Trojan.Encoder.32979

Technical Information

To ensure autorun and distribution

Creates the following files on removable media

<Drive name for removable media>:\3605wu4p0-readme.txt

Malicious functions

Terminates or attempts to terminate

the following user processes:

firefox.exe

Reads files which store third party applications passwords

%HOMEPATH%\desktop\archer.avi
%HOMEPATH%\desktop\coffee.bmp
%HOMEPATH%\desktop\dashborder_120.bmp
%HOMEPATH%\desktop\default.bmp
%HOMEPATH%\desktop\fi51.doc
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx
%HOMEPATH%\desktop\holycrosschurchinstructions.docx
%HOMEPATH%\desktop\join.avi
%HOMEPATH%\desktop\ovp25012015.doc
%HOMEPATH%\desktop\testee.cer
%HOMEPATH%\desktop\tileimage.bmp

Modifies file system

Creates the following files

%TEMP%\nsc696d.tmp\system.dll
%HOMEPATH%\contacts\3605wu4p0-readme.txt
C:\users\public\videos\3605wu4p0-readme.txt
C:\users\public\recorded tv\3605wu4p0-readme.txt
C:\users\public\pictures\3605wu4p0-readme.txt
C:\users\public\music\3605wu4p0-readme.txt
C:\users\public\libraries\3605wu4p0-readme.txt
C:\users\public\favorites\3605wu4p0-readme.txt
C:\users\public\downloads\3605wu4p0-readme.txt
C:\users\public\documents\3605wu4p0-readme.txt
C:\users\default\videos\3605wu4p0-readme.txt
%HOMEPATH%\documents\3605wu4p0-readme.txt
C:\users\default\saved games\3605wu4p0-readme.txt
C:\users\default\pictures\3605wu4p0-readme.txt
C:\users\default\music\3605wu4p0-readme.txt
C:\users\default\links\3605wu4p0-readme.txt
C:\users\default\favorites\3605wu4p0-readme.txt
C:\users\default\downloads\3605wu4p0-readme.txt
C:\users\default\documents\3605wu4p0-readme.txt
C:\users\default\desktop\3605wu4p0-readme.txt
C:\users\public\desktop\3605wu4p0-readme.txt
C:\far2\plugins\compare\3605wu4p0-readme.txt
%HOMEPATH%\downloads\3605wu4p0-readme.txt
%HOMEPATH%\favorites\msn websites\3605wu4p0-readme.txt
%HOMEPATH%\favorites\microsoft websites\3605wu4p0-readme.txt
%HOMEPATH%\favorites\links for united states\3605wu4p0-readme.txt
%HOMEPATH%\favorites\links\3605wu4p0-readme.txt
C:\users\public\videos\sample videos\3605wu4p0-readme.txt
C:\users\public\recorded tv\sample media\3605wu4p0-readme.txt
C:\users\public\pictures\sample pictures\3605wu4p0-readme.txt
C:\users\public\music\sample music\3605wu4p0-readme.txt
%ProgramFiles%\microsoft sql server compact edition\v3.5\desktop\3605wu4p0-readme.txt
%ProgramFiles%\microsoft sql server compact edition\v3.5\3605wu4p0-readme.txt
%HOMEPATH%\desktop\3605wu4p0-readme.txt
C:\far2\addons\colors\default_highlighting\3605wu4p0-readme.txt
C:\far2\addons\colors\custom_highlighting\3605wu4p0-readme.txt
%HOMEPATH%\voip\3605wu4p0-readme.txt
%HOMEPATH%\videos\3605wu4p0-readme.txt
%HOMEPATH%\searches\3605wu4p0-readme.txt
%HOMEPATH%\saved games\3605wu4p0-readme.txt
%HOMEPATH%\pictures\3605wu4p0-readme.txt
%HOMEPATH%\music\3605wu4p0-readme.txt
%HOMEPATH%\links\3605wu4p0-readme.txt
C:\far2\addons\xlat\russian\3605wu4p0-readme.txt
%HOMEPATH%\favorites\3605wu4p0-readme.txt
C:\far2\pluginsdk\headers.pas\3605wu4p0-readme.txt
C:\far2\pluginsdk\headers.c\3605wu4p0-readme.txt
C:\far2\plugins\tmppanel\3605wu4p0-readme.txt
C:\far2\addons\3605wu4p0-readme.txt
C:\users\default\3605wu4p0-readme.txt
C:\totalcmd\language\3605wu4p0-readme.txt
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\3605wu4p0-readme.txt
%ProgramFiles%\microsoft sql server compact edition\3605wu4p0-readme.txt
C:\far2\pluginsdk\3605wu4p0-readme.txt
C:\far2\plugins\3605wu4p0-readme.txt
C:\far2\fexcept\3605wu4p0-readme.txt
C:\far2\encyclopedia\3605wu4p0-readme.txt
%HOMEPATH%\favorites\windows live\3605wu4p0-readme.txt
%HOMEPATH%\3605wu4p0-readme.txt
<Current directory>\3605wu4p0-readme.txt
C:\users\3605wu4p0-readme.txt
C:\totalcmd\3605wu4p0-readme.txt
C:\recovery\3605wu4p0-readme.txt
%ProgramFiles(x86)%\3605wu4p0-readme.txt
%ProgramFiles%\3605wu4p0-readme.txt
C:\far2\3605wu4p0-readme.txt
C:\3605wu4p0-readme.txt
%APPDATA%\140158967
C:\far2\documentation\3605wu4p0-readme.txt
C:\far2\plugins\ftp\lib\3605wu4p0-readme.txt
C:\far2\addons\colors\3605wu4p0-readme.txt
C:\far2\addons\shell\3605wu4p0-readme.txt
C:\far2\addons\macros\3605wu4p0-readme.txt
C:\far2\plugins\proclist\3605wu4p0-readme.txt
C:\far2\plugins\network\3605wu4p0-readme.txt
C:\far2\plugins\macroview\3605wu4p0-readme.txt
C:\far2\plugins\hlfviewer\3605wu4p0-readme.txt
C:\far2\plugins\ftp\3605wu4p0-readme.txt
C:\far2\plugins\filecase\3605wu4p0-readme.txt
C:\far2\plugins\farcmds\3605wu4p0-readme.txt
C:\far2\plugins\emenu\3605wu4p0-readme.txt
C:\far2\addons\setup\3605wu4p0-readme.txt
C:\far2\plugins\editcase\3605wu4p0-readme.txt
C:\users\public\3605wu4p0-readme.txt
C:\far2\plugins\brackets\3605wu4p0-readme.txt
C:\far2\plugins\autowrap\3605wu4p0-readme.txt
C:\far2\plugins\arclite\3605wu4p0-readme.txt
C:\far2\plugins\align\3605wu4p0-readme.txt
C:\far2\encyclopedia\tap\3605wu4p0-readme.txt
C:\far2\documentation\rus\3605wu4p0-readme.txt
C:\far2\documentation\eng\3605wu4p0-readme.txt
C:\far2\addons\xlat\3605wu4p0-readme.txt
C:\far2\plugins\drawline\3605wu4p0-readme.txt
D:\3605wu4p0-readme.txt