Trojan.Encoder.33057

Technical Information

To ensure autorun and distribution

Creates the following files on removable media

<Drive name for removable media>:\readme.txt
<Drive name for removable media>:\correct.avi
<Drive name for removable media>:\join.avi
<Drive name for removable media>:\split.avi
<Drive name for removable media>:\dialmap.bmp
<Drive name for removable media>:\default.bmp
<Drive name for removable media>:\toolbar.bmp
<Drive name for removable media>:\dashborder_96.bmp
<Drive name for removable media>:\dashborder_144.bmp
<Drive name for removable media>:\sdkfailsafeemulator.cer
<Drive name for removable media>:\testee.cer
<Drive name for removable media>:\contoso_1.cer
<Drive name for removable media>:\pmd.cer

Modifies file system

Creates the following files

C:\readme.txt
%ProgramFiles%\avgscan\readme.txt
%ProgramFiles%\avgrssvc\readme.txt
%ProgramFiles%\avgnpsvc\readme.txt
%ProgramFiles%\avgnpdln\readme.txt
D:\readme.txt
%ProgramFiles%\avginet\readme.txt
%ProgramFiles%\avgfwsrv\readme.txt
%ProgramFiles%\avgemc\readme.txt
%ProgramFiles%\avgdiag\readme.txt
%ProgramFiles%\avgcc\readme.txt
%ProgramFiles%\avgamsvr\readme.txt
%ProgramFiles%\avconsol\readme.txt
%ProgramFiles%\avgupden\readme.txt
%ProgramFiles%\avconfig\readme.txt
%ProgramFiles%\avciman\readme.txt
%ProgramFiles%\avcenter\readme.txt
%ProgramFiles%\avadmin\readme.txt
%ProgramFiles%\autotrace\readme.txt
%ProgramFiles%\autostartexplorer\readme.txt
%ProgramFiles%\autodown\readme.txt
%ProgramFiles%\aswupdsv\readme.txt
%ProgramFiles%\aswregsvr\readme.txt
%ProgramFiles%\ash_updatemediator\readme.txt
%ProgramFiles%\ashwebsv\readme.txt
%ProgramFiles%\ashupd\readme.txt
%ProgramFiles%\ashskpck\readme.txt
%ProgramFiles%\avcmd\readme.txt
%ProgramFiles%\bdagent\readme.txt
%ProgramFiles%\btinint\readme.txt
%ProgramFiles%\avgw\readme.txt
%ProgramFiles%\btini\readme.txt
%ProgramFiles%\blindman\readme.txt
%ProgramFiles%\blackice\readme.txt
%ProgramFiles%\blackd\readme.txt
%ProgramFiles%\bdwizreg\readme.txt
%ProgramFiles%\bdswitch\readme.txt
%ProgramFiles%\bdsurvey\readme.txt
%ProgramFiles%\bdsubmitwiz\readme.txt
%ProgramFiles%\bdsubmit\readme.txt
%ProgramFiles%\bdss\readme.txt
%ProgramFiles%\bdoesrv\readme.txt
%ProgramFiles%\bdnews\readme.txt
%ProgramFiles%\ashskpcc\readme.txt
%ProgramFiles%\bdmcon\readme.txt
%ProgramFiles%\backweb-4476822\readme.txt
%ProgramFiles%\b2\readme.txt
%ProgramFiles%\avsynmgr\readme.txt
%ProgramFiles%\avscan\readme.txt
%ProgramFiles%\avpm\readme.txt
%ProgramFiles%\avpcc\readme.txt
%ProgramFiles%\avnotify\readme.txt
%ProgramFiles%\avkwctl\readme.txt
%ProgramFiles%\avkservice\readme.txt
%ProgramFiles%\avkserv\readme.txt
%ProgramFiles%\avinitnt\readme.txt
%ProgramFiles%\avgwizfw\readme.txt
%ProgramFiles%\avgupsvc\readme.txt
%ProgramFiles%\avgvv\readme.txt
%ProgramFiles%\ashsimpl\readme.txt
%ProgramFiles%\ackwin32\readme.txt
%ProgramFiles%\a2wizard\readme.txt
%ProgramFiles%\a2upd\readme.txt
%ProgramFiles%\a2start\readme.txt
%ProgramFiles%\a2service\readme.txt
%ProgramFiles%\a2scan\readme.txt
%ProgramFiles%\a2hijackfree\readme.txt
%ProgramFiles%\a2guard\readme.txt
%ProgramFiles%\a2cmd\readme.txt
%ProgramFiles%\360tray\readme.txt
C:\perflogs\admin\readme.txt
C:\msocache\all users\readme.txt
C:\far2\pluginsdk\readme.txt
%ProgramFiles%\aavshield\readme.txt
C:\far2\plugins\readme.txt
C:\far2\encyclopedia\readme.txt
C:\far2\documentation\readme.txt
C:\users\readme.txt
<Current directory>\readme.txt
C:\totalcmd\readme.txt
C:\recovery\readme.txt
%ALLUSERSPROFILE%\readme.txt
%ProgramFiles(x86)%\readme.txt
%ProgramFiles%\readme.txt
C:\perflogs\readme.txt
C:\msocache\readme.txt
C:\far2\readme.txt
C:\far2\fexcept\readme.txt
%ProgramFiles%\aoltbserver\readme.txt
%ProgramFiles%\ashserv\readme.txt
%ProgramFiles%\admunch\readme.txt
%ProgramFiles%\ashquick\readme.txt
%ProgramFiles%\ashpopwz\readme.txt
%ProgramFiles%\ashmaisv\readme.txt
%ProgramFiles%\ashlogv\readme.txt
%ProgramFiles%\ashenhcd\readme.txt
%ProgramFiles%\ashdug\readme.txt
%ProgramFiles%\ashdisp\readme.txt
%ProgramFiles%\ashchest\readme.txt
%ProgramFiles%\ashavsrv\readme.txt
%ProgramFiles%\ashavast\readme.txt
%ProgramFiles%\ash\readme.txt
%ProgramFiles%\armorsurf\readme.txt
%ProgramFiles%\ashsimp2\readme.txt
%ProgramFiles%\armor2net\readme.txt
%ProgramFiles%\antivirus\readme.txt
%ProgramFiles%\anti-trojan\readme.txt
%ProgramFiles%\amsn\readme.txt
%ProgramFiles%\amon\readme.txt
%ProgramFiles%\alsvc\readme.txt
%ProgramFiles%\almon\readme.txt
%ProgramFiles%\airdefense\readme.txt
%ProgramFiles%\aimpro\readme.txt
%ProgramFiles%\aim6\readme.txt
%ProgramFiles%\ahnsd\readme.txt
%ProgramFiles%\ageofconan\readme.txt
%ProgramFiles%\agb5\readme.txt
%ProgramFiles%\about\readme.txt
%ProgramFiles%\cabalmain\readme.txt

Moves the following files

from %ProgramFiles%\desktop.ini to %ProgramFiles%\desktop.ini.cecjf
from %ProgramFiles(x86)%\desktop.ini to %ProgramFiles(x86)%\desktop.ini.cecjf

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Network activity

Connects to

'<LOCALNET>.42.0':445
'<LOCALNET>.42.161':445
'<LOCALNET>.42.162':445
'<LOCALNET>.42.163':445
'<LOCALNET>.42.164':445
'<LOCALNET>.42.165':445
'<LOCALNET>.42.166':445
'<LOCALNET>.42.167':445
'<LOCALNET>.42.168':445
'<LOCALNET>.42.169':445
'<LOCALNET>.42.170':445
'<LOCALNET>.42.171':445
'<LOCALNET>.42.172':445
'<LOCALNET>.42.173':445
'<LOCALNET>.42.175':445
'<LOCALNET>.42.189':445
'<LOCALNET>.42.176':445
'<LOCALNET>.42.177':445
'<LOCALNET>.42.178':445
'<LOCALNET>.42.179':445
'<LOCALNET>.42.180':445
'<LOCALNET>.42.181':445
'<LOCALNET>.42.182':445
'<LOCALNET>.42.183':445
'<LOCALNET>.42.184':445
'<LOCALNET>.42.185':445
'<LOCALNET>.42.186':445
'<LOCALNET>.42.187':445
'<LOCALNET>.42.188':445
'<LOCALNET>.42.160':445
'<LOCALNET>.42.174':445
'<LOCALNET>.42.159':445
'<LOCALNET>.42.142':445
'<LOCALNET>.42.129':445
'<LOCALNET>.42.130':445
'<LOCALNET>.42.131':445
'<LOCALNET>.42.132':445
'<LOCALNET>.42.133':445
'<LOCALNET>.42.134':445
'<LOCALNET>.42.135':445
'<LOCALNET>.42.136':445
'<LOCALNET>.42.137':445
'<LOCALNET>.42.138':445
'<LOCALNET>.42.139':445
'<LOCALNET>.42.140':445
'<LOCALNET>.42.141':445
'<LOCALNET>.42.143':445
'<LOCALNET>.42.157':445
'<LOCALNET>.42.144':445
'<LOCALNET>.42.145':445
'<LOCALNET>.42.146':445
'<LOCALNET>.42.147':445
'<LOCALNET>.42.148':445
'<LOCALNET>.42.149':445
'<LOCALNET>.42.150':445
'<LOCALNET>.42.151':445
'<LOCALNET>.42.152':445
'<LOCALNET>.42.153':445
'<LOCALNET>.42.154':445
'<LOCALNET>.42.155':445
'<LOCALNET>.42.156':445
'<LOCALNET>.42.158':445
'<LOCALNET>.42.207':445
'<LOCALNET>.42.253':445
'<LOCALNET>.42.192':445
'<LOCALNET>.42.225':445
'<LOCALNET>.42.226':445
'<LOCALNET>.42.227':445
'<LOCALNET>.42.228':445
'<LOCALNET>.42.229':445
'<LOCALNET>.42.230':445
'<LOCALNET>.42.231':445
'<LOCALNET>.42.232':445
'<LOCALNET>.42.233':445
'<LOCALNET>.42.234':445
'<LOCALNET>.42.235':445
'<LOCALNET>.42.236':445
'<LOCALNET>.42.237':445
'<LOCALNET>.42.239':445
'<LOCALNET>.42.191':445
'<LOCALNET>.42.240':445
'<LOCALNET>.42.241':445
'<LOCALNET>.42.242':445
'<LOCALNET>.42.243':445
'<LOCALNET>.42.244':445
'<LOCALNET>.42.245':445
'<LOCALNET>.42.246':445
'<LOCALNET>.42.247':445
'<LOCALNET>.42.248':445
'<LOCALNET>.42.249':445
'<LOCALNET>.42.250':445
'<LOCALNET>.42.251':445
'<LOCALNET>.42.252':445
'<LOCALNET>.42.224':445
'<LOCALNET>.42.128':445
'<LOCALNET>.42.223':445
'<LOCALNET>.42.206':445
'<LOCALNET>.42.193':445
'<LOCALNET>.42.194':445
'<LOCALNET>.42.195':445
'<LOCALNET>.42.196':445
'<LOCALNET>.42.197':445
'<LOCALNET>.42.198':445
'<LOCALNET>.42.199':445
'<LOCALNET>.42.200':445
'<LOCALNET>.42.201':445
'<LOCALNET>.42.202':445
'<LOCALNET>.42.203':445
'<LOCALNET>.42.204':445
'<LOCALNET>.42.205':445
'<LOCALNET>.42.190':445
'<LOCALNET>.42.221':445
'<LOCALNET>.42.208':445
'<LOCALNET>.42.209':445
'<LOCALNET>.42.210':445
'<LOCALNET>.42.211':445
'<LOCALNET>.42.212':445
'<LOCALNET>.42.213':445
'<LOCALNET>.42.214':445
'<LOCALNET>.42.215':445
'<LOCALNET>.42.216':445
'<LOCALNET>.42.217':445
'<LOCALNET>.42.218':445
'<LOCALNET>.42.219':445
'<LOCALNET>.42.220':445
'<LOCALNET>.42.222':445
'<LOCALNET>.42.238':445
'<LOCALNET>.42.127':445
'<LOCALNET>.42.110':445
'<LOCALNET>.42.33':445
'<LOCALNET>.42.34':445
'<LOCALNET>.42.35':445
'<LOCALNET>.42.36':445
'<LOCALNET>.42.37':445
'<LOCALNET>.42.38':445
'<LOCALNET>.42.39':445
'<LOCALNET>.42.40':445
'<LOCALNET>.42.41':445
'<LOCALNET>.42.42':445
'<LOCALNET>.42.43':445
'<LOCALNET>.42.44':445
'<LOCALNET>.42.45':445
'<LOCALNET>.42.47':445
'<LOCALNET>.42.61':445
'<LOCALNET>.42.48':445
'<LOCALNET>.42.49':445
'<LOCALNET>.42.50':445
'<LOCALNET>.42.51':445
'<LOCALNET>.42.52':445
'<LOCALNET>.42.53':445
'<LOCALNET>.42.54':445
'<LOCALNET>.42.55':445
'<LOCALNET>.42.56':445
'<LOCALNET>.42.57':445
'<LOCALNET>.42.58':445
'<LOCALNET>.42.59':445
'<LOCALNET>.42.60':445
'<LOCALNET>.42.32':445
'<LOCALNET>.42.46':445
'<LOCALNET>.42.31':445
'<LOCALNET>.42.14':445
'<LOCALNET>.42.1':445
'<LOCALNET>.42.2':445
'<LOCALNET>.42.3':445
'<LOCALNET>.42.4':445
'<LOCALNET>.42.5':445
'<LOCALNET>.42.6':445
'<LOCALNET>.42.7':445
'<LOCALNET>.42.8':445
'<LOCALNET>.42.9':445
'<LOCALNET>.42.10':445
'<LOCALNET>.42.11':445
'<LOCALNET>.42.12':445
'<LOCALNET>.42.13':445
'<LOCALNET>.42.15':445
'<LOCALNET>.42.29':445
'<LOCALNET>.42.16':445
'<LOCALNET>.42.17':445
'<LOCALNET>.42.18':445
'<LOCALNET>.42.19':445
'<LOCALNET>.42.20':445
'<LOCALNET>.42.21':445
'<LOCALNET>.42.22':445
'<LOCALNET>.42.23':445
'<LOCALNET>.42.24':445
'<LOCALNET>.42.25':445
'<LOCALNET>.42.26':445
'<LOCALNET>.42.27':445
'<LOCALNET>.42.28':445
'<LOCALNET>.42.30':445
'<LOCALNET>.42.79':445
'<LOCALNET>.42.125':445
'<LOCALNET>.42.64':445
'<LOCALNET>.42.97':445
'<LOCALNET>.42.98':445
'<LOCALNET>.42.99':445
'<LOCALNET>.42.100':445
'<LOCALNET>.42.101':445
'<LOCALNET>.42.102':445
'<LOCALNET>.42.103':445
'<LOCALNET>.42.104':445
'<LOCALNET>.42.105':445
'<LOCALNET>.42.106':445
'<LOCALNET>.42.107':445
'<LOCALNET>.42.108':445
'<LOCALNET>.42.109':445
'<LOCALNET>.42.111':445
'<LOCALNET>.42.63':445
'<LOCALNET>.42.112':445
'<LOCALNET>.42.113':445
'<LOCALNET>.42.114':445
'<LOCALNET>.42.115':445
'<LOCALNET>.42.116':445
'<LOCALNET>.42.117':445
'<LOCALNET>.42.118':445
'<LOCALNET>.42.119':445
'<LOCALNET>.42.120':445
'<LOCALNET>.42.121':445
'<LOCALNET>.42.122':445
'<LOCALNET>.42.123':445
'<LOCALNET>.42.124':445
'<LOCALNET>.42.96':445
'<LOCALNET>.42.126':445
'<LOCALNET>.42.95':445
'<LOCALNET>.42.78':445
'<LOCALNET>.42.65':445
'<LOCALNET>.42.66':445
'<LOCALNET>.42.67':445
'<LOCALNET>.42.68':445
'<LOCALNET>.42.69':445
'<LOCALNET>.42.70':445
'<LOCALNET>.42.71':445
'<LOCALNET>.42.72':445
'<LOCALNET>.42.73':445
'<LOCALNET>.42.74':445
'<LOCALNET>.42.75':445
'<LOCALNET>.42.76':445
'<LOCALNET>.42.77':445
'<LOCALNET>.42.62':445
'<LOCALNET>.42.93':445
'<LOCALNET>.42.80':445
'<LOCALNET>.42.81':445
'<LOCALNET>.42.82':445
'<LOCALNET>.42.83':445
'<LOCALNET>.42.84':445
'<LOCALNET>.42.85':445
'<LOCALNET>.42.86':445
'<LOCALNET>.42.87':445
'<LOCALNET>.42.88':445
'<LOCALNET>.42.89':445
'<LOCALNET>.42.90':445
'<LOCALNET>.42.91':445
'<LOCALNET>.42.92':445
'<LOCALNET>.42.94':445
'<LOCALNET>.42.254':445

Miscellaneous

Executes the following

'<SYSTEM32>\vssvc.exe'
'<SYSTEM32>\svchost.exe' -k swprv

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial