Trojan.Encoder.5654

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%ALLUSERSPROFILE%\start menu\programs\startup\decrypt_your_files.html

Malicious functions

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Windows Task Manager (Taskmgr)

Modifies file system

Creates the following files

%TEMP%\windowsupdate.exe
C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\etuaii8e\decrypt_your_files.html
C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\ee7gwdg8\decrypt_your_files.html
C:\documents and settings\networkservice\local settings\temp\decrypt_your_files.html
C:\documents and settings\networkservice\local settings\history\decrypt_your_files.html
C:\documents and settings\networkservice\local settings\history\history.ie5\decrypt_your_files.html
C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\z9pmdpek\decrypt_your_files.html
C:\documents and settings\networkservice\local settings\application data\decrypt_your_files.html
C:\documents and settings\networkservice\local settings\application data\microsoft\windows\decrypt_your_files.html
C:\documents and settings\networkservice\local settings\application data\microsoft\credentials\decrypt_your_files.html
C:\documents and settings\networkservice\local settings\application data\microsoft\credentials\s-1-5-20\decrypt_your_files.html
C:\documents and settings\networkservice\cookies\decrypt_your_files.html
C:\documents and settings\networkservice\application data\decrypt_your_files.html
C:\documents and settings\networkservice\application data\microsoft\decrypt_your_files.html
C:\documents and settings\networkservice\local settings\application data\microsoft\decrypt_your_files.html
%APPDATA%\adobe\acrobat\9.0\javascripts\decrypt_your_files.html
C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\decrypt_your_files.html
%APPDATA%\adobe\acrobat\10.0\decrypt_your_files.html
%APPDATA%\adobe\acrobat\10.0\security\decrypt_your_files.html
%APPDATA%\adobe\acrobat\10.0\security\crlcache\decrypt_your_files.html
%APPDATA%\adobe\acrobat\10.0\javascripts\decrypt_your_files.html
%APPDATA%\adobe\acrobat\10.0\forms\decrypt_your_files.html
%APPDATA%\adobe\acrobat\10.0\collab\decrypt_your_files.html
C:\documents and settings\networkservice\application data\microsoft\systemcertificates\decrypt_your_files.html
C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\h8mbgrq8\decrypt_your_files.html
%APPDATA%\.purple\certificates\decrypt_your_files.html
%APPDATA%\.purple\certificates\x509\decrypt_your_files.html
%APPDATA%\.purple\certificates\x509\tls_peers\decrypt_your_files.html
%HOMEPATH%\.oracle_jre_usage\decrypt_your_files.html
C:\documents and settings\networkservice\decrypt_your_files.html
C:\documents and settings\networkservice\local settings\decrypt_your_files.html
%APPDATA%\.purple\smileys\decrypt_your_files.html
C:\documents and settings\networkservice\local settings\<INETFILES>\decrypt_your_files.html
%APPDATA%\.purple\decrypt_your_files.html
%APPDATA%\adobe\acrobat\9.0\forms\decrypt_your_files.html
C:\documents and settings\networkservice\application data\microsoft\systemcertificates\my\crls\decrypt_your_files.html
C:\documents and settings\localservice\application data\microsoft\systemcertificates\my\certificates\decrypt_your_files.html
C:\documents and settings\localservice\application data\microsoft\systemcertificates\my\crls\decrypt_your_files.html
C:\documents and settings\localservice\application data\microsoft\systemcertificates\my\ctls\decrypt_your_files.html
C:\documents and settings\localservice\application data\microsoft\systemcertificates\my\decrypt_your_files.html
C:\documents and settings\localservice\application data\microsoft\systemcertificates\decrypt_your_files.html
C:\documents and settings\localservice\application data\microsoft\decrypt_your_files.html
C:\documents and settings\localservice\application data\decrypt_your_files.html
C:\documents and settings\localservice\cookies\decrypt_your_files.html
C:\documents and settings\localservice\local settings\application data\microsoft\credentials\s-1-5-19\decrypt_your_files.html
C:\documents and settings\localservice\local settings\application data\microsoft\credentials\decrypt_your_files.html
C:\documents and settings\localservice\local settings\application data\microsoft\windows\decrypt_your_files.html
C:\documents and settings\localservice\local settings\application data\microsoft\decrypt_your_files.html
C:\documents and settings\localservice\local settings\application data\decrypt_your_files.html
C:\documents and settings\localservice\local settings\history\history.ie5\decrypt_your_files.html
C:\documents and settings\localservice\local settings\history\decrypt_your_files.html
C:\documents and settings\networkservice\application data\microsoft\systemcertificates\my\certificates\decrypt_your_files.html
C:\documents and settings\localservice\local settings\<INETFILES>\decrypt_your_files.html
C:\documents and settings\localservice\local settings\decrypt_your_files.html
C:\documents and settings\networkservice\application data\microsoft\media player\decrypt_your_files.html
C:\documents and settings\networkservice\application data\microsoft\internet explorer\decrypt_your_files.html
C:\documents and settings\networkservice\application data\microsoft\credentials\decrypt_your_files.html
C:\documents and settings\networkservice\application data\microsoft\credentials\s-1-5-20\decrypt_your_files.html
C:\documents and settings\localservice\decrypt_your_files.html
C:\documents and settings\networkservice\application data\microsoft\systemcertificates\my\decrypt_your_files.html
C:\documents and settings\networkservice\application data\microsoft\systemcertificates\my\ctls\decrypt_your_files.html
C:\documents and settings\localservice\application data\microsoft\internet explorer\decrypt_your_files.html
C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\qiszf4kx\decrypt_your_files.html
C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\o4q6sqop\decrypt_your_files.html
C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\mqraz07n\decrypt_your_files.html
C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\9stcdn6y\decrypt_your_files.html
C:\documents and settings\localservice\local settings\temp\decrypt_your_files.html
C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\decrypt_your_files.html
%ALLUSERSPROFILE%\start menu\programs\winrar\decrypt_your_files.html
%APPDATA%\adobe\acrobat\9.0\decrypt_your_files.html
%APPDATA%\icqm\icq\html\en\loading\decrypt_your_files.html
%APPDATA%\icqm\icq\html\ru\decrypt_your_files.html
%APPDATA%\icqm\icq\html\ru\loading\decrypt_your_files.html
%APPDATA%\icqm\icq\html\ru\jabber\decrypt_your_files.html
%APPDATA%\icqm\icq\html\ru\error\decrypt_your_files.html
%APPDATA%\icqm\icq\html\pt\decrypt_your_files.html
%APPDATA%\icqm\icq\html\tr\jabber\decrypt_your_files.html
%APPDATA%\icqm\icq\html\pt\loading\decrypt_your_files.html
%APPDATA%\icqm\icq\html\pt\error\decrypt_your_files.html
%APPDATA%\icqm\icq\html\kz\decrypt_your_files.html
%APPDATA%\icqm\icq\html\kz\loading\decrypt_your_files.html
%APPDATA%\icqm\icq\html\kz\jabber\decrypt_your_files.html
%APPDATA%\icqm\icq\html\kz\error\decrypt_your_files.html
%APPDATA%\icqm\icq\html\en\decrypt_your_files.html
%APPDATA%\icqm\icq\html\pt\jabber\decrypt_your_files.html
%APPDATA%\adobe\acrobat\decrypt_your_files.html
%APPDATA%\icqm\icq\html\tr\loading\decrypt_your_files.html
%APPDATA%\icqm\icq\smiles\flash\decrypt_your_files.html
%APPDATA%\icqm\icq\skin_cache\decrypt_your_files.html
%APPDATA%\icqm\icq\skin\decrypt_your_files.html
%APPDATA%\icqm\icq\html\decrypt_your_files.html
%APPDATA%\icqm\icq\html\uz\decrypt_your_files.html
%APPDATA%\icqm\icq\html\en\jabber\decrypt_your_files.html
%APPDATA%\icqm\icq\html\uz\loading\decrypt_your_files.html
%APPDATA%\icqm\icq\html\tr\error\decrypt_your_files.html
%APPDATA%\icqm\icq\html\ua\decrypt_your_files.html
%APPDATA%\icqm\icq\html\ua\loading\decrypt_your_files.html
%APPDATA%\icqm\icq\html\ua\jabber\decrypt_your_files.html
%APPDATA%\icqm\icq\html\ua\error\decrypt_your_files.html
%APPDATA%\icqm\icq\html\tr\decrypt_your_files.html
%APPDATA%\icqm\icq\html\uz\jabber\decrypt_your_files.html
%APPDATA%\icqm\icq\html\en\error\decrypt_your_files.html
%APPDATA%\icqm\icq\smiles\smiles\8march\decrypt_your_files.html
%APPDATA%\icqm\icq\html\de\decrypt_your_files.html
%APPDATA%\icqm\icq\html\de\loading\decrypt_your_files.html
%APPDATA%\icq-profile\base\decrypt_your_files.html
C:\documents and settings\localservice\application data\microsoft\credentials\decrypt_your_files.html
