Trojan.Encoder.25787

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%ALLUSERSPROFILE%\Start Menu\Programs\Startup\msefisudvkrcish.txt
%HOMEPATH%\Start Menu\Programs\Startup\msefisudvkrcish.txt

Modifies file system:

Creates the following files:

%APPDATA%\Microsoft\Protect\CREDHIST
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\4\msefisudvkrcish.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\3\msefisudvkrcish.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\2\msefisudvkrcish.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\1\msefisudvkrcish.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\0\msefisudvkrcish.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\msefisudvkrcish.txt
<LS_APPDATA>\Microsoft\Credentials\msefisudvkrcish.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\msefisudvkrcish.txt
<LS_APPDATA>\Mozilla\Firefox\msefisudvkrcish.txt
<LS_APPDATA>\Mozilla\msefisudvkrcish.txt
<LS_APPDATA>\Microsoft\Windows Media\9.0\msefisudvkrcish.txt
<LS_APPDATA>\Microsoft\Windows Media\msefisudvkrcish.txt
<LS_APPDATA>\Microsoft\Windows\msefisudvkrcish.txt
<LS_APPDATA>\Microsoft\Media Player\msefisudvkrcish.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\msefisudvkrcish.txt
<LS_APPDATA>\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\msefisudvkrcish.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\5\msefisudvkrcish.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\E\msefisudvkrcish.txt
%TEMP%\msefisudvkrcish.txt
%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\msefisudvkrcish.txt
%HOMEPATH%\Local Settings\History\History.IE5\msefisudvkrcish.txt
%HOMEPATH%\Local Settings\History\msefisudvkrcish.txt
<LS_APPDATA>\VMware\msefisudvkrcish.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\msefisudvkrcish.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\7\msefisudvkrcish.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\6\msefisudvkrcish.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\D\msefisudvkrcish.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\C\msefisudvkrcish.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\B\msefisudvkrcish.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\A\msefisudvkrcish.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\9\msefisudvkrcish.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\8\msefisudvkrcish.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\F\msefisudvkrcish.txt
%HOMEPATH%\My Documents\msefisudvkrcish.txt
%HOMEPATH%\Local Settings\<INETFILES>\msefisudvkrcish.txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\msefisudvkrcish.txt
%APPDATA%\Microsoft\MMC\msefisudvkrcish.txt
%APPDATA%\Microsoft\SystemCertificates\My\Certificates\msefisudvkrcish.txt
%APPDATA%\Microsoft\SystemCertificates\My\msefisudvkrcish.txt
%APPDATA%\Microsoft\SystemCertificates\msefisudvkrcish.txt
%APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\msefisudvkrcish.txt
%APPDATA%\Microsoft\Protect\msefisudvkrcish.txt
%APPDATA%\Microsoft\SystemCertificates\My\CRLs\msefisudvkrcish.txt
%APPDATA%\Microsoft\SystemCertificates\My\CTLs\msefisudvkrcish.txt
<LS_APPDATA>\Microsoft\msefisudvkrcish.txt
%APPDATA%\Microsoft\Internet Explorer\msefisudvkrcish.txt
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\msefisudvkrcish.txt
%APPDATA%\Microsoft\Crypto\RSA\msefisudvkrcish.txt
%APPDATA%\Microsoft\Crypto\msefisudvkrcish.txt
%APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\msefisudvkrcish.txt
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\msefisudvkrcish.txt
<LS_APPDATA>\Microsoft\CD Burning\msefisudvkrcish.txt
%APPDATA%\Microsoft\Windows\msefisudvkrcish.txt
%HOMEPATH%\Cookies\msefisudvkrcish.txt
%HOMEPATH%\Favorites\msefisudvkrcish.txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\msefisudvkrcish.txt
<LS_APPDATA>\Identities\msefisudvkrcish.txt
<LS_APPDATA>\msefisudvkrcish.txt
%HOMEPATH%\Local Settings\msefisudvkrcish.txt
%HOMEPATH%\Favorites\Links\msefisudvkrcish.txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\msefisudvkrcish.txt
%APPDATA%\Microsoft\Windows\Themes\msefisudvkrcish.txt
%APPDATA%\Mozilla\msefisudvkrcish.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\msefisudvkrcish.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\msefisudvkrcish.txt
%APPDATA%\Mozilla\Firefox\Profiles\msefisudvkrcish.txt
%APPDATA%\Mozilla\Firefox\msefisudvkrcish.txt
%APPDATA%\Mozilla\Extensions\msefisudvkrcish.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\msefisudvkrcish.txt
C:\Documents and Settings\Default User\My Documents\msefisudvkrcish.txt
%HOMEPATH%\My Documents\Downloads\msefisudvkrcish.txt
C:\Far2\Plugins\FarCmds\msefisudvkrcish.txt
