Trojan.Encoder.3963

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '12_23-dst' = '%WINDIR%\mpytytenhnro.exe'

Creates or modifies the following files:

%ALLUSERSPROFILE%\Start Menu\Programs\Startup\Recovery+jissg.html
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\Recovery+jissg.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\Recovery+jissg.png

Malicious functions:

Creates and executes the following:

'%WINDIR%\mpytytenhnro.exe'

Executes the following:

'<SYSTEM32>\cmd.exe' /c DEL <Full path to virus>

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\cmd.exe

the following user processes:

ecmd.exe

Modifies file system:

Creates the following files:

C:\Documents and Settings\Default User\Start Menu\Programs\Startup\Recovery+jissg.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\Recovery+jissg.html
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Recovery+jissg.html
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\Recovery+jissg.png
C:\Documents and Settings\Default User\Start Menu\Programs\Recovery+jissg.html
C:\Documents and Settings\Default User\Start Menu\Recovery+jissg.png
C:\Documents and Settings\Default User\Start Menu\Programs\Recovery+jissg.png
C:\Documents and Settings\Default User\Start Menu\Programs\Recovery+jissg.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\Recovery+jissg.html
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\Recovery+jissg.png
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\Recovery+jissg.png
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\Recovery+jissg.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Recovery+jissg.png
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Recovery+jissg.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\Recovery+jissg.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\Recovery+jissg.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\Recovery+jissg.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\Recovery+jissg.png
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\Recovery+jissg.png
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\Recovery+jissg.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\Recovery+jissg.png
C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\Recovery+jissg.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\Recovery+jissg.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\Recovery+jissg.html
C:\Documents and Settings\Default User\Templates\Recovery+jissg.png
C:\Documents and Settings\Default User\Templates\Recovery+jissg.txt
C:\Documents and Settings\Default User\Start Menu\Recovery+jissg.txt
C:\Documents and Settings\Default User\Start Menu\Recovery+jissg.html
C:\Documents and Settings\Default User\Recovery+jissg.txt
C:\Documents and Settings\Default User\Recovery+jissg.html
C:\Documents and Settings\Default User\Templates\Recovery+jissg.html
C:\Documents and Settings\Default User\Recovery+jissg.png
C:\Documents and Settings\Default User\SendTo\Recovery+jissg.html
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\Recovery+jissg.txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\Recovery+jissg.html
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\Recovery+jissg.html
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\Recovery+jissg.png
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Recovery+jissg.html
C:\Documents and Settings\Default User\Local Settings\Recovery+jissg.png
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Recovery+jissg.png
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Recovery+jissg.txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\Recovery+jissg.html
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\Recovery+jissg.png
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\Recovery+jissg.png
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\Recovery+jissg.txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\Recovery+jissg.png
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\Recovery+jissg.txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\Recovery+jissg.txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\Recovery+jissg.html
C:\Documents and Settings\Default User\PrintHood\Recovery+jissg.html
C:\Documents and Settings\Default User\Recent\Recovery+jissg.png
C:\Documents and Settings\Default User\PrintHood\Recovery+jissg.png
C:\Documents and Settings\Default User\PrintHood\Recovery+jissg.txt
C:\Documents and Settings\Default User\SendTo\Recovery+jissg.png
C:\Documents and Settings\Default User\SendTo\Recovery+jissg.txt
C:\Documents and Settings\Default User\Recent\Recovery+jissg.txt
C:\Documents and Settings\Default User\Recent\Recovery+jissg.html
C:\Documents and Settings\Default User\My Documents\Recovery+jissg.png
C:\Documents and Settings\Default User\My Documents\Recovery+jissg.txt
C:\Documents and Settings\Default User\Local Settings\Recovery+jissg.txt
C:\Documents and Settings\Default User\Local Settings\Recovery+jissg.html
C:\Documents and Settings\Default User\NetHood\Recovery+jissg.txt
C:\Documents and Settings\Default User\NetHood\Recovery+jissg.html
C:\Documents and Settings\Default User\My Documents\Recovery+jissg.html
C:\Documents and Settings\Default User\NetHood\Recovery+jissg.png
C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\Recovery+jissg.html
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\Recovery+jissg.txt
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\Recovery+jissg.html
C:\Documents and Settings\LocalService\Local Settings\Application Data\Recovery+jissg.html
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\Recovery+jissg.png
C:\Documents and Settings\LocalService\Local Settings\History\Recovery+jissg.html
C:\Documents and Settings\LocalService\Local Settings\Temp\Recovery+jissg.png
C:\Documents and Settings\LocalService\Local Settings\History\Recovery+jissg.png
C:\Documents and Settings\LocalService\Local Settings\History\Recovery+jissg.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\Recovery+jissg.html
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Recovery+jissg.png
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\Recovery+jissg.png
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\Recovery+jissg.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Recovery+jissg.png
C:\Documents and Settings\LocalService\Local Settings\Application Data\Recovery+jissg.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Recovery+jissg.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Recovery+jissg.html
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\LBMMC3H3\Recovery+jissg.html
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\MOE00UY1\Recovery+jissg.png
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\LBMMC3H3\Recovery+jissg.png
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\LBMMC3H3\Recovery+jissg.txt
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Recovery+jissg.png
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Recovery+jissg.txt
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\MOE00UY1\Recovery+jissg.txt
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\MOE00UY1\Recovery+jissg.html
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\BGGTYMH1\Recovery+jissg.png
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\BGGTYMH1\Recovery+jissg.txt
C:\Documents and Settings\LocalService\Local Settings\Temp\Recovery+jissg.txt
C:\Documents and Settings\LocalService\Local Settings\Temp\Recovery+jissg.html
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\Recovery+jissg.txt
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\Recovery+jissg.html
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\BGGTYMH1\Recovery+jissg.html
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\Recovery+jissg.png
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\Recovery+jissg.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\Recovery+jissg.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\Recovery+jissg.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\Recovery+jissg.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\Recovery+jissg.png
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Recovery+jissg.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\Recovery+jissg.png
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Recovery+jissg.png
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Recovery+jissg.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\Recovery+jissg.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\Recovery+jissg.png
C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\Recovery+jissg.png
C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\Recovery+jissg.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\Recovery+jissg.png
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\Recovery+jissg.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\Recovery+jissg.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\Recovery+jissg.html
C:\Documents and Settings\LocalService\Cookies\Recovery+jissg.html
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\Recovery+jissg.png
C:\Documents and Settings\LocalService\Cookies\Recovery+jissg.png
C:\Documents and Settings\LocalService\Cookies\Recovery+jissg.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\Recovery+jissg.png
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\Recovery+jissg.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\Recovery+jissg.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\Recovery+jissg.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\Recovery+jissg.png
C:\Documents and Settings\LocalService\Application Data\Microsoft\Recovery+jissg.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\Recovery+jissg.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\Recovery+jissg.html
C:\Documents and Settings\LocalService\Application Data\Recovery+jissg.txt
C:\Documents and Settings\LocalService\Application Data\Recovery+jissg.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\Recovery+jissg.html
C:\Documents and Settings\LocalService\Application Data\Recovery+jissg.png
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\Recovery+jissg.html
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\Recovery+jissg.png
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\Recovery+jissg.png
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\Recovery+jissg.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\Recovery+jissg.png
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\Recovery+jissg.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\Recovery+jissg.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\Recovery+jissg.html
%ALLUSERSPROFILE%\Favorites\Recovery+jissg.png
%ALLUSERSPROFILE%\Favorites\Recovery+jissg.txt
%ALLUSERSPROFILE%\DRM\Recovery+jissg.txt
%ALLUSERSPROFILE%\DRM\Recovery+jissg.html
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\Recovery+jissg.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\Recovery+jissg.html
%ALLUSERSPROFILE%\Favorites\Recovery+jissg.html
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\Recovery+jissg.png
%ALLUSERSPROFILE%\Start Menu\Programs\Recovery+jissg.png
%ALLUSERSPROFILE%\Start Menu\Programs\Recovery+jissg.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Games\Recovery+jissg.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Games\Recovery+jissg.html
%ALLUSERSPROFILE%\Start Menu\Recovery+jissg.txt
%ALLUSERSPROFILE%\Start Menu\Recovery+jissg.html
%ALLUSERSPROFILE%\Start Menu\Programs\Recovery+jissg.html
%ALLUSERSPROFILE%\Start Menu\Recovery+jissg.png
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Recovery+jissg.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Recovery+jissg.html
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\Recovery+jissg.html
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Recovery+jissg.png
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\Recovery+jissg.html
%ALLUSERSPROFILE%\Start Menu\Programs\Games\Recovery+jissg.png
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\Recovery+jissg.png
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\Recovery+jissg.txt
%ALLUSERSPROFILE%\DRM\Recovery+jissg.png
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\Recovery+jissg.html
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\Recovery+jissg.png
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\Recovery+jissg.png
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\Recovery+jissg.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\Recovery+jissg.png
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\Recovery+jissg.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\Recovery+jissg.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\Recovery+jissg.html
<Current directory>\Recovery+jissg.png
<Current directory>\Recovery+jissg.txt
%WINDIR%\mpytytenhnro.exe
%HOMEPATH%\My Documents\recover_file_iigennsdq.txt
%ALLUSERSPROFILE%\Documents\My Music\My Playlists\Recovery+jissg.txt
%ALLUSERSPROFILE%\Documents\My Music\My Playlists\Recovery+jissg.html
<Current directory>\Recovery+jissg.html
%ALLUSERSPROFILE%\Documents\My Music\My Playlists\Recovery+jissg.png
%ALLUSERSPROFILE%\Documents\My Videos\Recovery+jissg.png
%ALLUSERSPROFILE%\Documents\My Videos\Recovery+jissg.txt
%ALLUSERSPROFILE%\Documents\My Pictures\Recovery+jissg.txt
%ALLUSERSPROFILE%\Documents\My Pictures\Recovery+jissg.html
%ALLUSERSPROFILE%\Documents\Recovery+jissg.txt
%ALLUSERSPROFILE%\Documents\Recovery+jissg.html
%ALLUSERSPROFILE%\Documents\My Videos\Recovery+jissg.html
%ALLUSERSPROFILE%\Documents\Recovery+jissg.png
%ALLUSERSPROFILE%\Documents\My Music\Recovery+jissg.txt
%ALLUSERSPROFILE%\Documents\My Music\Recovery+jissg.html
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\Recovery+jissg.html
%ALLUSERSPROFILE%\Documents\My Music\Recovery+jissg.png
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Recovery+jissg.html
%ALLUSERSPROFILE%\Documents\My Pictures\Recovery+jissg.png
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Recovery+jissg.png
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Recovery+jissg.txt
%ALLUSERSPROFILE%\Templates\Recovery+jissg.png
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\Recovery+jissg.html
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\Recovery+jissg.png
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\Recovery+jissg.png
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\Recovery+jissg.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Recovery+jissg.png
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Recovery+jissg.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\Recovery+jissg.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\Recovery+jissg.html
C:\Documents and Settings\Default User\Favorites\Recovery+jissg.png
C:\Documents and Settings\Default User\Favorites\Recovery+jissg.txt
C:\Documents and Settings\Default User\Cookies\Recovery+jissg.txt
C:\Documents and Settings\Default User\Cookies\Recovery+jissg.html
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\Recovery+jissg.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\Recovery+jissg.html
C:\Documents and Settings\Default User\Favorites\Recovery+jissg.html
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\Recovery+jissg.png
C:\Documents and Settings\Default User\Local Settings\Temp\Recovery+jissg.png
C:\Documents and Settings\Default User\Local Settings\Temp\Recovery+jissg.txt
C:\Documents and Settings\Default User\Local Settings\History\Recovery+jissg.txt
C:\Documents and Settings\Default User\Local Settings\History\Recovery+jissg.html
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\Recovery+jissg.txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\Recovery+jissg.html
C:\Documents and Settings\Default User\Local Settings\Temp\Recovery+jissg.html
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\Recovery+jissg.png
C:\Documents and Settings\Default User\Local Settings\Application Data\Recovery+jissg.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Recovery+jissg.html
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Recovery+jissg.html
C:\Documents and Settings\Default User\Local Settings\Application Data\Recovery+jissg.png
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\Recovery+jissg.html
C:\Documents and Settings\Default User\Local Settings\History\Recovery+jissg.png
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\Recovery+jissg.png
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\Recovery+jissg.txt
C:\Documents and Settings\Default User\Cookies\Recovery+jissg.png
C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\Recovery+jissg.html
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\Recovery+jissg.png
C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\Recovery+jissg.png
C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\Recovery+jissg.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\Recovery+jissg.png
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\Recovery+jissg.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\Recovery+jissg.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\Recovery+jissg.html
%ALLUSERSPROFILE%\Recovery+jissg.png
%ALLUSERSPROFILE%\Recovery+jissg.txt
%ALLUSERSPROFILE%\Templates\Recovery+jissg.txt
%ALLUSERSPROFILE%\Templates\Recovery+jissg.html
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\Recovery+jissg.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\Recovery+jissg.html
%ALLUSERSPROFILE%\Recovery+jissg.html
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\Recovery+jissg.png
C:\Documents and Settings\Default User\Application Data\Microsoft\Recovery+jissg.png
C:\Documents and Settings\Default User\Application Data\Microsoft\Recovery+jissg.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\Recovery+jissg.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\Recovery+jissg.html
C:\Documents and Settings\Default User\Application Data\Recovery+jissg.txt
C:\Documents and Settings\Default User\Application Data\Recovery+jissg.html
C:\Documents and Settings\Default User\Application Data\Microsoft\Recovery+jissg.html
C:\Documents and Settings\Default User\Application Data\Recovery+jissg.png
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\Recovery+jissg.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\Recovery+jissg.html
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\Recovery+jissg.html
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\Recovery+jissg.png
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Recovery+jissg.html
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\Recovery+jissg.png
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Recovery+jissg.png
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Recovery+jissg.txt

Sets the 'hidden' attribute to the following files:

%WINDIR%\mpytytenhnro.exe

Deletes itself.

Network activity:

Connects to:

'cs###dro.org':80
'fm#.org.in':80
'mh###usa.com':80
'de###stal.pl':80
'lo###ydress.pl':80
'ig#####elrenacer.com':80

TCP:

HTTP POST requests:

http://cs###dro.org/images/icons/mzsys.php
http://fm#.org.in/wp-content/uploads/mzsys.php
http://mh###usa.com/wp-content/upgrade/mzsys.ph
http://de###stal.pl/jscripts/jsgaleria/csys.php
http://lo###ydress.pl/wp-content/themes/sketch/csys.php
http://ig#####elrenacer.com/modules/mod_stats/csys.php

UDP:

DNS ASK cs###dro.org
DNS ASK fm#.org.in
DNS ASK mh###usa.com
DNS ASK de###stal.pl
DNS ASK lo###ydress.pl
DNS ASK ig#####elrenacer.com

Miscellaneous:

Searches for the following windows:

ClassName: 'Indicator' WindowName: ''

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial