La mia libreria
La mia libreria

+ Aggiungi alla libreria

Supporto
Supporto 24/7 | Regole per contattare

Richieste

Profile

Trojan.Encoder.34206

Aggiunto al database dei virus Dr.Web: 2021-07-31

La descrizione è stata aggiunta:

Technical Information

Modifies file system
Creates the following files
  • %ALLUSERSPROFILE%\adobe\arm\reader_15.007.20033\acrordrdcupd1500920077.mspphqghumeayln
  • %ALLUSERSPROFILE%\microsoft\windows\ringtones\ringtone 06.wmacswtwkkxlcbhu
  • %ALLUSERSPROFILE%\microsoft\windows\ringtones\ringtone 07.wmaqkvcswjebkrjq
  • %ALLUSERSPROFILE%\microsoft\windows\ringtones\ringtone 08.wmalpgfgratzbsgv
  • %ALLUSERSPROFILE%\microsoft\windows\ringtones\ringtone 09.wmauvzifnhyxwjs&
  • %ALLUSERSPROFILE%\microsoft\windows\ringtones\ringtone 10.wmajavwauxpannaГЁ
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\accessibility\speech recognition.lnkzwudwdfzlktbg
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\calculator.lnkqdxgyyiudsjvx
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\desktop.iniezkmesbjlkyer
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\displayswitch.lnkrtahnexhuqmjx
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\math input panel.lnkicbmusqdklasr
  • %ALLUSERSPROFILE%\microsoft\windows\ringtones\ringtone 03.wmacgmmvedewdmf
  • %ALLUSERSPROFILE%\microsoft\windows\ringtones\ringtone 05.wmaqecihluilgmfu
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\networkprojection.lnkzfwyucpabqsex
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\snipping tool.lnkitllplxelrdkx
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\sound recorder.lnkexdtquvptteyc
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\sticky notes.lnkhtlqlbbbvoqoГЁ
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\system restore.lnkdoyjwpyatmleГЁ
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\task scheduler.lnkyqsvkpamsvbmГї
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\tablet pc\tabtip.lnklirizxoqptqqГЁ
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\windows powershell\desktop.ininxmsyamptlzaГЁ
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\windows powershell\windows powershell ise.lnkhdkcrfvbeiyis
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\windows powershell\windows powershell.lnkpvfvpzhyujabf
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\wordpad.lnktqwwtbkdogket
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\paint.lnkffunqpkfnnber
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\remote desktop connection.lnkcbbcjpdyjlibt
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\component services.lnkzletbqexkrqos
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\acrobat reader dc.lnkmhibyxrnxsxro
  • %ALLUSERSPROFILE%\microsoft\windows\ringtones\desktop.inizubuacclfkcy
  • %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\propmap\cipt0000.000dnilqadojskkj
  • %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\propmap\cipt0000.001vfxahhjmboclg
  • %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\propmap\cipt0000.002jarintdwcldv
  • %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\secstore\cist0000.000dxropbyjzwyy
  • %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\secstore\cist0000.001ojuothwmlvrg
  • %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\secstore\cist0000.002lfzdzdbtubxu
  • %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\windows.edboffvncrswsaz
  • %ALLUSERSPROFILE%\microsoft\user account pictures\guest.bmpzuvldvybsuxk
  • %ALLUSERSPROFILE%\microsoft\user account pictures\user.bmpbmfzvrtnovid
  • %ALLUSERSPROFILE%\microsoft\windows\ringtones\ringtone 01.wmazobghtuoxraj
  • %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\index.002jtlntxmrjxxwo
  • %ALLUSERSPROFILE%\microsoft\windows\ringtones\ringtone 02.wmavprecwgxxpsw
  • %ALLUSERSPROFILE%\microsoft\windows\caches\cversions.2.dbnsnqivmvubcw
  • %ALLUSERSPROFILE%\microsoft\windows\caches\{4e4260a4-7e39-442e-bc22-7ff751d1c161}.2.ver0x0000000000000002.dbxtwwtaidyaxy
  • %ALLUSERSPROFILE%\microsoft\windows\caches\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000e.dbqleprxibexxy
  • %ALLUSERSPROFILE%\microsoft\windows\caches\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.dbfvsddygthcuy
  • %ALLUSERSPROFILE%\microsoft\windows\caches\{84c252b6-5dca-4ae7-94d3-461f67359cd9}.2.ver0x0000000000000001.dbyfwpjsfybglg
  • %ALLUSERSPROFILE%\microsoft\windows\caches\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.dbzmbintattnho
  • %ALLUSERSPROFILE%\microsoft\windows\drm\blackbox.binwzabsdnvqhkfГё
  • %ALLUSERSPROFILE%\microsoft\windows\drm\drmstore.hdscmofisfrfqgv\
  • %ALLUSERSPROFILE%\microsoft\windows\drm\v3ks.blapmvorpjfzslz
  • %ALLUSERSPROFILE%\microsoft\windows\drm\v3ks.secmpjjnehrykxj
  • %ALLUSERSPROFILE%\microsoft\windows\caches\{1573b5e2-35f5-4eaf-bec0-4e35d1d995f6}.2.ver0x0000000000000002.dbtfsrqtmknepb
  • %ALLUSERSPROFILE%\microsoft\windows\caches\{1e8814b6-8f2d-4b97-87f6-9370f7eb40b7}.2.ver0x0000000000000001.dbhowejazhkwcm
  • %ALLUSERSPROFILE%\microsoft\windows\caches\{40fc8d7d-05ed-4feb-b03b-6c100659ef5c}.2.ver0x0000000000000001.dbmtpixxxlzqys
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\outllibr.rest.trx_dllnayxqkqoyzwmx
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\computer management.lnkiernaplqyjpqw
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\microsoft office 2010 upload center.lnkaalkicsnxuco-
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft onenote 2010.lnkxwxqmndhldtt[
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft outlook 2010.lnkxsknxteznjsqv
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft powerpoint 2010.lnktfbccfqmwhbv[
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft publisher 2010.lnkssiigvijsuxi9
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft sharepoint workspace 2010.lnkicaahmkwywttq
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft word 2010.lnkjzppkwlbmjahg
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\mirc\mirc help.lnkegyrhlthxwgjr
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\mirc\mirc.lnkprwvhshzyavqk
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\mirc\readme.txt.lnkyecztozoabnak
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\microsoft office 2010 language preferences.lnkivahqatmsckm{
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\mozilla firefox.lnkeuiozioiuozxВ§
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\microsoft office picture manager.lnkvtykrxawzadj{
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\pidgin.lnkispqnzomcwvaГ§
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\qip 2012\uninstall qip 2012.lnkaihfshccxhuu-
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\winrar\winrar help.lnkjbfrjpcgdjdre
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\winrar\winrar.lnkwdnposrjgdrq{
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\xps viewer.lnkrvqtvppazhlt)
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\windows update.lnkjqvcclpeztsjk
  • %ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_088cc9f7\report.werpynzfrotqpoxq
  • %ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_099489dd\report.wermwhhwewnvcbvz
  • %ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_cab_0841821b\report.werdkuzififrtwqq
  • %ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_cab_0841821b\wer5c82.tmp.appcompat.txtqeojueqbnskwr
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\mozilla thunderbird.lnkqtihwauroqrdГЎ
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\microsoft clip organizer.lnkrnuwkmsyqcpux
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\qip 2012\qip 2012.lnkwwqqtmiuuyvgq
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\digital certificate for vba projects.lnkzghutifklgkl\
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft infopath filler 2010.lnktnqwtoetonxwe
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\desktop.iniksvloidzfpirw
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\iscsi initiator.lnkotakudkpedupr
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\memory diagnostics tool.lnkkczlhwuskdne
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\microsoft .net framework 1.1 configuration.lnkvdcplbklpjmp
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\microsoft .net framework 1.1 wizards.lnkfdcyqtrcvvvt
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\performance monitor.lnkrffvpekkqmcu
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\print management.lnkpryjauteuvcz
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\security configuration management.lnkvicthrxsxclp
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\services.lnkrgdlwxfaigay
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\system configuration.lnkrueicufdiamh
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\task scheduler.lnktkbxotdirxxg
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\windows firewall with advanced security.lnkvzqmeyrovfic
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\event viewer.lnkwycztwzzvewx
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\windows powershell modules.lnkhqnivfjzauqf
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\java\check for updates.lnksjvwzxssqxnje
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\java\configure java.lnkomuyjnjuwrsyc
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\configuration\x264 vfw (x86).lnkyayzkhuhjrjsГ§
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\help\frequently asked questions.lnkxsbziyrvgqmlq
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\uninstall\uninstall k-lite codec pack.lnkuckbsepjeisz-
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft .net framework sdk v1.1\documentation.lnkfnwywmxxgdpy`
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft .net framework sdk v1.1\tools.lnkbhcwhlsyoyhg9
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft access 2010.lnkmgopprzaxqmo~
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft excel 2010.lnkmsyhgagiupjq@
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft infopath designer 2010.lnkbzxthtopotmi9
  • %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\index.001sqfqwehtxdzut
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\desktop.inidftgmopsrgpuВЁ
  • %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\settings.diatlggkytbiolym
  • %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\index.000bvqopqfoviusf
  • %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciad0002.002nwafxwhgbibas
  • %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciad0002.001eskmkhssmvno\
  • %ALLUSERSPROFILE%\microsoft\msdn\7.0\1042\dexplore.ctmxvfbcgkcfqckГ«
  • %ALLUSERSPROFILE%\microsoft\msdn\7.0\1046\dexplore.ctmcotzgkubmjrmГѕ
  • %ALLUSERSPROFILE%\microsoft\msdn\7.0\1049\dexplore.ctmbsztsshfroef›
  • %ALLUSERSPROFILE%\microsoft\msdn\7.0\1050\dexplore.ctmwsjrxjhguzyuГѕ
  • %ALLUSERSPROFILE%\microsoft\msdn\7.0\3082\dexplore.ctmiqflduuveoowx
  • %ALLUSERSPROFILE%\microsoft\network\downloader\qmgr0.datqcudhnefnjhaГі
  • %ALLUSERSPROFILE%\microsoft\network\downloader\qmgr1.datimuczfskuidux
  • %ALLUSERSPROFILE%\microsoft\office\assetlibrary.icoburiswtbrecuГј
  • %ALLUSERSPROFILE%\microsoft\office\documentrepository.icoykabfcvkdzezВЃ
  • %ALLUSERSPROFILE%\microsoft\msdn\7.0\1036\dexplore.ctmwkbarxbgfcbcГѕ
  • %ALLUSERSPROFILE%\microsoft\msdn\7.0\1031\dexplore.ctmwkbjzwucwljfГѕ
  • %ALLUSERSPROFILE%\microsoft\msdn\7.0\1041\dexplore.ctmtrehbbcpxifb€
  • %ALLUSERSPROFILE%\microsoft\office\mysharepoints.icotoidukuhjzefx
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\envelopr.dll.trx_dllamceroswitdp—
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\grintl32.dll.trx_dlltpcclifkeljyГ«
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\grintl32.rest.trx_dlltihrcqaybnefl
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\mapir.dll.trx_dllxnxvgzedyyhnГѕ
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\mor6int.rest.trx_dllgycdrudmphmef
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\msointl.dll.trx_dllckotrwospofgГѕ
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\msointl.rest.trx_dllhfozqvlqfxwwz
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\omsintl.dll.trx_dllkmfxdyygmdcax
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\onintl.dll.trx_dllszsgovsodkjgГі
  • %ALLUSERSPROFILE%\microsoft\office\mysite.icoczzzbfkqdpqzВµ
  • %ALLUSERSPROFILE%\microsoft\office\sharepointportalsite.icoikfobucdhthxВё
  • %ALLUSERSPROFILE%\microsoft\office\sharepointteamsite.icodjgkjelrlpax
  • %ALLUSERSPROFILE%\microsoft\msdn\7.0\1033\dexplore.ctmrimpmyhchzrik
  • %ALLUSERSPROFILE%\microsoft\msdn\7.0\1028\dexplore.ctmvfajfrmxothoГҐ
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\onintl.rest.trx_dllhcwmbmxrmhuy‘
  • %ALLUSERSPROFILE%\adobe\arm\s\10428\adobearmhelper.exeggbwkfnqduxw
  • %ALLUSERSPROFILE%\adobe\arm\s\armmanifest.msifnfozvsrtkjp
  • %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\abcpy.inirepggxrpnrvy
  • %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acrordrdcupd1500820082.mspstmwcysyycqp
  • %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acroread.msievikeffmznim
  • %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\data1.cabkkasvwsrenzk
  • %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\setup.exeycxfxtlsgyps
  • %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\setup.inifadpooefxzbc
  • %ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\help_cvalidator.h1doejuvpvaboyg
  • %ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\help_mkwd_assetid.h1wpoeylfpbnplj8
  • %ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\help_mkwd_bestbet.h1wvrvipyamyehw
  • %ALLUSERSPROFILE%\adobe\arm\reader_15.007.20033\readerdcmanifest.msilfdxfircvscx
  • %ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\help_mtoc_help.h1hqnqrqpmxujjl
  • %ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\help_mvalidator.lckncbxcoksfzkv
  • %ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\help{9daa54e8-cd95-4107-8e7f-ba3f24732d95}.h1qatxdknlyjyhf
  • %ALLUSERSPROFILE%\microsoft\crypto\keys\68383f0e45dd9b02f69c4041b082ee57_36d1130a-ac2e-44f7-9dc1-e424fbcbe0eeixjswnkkufnu
  • %ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\5d91c0b736f4f8dbdd317cf8a037fced_36d1130a-ac2e-44f7-9dc1-e424fbcbe0eepsajlfvgubfas
  • %ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\6d14e4b1d8ca773bab785d1be032546e_36d1130a-ac2e-44f7-9dc1-e424fbcbe0eeaovlzylntrkd0
  • %ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\d42cc0c3858a58db2db37658219e6400_36d1130a-ac2e-44f7-9dc1-e424fbcbe0eecpwsrtesjwhd3
  • %ALLUSERSPROFILE%\microsoft\dbgclr\7.1\1033\dbgclr.ctmizcobzcnfwlq6
  • %ALLUSERSPROFILE%\microsoft\identitycrl\ppcrlconfig.dllowkjilefraamГ¤
  • %ALLUSERSPROFILE%\microsoft\ilscache\ilrcache.xmlqnjwjmwaxxmn$
  • %ALLUSERSPROFILE%\microsoft\ilscache\imcrcache.xmlsnhhlqqrzudl1
  • %ALLUSERSPROFILE%\microsoft\mf\active.grltfzotcjtnzxuo
  • %ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\help_mvalidator.h1doovaowuxwhms
  • %ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_cab_0841821b\wer5cc2.tmp.werinternalmetadata.xmlzeewzkaojursv
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\data sources (odbc).lnkoubvjsebalwnl
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\outllibr.dll.trx_dllfyqgajqkcklzВЈ
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\stintl.dll.trx_dllwkegjccvhhrj~
  • %ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\tokens.datjomonxrqyjzg
  • %ALLUSERSPROFILE%\microsoft\rac\publisheddata\racwmidatabase.sdfinrnnzwacxxa
  • %ALLUSERSPROFILE%\microsoft\rac\statedata\racdatabase.sdfedrwudxzrfus
  • %ALLUSERSPROFILE%\microsoft\rac\statedata\racmetadata.datewjtboxvynfh
  • %ALLUSERSPROFILE%\microsoft\rac\statedata\racwmidatabookmarks.datkstcenaumnddГ­
  • %ALLUSERSPROFILE%\microsoft\rac\statedata\racwmieventdata.datxfdmvzcautdci
  • %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\gatherlogs\systemindex\systemindex.1.crwlckxaaydzsxttn
  • %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\gatherlogs\systemindex\systemindex.1.gthrobbgqngvvpjgd
  • %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\mss.chkojoglmkxgbfc›
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\xlintl32.rest.trx_dlldnmphnqkamhu
  • %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\mss.logpypckqchbddzГІ
  • %ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\cache\cache.datzkkldacllteo
  • %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\00010003.cibsqfcihubsjol
  • %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\00010003.widelsotflbgsfn
  • %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\00010003.wsbpcuzsrupchyn
  • %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciab0001.000vzhcpqugriwni
  • %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciab0001.001iqxdfjpwpxfbl
  • %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciab0001.002lkpnpeelfjmt0
  • %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciab0002.000kuqpzomwnlmbw
  • %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciab0002.001upmktlptndmpe
  • %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciab0002.002dsydsgvfpenet
  • %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciad0002.000mwborifsuqhc
  • %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\mssres00002.jrscclmznmjugwwi
  • %ALLUSERSPROFILE%\microsoft\msdn\7.0\1040\dexplore.ctmeyhjugixwtbvВє
  • %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\00010003.dirllmsqsghmcph0
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\xlslicer.dll.trx_dllrktrffaclvgrВі
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\xlintl32.dll.trx_dllmausjgmhcmhg
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\wwintl.rest.trx_dlloqylobcwqxkz
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\wwintl.dll.trx_dllowqrwwwpzsqmi
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\wwintl.rest.trx_dlletogepspxnvjn
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\xlintl32.dll.trx_dlliupalyynmkmnd
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\xlintl32.rest.trx_dlluvklhsecdwra™
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\xlslicer.dll.trx_dllcgfmzkgipdfos
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\envelopr.dll.trx_dlldkjmjqwiqpuo\
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\grintl32.dll.trx_dllqhimvfvuzwyvv
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\grintl32.rest.trx_dllijgfullkjduhf
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\mapir.dll.trx_dllsjafbtlkmfqrx
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\mor6int.rest.trx_dllmyjfjnhhssqc
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\pub6intl.rest.trx_dllrarxsvkhtqdig
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\msointl.dll.trx_dlltydteamdcjbpu
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\omsintl.dll.trx_dlljwlgrsmeaear
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\onintl.rest.trx_dllwtvjsjbaoiojl
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\outllibr.dll.trx_dlllwhypnvruihof
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\outllibr.rest.trx_dllswkifygtydhaВі
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\outlwvw.dll.trx_dllcwyhsgewzmtg\
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\ppintl.rest.trx_dllonzltjhgauhns
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\pub6intl.dll.trx_dllihreqgjfwkjsf
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\pub6intl.rest.trx_dllmtpjhaefqzaac
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\pubwzint.rest.trx_dlluldrchjccdyr6
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\sgres.dll.trx_dllfvvrivuyeegfl
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\visbrres.dll.trx_dllivdrcygurqdrf
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\msointl.rest.trx_dllrhtnegyiwxgcd
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\visintl.dll.trx_dlledakubnfgupr
  • %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\ppintl.rest.trx_dllfmbisgekyrgzz
  • %ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_cab_0841821b\wer5cd2.tmp.hdmpqgsczvhhujzu!
Modifies the following files
  • %ALLUSERSPROFILE%\adobe\arm\reader_15.007.20033\acrordrdcupd1500920077.msp
  • %ALLUSERSPROFILE%\microsoft\msdn\7.0\1036\dexplore.ctm
  • %ALLUSERSPROFILE%\microsoft\msdn\7.0\1033\dexplore.ctm
  • %ALLUSERSPROFILE%\microsoft\msdn\7.0\1031\dexplore.ctm
  • %ALLUSERSPROFILE%\microsoft\msdn\7.0\1028\dexplore.ctm
  • %ALLUSERSPROFILE%\microsoft\mf\pending.grl
  • %ALLUSERSPROFILE%\microsoft\mf\active.grl
  • %ALLUSERSPROFILE%\microsoft\ilscache\imcrcache.xml
  • %ALLUSERSPROFILE%\microsoft\ilscache\ilrcache.xml
  • %ALLUSERSPROFILE%\microsoft\dbgclr\7.1\1033\dbgclr.ctm
  • %ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\d42cc0c3858a58db2db37658219e6400_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
  • %ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\6d14e4b1d8ca773bab785d1be032546e_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
  • %ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\5d91c0b736f4f8dbdd317cf8a037fced_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
  • %ALLUSERSPROFILE%\microsoft\crypto\keys\68383f0e45dd9b02f69c4041b082ee57_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
  • %ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\help{9daa54e8-cd95-4107-8e7f-ba3f24732d95}.h1q
  • %ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\help_mvalidator.lck
  • %ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\help_mvalidator.h1d
  • %ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\help_mtoc_help.h1h
  • %ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\help_mkwd_bestbet.h1w
  • %ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\help_mkwd_assetid.h1w
  • %ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\help_cvalidator.h1d
  • %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\setup.ini
  • %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\data1.cab
  • %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acroread.msi
  • %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acrordrdcupd1500820082.msp
  • %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\abcpy.ini
  • %ALLUSERSPROFILE%\adobe\arm\s\armmanifest.msi
  • %ALLUSERSPROFILE%\adobe\arm\reader_15.007.20033\readerdcmanifest.msi
  • %ALLUSERSPROFILE%\microsoft\msdn\7.0\1040\dexplore.ctm
  • %ALLUSERSPROFILE%\microsoft\msdn\7.0\1041\dexplore.ctm
Modifies multiple files.
Modifies user data files (Trojan.Encoder).

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android