiumavjcklbqt.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\B\nbuiumavjcklbqt.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\C\nbuiumavjcklbqt.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\D\nbuiumavjcklbqt.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\E\nbuiumavjcklbqt.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\F\nbuiumavjcklbqt.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\nbuiumavjcklbqt.txt
<LS_APPDATA>\VMware\nbuiumavjcklbqt.txt
%HOMEPATH%\Local Settings\History\nbuiumavjcklbqt.txt
%HOMEPATH%\Local Settings\History\History.IE5\nbuiumavjcklbqt.txt
%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\nbuiumavjcklbqt.txt
%TEMP%\nbuiumavjcklbqt.txt
%HOMEPATH%\Local Settings\<INETFILES>\nbuiumavjcklbqt.txt
%HOMEPATH%\My Documents\nbuiumavjcklbqt.txt
%HOMEPATH%\My Documents\Downloads\nbuiumavjcklbqt.txt
%HOMEPATH%\My Documents\My Music\nbuiumavjcklbqt.txt
%HOMEPATH%\My Documents\My Pictures\nbuiumavjcklbqt.txt
%HOMEPATH%\My Documents\My Received Files\nbuiumavjcklbqt.txt
%HOMEPATH%\NetHood\nbuiumavjcklbqt.txt
%HOMEPATH%\PrintHood\nbuiumavjcklbqt.txt
%HOMEPATH%\Recent\nbuiumavjcklbqt.txt
%HOMEPATH%\SendTo\nbuiumavjcklbqt.txt
%HOMEPATH%\Start Menu\nbuiumavjcklbqt.txt
%HOMEPATH%\Start Menu\Programs\nbuiumavjcklbqt.txt
%HOMEPATH%\Start Menu\Programs\Accessories\nbuiumavjcklbqt.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\3\nbuiumavjcklbqt.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\4\nbuiumavjcklbqt.txt
C:\Documents and Settings\NetworkService\Local Settings\History\nbuiumavjcklbqt.txt
C:\Documents and Settings\Default User\Local Settings\Temp\nbuiumavjcklbqt.txt
%ALLUSERSPROFILE%\Start Menu\nbuiumavjcklbqt.txt
%ALLUSERSPROFILE%\Start Menu\Programs\nbuiumavjcklbqt.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\nbuiumavjcklbqt.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\nbuiumavjcklbqt.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\nbuiumavjcklbqt.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\nbuiumavjcklbqt.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\nbuiumavjcklbqt.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\nbuiumavjcklbqt.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Games\nbuiumavjcklbqt.txt
%ALLUSERSPROFILE%\Templates\nbuiumavjcklbqt.txt
C:\Documents and Settings\Default User\nbuiumavjcklbqt.txt
C:\Documents and Settings\Default User\Application Data\nbuiumavjcklbqt.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\nbuiumavjcklbqt.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\nbuiumavjcklbqt.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\nbuiumavjcklbqt.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\nbuiumavjcklbqt.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\nbuiumavjcklbqt.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\nbuiumavjcklbqt.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\nbuiumavjcklbqt.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\nbuiumavjcklbqt.txt
C:\Documents and Settings\Default User\Cookies\nbuiumavjcklbqt.txt
C:\Documents and Settings\Default User\Desktop\nbuiumavjcklbqt.txt
C:\Documents and Settings\Default User\Favorites\nbuiumavjcklbqt.txt
C:\Documents and Settings\Default User\Local Settings\nbuiumavjcklbqt.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\nbuiumavjcklbqt.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\nbuiumavjcklbqt.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\nbuiumavjcklbqt.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\nbuiumavjcklbqt.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\nbuiumavjcklbqt.txt
%ALLUSERSPROFILE%\Favorites\nbuiumavjcklbqt.txt
C:\Documents and Settings\Default User\Local Settings\History\nbuiumavjcklbqt.txt
%ALLUSERSPROFILE%\DRM\nbuiumavjcklbqt.txt
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\nbuiumavjcklbqt.txt
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\088b59f52a6356d9a5c3f683978c36f7_23ef5514-3059-436f-a4a7-4cefaab20eb1
C:\Documents and Settings\nbuiumavjcklbqt.txt
%ALLUSERSPROFILE%\nbuiumavjcklbqt.txt
%ALLUSERSPROFILE%\Application Data\nbuiumavjcklbqt.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\nbuiumavjcklbqt.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\nbuiumavjcklbqt.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\nbuiumavjcklbqt.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\MachineKeys\nbuiumavjcklbqt.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\nbuiumavjcklbqt.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\nbuiumavjcklbqt.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\nbuiumavjcklbqt.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Dr Watson\nbuiumavjcklbqt.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\HTML Help\nbuiumavjcklbqt.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Index\nbuiumavjcklbqt.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Player\nbuiumavjcklbqt.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\nbuiumavjcklbqt.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\nbuiumavjcklbqt.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Cm\nbuiumavjcklbqt.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Pbk\nbuiumavjcklbqt.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\nbuiumavjcklbqt.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\nbuiumavjcklbqt.txt
%ALLUSERSPROFILE%\Desktop\nbuiumavjcklbqt.txt
%ALLUSERSPROFILE%\Documents\nbuiumavjcklbqt.txt
%ALLUSERSPROFILE%\Documents\My Music\nbuiumavjcklbqt.txt
%ALLUSERSPROFILE%\Documents\My Music\My Playlists\nbuiumavjcklbqt.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\nbuiumavjcklbqt.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\nbuiumavjcklbqt.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\nbuiumavjcklbqt.txt
%ALLUSERSPROFILE%\Documents\My Pictures\nbuiumavjcklbqt.txt
%ALLUSERSPROFILE%\Documents\My Videos\nbuiumavjcklbqt.txt
C:\Documents and Settings\LocalService\Local Settings\nbuiumavjcklbqt.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\nbuiumavjcklbqt.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\nbuiumavjcklbqt.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\nbuiumavjcklbqt.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\nbuiumavjcklbqt.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\nbuiumavjcklbqt.txt
C:\Documents and Settings\LocalService\Local Settings\History\nbuiumavjcklbqt.txt
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\nbuiumavjcklbqt.txt
C:\Documents and Settings\LocalService\Local Settings\Temp\nbuiumavjcklbqt.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\nbuiumavjcklbqt.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\nbuiumavjcklbqt.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\BGGTYMH1\nbuiumavjcklbqt.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\CJCTQ25G\nbuiumavjcklbqt.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\LBMMC3H3\nbuiumavjcklbqt.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\MOE00UY1\nbuiumavjcklbqt.txt
C:\Documents and Settings\NetworkService\nbuiumavjcklbqt.txt
C:\Documents and Settings\NetworkService\Application Data\nbuiumavjcklbqt.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\nbuiumavjcklbqt.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\nbuiumavjcklbqt.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\nbuiumavjcklbqt.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\nbuiumavjcklbqt.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\nbuiumavjcklbqt.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\nbuiumavjcklbqt.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\nbuiumavjcklbqt.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\nbuiumavjcklbqt.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\nbuiumavjcklbqt.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\nbuiumavjcklbqt.txt
C:\Documents and Settings\NetworkService\Cookies\nbuiumavjcklbqt.txt
C:\Documents and Settings\NetworkService\Local Settings\nbuiumavjcklbqt.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\nbuiumavjcklbqt.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\nbuiumavjcklbqt.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\nbuiumavjcklbqt.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\nbuiumavjcklbqt.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\nbuiumavjcklbqt.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\nbuiumavjcklbqt.txt
C:\Documents and Settings\LocalService\Cookies\nbuiumavjcklbqt.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\nbuiumavjcklbqt.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\nbuiumavjcklbqt.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\nbuiumavjcklbqt.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\nbuiumavjcklbqt.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\nbuiumavjcklbqt.txt
C:\Documents and Settings\Default User\My Documents\nbuiumavjcklbqt.txt
C:\Documents and Settings\Default User\NetHood\nbuiumavjcklbqt.txt
C:\Documents and Settings\Default User\PrintHood\nbuiumavjcklbqt.txt
C:\Documents and Settings\Default User\Recent\nbuiumavjcklbqt.txt
C:\Documents and Settings\Default User\SendTo\nbuiumavjcklbqt.txt
C:\Documents and Settings\Default User\Start Menu\nbuiumavjcklbqt.txt
C:\Documents and Settings\Default User\Start Menu\Programs\nbuiumavjcklbqt.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\nbuiumavjcklbqt.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\nbuiumavjcklbqt.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\nbuiumavjcklbqt.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\nbuiumavjcklbqt.txt
C:\Documents and Settings\Default User\Templates\nbuiumavjcklbqt.txt
C:\Documents and Settings\LocalService\nbuiumavjcklbqt.txt
C:\Documents and Settings\LocalService\Application Data\nbuiumavjcklbqt.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\nbuiumavjcklbqt.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\nbuiumavjcklbqt.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\nbuiumavjcklbqt.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\nbuiumavjcklbqt.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\nbuiumavjcklbqt.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\nbuiumavjcklbqt.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\nbuiumavjcklbqt.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\nbuiumavjcklbqt.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\nbuiumavjcklbqt.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\nbuiumavjcklbqt.txt
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\nbuiumavjcklbqt.txt
C:\Far2\Plugins\EditCase\nbuiumavjcklbqt.txt

Deletes the following files:

%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\088b59f52a6356d9a5c3f683978c36f7_23ef5514-3059-436f-a4a7-4cefaab20eb1

Moves the following files:

from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8-ondo37boba28ldj.db
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3-ondo37boba28ldj.db
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod-ondo37boba28ldj.db

Modifies user data files (Trojan.Encoder).

Miscellaneous:

Executes the following:

'<SYSTEM32>\cmd.exe' /C net view
'<SYSTEM32>\net.exe' view

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial