Trojan.Encoder.35845

Technical Information

To ensure autorun and distribution

Creates the following files on removable media

<Drive name for removable media>:\readme

Malicious functions

To complicate detection of its presence in the operating system,

deletes volume shadow copies.

Terminates or attempts to terminate

the following user processes:

firefox.exe

Modifies file system

Creates the following files

C:\readme
C:\users\public\videos\sample videos\readme
C:\users\public\recorded tv\sample media\readme
C:\users\public\recorded tv\readme
C:\users\public\pictures\sample pictures\readme
C:\users\public\documents\my pictures\readme
C:\users\public\documents\my videos\readme
C:\users\public\music\sample music\readme
C:\users\public\libraries\readme
C:\users\public\favorites\readme
C:\users\public\downloads\readme
C:\users\public\documents\my music\readme
C:\users\public\desktop\readme
%HOMEPATH%\application data\readme
C:\users\public\readme
C:\users\default\templates\readme
C:\users\default\start menu\readme
C:\users\default\sendto\readme
C:\users\default\saved games\readme
C:\users\default\recent\readme
C:\users\default\printhood\readme
C:\users\default\nethood\readme
C:\users\default\local settings\readme
C:\users\default\links\readme
C:\users\public\documents\readme
C:\perflogs\readme
%HOMEPATH%\contacts\readme
%HOMEPATH%\templates\readme
D:\readme
%HOMEPATH%\voip\readme
%HOMEPATH%\sendto\readme
%HOMEPATH%\start menu\readme
%HOMEPATH%\saved games\readme
%HOMEPATH%\searches\readme
%HOMEPATH%\recent\readme
%HOMEPATH%\printhood\readme
%HOMEPATH%\local settings\readme
%HOMEPATH%\nethood\readme
C:\users\default\favorites\readme
%HOMEPATH%\readme
%HOMEPATH%\favorites\msn websites\readme
%HOMEPATH%\favorites\microsoft websites\readme
%HOMEPATH%\favorites\links for united states\readme
%HOMEPATH%\favorites\links\readme
%HOMEPATH%\favorites\readme
%HOMEPATH%\downloads\readme
%HOMEPATH%\documents\my videos\readme
%HOMEPATH%\documents\my pictures\readme
%HOMEPATH%\documents\my music\readme
%HOMEPATH%\documents\readme
%HOMEPATH%\desktop\readme
%HOMEPATH%\favorites\windows live\readme
%HOMEPATH%\cookies\readme
C:\users\default\downloads\readme
C:\users\default\documents\my videos\readme
C:\users\default\documents\my pictures\readme
C:\far2\documentation\readme
C:\far2\plugins\compare\readme
C:\far2\plugins\brackets\readme
C:\far2\plugins\autowrap\readme
C:\far2\plugins\align\readme
C:\far2\plugins\arclite\readme
C:\far2\plugins\readme
C:\far2\fexcept\readme
C:\far2\encyclopedia\tap\readme
C:\far2\encyclopedia\readme
C:\far2\documentation\rus\readme
m:\readme
C:\far2\plugins\editcase\readme
C:\far2\addons\xlat\russian\readme
C:\far2\addons\xlat\readme
C:\far2\addons\shell\readme
C:\far2\addons\setup\readme
C:\far2\addons\macros\readme
C:\far2\addons\colors\default_highlighting\readme
C:\far2\addons\colors\custom_highlighting\readme
C:\far2\addons\colors\readme
C:\far2\addons\readme
C:\far2\readme
C:\documents and settings\readme
C:\far2\documentation\eng\readme
%HOMEPATH%\links\readme
C:\far2\plugins\emenu\readme
C:\far2\plugins\ftp\readme
C:\far2\plugins\farcmds\readme
C:\users\default\documents\my music\readme
C:\users\default\documents\readme
C:\users\default\desktop\readme
C:\users\default\cookies\readme
C:\users\default\application data\readme
C:\users\default\readme
C:\recovery\readme
C:\totalcmd\readme
C:\totalcmd\language\readme
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\readme
C:\far2\plugins\filecase\readme
<Current directory>\readme
C:\far2\plugins\drawline\readme
C:\msocache\readme
C:\far2\pluginsdk\headers.pas\readme
C:\far2\plugins\tmppanel\readme
C:\far2\pluginsdk\headers.c\readme
C:\far2\pluginsdk\readme
C:\far2\plugins\proclist\readme
C:\far2\plugins\network\readme
C:\far2\plugins\macroview\readme
C:\far2\plugins\hlfviewer\readme
C:\far2\plugins\ftp\lib\readme
C:\perflogs\admin\readme
m:\xeldz.dfijqsdfbadf

Modifies the following files

C:\far2\fareng.hlf.dfijqsdfbadf
C:\far2\addons\colors\custom_highlighting\farcolors242.reg.dfijqsdfbadf
C:\far2\addons\colors\custom_highlighting\import_colors.bat.dfijqsdfbadf
C:\far2\addons\colors\custom_highlighting\descript.ion.dfijqsdfbadf
C:\far2\addons\colors\custom_highlighting\colors_from_gernichenko.reg.dfijqsdfbadf
C:\far2\addons\colors\custom_highlighting\colors_from_admin_essp_ru.reg.dfijqsdfbadf
C:\far2\addons\colors\custom_highlighting\colors_from_sadovoj.reg.dfijqsdfbadf
C:\far2\restoresettings.cmd.dfijqsdfbadf
C:\far2\addons\colors\custom_highlighting\black_from_july.reg.dfijqsdfbadf
C:\far2\addons\colors\custom_highlighting\black_from_myodov.reg.dfijqsdfbadf
C:\far2\file_id.diz.dfijqsdfbadf
C:\far2\addons\readme.txt.dfijqsdfbadf
C:\far2\addons\colors\custom_highlighting\black_from_fonarev.reg.dfijqsdfbadf
C:\far2\addons\descript.ion.dfijqsdfbadf
C:\far2\savesettings.cmd.dfijqsdfbadf
C:\far2\farcze.lng.dfijqsdfbadf
C:\far2\farpol.lng.dfijqsdfbadf
C:\far2\farhun.lng.dfijqsdfbadf
C:\far2\farrus.hlf.dfijqsdfbadf
C:\far2\farspa.lng.dfijqsdfbadf
C:\far2\farrus.lng.dfijqsdfbadf
C:\far2\farhun.hlf.dfijqsdfbadf
C:\far2\changelog_eng.dfijqsdfbadf
C:\far2\changelog.dfijqsdfbadf
C:\far2\farger.lng.dfijqsdfbadf
C:\far2\clearpluginscache.cmd.dfijqsdfbadf
C:\far2\fareng.lng.dfijqsdfbadf
C:\far2\far.map.dfijqsdfbadf
C:\far2\addons\colors\custom_highlighting\hell.reg.dfijqsdfbadf
C:\far2\addons\colors\descript.ion.dfijqsdfbadf