%APPDATA%\adobe\linguistics\dictionaries\adobe custom dictionary\can\decrypt_your_files.html
%APPDATA%\adobe\flash player\assetcache\mc4yk349\decrypt_your_files.html
%APPDATA%\adobe\flash player\assetcache\decrypt_your_files.html
%APPDATA%\adobe\flash player\decrypt_your_files.html
%APPDATA%\adobe\headlights\decrypt_your_files.html
%APPDATA%\icq-profile\update\decrypt_your_files.html
%APPDATA%\adobe\linguistics\dictionaries\adobe custom dictionary\all\decrypt_your_files.html
%APPDATA%\adobe\linguistics\dictionaries\adobe custom dictionary\eng\decrypt_your_files.html
%APPDATA%\icq-profile\update\splash_banner\decrypt_your_files.html
%APPDATA%\adobe\linguistics\dictionaries\adobe custom dictionary\decrypt_your_files.html
%APPDATA%\adobe\linguistics\dictionaries\decrypt_your_files.html
%APPDATA%\adobe\linguistics\decrypt_your_files.html
%APPDATA%\adobe\logtransport2\decrypt_your_files.html
%APPDATA%\adobe\linguistics\dictionaries\adobe custom dictionary\brt\decrypt_your_files.html
C:\documents and settings\localservice\application data\microsoft\media player\decrypt_your_files.html
%APPDATA%\icqm\icq\database\decrypt_your_files.html
%APPDATA%\icqm\icq\html\bg\loading\decrypt_your_files.html
%APPDATA%\icqm\icq\html\bg\decrypt_your_files.html
%APPDATA%\icqm\icq\html\de\error\decrypt_your_files.html
%APPDATA%\icqm\icq\html\cz\decrypt_your_files.html
%APPDATA%\icqm\icq\html\cz\loading\decrypt_your_files.html
%APPDATA%\icqm\icq\html\cz\jabber\decrypt_your_files.html
%APPDATA%\icqm\icq\html\cz\error\decrypt_your_files.html
%APPDATA%\icqm\icq\html\de\jabber\decrypt_your_files.html
%APPDATA%\icq-profile\decrypt_your_files.html
%APPDATA%\adobe\decrypt_your_files.html
%APPDATA%\icqm\icq\html\bg\error\decrypt_your_files.html
%APPDATA%\icqm\icq\graphics\decrypt_your_files.html
%APPDATA%\icqm\icq\graphics\phone\decrypt_your_files.html
%APPDATA%\icqm\icq\fonts\decrypt_your_files.html
%APPDATA%\icqm\icq\dll\decrypt_your_files.html
%APPDATA%\icqm\icq\html\bg\jabber\decrypt_your_files.html
C:\documents and settings\localservice\application data\microsoft\credentials\s-1-5-19\decrypt_your_files.html
C:\documents and settings\default user\decrypt_your_files.html
C:\documents and settings\default user\templates\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\microsoft\network\connections\cm\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\microsoft\network\connections\pbk\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\microsoft\network\connections\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\microsoft\network\downloader\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\microsoft\network\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\microsoft\office\data\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\microsoft\office\groove\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\microsoft\office\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\microsoft\user account pictures\default pictures\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\microsoft\user account pictures\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\microsoft\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\microsoft help\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\oracle\java\installcache\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\oracle\java\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\oracle\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\sun\java\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\vcruntimeadditional_x86\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\sun\java\java update\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\package cache\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\package cache\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\microsoft\msdn\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\2052\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\packages\vcruntimeminimum_x86\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\package cache\{615bc16d-60f5-482e-91b3-b51d8130963b}\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\package cache\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\package cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\packages\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\3082\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1050\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1031\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\adobe\setup\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\adobe\acrobat\10.0\replicate\security\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\adobe\acrobat\10.0\replicate\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\adobe\acrobat\10.0\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\adobe\acrobat\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\adobe\arm\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\sun\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\adobe\setup\{ac76ba86-7ad7-1033-7b44-aa1000000001}\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\microsoft\crypto\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\adobe\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\microsoft\crypto\dss\machinekeys\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\microsoft\crypto\dss\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\microsoft\crypto\rsa\machinekeys\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\microsoft\crypto\rsa\s-1-5-18\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\adobe\updater6\decrypt_your_files.html
%APPDATA%\icqm\icq\smiles\smiles\animated\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\microsoft\dbgclr\7.1\1033\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\microsoft\html help\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\microsoft\dbgclr\7.1\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1049\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1046\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1042\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1041\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1040\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\microsoft\dbgclr\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1036\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\microsoft\crypto\rsa\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1028\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\microsoft\msdaipp\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\microsoft\msdaipp\offline\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\microsoft\media player\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\microsoft\media index\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1033\decrypt_your_files.html
%APPDATA%\icqm\icq\html\uz\error\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\decrypt_your_files.html
%ALLUSERSPROFILE%\start menu\programs\accessories\entertainment\decrypt_your_files.html
C:\documents and settings\default user\local settings\history\decrypt_your_files.html
C:\documents and settings\default user\local settings\history\history.ie5\decrypt_your_files.html
C:\documents and settings\default user\local settings\application data\decrypt_your_files.html
C:\documents and settings\default user\local settings\application data\microsoft\decrypt_your_files.html
C:\documents and settings\default user\local settings\<INETFILES>\content.ie5\etuaii8e\decrypt_your_files.html
C:\documents and settings\default user\local settings\application data\microsoft\windows media\decrypt_your_files.html
C:\documents and settings\default user\local settings\application data\microsoft\media player\decrypt_your_files.html
C:\documents and settings\default user\favorites\decrypt_your_files.html
C:\documents and settings\default user\desktop\decrypt_your_files.html
C:\documents and settings\default user\cookies\decrypt_your_files.html
C:\documents and settings\default user\application data\decrypt_your_files.html
C:\documents and settings\default user\application data\microsoft\decrypt_your_files.html
C:\documents and settings\default user\local settings\application data\microsoft\windows media\9.0\decrypt_your_files.html
%ALLUSERSPROFILE%\application data\microsoft\msdn\8.0\decrypt_your_files.html
C:\documents and settings\default user\local settings\<INETFILES>\content.ie5\h8mbgrq8\decrypt_your_files.html
C:\documents and settings\default user\start menu\decrypt_your_files.html
C:\documents and settings\default user\recent\decrypt_your_files.html
C:\documents and settings\default user\sendto\decrypt_your_files.html
C:\documents and settings\default user\start menu\programs\decrypt_your_files.html
C:\documents and settings\default user\start menu\programs\startup\decrypt_your_files.html
C:\documents and settings\default user\start menu\programs\accessories\decrypt_your_files.html
C:\documents and settings\default user\start menu\programs\accessories\entertainment\decrypt_your_files.html
C:\documents and settings\default user\start menu\programs\accessories\accessibility\decrypt_your_files.html
C:\documents and settings\default user\local settings\temp\decrypt_your_files.html
C:\documents and settings\default user\application data\microsoft\systemcertificates\decrypt_your_files.html
C:\documents and settings\default user\local settings\<INETFILES>\content.ie5\z9pmdpek\decrypt_your_files.html
C:\documents and settings\default user\nethood\decrypt_your_files.html
C:\documents and settings\default user\my documents\decrypt_your_files.html
C:\documents and settings\default user\local settings\decrypt_your_files.html
C:\documents and settings\default user\local settings\<INETFILES>\decrypt_your_files.html
C:\documents and settings\default user\local settings\<INETFILES>\content.ie5\decrypt_your_files.html
C:\documents and settings\default user\printhood\decrypt_your_files.html
C:\documents and settings\default user\local settings\<INETFILES>\content.ie5\ee7gwdg8\decrypt_your_files.html
C:\documents and settings\default user\application data\microsoft\systemcertificates\my\decrypt_your_files.html
C:\documents and settings\default user\application data\microsoft\systemcertificates\my\ctls\decrypt_your_files.html
%ALLUSERSPROFILE%\desktop\decrypt_your_files.html
%ALLUSERSPROFILE%\documents\my videos\decrypt_your_files.html
%ALLUSERSPROFILE%\documents\my music\sample music\decrypt_your_files.html
%ALLUSERSPROFILE%\documents\my music\sample playlists\00107ff6\decrypt_your_files.html
%ALLUSERSPROFILE%\documents\my music\sample playlists\decrypt_your_files.html
%ALLUSERSPROFILE%\documents\my music\decrypt_your_files.html
%ALLUSERSPROFILE%\start menu\programs\administrative tools\decrypt_your_files.html
%ALLUSERSPROFILE%\documents\my pictures\sample pictures\decrypt_your_files.html
%ALLUSERSPROFILE%\documents\decrypt_your_files.html
%ALLUSERSPROFILE%\start menu\programs\accessories\decrypt_your_files.html
%ALLUSERSPROFILE%\drm\decrypt_your_files.html
%ALLUSERSPROFILE%\favorites\decrypt_your_files.html
%ALLUSERSPROFILE%\start menu\programs\accessories\accessibility\decrypt_your_files.html
%ALLUSERSPROFILE%\start menu\programs\accessories\communications\decrypt_your_files.html
%ALLUSERSPROFILE%\documents\my pictures\decrypt_your_files.html
%ALLUSERSPROFILE%\documents\my music\my playlists\decrypt_your_files.html
%ALLUSERSPROFILE%\start menu\programs\google chrome\decrypt_your_files.html
%ALLUSERSPROFILE%\start menu\programs\microsoft office\microsoft office tools\decrypt_your_files.html
C:\documents and settings\default user\application data\microsoft\systemcertificates\my\crls\decrypt_your_files.html
%ALLUSERSPROFILE%\start menu\programs\games\decrypt_your_files.html
C:\documents and settings\default user\application data\microsoft\systemcertificates\my\certificates\decrypt_your_files.html
C:\documents and settings\default user\application data\microsoft\media player\decrypt_your_files.html
C:\documents and settings\default user\application data\microsoft\internet explorer\decrypt_your_files.html
%ALLUSERSPROFILE%\decrypt_your_files.html
%ALLUSERSPROFILE%\start menu\programs\microsoft .net framework sdk v1.1\decrypt_your_files.html
%ALLUSERSPROFILE%\templates\decrypt_your_files.html
%ALLUSERSPROFILE%\start menu\programs\decrypt_your_files.html
%ALLUSERSPROFILE%\start menu\programs\accessories\system tools\decrypt_your_files.html
%ALLUSERSPROFILE%\start menu\programs\steam\decrypt_your_files.html
%ALLUSERSPROFILE%\start menu\programs\qip 2012\decrypt_your_files.html
%ALLUSERSPROFILE%\start menu\programs\mirc\decrypt_your_files.html
%ALLUSERSPROFILE%\start menu\programs\microsoft office\decrypt_your_files.html
%ALLUSERSPROFILE%\start menu\decrypt_your_files.html
%APPDATA%\icqm\icq\smiles\smiles\cat\decrypt_your_files.html

Moves the following files

from %APPDATA%\.purple\prefs.xml to %APPDATA%\.purple\prefs.xml.fantom
from %APPDATA%\icqm\icq\smiles\smiles\8march\doll.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\doll.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\8march\drink.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\drink.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\8march\flowers.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\flowers.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\8march\hug.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\hug.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\8march\joy.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\joy.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\8march\love.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\love.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\8march\new_dress.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\new_dress.gif.fantom
from %APPDATA%\icqm\icq\smiles\flash\sobaka_strelyaet.swf to %APPDATA%\icqm\icq\smiles\flash\sobaka_strelyaet.swf.fantom
from %APPDATA%\icqm\icq\smiles\smiles\8march\perfume.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\perfume.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\8march\ring.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\ring.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\8march\shoes.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\shoes.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\8march\sunburn.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\sunburn.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\animated\angel.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\angel.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\animated\appl.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\appl.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\8march\cookie.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\cookie.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\8march\cat.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\cat.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\8march\car.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\car.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\s008.gif to %APPDATA%\icqm\icq\smiles\smiles\s008.gif.fantom
from %APPDATA%\icqm\icq\smiles\flash\zadolbal.swf to %APPDATA%\icqm\icq\smiles\flash\zadolbal.swf.fantom
from %APPDATA%\icqm\icq\smiles\flash\wf_love_srazila.swf to %APPDATA%\icqm\icq\smiles\flash\wf_love_srazila.swf.fantom
from %APPDATA%\icqm\icq\smiles\flash\wf_love_sdaus.swf to %APPDATA%\icqm\icq\smiles\flash\wf_love_sdaus.swf.fantom
from %APPDATA%\icqm\icq\smiles\flash\tank.swf to %APPDATA%\icqm\icq\smiles\flash\tank.swf.fantom
from %APPDATA%\icqm\icq\smiles\flash\sorry.swf to %APPDATA%\icqm\icq\smiles\flash\sorry.swf.fantom
from %APPDATA%\icqm\icq\smiles\smiles\8march\mad.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\mad.gif.fantom
from %APPDATA%\icqm\icq\smiles\flash\sobaka.swf to %APPDATA%\icqm\icq\smiles\flash\sobaka.swf.fantom
from %APPDATA%\icqm\icq\smiles\flash\smeh.swf to %APPDATA%\icqm\icq\smiles\flash\smeh.swf.fantom
from %APPDATA%\icqm\icq\smiles\flash\skratch.swf to %APPDATA%\icqm\icq\smiles\flash\skratch.swf.fantom
from %APPDATA%\icqm\icq\smiles\flash\serdze.swf to %APPDATA%\icqm\icq\smiles\flash\serdze.swf.fantom
from %APPDATA%\icqm\icq\smiles\flash\rosy.swf to %APPDATA%\icqm\icq\smiles\flash\rosy.swf.fantom
from %APPDATA%\icqm\icq\smiles\flash\rabotaet.swf to %APPDATA%\icqm\icq\smiles\flash\rabotaet.swf.fantom
from %APPDATA%\icqm\icq\smiles\flash\missyou.swf to %APPDATA%\icqm\icq\smiles\flash\missyou.swf.fantom
from %APPDATA%\icqm\icq\smiles\smiles\animated\beauty.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\beauty.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\animated\flowr.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\flowr.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_mouse.gif to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_mouse.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\animated\book.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\book.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\animated\rainbow.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\rainbow.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\animated\red.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\red.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\animated\sad.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\sad.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\animated\sing.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\sing.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\animated\skuka.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\skuka.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\animated\sleep.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\sleep.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\animated\tongue.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\tongue.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\animated\beer.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\beer.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\animated\victory.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\victory.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\animated\wonder.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\wonder.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_attack.gif to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_attack.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_hand.gif to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_hand.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_lick.gif to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_lick.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_meow.gif to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_meow.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\animated\poison.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\poison.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\animated\pistolet.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\pistolet.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\animated\love.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\love.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\animated\kiss.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\kiss.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\animated\hungry.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\hungry.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\animated\history.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\history.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\animated\gift.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\gift.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\animated\gg2.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\gg2.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\animated\gg.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\gg.gif.fantom
from %APPDATA%\icqm\icq\smiles\flash\mad dog.swf to %APPDATA%\icqm\icq\smiles\flash\mad dog.swf.fantom
from %APPDATA%\icqm\icq\smiles\smiles\animated\fingal.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\fingal.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\animated\fight.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\fight.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\animated\eat.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\eat.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\animated\devil.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\devil.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\animated\dance.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\dance.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\animated\cry.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\cry.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\animated\could.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\could.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\animated\blew.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\blew.gif.fantom
from %APPDATA%\icqm\icq\smiles\smiles\animated\smile.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\smile.gif.fantom
from %APPDATA%\icqm\icq\smiles\flash\love_bear_rose.swf to %APPDATA%\icqm\icq\smiles\flash\love_bear_rose.swf.fantom
from %APPDATA%\icqm\icq\smiles\flash\kot_goodbye.swf to %APPDATA%\icqm\icq\smiles\flash\kot_goodbye.swf.fantom
from %APPDATA%\icqm\icq\html\en\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\en\loading\progress_agent.gif.fantom
from %APPDATA%\icqm\icq\html\kz\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\kz\loading\progress_agent.gif.fantom
from %APPDATA%\icqm\icq\html\pt\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\pt\loading\progress_agent.gif.fantom
from %APPDATA%\icqm\icq\html\ru\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\ru\loading\progress_agent.gif.fantom
from %APPDATA%\icqm\icq\html\tr\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\tr\loading\progress_agent.gif.fantom
from %APPDATA%\icqm\icq\html\ua\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\ua\loading\progress_agent.gif.fantom
from %APPDATA%\icqm\icq\smiles\mrasmileslang_bg.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_bg.xml.fantom
from %APPDATA%\icq-profile\installerlang.xml to %APPDATA%\icq-profile\installerlang.xml.fantom
from %APPDATA%\icqm\icq\smiles\mrasmileslang_cz.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_cz.xml.fantom
from %APPDATA%\icqm\icq\smiles\mrasmileslang_de.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_de.xml.fantom
from %APPDATA%\icqm\icq\smiles\mrasmileslang_en.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_en.xml.fantom
from %APPDATA%\icqm\icq\smiles\mrasmileslang_kz.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_kz.xml.fantom
from %APPDATA%\icqm\icq\smiles\mrasmileslang_pt.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_pt.xml.fantom
from %APPDATA%\icqm\icq\smiles\mrasmileslang_ru.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_ru.xml.fantom
from %APPDATA%\icqm\icq\html\de\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\de\loading\progress_agent.gif.fantom
from %APPDATA%\icqm\icq\html\cz\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\cz\loading\progress_agent.gif.fantom
from %APPDATA%\icqm\icq\html\bg\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\bg\loading\progress_agent.gif.fantom
from %APPDATA%\icqm\icq\database\citylist_uz.csv to %APPDATA%\icqm\icq\database\citylist_uz.csv.fantom
from %APPDATA%\icqm\icq\database\citylist_ua.csv to %APPDATA%\icqm\icq\database\citylist_ua.csv.fantom
from %APPDATA%\icqm\icq\database\citylist_tr.csv to %APPDATA%\icqm\icq\database\citylist_tr.csv.fantom
from %APPDATA%\icqm\icq\database\citylist_ru.csv to %APPDATA%\icqm\icq\database\citylist_ru.csv.fantom
from %APPDATA%\icqm\icq\database\citylist_kz.csv to %APPDATA%\icqm\icq\database\citylist_kz.csv.fantom
from %APPDATA%\icqm\icq\database\citylist_en.csv to %APPDATA%\icqm\icq\database\citylist_en.csv.fantom
from %APPDATA%\icqm\icq\html\uz\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\uz\loading\progress_agent.gif.fantom
from %APPDATA%\adobe\acrobat\9.0\javascripts\glob.settings.js to %APPDATA%\adobe\acrobat\9.0\javascripts\glob.settings.js.fantom
from %APPDATA%\adobe\acrobat\9.0\javascripts\glob.js to %APPDATA%\adobe\acrobat\9.0\javascripts\glob.js.fantom
from %APPDATA%\adobe\acrobat\10.0\javascripts\glob.settings.js to %APPDATA%\adobe\acrobat\10.0\javascripts\glob.settings.js.fantom
from %APPDATA%\adobe\acrobat\10.0\javascripts\glob.js to %APPDATA%\adobe\acrobat\10.0\javascripts\glob.js.fantom
from %APPDATA%\adobe\acrobat\10.0\tmgrpprm.sav to %APPDATA%\adobe\acrobat\10.0\tmgrpprm.sav.fantom
from %APPDATA%\adobe\acrobat\10.0\tmdocs.sav to %APPDATA%\adobe\acrobat\10.0\tmdocs.sav.fantom
from %APPDATA%\.purple\status.xml to %APPDATA%\.purple\status.xml.fantom
from %APPDATA%\icqm\icq\smiles\mrasmileslang_tr.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_tr.xml.fantom
from %APPDATA%\icqm\icq\smiles\flash\canthearu.swf to %APPDATA%\icqm\icq\smiles\flash\canthearu.swf.fantom
from %APPDATA%\icqm\icq\smiles\flash\love_bear_hugs.swf to %APPDATA%\icqm\icq\smiles\flash\love_bear_hugs.swf.fantom
from %APPDATA%\icqm\icq\smiles\skin.txt to %APPDATA%\icqm\icq\smiles\skin.txt.fantom
from %APPDATA%\icqm\icq\smiles\flash\gangsta.swf to %APPDATA%\icqm\icq\smiles\flash\gangsta.swf.fantom
from %APPDATA%\icqm\icq\smiles\flash\guby.swf to %APPDATA%\icqm\icq\smiles\flash\guby.swf.fantom
from %APPDATA%\icqm\icq\smiles\flash\information.swf to %APPDATA%\icqm\icq\smiles\flash\information.swf.fantom
from %APPDATA%\icqm\icq\smiles\flash\joy.swf to %APPDATA%\icqm\icq\smiles\flash\joy.swf.fantom
from %APPDATA%\icqm\icq\smiles\flash\kisses.swf to %APPDATA%\icqm\icq\smiles\flash\kisses.swf.fantom
from %APPDATA%\icqm\icq\smiles\flash\kot_cool.swf to %APPDATA%\icqm\icq\smiles\flash\kot_cool.swf.fantom
from %APPDATA%\icqm\icq\smiles\flash\kot_nedutza.swf to %APPDATA%\icqm\icq\smiles\flash\kot_nedutza.swf.fantom
from %APPDATA%\icqm\icq\smiles\mrasmileslang_ua.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_ua.xml.fantom
from %APPDATA%\icqm\icq\smiles\flash\kot_obida.swf to %APPDATA%\icqm\icq\smiles\flash\kot_obida.swf.fantom
from %APPDATA%\icqm\icq\smiles\flash\kot_spasibo.swf to %APPDATA%\icqm\icq\smiles\flash\kot_spasibo.swf.fantom
from %APPDATA%\icqm\icq\smiles\flash\kot_wow.swf to %APPDATA%\icqm\icq\smiles\flash\kot_wow.swf.fantom
from %APPDATA%\icqm\icq\smiles\flash\krizis.swf to %APPDATA%\icqm\icq\smiles\flash\krizis.swf.fantom
from %APPDATA%\icqm\icq\smiles\flash\laugh.swf to %APPDATA%\icqm\icq\smiles\flash\laugh.swf.fantom
from %APPDATA%\icqm\icq\smiles\flash\likeu.swf to %APPDATA%\icqm\icq\smiles\flash\likeu.swf.fantom
from %APPDATA%\icqm\icq\smiles\flash\duh.swf to %APPDATA%\icqm\icq\smiles\flash\duh.swf.fantom
from %APPDATA%\icqm\icq\smiles\flash\drako_zombie.swf to %APPDATA%\icqm\icq\smiles\flash\drako_zombie.swf.fantom
from %APPDATA%\icqm\icq\smiles\flash\drako_snegyrka.swf to %APPDATA%\icqm\icq\smiles\flash\drako_snegyrka.swf.fantom
from %APPDATA%\icqm\icq\smiles\flash\drako_opyatnica.swf to %APPDATA%\icqm\icq\smiles\flash\drako_opyatnica.swf.fantom
from %APPDATA%\icqm\icq\smiles\flash\drako_love.swf to %APPDATA%\icqm\icq\smiles\flash\drako_love.swf.fantom
from %APPDATA%\icqm\icq\smiles\flash\drako_koster.swf to %APPDATA%\icqm\icq\smiles\flash\drako_koster.swf.fantom
from %APPDATA%\icqm\icq\smiles\flash\drako_bolnoy.swf to %APPDATA%\icqm\icq\smiles\flash\drako_bolnoy.swf.fantom
from %APPDATA%\icqm\icq\smiles\flash\devochka.swf to %APPDATA%\icqm\icq\smiles\flash\devochka.swf.fantom
from %APPDATA%\icqm\icq\smiles\flash\chillout.swf to %APPDATA%\icqm\icq\smiles\flash\chillout.swf.fantom
from %APPDATA%\icqm\icq\smiles\flash\love_bear_kiss.swf to %APPDATA%\icqm\icq\smiles\flash\love_bear_kiss.swf.fantom
from %APPDATA%\icqm\icq\smiles\flash\boo.swf to %APPDATA%\icqm\icq\smiles\flash\boo.swf.fantom
from %APPDATA%\icqm\icq\smiles\flash\bodun.swf to %APPDATA%\icqm\icq\smiles\flash\bodun.swf.fantom
from %APPDATA%\icqm\icq\smiles\flash\beer.swf to %APPDATA%\icqm\icq\smiles\flash\beer.swf.fantom
from %APPDATA%\icqm\icq\smiles\flash\beback.swf to %APPDATA%\icqm\icq\smiles\flash\beback.swf.fantom
from %APPDATA%\icqm\icq\smiles\flash\bad_cold.swf to %APPDATA%\icqm\icq\smiles\flash\bad_cold.swf.fantom
from %APPDATA%\icqm\icq\smiles\flash\angel.swf to %APPDATA%\icqm\icq\smiles\flash\angel.swf.fantom
from %APPDATA%\icqm\icq\smiles\flash\akitaka.swf to %APPDATA%\icqm\icq\smiles\flash\akitaka.swf.fantom
from %APPDATA%\icqm\icq\smiles\mrasmileslang_uz.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_uz.xml.fantom
from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_paper.gif to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_paper.gif.fantom

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Network activity

TCP

HTTP GET requests

http://po#####olsforyou.com/themes/prestashop/cache/stats.php

UDP

DNS ASK po#####olsforyou.com

Miscellaneous

Creates and executes the following

'%TEMP%\windowsupdate.exe'

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial