La mia libreria
La mia libreria

+ Aggiungi alla libreria

Supporto
Supporto 24/7 | Regole per contattare

Richieste

Profile

Trojan.Encoder.31688

Aggiunto al database dei virus Dr.Web: 2020-04-29

La descrizione è stata aggiunta:

Technical Information

To ensure autorun and distribution
Modifies the following registry keys
  • [<HKLM>\Software\Classes\Shareware File\shell\open\command] '' = '%APPDATA%\System.exe "%l" '
Creates or modifies the following files
  • <SYSTEM32>\tasks\policyupdate
Modifies file system
Creates the following files
  • %APPDATA%\system.exe
  • %ProgramFiles(x86)%\steam\servers\serverbrowser_portuguese.txt.swr
  • %TEMP%\serverbrowser_portuguese.txt
  • %ProgramFiles(x86)%\steam\servers\serverbrowser_polish.txt.swr
  • %TEMP%\serverbrowser_polish.txt
  • %ProgramFiles(x86)%\steam\servers\serverbrowser_norwegian.txt.swr
  • %TEMP%\serverbrowser_norwegian.txt
  • %ProgramFiles(x86)%\steam\servers\serverbrowser_koreana.txt.swr
  • %TEMP%\serverbrowser_koreana.txt
  • %ProgramFiles(x86)%\steam\servers\serverbrowser_korean.txt.swr
  • %TEMP%\serverbrowser_korean.txt
  • %ProgramFiles(x86)%\steam\servers\serverbrowser_japanese.txt.swr
  • %ProgramFiles(x86)%\steam\servers\serverbrowser_italian.txt.swr
  • %ProgramFiles(x86)%\steam\servers\serverbrowser_romanian.txt.swr
  • %TEMP%\serverbrowser_italian.txt
  • %ProgramFiles(x86)%\steam\servers\serverbrowser_hungarian.txt.swr
  • %TEMP%\serverbrowser_hungarian.txt
  • %ProgramFiles(x86)%\steam\servers\serverbrowser_greek.txt.swr
  • %TEMP%\serverbrowser_greek.txt
  • %ProgramFiles(x86)%\steam\servers\serverbrowser_german.txt.swr
  • %TEMP%\serverbrowser_german.txt
  • %ProgramFiles(x86)%\steam\servers\serverbrowser_french.txt.swr
  • %TEMP%\serverbrowser_french.txt
  • %ProgramFiles(x86)%\steam\servers\serverbrowser_finnish.txt.swr
  • %TEMP%\serverbrowser_japanese.txt
  • %TEMP%\serverbrowser_english.txt
  • %TEMP%\serverbrowser_russian.txt
  • %ProgramFiles(x86)%\steam\resource\overlay_dutch.txt.swr
  • %TEMP%\overlay_dutch.txt
  • %ProgramFiles(x86)%\steam\resource\overlay_danish.txt.swr
  • %TEMP%\overlay_danish.txt
  • %ProgramFiles(x86)%\steam\resource\overlay_czech.txt.swr
  • %TEMP%\overlay_czech.txt
  • %ProgramFiles(x86)%\steam\resource\overlay_bulgarian.txt.swr
  • %TEMP%\overlay_bulgarian.txt
  • %ProgramFiles(x86)%\steam\resource\overlay_brazilian.txt.swr
  • %TEMP%\overlay_brazilian.txt
  • %ProgramFiles(x86)%\steam\servers\serverbrowser_ukrainian.txt.swr
  • %TEMP%\serverbrowser_finnish.txt
  • %TEMP%\serverbrowser_romanian.txt
  • %TEMP%\serverbrowser_turkish.txt
  • %ProgramFiles(x86)%\steam\servers\serverbrowser_thai.txt.swr
  • %TEMP%\serverbrowser_thai.txt
  • %ProgramFiles(x86)%\steam\servers\serverbrowser_tchinese.txt.swr
  • %TEMP%\serverbrowser_tchinese.txt
  • %ProgramFiles(x86)%\steam\servers\serverbrowser_swedish.txt.swr
  • %TEMP%\serverbrowser_swedish.txt
  • %ProgramFiles(x86)%\steam\servers\serverbrowser_spanish.txt.swr
  • %TEMP%\serverbrowser_spanish.txt
  • %ProgramFiles(x86)%\steam\servers\serverbrowser_schinese.txt.swr
  • %TEMP%\serverbrowser_schinese.txt
  • %ProgramFiles(x86)%\steam\servers\serverbrowser_turkish.txt.swr
  • %ProgramFiles(x86)%\steam\servers\serverbrowser_russian.txt.swr
  • %ProgramFiles(x86)%\steam\servers\serverbrowser_english.txt.swr
  • %ProgramFiles(x86)%\steam\servers\serverbrowser_dutch.txt.swr
  • %ProgramFiles(x86)%\steam\resource\overlay_english.txt.swr
  • %ProgramFiles(x86)%\steam\steam\cached\steamui_postlogon_japanese.txt.swr
  • %ProgramFiles(x86)%\steam\steam\cached\steamui_postlogon_portuguese.txt.swr
  • %TEMP%\steamui_postlogon_portuguese.txt
  • %ProgramFiles(x86)%\steam\steam\cached\steamui_postlogon_polish.txt.swr
  • %TEMP%\steamui_postlogon_polish.txt
  • %ProgramFiles(x86)%\steam\steam\cached\steamui_postlogon_norwegian.txt.swr
  • %TEMP%\steamui_postlogon_norwegian.txt
  • %ProgramFiles(x86)%\steam\steam\cached\steamui_postlogon_koreana.txt.swr
  • %TEMP%\steamui_postlogon_koreana.txt
  • %ProgramFiles(x86)%\steam\steam\cached\steamui_postlogon_korean.txt.swr
  • %TEMP%\steamui_postlogon_korean.txt
  • %TEMP%\steamui_postlogon_romanian.txt
  • %ProgramFiles(x86)%\steam\steam\cached\steamui_postlogon_romanian.txt.swr
  • %TEMP%\overlay_english.txt
  • %TEMP%\steamui_postlogon_italian.txt
  • %ProgramFiles(x86)%\steam\steam\cached\steamui_postlogon_hungarian.txt.swr
  • %TEMP%\steamui_postlogon_hungarian.txt
  • %ProgramFiles(x86)%\steam\steam\cached\steamui_postlogon_greek.txt.swr
  • %TEMP%\steamui_postlogon_greek.txt
  • %ProgramFiles(x86)%\steam\steam\cached\steamui_postlogon_german.txt.swr
  • %TEMP%\steamui_postlogon_german.txt
  • %ProgramFiles(x86)%\steam\steam\cached\steamui_postlogon_french.txt.swr
  • %TEMP%\steamui_postlogon_french.txt
  • %ProgramFiles(x86)%\steam\steam\cached\steamui_postlogon_finnish.txt.swr
  • %ProgramFiles(x86)%\steam\steam\cached\steamui_postlogon_italian.txt.swr
  • %TEMP%\serverbrowser_ukrainian.txt
  • %TEMP%\steamui_postlogon_russian.txt
  • %TEMP%\steamui_postlogon_ukrainian.txt
  • %ProgramFiles(x86)%\steam\steam\cached\steamui_postlogon_ukrainian.txt.swr
  • %ProgramFiles(x86)%\steam\servers\serverbrowser_danish.txt.swr
  • %TEMP%\serverbrowser_danish.txt
  • %ProgramFiles(x86)%\steam\servers\serverbrowser_czech.txt.swr
  • %TEMP%\serverbrowser_czech.txt
  • %ProgramFiles(x86)%\steam\servers\serverbrowser_bulgarian.txt.swr
  • %TEMP%\serverbrowser_bulgarian.txt
  • %ProgramFiles(x86)%\steam\servers\serverbrowser_brazilian.txt.swr
  • %TEMP%\serverbrowser_brazilian.txt
  • %ProgramFiles(x86)%\steam\skins\skins_readme.txt.swr
  • %TEMP%\skins_readme.txt
  • %TEMP%\serverbrowser_dutch.txt
  • %ProgramFiles(x86)%\steam\steam\cached\steamui_postlogon_russian.txt.swr
  • %TEMP%\steamui_postlogon_schinese.txt
  • %TEMP%\steamui_postlogon_turkish.txt
  • %ProgramFiles(x86)%\steam\steam\cached\steamui_postlogon_thai.txt.swr
  • %TEMP%\steamui_postlogon_thai.txt
  • %ProgramFiles(x86)%\steam\steam\cached\steamui_postlogon_tchinese.txt.swr
  • %TEMP%\steamui_postlogon_tchinese.txt
  • %ProgramFiles(x86)%\steam\steam\cached\steamui_postlogon_swedish.txt.swr
  • %TEMP%\steamui_postlogon_swedish.txt
  • %ProgramFiles(x86)%\steam\steam\cached\steamui_postlogon_spanish.txt.swr
  • %TEMP%\steamui_postlogon_spanish.txt
  • %ProgramFiles(x86)%\steam\steam\cached\steamui_postlogon_schinese.txt.swr
  • %ProgramFiles(x86)%\steam\steam\cached\steamui_postlogon_turkish.txt.swr
  • %ProgramFiles(x86)%\steam\tenfoot\resource\keyboards\layout_dutch_default.txt.swr
  • %TEMP%\overlay_finnish.txt
  • %ProgramFiles(x86)%\steam\resource\platform_russian.txt.swr
  • %TEMP%\platform_russian.txt
  • %ProgramFiles(x86)%\steam\resource\platform_romanian.txt.swr
  • %TEMP%\platform_romanian.txt
  • %ProgramFiles(x86)%\steam\resource\platform_portuguese.txt.swr
  • %TEMP%\platform_portuguese.txt
  • %ProgramFiles(x86)%\steam\resource\platform_polish.txt.swr
  • %TEMP%\platform_polish.txt
  • %ProgramFiles(x86)%\steam\resource\platform_norwegian.txt.swr
  • %TEMP%\platform_norwegian.txt
  • %ProgramFiles(x86)%\steam\resource\platform_koreana.txt.swr
  • %TEMP%\platform_schinese.txt
  • %TEMP%\platform_koreana.txt
  • %TEMP%\platform_korean.txt
  • %ProgramFiles(x86)%\steam\resource\platform_japanese.txt.swr
  • %TEMP%\platform_japanese.txt
  • %ProgramFiles(x86)%\steam\resource\platform_italian.txt.swr
  • %TEMP%\platform_italian.txt
  • %ProgramFiles(x86)%\steam\resource\platform_hungarian.txt.swr
  • %TEMP%\platform_hungarian.txt
  • %ProgramFiles(x86)%\steam\resource\platform_greek.txt.swr
  • %TEMP%\platform_greek.txt
  • %ProgramFiles(x86)%\steam\resource\platform_german.txt.swr
  • %TEMP%\platform_german.txt
  • %ProgramFiles(x86)%\steam\resource\platform_korean.txt.swr
  • %ProgramFiles(x86)%\steam\resource\platform_french.txt.swr
  • %TEMP%\steamui_postlogon_finnish.txt
  • %TEMP%\platform_french.txt
  • %ProgramFiles(x86)%\steam\resource\vgui_finnish.txt.swr
  • %TEMP%\vgui_finnish.txt
  • %ProgramFiles(x86)%\steam\resource\vgui_english.txt.swr
  • %TEMP%\vgui_english.txt
  • %ProgramFiles(x86)%\steam\resource\vgui_dutch.txt.swr
  • %TEMP%\vgui_dutch.txt
  • %ProgramFiles(x86)%\steam\resource\vgui_danish.txt.swr
  • %TEMP%\vgui_danish.txt
  • %ProgramFiles(x86)%\steam\resource\vgui_czech.txt.swr
  • %TEMP%\vgui_czech.txt
  • %ProgramFiles(x86)%\steam\resource\vgui_bulgarian.txt.swr
  • %TEMP%\platform_spanish.txt
  • %ProgramFiles(x86)%\steam\resource\platform_schinese.txt.swr
  • %TEMP%\vgui_brazilian.txt
  • %ProgramFiles(x86)%\steam\resource\platform_ukrainian.txt.swr
  • %TEMP%\platform_ukrainian.txt
  • %ProgramFiles(x86)%\steam\resource\platform_turkish.txt.swr
  • %TEMP%\platform_turkish.txt
  • %ProgramFiles(x86)%\steam\resource\platform_thai.txt.swr
  • %TEMP%\platform_thai.txt
  • %ProgramFiles(x86)%\steam\resource\platform_tchinese.txt.swr
  • %TEMP%\platform_tchinese.txt
  • %ProgramFiles(x86)%\steam\resource\platform_swedish.txt.swr
  • %TEMP%\platform_swedish.txt
  • %ProgramFiles(x86)%\steam\resource\vgui_brazilian.txt.swr
  • %ProgramFiles(x86)%\steam\resource\platform_spanish.txt.swr
  • %TEMP%\steamui_postlogon_japanese.txt
  • %TEMP%\platform_finnish.txt
  • %TEMP%\platform_brazilian.txt
  • %TEMP%\overlay_romanian.txt
  • %ProgramFiles(x86)%\steam\resource\overlay_portuguese.txt.swr
  • %TEMP%\overlay_portuguese.txt
  • %ProgramFiles(x86)%\steam\resource\overlay_polish.txt.swr
  • %TEMP%\overlay_polish.txt
  • %ProgramFiles(x86)%\steam\resource\overlay_norwegian.txt.swr
  • %TEMP%\overlay_norwegian.txt
  • %ProgramFiles(x86)%\steam\resource\overlay_koreana.txt.swr
  • %TEMP%\overlay_koreana.txt
  • %ProgramFiles(x86)%\steam\resource\overlay_korean.txt.swr
  • %TEMP%\overlay_russian.txt
  • %TEMP%\overlay_korean.txt
  • %TEMP%\overlay_japanese.txt
  • %ProgramFiles(x86)%\steam\resource\overlay_italian.txt.swr
  • %TEMP%\overlay_italian.txt
  • %ProgramFiles(x86)%\steam\resource\overlay_hungarian.txt.swr
  • %TEMP%\overlay_hungarian.txt
  • %ProgramFiles(x86)%\steam\resource\overlay_greek.txt.swr
  • %TEMP%\overlay_greek.txt
  • %ProgramFiles(x86)%\steam\resource\overlay_german.txt.swr
  • %TEMP%\overlay_german.txt
  • %ProgramFiles(x86)%\steam\resource\overlay_french.txt.swr
  • %TEMP%\overlay_french.txt
  • %ProgramFiles(x86)%\steam\resource\overlay_japanese.txt.swr
  • %ProgramFiles(x86)%\steam\resource\platform_finnish.txt.swr
  • %ProgramFiles(x86)%\steam\resource\overlay_finnish.txt.swr
  • %ProgramFiles(x86)%\steam\resource\overlay_romanian.txt.swr
  • %ProgramFiles(x86)%\steam\resource\platform_english.txt.swr
  • %TEMP%\platform_english.txt
  • %ProgramFiles(x86)%\steam\resource\platform_dutch.txt.swr
  • %TEMP%\platform_dutch.txt
  • %ProgramFiles(x86)%\steam\resource\platform_danish.txt.swr
  • %TEMP%\platform_danish.txt
  • %ProgramFiles(x86)%\steam\resource\platform_czech.txt.swr
  • %TEMP%\platform_czech.txt
  • %ProgramFiles(x86)%\steam\resource\platform_bulgarian.txt.swr
  • %TEMP%\platform_bulgarian.txt
  • %ProgramFiles(x86)%\steam\resource\platform_brazilian.txt.swr
  • %TEMP%\overlay_schinese.txt
  • %ProgramFiles(x86)%\steam\resource\overlay_russian.txt.swr
  • %TEMP%\overlay_ukrainian.txt
  • %ProgramFiles(x86)%\steam\resource\overlay_turkish.txt.swr
  • %TEMP%\overlay_turkish.txt
  • %ProgramFiles(x86)%\steam\resource\overlay_thai.txt.swr
  • %TEMP%\overlay_thai.txt
  • %ProgramFiles(x86)%\steam\resource\overlay_tchinese.txt.swr
  • %TEMP%\overlay_tchinese.txt
  • %ProgramFiles(x86)%\steam\resource\overlay_swedish.txt.swr
  • %TEMP%\overlay_swedish.txt
  • %ProgramFiles(x86)%\steam\resource\overlay_spanish.txt.swr
  • %TEMP%\overlay_spanish.txt
  • %ProgramFiles(x86)%\steam\resource\overlay_ukrainian.txt.swr
  • %ProgramFiles(x86)%\steam\resource\overlay_schinese.txt.swr
  • %ProgramFiles(x86)%\steam\steam\cached\steamui_postlogon_english.txt.swr
  • %TEMP%\steamui_postlogon_english.txt
  • %ProgramFiles(x86)%\steam\steam\cached\steamui_postlogon_dutch.txt.swr
  • %CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\languagenames2\displaylanguagenames.en_ca.txt.swr
  • %ProgramFiles(x86)%\k-lite codec pack\icaros\ffmpeg license.txt.swr
  • %TEMP%\ffmpeg license.txt
  • %CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\languagenames2\displaylanguagenames.en_us_posix.txt.swr
  • %TEMP%\displaylanguagenames.en_us_posix.txt
  • %CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\languagenames2\displaylanguagenames.en_us.txt.swr
  • %TEMP%\displaylanguagenames.en_us.txt
  • %CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\languagenames2\displaylanguagenames.en_gb_euro.txt.swr
  • %TEMP%\displaylanguagenames.en_gb_euro.txt
  • %CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\languagenames2\displaylanguagenames.en_gb.txt.swr
  • %TEMP%\displaylanguagenames.en_gb.txt
  • %TEMP%\ctryinfo.txt
  • %ProgramFiles(x86)%\k-lite codec pack\icaros\icaros license.txt.swr
  • %TEMP%\readme_en_gb.txt
  • %TEMP%\products.txt
  • %CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\abbreviations\en_us\list.txt.swr
  • %TEMP%\list.txt
  • %CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_ca\readme_th_en_ca_v2.txt.swr
  • %TEMP%\readme_th_en_ca_v2.txt
  • %CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_ca\readme_en_ca.txt.swr
  • %TEMP%\readme_en_ca.txt
  • %CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\wordnet_license.txt.swr
  • %TEMP%\wordnet_license.txt
  • %CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\readme_en_gb.txt.swr
  • %CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\adobe\products.txt.swr
  • %TEMP%\displaylanguagenames.en_ca.txt
  • %TEMP%\redist.txt
  • %TEMP%\tenfoot_danish.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\localization\tenfoot_danish.txt.swr
  • %ProgramFiles(x86)%\steam\tenfoot\resource\localization\tenfoot_german.txt.swr
  • %TEMP%\tenfoot_german.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\localization\tenfoot_french.txt.swr
  • %TEMP%\tenfoot_french.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\localization\tenfoot_finnish.txt.swr
  • %TEMP%\tenfoot_finnish.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\localization\tenfoot_english.txt.swr
  • %TEMP%\tenfoot_english.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\localization\tenfoot_dutch.txt.swr
  • %TEMP%\tenfoot_dutch.txt
  • %TEMP%\tenfoot_greek.txt
  • %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\redist.txt.swr
  • %TEMP%\versions.txt
  • %TEMP%\tenfoot_czech.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\localization\tenfoot_bulgarian.txt.swr
  • %TEMP%\tenfoot_bulgarian.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\localization\tenfoot_brazilian.txt.swr
  • %TEMP%\tenfoot_brazilian.txt
  • %ProgramFiles(x86)%\qip 2012\smilies\qip smilies\copyright.txt.swr
  • %TEMP%\copyright.txt
  • %ProgramFiles(x86)%\qip 2012\smilies\qip smilies\copyright(eng).txt.swr
  • %TEMP%\copyright(eng).txt
  • %ProgramFiles(x86)%\mirc\versions.txt.swr
  • %ProgramFiles(x86)%\steam\tenfoot\resource\localization\tenfoot_czech.txt.swr
  • %TEMP%\vgui_french.txt
  • %TEMP%\tenfoot_hungarian.txt
  • %CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\license.txt.swr
  • %TEMP%\cp1257.txt
  • %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\cyrillic.txt.swr
  • %TEMP%\cyrillic.txt
  • %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\croatian.txt.swr
  • %TEMP%\croatian.txt
  • %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\corpchar.txt.swr
  • %TEMP%\corpchar.txt
  • %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\centeuro.txt.swr
  • %TEMP%\centeuro.txt
  • %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1258.txt.swr
  • %TEMP%\cp1258.txt
  • %TEMP%\readme.txt
  • %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\greek.txt.swr
  • %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1254.txt.swr
  • %TEMP%\cp1254.txt
  • %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1253.txt.swr
  • %TEMP%\cp1253.txt
  • %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1252.txt.swr
  • %TEMP%\cp1252.txt
  • %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1251.txt.swr
  • %TEMP%\cp1251.txt
  • %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1250.txt.swr
  • %TEMP%\cp1250.txt
  • %APPDATA%\shareware.log
  • %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\win\cp1257.txt.swr
  • %CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\readme.txt.swr
  • %TEMP%\iceland.txt
  • %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\roman.txt.swr
  • %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\iceland.txt.swr
  • %TEMP%\license.txt
  • %CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\changelog.txt.swr
  • %TEMP%\changelog.txt
  • %CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_gb\affdescription.txt.swr
  • %TEMP%\affdescription.txt
  • %CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\dictionaries\en_us\readme_en_us.txt.swr
  • %TEMP%\readme_en_us.txt
  • %CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\supplementaldictionaries\en_us\excluded.txt.swr
  • %TEMP%\excluded.txt
  • %CommonProgramFiles(x86)%\adobe\reader\dc\linguistics\providers\plugins2\adobehunspellplugin\supplementaldictionaries\en_us\added.txt.swr
  • %TEMP%\roman.txt
  • %TEMP%\added.txt
  • %TEMP%\greek.txt
  • %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\adobe\zdingbat.txt.swr
  • %TEMP%\zdingbat.txt
  • %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\ukraine.txt.swr
  • %TEMP%\ukraine.txt
  • %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\turkish.txt.swr
  • %TEMP%\turkish.txt
  • %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\symbol.txt.swr
  • %TEMP%\symbol.txt
  • %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\typesupport\unicode\mappings\mac\romanian.txt.swr
  • %TEMP%\romanian.txt
  • %CommonProgramFiles(x86)%\microsoft shared\office10\ctryinfo.txt.swr
  • %TEMP%\vgui_bulgarian.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\localization\tenfoot_greek.txt.swr
  • %TEMP%\tenfoot_japanese.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\keyboards\layout_russian_default.txt.swr
  • %TEMP%\layout_russian_default.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\keyboards\layout_romanian_dualtouch.txt.swr
  • %TEMP%\layout_romanian_dualtouch.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\keyboards\layout_portuguese_dualtouch.txt.swr
  • %TEMP%\layout_portuguese_dualtouch.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\keyboards\layout_portuguese_default.txt.swr
  • %TEMP%\layout_portuguese_default.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\keyboards\layout_polish_dualtouch.txt.swr
  • %TEMP%\layout_polish_dualtouch.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\keyboards\layout_polish_default.txt.swr
  • %TEMP%\tenfoot_italian.txt
  • %TEMP%\layout_polish_default.txt
  • %TEMP%\layout_norwegian_dualtouch.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\keyboards\layout_norwegian_default.txt.swr
  • %TEMP%\layout_norwegian_default.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\keyboards\layout_italian_dualtouch.txt.swr
  • %TEMP%\layout_italian_dualtouch.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\keyboards\layout_italian_default.txt.swr
  • %TEMP%\layout_italian_default.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\localization\tenfoot_russian.txt.swr
  • %ProgramFiles(x86)%\steam\tenfoot\resource\keyboards\layout_hungarian_dualtouch.txt.swr
  • %TEMP%\layout_hungarian_dualtouch.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\keyboards\layout_german_dualtouch.txt.swr
  • %ProgramFiles(x86)%\steam\tenfoot\resource\keyboards\layout_norwegian_dualtouch.txt.swr
  • %TEMP%\layout_german_dualtouch.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\keyboards\layout_german_default.txt.swr
  • %ProgramFiles(x86)%\steam\tenfoot\resource\keyboards\layout_spanish_default.txt.swr
  • %ProgramFiles(x86)%\steam\tenfoot\resource\keyboards\layout_russian_dualtouch.txt.swr
  • %TEMP%\steamui_postlogon_dutch.txt
  • %ProgramFiles(x86)%\steam\steam\cached\steamui_postlogon_danish.txt.swr
  • %TEMP%\steamui_postlogon_danish.txt
  • %ProgramFiles(x86)%\steam\steam\cached\steamui_postlogon_czech.txt.swr
  • %TEMP%\steamui_postlogon_czech.txt
  • %ProgramFiles(x86)%\steam\steam\cached\steamui_postlogon_bulgarian.txt.swr
  • %TEMP%\steamui_postlogon_bulgarian.txt
  • %ProgramFiles(x86)%\steam\steam\cached\steamui_postlogon_brazilian.txt.swr
  • %TEMP%\steamui_postlogon_brazilian.txt
  • %ProgramFiles(x86)%\winamp\whatsnew.txt.swr
  • %TEMP%\layout_spanish_default.txt
  • %TEMP%\whatsnew.txt
  • %TEMP%\layout_russian_dualtouch.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\keyboards\layout_ukrainian_dualtouch.txt.swr
  • %TEMP%\layout_ukrainian_dualtouch.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\keyboards\layout_turkish_dualtouch.txt.swr
  • %TEMP%\layout_turkish_dualtouch.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\keyboards\layout_swedish_dualtouch.txt.swr
  • %TEMP%\layout_swedish_dualtouch.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\keyboards\layout_swedish_default.txt.swr
  • %TEMP%\layout_swedish_default.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\keyboards\layout_spanish_dualtouch.txt.swr
  • %TEMP%\layout_spanish_dualtouch.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\fonts\license_cjk.txt.swr
  • %ProgramFiles(x86)%\steam\tenfoot\resource\localization\tenfoot_italian.txt.swr
  • %TEMP%\license_cjk.txt
  • %TEMP%\icaros license.txt
  • %TEMP%\tenfoot_thai.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\localization\tenfoot_tchinese.txt.swr
  • %TEMP%\tenfoot_tchinese.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\localization\tenfoot_swedish.txt.swr
  • %TEMP%\tenfoot_swedish.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\localization\tenfoot_spanish.txt.swr
  • %TEMP%\tenfoot_spanish.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\localization\tenfoot_schinese.txt.swr
  • %TEMP%\tenfoot_schinese.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\localization\tenfoot_romanian.txt.swr
  • %TEMP%\tenfoot_russian.txt
  • %TEMP%\layout_french_dualtouch.txt
  • %TEMP%\tenfoot_romanian.txt
  • %TEMP%\tenfoot_portuguese.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\localization\tenfoot_polish.txt.swr
  • %TEMP%\tenfoot_polish.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\localization\tenfoot_hungarian.txt.swr
  • %ProgramFiles(x86)%\steam\tenfoot\resource\localization\tenfoot_norwegian.txt.swr
  • %TEMP%\tenfoot_norwegian.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\localization\tenfoot_koreana.txt.swr
  • %TEMP%\tenfoot_koreana.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\localization\tenfoot_korean.txt.swr
  • %TEMP%\tenfoot_korean.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\localization\tenfoot_japanese.txt.swr
  • %ProgramFiles(x86)%\steam\tenfoot\resource\localization\tenfoot_portuguese.txt.swr
  • %TEMP%\layout_german_default.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\keyboards\layout_french_dualtouch.txt.swr
  • %TEMP%\tenfoot_ukrainian.txt
  • %TEMP%\tenfoot_turkish.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\keyboards\layout_french_default.txt.swr
  • %TEMP%\layout_french_default.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\keyboards\layout_finnish_dualtouch.txt.swr
  • %TEMP%\layout_finnish_dualtouch.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\keyboards\layout_finnish_default.txt.swr
  • %TEMP%\layout_finnish_default.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\keyboards\layout_english_dualtouch.txt.swr
  • %TEMP%\layout_english_dualtouch.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\keyboards\layout_english_default.txt.swr
  • %TEMP%\layout_english_default.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\localization\tenfoot_turkish.txt.swr
  • %ProgramFiles(x86)%\steam\tenfoot\resource\keyboards\layout_dutch_dualtouch.txt.swr
  • %ProgramFiles(x86)%\steam\tenfoot\resource\localization\tenfoot_thai.txt.swr
  • %TEMP%\layout_dutch_default.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\keyboards\layout_danish_dualtouch.txt.swr
  • %TEMP%\layout_danish_dualtouch.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\keyboards\layout_danish_default.txt.swr
  • %TEMP%\layout_danish_default.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\keyboards\layout_brazilian_dualtouch.txt.swr
  • %TEMP%\layout_brazilian_dualtouch.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\keyboards\layout_brazilian_default.txt.swr
  • %TEMP%\layout_brazilian_default.txt
  • %ProgramFiles(x86)%\steam\tenfoot\resource\localization\tenfoot_ukrainian.txt.swr
  • %TEMP%\layout_dutch_dualtouch.txt
  • %ProgramFiles(x86)%\steam\resource\vgui_french.txt.swr
Sets the 'hidden' attribute to the following files
  • %APPDATA%\system.exe
Deletes the following files
  • %APPDATA%\shareware.log
Substitutes the following files
  • %APPDATA%\shareware.log
Miscellaneous
Creates and executes the following
  • '%APPDATA%\system.exe' -regedit
  • '%APPDATA%\system.exe' -silent
  • '%WINDIR%\syswow64\schtasks.exe' /create /sc minute /mo 1 /tn PolicyUpdate /tr "%APPDATA%\System.exe -silent"' (with hidden window)
  • '%APPDATA%\system.exe' -silent' (with hidden window)
Executes the following
  • '%WINDIR%\syswow64\schtasks.exe' /create /sc minute /mo 1 /tn PolicyUpdate /tr "%APPDATA%\System.exe -silent"
  • '<SYSTEM32>\taskeng.exe' {0D5D5F29-A1CF-4E3A-A156-801315ACF758} S-1-5-21-1960123792-2022915161-3775307078-1001:bdjdromud\user:Interactive:[1]

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android