C:\Far2\Plugins\EMenu\msefisudvkrcish.txt
C:\Far2\Plugins\ExtSearch\sources\RegExp\msefisudvkrcish.txt
C:\Far2\Plugins\ExtSearch\sources\msefisudvkrcish.txt
C:\Far2\Plugins\ExtSearch\keys\msefisudvkrcish.txt
C:\Far2\Plugins\ExtSearch\doc\msefisudvkrcish.txt
C:\Far2\Plugins\ExtSearch\msefisudvkrcish.txt
C:\Far2\Plugins\FTP\msefisudvkrcish.txt
C:\Far2\Plugins\FileCase\msefisudvkrcish.txt
C:\Far2\Plugins\Colorer\hrc\auto\msefisudvkrcish.txt
C:\Far2\Plugins\Compare\msefisudvkrcish.txt
C:\Far2\Plugins\Colorer\hrd\console\contrib\msefisudvkrcish.txt
C:\Far2\Plugins\Colorer\hrd\console\msefisudvkrcish.txt
C:\Far2\Plugins\Colorer\hrd\msefisudvkrcish.txt
C:\Far2\Plugins\Colorer\hrc\auto\types\msefisudvkrcish.txt
C:\Far2\Plugins\DrawLine\msefisudvkrcish.txt
C:\Far2\Plugins\EditCase\msefisudvkrcish.txt
C:\Far2\Plugins\HlfViewer\msefisudvkrcish.txt
C:\Far2\Plugins\Colorer\hrc\msefisudvkrcish.txt
C:\Far2\Plugins\WinSCP\filezilla\misc\msefisudvkrcish.txt
C:\Far2\Plugins\WinSCP\filezilla\msefisudvkrcish.txt
C:\Far2\Plugins\WinSCP\fari\msefisudvkrcish.txt
C:\Far2\Plugins\WinSCP\far\msefisudvkrcish.txt
C:\Far2\Plugins\WinSCP\dragext\msefisudvkrcish.txt
C:\Far2\Plugins\FTP\lib\msefisudvkrcish.txt
C:\Far2\Plugins\WinSCP\forms\msefisudvkrcish.txt
C:\Far2\Plugins\WinSCP\core\msefisudvkrcish.txt
C:\Far2\Plugins\WinSCP\msefisudvkrcish.txt
C:\Far2\Plugins\TmpPanel\msefisudvkrcish.txt
C:\Far2\Plugins\ProcList\msefisudvkrcish.txt
C:\Far2\Plugins\Network\msefisudvkrcish.txt
C:\Far2\Plugins\MacroView\msefisudvkrcish.txt
C:\Far2\Plugins\WinSCP\console\msefisudvkrcish.txt
C:\Far2\Plugins\WinSCP\components\msefisudvkrcish.txt
C:\Far2\Plugins\Colorer\bin\msefisudvkrcish.txt
C:\Far2\Plugins\Colorer\msefisudvkrcish.txt
C:\Far2\Addons\msefisudvkrcish.txt
%HOMEPATH%\Templates\msefisudvkrcish.txt
%HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\msefisudvkrcish.txt
%HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\msefisudvkrcish.txt
%HOMEPATH%\Start Menu\Programs\Accessories\msefisudvkrcish.txt
C:\Far2\Addons\Colors\msefisudvkrcish.txt
%HOMEPATH%\Start Menu\Programs\msefisudvkrcish.txt
%HOMEPATH%\SendTo\msefisudvkrcish.txt
%HOMEPATH%\Recent\msefisudvkrcish.txt
%HOMEPATH%\PrintHood\msefisudvkrcish.txt
%HOMEPATH%\NetHood\msefisudvkrcish.txt
%HOMEPATH%\My Documents\My Received Files\msefisudvkrcish.txt
%HOMEPATH%\My Documents\My Pictures\msefisudvkrcish.txt
%HOMEPATH%\Start Menu\msefisudvkrcish.txt
C:\Far2\Addons\Colors\Custom Highlighting\msefisudvkrcish.txt
C:\Far2\Addons\Colors\Default Highlighting\msefisudvkrcish.txt
C:\Far2\msefisudvkrcish.txt
C:\Far2\Addons\Macros\msefisudvkrcish.txt
C:\Far2\Plugins\AutoWrap\msefisudvkrcish.txt
C:\Far2\Documentation\rus\msefisudvkrcish.txt
C:\Far2\Plugins\arclite\msefisudvkrcish.txt
C:\Far2\Plugins\Align\msefisudvkrcish.txt
C:\Far2\Plugins\7-Zip\msefisudvkrcish.txt
C:\Far2\Plugins\msefisudvkrcish.txt
C:\Far2\FExcept\msefisudvkrcish.txt
C:\Far2\Encyclopedia\msefisudvkrcish.txt
C:\Far2\Documentation\eng\msefisudvkrcish.txt
C:\Far2\Plugins\Brackets\msefisudvkrcish.txt
C:\Far2\Documentation\msefisudvkrcish.txt
C:\Far2\Addons\XLat\Russian\msefisudvkrcish.txt
C:\Far2\Addons\XLat\msefisudvkrcish.txt
C:\Far2\Addons\Shell\msefisudvkrcish.txt
C:\Far2\Addons\SetUp\msefisudvkrcish.txt
%APPDATA%\Microsoft\Credentials\msefisudvkrcish.txt
%APPDATA%\Microsoft\Media Player\msefisudvkrcish.txt
%APPDATA%\Microsoft\Address Book\msefisudvkrcish.txt
%APPDATA%\Microsoft\msefisudvkrcish.txt
%APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\msefisudvkrcish.txt
C:\Documents and Settings\Default User\Application Data\msefisudvkrcish.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\msefisudvkrcish.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\msefisudvkrcish.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\msefisudvkrcish.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\msefisudvkrcish.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\msefisudvkrcish.txt
%ALLUSERSPROFILE%\Start Menu\Programs\msefisudvkrcish.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\msefisudvkrcish.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\msefisudvkrcish.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Games\msefisudvkrcish.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\msefisudvkrcish.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\msefisudvkrcish.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\msefisudvkrcish.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\msefisudvkrcish.txt
%ALLUSERSPROFILE%\Templates\msefisudvkrcish.txt
C:\Documents and Settings\Default User\msefisudvkrcish.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\msefisudvkrcish.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\msefisudvkrcish.txt
C:\Documents and Settings\Default User\Local Settings\History\msefisudvkrcish.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\msefisudvkrcish.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\msefisudvkrcish.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\msefisudvkrcish.txt
C:\Documents and Settings\Default User\Local Settings\Temp\msefisudvkrcish.txt
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\msefisudvkrcish.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\msefisudvkrcish.txt
C:\Documents and Settings\Default User\Cookies\msefisudvkrcish.txt
C:\Documents and Settings\Default User\Desktop\msefisudvkrcish.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\msefisudvkrcish.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\msefisudvkrcish.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\msefisudvkrcish.txt
C:\Documents and Settings\Default User\Local Settings\msefisudvkrcish.txt
C:\Documents and Settings\Default User\Favorites\msefisudvkrcish.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\msefisudvkrcish.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\msefisudvkrcish.txt
%ALLUSERSPROFILE%\Start Menu\msefisudvkrcish.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\msefisudvkrcish.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\HTML Help\msefisudvkrcish.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Dr Watson\msefisudvkrcish.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\msefisudvkrcish.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\msefisudvkrcish.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\msefisudvkrcish.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Player\msefisudvkrcish.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\MachineKeys\msefisudvkrcish.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\msefisudvkrcish.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\msefisudvkrcish.txt
%ALLUSERSPROFILE%\Application Data\msefisudvkrcish.txt
%ALLUSERSPROFILE%\msefisudvkrcish.txt
C:\Documents and Settings\msefisudvkrcish.txt
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\4d8e6cbeb872f770c61b7aec1c4046da_23ef5514-3059-436f-a4a7-4cefaab20eb1
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\msefisudvkrcish.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\msefisudvkrcish.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Index\msefisudvkrcish.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\msefisudvkrcish.txt
%ALLUSERSPROFILE%\Favorites\msefisudvkrcish.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\msefisudvkrcish.txt
%ALLUSERSPROFILE%\DRM\msefisudvkrcish.txt
%ALLUSERSPROFILE%\Documents\My Videos\msefisudvkrcish.txt
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\msefisudvkrcish.txt
%ALLUSERSPROFILE%\Documents\My Pictures\msefisudvkrcish.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\msefisudvkrcish.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\msefisudvkrcish.txt
%ALLUSERSPROFILE%\Documents\My Music\My Playlists\msefisudvkrcish.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Cm\msefisudvkrcish.txt
%ALLUSERSPROFILE%\Documents\My Music\msefisudvkrcish.txt
%ALLUSERSPROFILE%\Documents\msefisudvkrcish.txt
%ALLUSERSPROFILE%\Desktop\msefisudvkrcish.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\msefisudvkrcish.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\msefisudvkrcish.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Pbk\msefisudvkrcish.txt
C:\Far2\Plugins\WinSCP\lib\msefisudvkrcish.txt
%HOMEPATH%\My Documents\My Music\msefisudvkrcish.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\msefisudvkrcish.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\msefisudvkrcish.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\LBMMC3H3\msefisudvkrcish.txt
C:\Documents and Settings\NetworkService\Local Settings\msefisudvkrcish.txt
C:\Documents and Settings\NetworkService\Cookies\msefisudvkrcish.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\msefisudvkrcish.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\msefisudvkrcish.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\msefisudvkrcish.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\msefisudvkrcish.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\msefisudvkrcish.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\msefisudvkrcish.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\msefisudvkrcish.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\msefisudvkrcish.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\msefisudvkrcish.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\msefisudvkrcish.txt
C:\Documents and Settings\NetworkService\Application Data\msefisudvkrcish.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\msefisudvkrcish.txt
C:\Documents and Settings\NetworkService\msefisudvkrcish.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\msefisudvkrcish.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\msefisudvkrcish.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\msefisudvkrcish.txt
%APPDATA%\Identities\msefisudvkrcish.txt
%APPDATA%\msefisudvkrcish.txt
%HOMEPATH%\msefisudvkrcish.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\msefisudvkrcish.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\msefisudvkrcish.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\msefisudvkrcish.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\msefisudvkrcish.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\msefisudvkrcish.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\msefisudvkrcish.txt
C:\Documents and Settings\NetworkService\Local Settings\Temp\msefisudvkrcish.txt
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\msefisudvkrcish.txt
C:\Documents and Settings\NetworkService\Local Settings\History\msefisudvkrcish.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\msefisudvkrcish.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\msefisudvkrcish.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\MOE00UY1\msefisudvkrcish.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\CJCTQ25G\msefisudvkrcish.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\BGGTYMH1\msefisudvkrcish.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\msefisudvkrcish.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\msefisudvkrcish.txt
C:\Documents and Settings\LocalService\Application Data\msefisudvkrcish.txt
C:\Documents and Settings\LocalService\msefisudvkrcish.txt
C:\Documents and Settings\Default User\Templates\msefisudvkrcish.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\msefisudvkrcish.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\msefisudvkrcish.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\msefisudvkrcish.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\msefisudvkrcish.txt
C:\Documents and Settings\Default User\Start Menu\Programs\msefisudvkrcish.txt
C:\Documents and Settings\Default User\Start Menu\msefisudvkrcish.txt
C:\Documents and Settings\Default User\SendTo\msefisudvkrcish.txt
C:\Documents and Settings\Default User\Recent\msefisudvkrcish.txt
C:\Documents and Settings\Default User\PrintHood\msefisudvkrcish.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\msefisudvkrcish.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\msefisudvkrcish.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\msefisudvkrcish.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\msefisudvkrcish.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\msefisudvkrcish.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\msefisudvkrcish.txt
C:\Documents and Settings\LocalService\Local Settings\Temp\msefisudvkrcish.txt
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\msefisudvkrcish.txt
C:\Documents and Settings\LocalService\Local Settings\History\msefisudvkrcish.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\msefisudvkrcish.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\msefisudvkrcish.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\msefisudvkrcish.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\msefisudvkrcish.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\msefisudvkrcish.txt
C:\Documents and Settings\LocalService\Local Settings\msefisudvkrcish.txt
C:\Documents and Settings\LocalService\Cookies\msefisudvkrcish.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\msefisudvkrcish.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\msefisudvkrcish.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\msefisudvkrcish.txt
C:\Documents and Settings\Default User\NetHood\msefisudvkrcish.txt
C:\Far2\Plugins\WinSCP\packages\msefisudvkrcish.txt

Deletes the following files:

%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\4d8e6cbeb872f770c61b7aec1c4046da_23ef5514-3059-436f-a4a7-4cefaab20eb1

Moves the following files:

from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8-djau37oxhn28cra.db
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3-djau37oxhn28cra.db
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod-djau37oxhn28cra.db

Modifies user data files (Trojan.Encoder).

Miscellaneous:

Executes the following:

'<SYSTEM32>\cmd.exe' /C net view
'<SYSTEM32>\net.exe' view

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial