Trojan.Encoder.37563

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\<File name>.exe

Creates the following files on removable media

<Drive name for removable media>:\contosoroot_1.cer
<Drive name for removable media>:\contosoroot.cer
<Drive name for removable media>:\pmd.cer
<Drive name for removable media>:\contoso.cer
<Drive name for removable media>:\lisp_success.doc
<Drive name for removable media>:\fi51.doc
<Drive name for removable media>:\weeklysheet1215.doc
<Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
<Drive name for removable media>:\holycrosschurchinstructions.docx
<Drive name for removable media>:\sdszfo.docx
<Drive name for removable media>:\file_p_00000000_1371597592.docx
<Drive name for removable media>:\adhd_and_obesity.docx
<Drive name for removable media>:\hadac_newsletter_july_2010_final.docx
<Drive name for removable media>:\pushkin.jpeg
<Drive name for removable media>:\region-north-karelia.jpeg
<Drive name for removable media>:\168.jpeg

Modifies file system

Creates the following files

%TEMP%\wrp32b.tmp
%TEMP%\wrpa161.tmp
%TEMP%\wrpa651.tmp
%TEMP%\wrpa72d.tmp
%TEMP%\wrpa848.tmp
%TEMP%\wrpa868.tmp
%TEMP%\wrpa879.tmp
%TEMP%\wrpa878.tmp
%TEMP%\wrpabbe.tmp
%TEMP%\wrpa0d3.tmp
%TEMP%\wrpa056.tmp
%TEMP%\wrpa72e.tmp
%TEMP%\wrpaa90.tmp
%TEMP%\wrpaa92.tmp
%TEMP%\wrpaa91.tmp
%TEMP%\wrpaab2.tmp
%TEMP%\wrpab6e.tmp
%TEMP%\wrpab8e.tmp
%TEMP%\wrpa8a9.tmp
%TEMP%\wrpa8f9.tmp
%TEMP%\wrp7d55.tmp
%TEMP%\wrpa8d9.tmp
%TEMP%\wrp854b.tmp
%TEMP%\wrp7d96.tmp
%TEMP%\wrp7df5.tmp
%TEMP%\wrp7d85.tmp
%TEMP%\wrp84c9.tmp
%TEMP%\wrp84e9.tmp
%TEMP%\wrp8519.tmp
%TEMP%\wrp851a.tmp
%TEMP%\wrp9edc.tmp
%TEMP%\wrp9f8a.tmp
%TEMP%\wrp9f6a.tmp
%TEMP%\wrp859b.tmp
%TEMP%\wrp85bb.tmp
%TEMP%\wrp860a.tmp
%TEMP%\wrp9eca.tmp
%TEMP%\wrp9ecb.tmp
%TEMP%\wrp9ecc.tmp
%TEMP%\wrp93c1.tmp
%TEMP%\wrp852b.tmp
%TEMP%\wrp859a.tmp
%TEMP%\wrp7d86.tmp
%TEMP%\wrpabbf.tmp
%TEMP%\wrpafaa.tmp
%TEMP%\wrpc61d.tmp
%TEMP%\wrpc63d.tmp
%TEMP%\wrpc802.tmp
%TEMP%\wrpc8de.tmp
%TEMP%\wrpc97b.tmp
%TEMP%\wrpc97c.tmp
%TEMP%\wrpca57.tmp
%TEMP%\wrpc540.tmp
%TEMP%\wrpc561.tmp
%TEMP%\wrpca58.tmp
%TEMP%\wrpcb84.tmp
%TEMP%\wrpcb94.tmp
%TEMP%\wrpcc22.tmp
%TEMP%\wrpcc23.tmp
%TEMP%\wrpccee.tmp
%TEMP%\wrpccef.tmp
%TEMP%\wrpce09.tmp
%TEMP%\wrpcad6.tmp
%TEMP%\wrpcad7.tmp
%TEMP%\wrpaebe.tmp
%TEMP%\wrpaead.tmp
%TEMP%\wrpc425.tmp
%TEMP%\wrpb391.tmp
%TEMP%\wrpb392.tmp
%TEMP%\wrpbc89.tmp
%TEMP%\wrpbc9a.tmp
%TEMP%\wrpbf0b.tmp
%TEMP%\wrpbf0c.tmp
%TEMP%\wrpc493.tmp
%TEMP%\wrpaf99.tmp
%TEMP%\wrpc4b3.tmp
%TEMP%\wrpc064.tmp
%TEMP%\wrpc28a.tmp
%TEMP%\wrpc28b.tmp
%TEMP%\wrpbc0b.tmp
%TEMP%\wrpc328.tmp
%TEMP%\wrpc367.tmp
%TEMP%\wrpc3f5.tmp
%TEMP%\wrpc084.tmp
%TEMP%\wrpc1ae.tmp
%TEMP%\wrpc1af.tmp
%TEMP%\wrp7d44.tmp
%TEMP%\wrp7cb7.tmp
%TEMP%\wrp7ca6.tmp
%TEMP%\wrp211f.tmp
%TEMP%\wrp2130.tmp
%TEMP%\wrp219e.tmp
%TEMP%\wrp219f.tmp
%TEMP%\wrp228a.tmp
%TEMP%\wrp229b.tmp
%TEMP%\wrp24ec.tmp
%TEMP%\wrp1818.tmp
%TEMP%\wrp3a3d.tmp
%TEMP%\wrp175c.tmp
%TEMP%\wrp2eef.tmp
%TEMP%\wrp2ef0.tmp
%TEMP%\wrp2f20.tmp
%TEMP%\wrp2f30.tmp
%TEMP%\wrp3902.tmp
%TEMP%\wrp3922.tmp
%TEMP%\wrp3a2c.tmp
%TEMP%\wrp27cc.tmp
%TEMP%\wrp24ed.tmp
%TEMP%\wrp27dc.tmp
%TEMP%\wrp16af.tmp
%TEMP%\wrp113a.tmp
%TEMP%\wrp35c.tmp
%TEMP%\wrp36d.tmp
%TEMP%\wrp36e.tmp
%TEMP%\wrpf60.tmp
%TEMP%\wrpfaf.tmp
%TEMP%\wrp101d.tmp
%TEMP%\wrp101e.tmp
%TEMP%\wrp173c.tmp
%TEMP%\wrp3af9.tmp
%TEMP%\wrp33c.tmp
%TEMP%\wrp113b.tmp
%TEMP%\wrp1207.tmp
%TEMP%\wrp1237.tmp
%TEMP%\wrp1238.tmp
%TEMP%\wrp1583.tmp
%TEMP%\wrp1594.tmp
%TEMP%\wrp15d3.tmp
%TEMP%\wrp108e.tmp
%TEMP%\wrp108d.tmp
%TEMP%\wrp1819.tmp
%TEMP%\wrp3b19.tmp
%TEMP%\wrp5b9c.tmp
%TEMP%\wrp5d63.tmp
%TEMP%\wrp5e8d.tmp
%TEMP%\wrp5e9e.tmp
%TEMP%\wrp5f3b.tmp
%TEMP%\wrp5e4e.tmp
%TEMP%\wrp5ff7.tmp
%TEMP%\wrp5af0.tmp
%TEMP%\wrp5a62.tmp
%TEMP%\wrp5bcc.tmp
%TEMP%\wrp6239.tmp
%TEMP%\wrp6411.tmp
%TEMP%\wrp6460.tmp
%TEMP%\wrp6461.tmp
%TEMP%\wrp6491.tmp
%TEMP%\wrp7c08.tmp
%TEMP%\wrp7c19.tmp
%TEMP%\wrp6298.tmp
%TEMP%\wrp640f.tmp
%TEMP%\wrp6410.tmp
%TEMP%\wrp4577.tmp
%TEMP%\wrp59d5.tmp
%TEMP%\wrp3be5.tmp
%TEMP%\wrp3d1f.tmp
%TEMP%\wrp3d20.tmp
%TEMP%\wrp3e0b.tmp
%TEMP%\wrp3e3b.tmp
%TEMP%\wrp3f07.tmp
%TEMP%\wrp378a.tmp
%TEMP%\wrp3f46.tmp
%TEMP%\wrp4031.tmp
%TEMP%\wrp3bf6.tmp
%TEMP%\wrp4042.tmp
%TEMP%\wrp41e9.tmp
%TEMP%\wrp443b.tmp
%TEMP%\wrp443c.tmp
%TEMP%\wrp4517.tmp
%TEMP%\wrp4537.tmp
%TEMP%\wrp5955.tmp
%TEMP%\wrp5956.tmp
%TEMP%\wrp59b5.tmp
%TEMP%\wrp41b9.tmp
%TEMP%\wrpce87.tmp
%TEMP%\wrpce88.tmp

Moves the following system files

from %WINDIR%\installer\$patchcache$\managed\00004109110000000100000000f01fec\14.0.4763\onenoteirm.xml to %WINDIR%\installer\$patchcache$\managed\00004109110000000100000000f01fec\14.0.4763\onenoteirm.xml.backspace@riseup.net_531
from %WINDIR%\microsoft.net\directx for managed code\1.0.2902.0\microsoft.directx.audiovideoplayback.xml to %WINDIR%\microsoft.net\directx for managed code\1.0.2902.0\microsoft.directx.audiovideoplayback.xml.backspace@riseup.net_531
from %WINDIR%\microsoft.net\directx for managed code\1.0.2902.0\microsoft.directx.diagnostics.xml to %WINDIR%\microsoft.net\directx for managed code\1.0.2902.0\microsoft.directx.diagnostics.xml.backspace@riseup.net_531
from %WINDIR%\microsoft.net\directx for managed code\1.0.2902.0\microsoft.directx.direct3d.xml to %WINDIR%\microsoft.net\directx for managed code\1.0.2902.0\microsoft.directx.direct3d.xml.backspace@riseup.net_531

Moves the following files

from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\welcome tool\iconimages.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\welcome tool\iconimages.jpg.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\profile\profile_wrapper.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\profile\profile_wrapper.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\profile\profile_options.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\profile\profile_options.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\profile\profile_loading.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\profile\profile_loading.xml.backspace@riseup.net_531
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0227419.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\j0227419.jpg.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\parental\setsuccess.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\parental\setsuccess.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\parental\setrecovery.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\parental\setrecovery.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\parental\setpin.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\parental\setpin.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\parental\setinprogress.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\parental\setinprogress.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\reference assemblies\microsoft\framework\v3.0\winfxlist.xml to %ProgramFiles(x86)%\reference assemblies\microsoft\framework\v3.0\winfxlist.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\graphics\broadcast\desktop_placeholder.jpg to %ProgramFiles(x86)%\steam\graphics\broadcast\desktop_placeholder.jpg.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\parental\setfail.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\parental\setfail.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\parental\setenablecode.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\parental\setenablecode.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\parental\parental_unlock.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\parental\parental_unlock.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\parental\parental_replacement_panel.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\parental\parental_replacement_panel.xml.backspace@riseup.net_531
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0216153.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\j0216153.jpg.backspace@riseup.net_531
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0216112.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\j0216112.jpg.backspace@riseup.net_531
from %ProgramFiles(x86)%\reference assemblies\microsoft\framework\v3.0\redistlist\frameworklist.xml to %ProgramFiles(x86)%\reference assemblies\microsoft\framework\v3.0\redistlist\frameworklist.xml.backspace@riseup.net_531
from %ProgramFiles%\microsoft office\office14\infopathom\infopathomformservices\infopathomformservicesv12\microsoft.office.infopath.xml to %ProgramFiles%\microsoft office\office14\infopathom\infopathomformservices\infopathomformservicesv12\microsoft.office.infopath.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\overlay\steamcontrollerhud.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\overlay\steamcontrollerhud.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\quitentries.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\quitentries.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\settings\network\settings_network_device_wiz.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\settings\network\settings_network_device_wiz.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\settings\network\settings_network_connect.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\settings\network\settings_network_connect.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\settings\audio\settings_audio_profile_wiz.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\settings\audio\settings_audio_profile_wiz.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\settings\audio\settings_audio_codec_wiz.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\settings\audio\settings_audio_codec_wiz.xml.backspace@riseup.net_531
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0287644.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\j0287644.jpg.backspace@riseup.net_531
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0287643.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\j0287643.jpg.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\settings\audio\settings_audio_card_wiz.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\settings\audio\settings_audio_card_wiz.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\images\generic.jpg to %ProgramFiles(x86)%\steam\tenfoot\resource\images\generic.jpg.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\parental\parental_recent_app.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\parental\parental_recent_app.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\quit.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\quit.xml.backspace@riseup.net_531
from %ProgramFiles%\microsoft office\office14\infopathom\infopathomformservices\microsoft.office.infopath.xml to %ProgramFiles%\microsoft office\office14\infopathom\infopathomformservices\microsoft.office.infopath.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\images\cog_transparent.jpg to %ProgramFiles(x86)%\steam\tenfoot\resource\images\cog_transparent.jpg.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\search_storeresult.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\search_storeresult.xml.backspace@riseup.net_531
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0287641.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\j0287641.jpg.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\search.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\search.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\remotecontent.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\remotecontent.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\remote\remote_loading.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\remote\remote_loading.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\images\bootstrapper.jpg to %ProgramFiles(x86)%\steam\tenfoot\resource\images\bootstrapper.jpg.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\search_storesection.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\search_storesection.xml.backspace@riseup.net_531
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0227558.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\j0227558.jpg.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\parental\parental_lock.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\parental\parental_lock.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\parental\parental_griditem.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\parental\parental_griditem.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\parental\parental_disable.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\parental\parental_disable.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\overlay\notification_accesswhileplaying.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\overlay\notification_accesswhileplaying.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\mozilla thunderbird\searchplugins\ebay.xml to %ProgramFiles(x86)%\mozilla thunderbird\searchplugins\ebay.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\mozilla thunderbird\searchplugins\bing.xml to %ProgramFiles(x86)%\mozilla thunderbird\searchplugins\bing.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\mozilla thunderbird\searchplugins\aol-web-search.xml to %ProgramFiles(x86)%\mozilla thunderbird\searchplugins\aol-web-search.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\mozilla thunderbird\searchplugins\amazondotcom.xml to %ProgramFiles(x86)%\mozilla thunderbird\searchplugins\amazondotcom.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\overlay\notification_screenshot.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\overlay\notification_screenshot.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\mozilla thunderbird\blocklist.xml to %ProgramFiles(x86)%\mozilla thunderbird\blocklist.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\overlay\notification_refreshlogin.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\overlay\notification_refreshlogin.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\settings\network\settings_network_ipconfig.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\settings\network\settings_network_ipconfig.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\overlay\notification_steamlinkauth.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\overlay\notification_steamlinkauth.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\overlay\ghostmodecontainer.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\overlay\ghostmodecontainer.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\overlay\async_notifications_requested.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\overlay\async_notifications_requested.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\mozilla firefox\browser\searchplugins\yahoo.xml to %ProgramFiles(x86)%\mozilla firefox\browser\searchplugins\yahoo.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\oobe\timezonesettings.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\oobe\timezonesettings.xml.backspace@riseup.net_531
from %ProgramFiles%\microsoft office\office14\groove\xml files\starterapplicationdescriptors.xml to %ProgramFiles%\microsoft office\office14\groove\xml files\starterapplicationdescriptors.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\mozilla firefox\browser\searchplugins\wikipedia.xml to %ProgramFiles(x86)%\mozilla firefox\browser\searchplugins\wikipedia.xml.backspace@riseup.net_531
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0178639.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\j0178639.jpg.backspace@riseup.net_531
from %ProgramFiles%\microsoft office\office14\groove\xml files\messenger.xml to %ProgramFiles%\microsoft office\office14\groove\xml files\messenger.xml.backspace@riseup.net_531
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0178932.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\j0178932.jpg.backspace@riseup.net_531
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0287642.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\j0287642.jpg.backspace@riseup.net_531
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0179963.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\j0179963.jpg.backspace@riseup.net_531
from %ProgramFiles%\microsoft office\office14\groove\xml files\starternotificationdescriptors.xml to %ProgramFiles%\microsoft office\office14\groove\xml files\starternotificationdescriptors.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\mozilla thunderbird\searchplugins\wikipedia.xml to %ProgramFiles(x86)%\mozilla thunderbird\searchplugins\wikipedia.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\parental\parental_appgrid_overlay.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\parental\parental_appgrid_overlay.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\opera\launcher.visualelementsmanifest.xml to %ProgramFiles(x86)%\opera\launcher.visualelementsmanifest.xml.backspace@riseup.net_531
from %ProgramFiles%\microsoft office\office14\groove\xml files\startertooltemplates.xml to %ProgramFiles%\microsoft office\office14\groove\xml files\startertooltemplates.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\opera\installation_status.xml to %ProgramFiles(x86)%\opera\installation_status.xml.backspace@riseup.net_531
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0202045.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\j0202045.jpg.backspace@riseup.net_531
from %ProgramFiles(x86)%\opera\29.0.1795.47\resources\dictionaries.xml to %ProgramFiles(x86)%\opera\29.0.1795.47\resources\dictionaries.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\parental\intro.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\parental\intro.xml.backspace@riseup.net_531
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0182689.jpg to %ProgramFiles%\microsoft office\clipart\pub60cor\j0182689.jpg.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\parental\choosefeatures.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\parental\choosefeatures.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\mozilla thunderbird\searchplugins\twitter.xml to %ProgramFiles(x86)%\mozilla thunderbird\searchplugins\twitter.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\overlay\overlay_notifications.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\overlay\overlay_notifications.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\overlay\overlay_friends_notification_item.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\overlay\overlay_friends_notification_item.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\overlay\overlay_friends_notifications.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\overlay\overlay_friends_notifications.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\overlay\overlay_first_time_broadcast.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\overlay\overlay_first_time_broadcast.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\overlay\overlay.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\overlay\overlay.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\overlay\notification_watch_request.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\overlay\notification_watch_request.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\mozilla thunderbird\searchplugins\yahoo.xml to %ProgramFiles(x86)%\mozilla thunderbird\searchplugins\yahoo.xml.backspace@riseup.net_531
from %ProgramFiles(x86)%\steam\tenfoot\resource\layout\parental\chooseapps.xml to %ProgramFiles(x86)%\steam\tenfoot\resource\layout\parental\chooseapps.xml.backspace@riseup.net_531
from %ProgramFiles%\microsoft office\office14\infopathom\infopathomv12\microsoft.office.infopath.xml to %ProgramFiles%\microsoft office\office14\infopathom\infopathomv12\microsoft.office.infopath.xml.backspace@riseup.net_531

Modifies the following files

<Drive name for removable media>:\contosoroot_1.cer
%ProgramFiles(x86)%\mozilla thunderbird\searchplugins\ebay.xml
%ProgramFiles(x86)%\mozilla thunderbird\searchplugins\bing.xml
%ProgramFiles(x86)%\mozilla thunderbird\searchplugins\aol-web-search.xml
%ProgramFiles(x86)%\mozilla thunderbird\searchplugins\amazondotcom.xml
%ProgramFiles(x86)%\steam\tenfoot\resource\layout\overlay\notification_steamlinkauth.xml
%ProgramFiles%\microsoft office\clipart\pub60cor\j0179963.jpg
<Drive name for removable media>:\weeklysheet1215.doc
%ProgramFiles(x86)%\steam\tenfoot\resource\layout\overlay\notification_screenshot.xml
%ProgramFiles(x86)%\steam\tenfoot\resource\layout\overlay\notification_refreshlogin.xml
%ProgramFiles%\microsoft office\office14\groove\xml files\starternotificationdescriptors.xml
%ProgramFiles(x86)%\steam\tenfoot\resource\layout\overlay\notification_accesswhileplaying.xml
%ProgramFiles(x86)%\steam\tenfoot\resource\layout\overlay\ghostmodecontainer.xml
%ProgramFiles(x86)%\mozilla thunderbird\blocklist.xml
%ProgramFiles(x86)%\steam\tenfoot\resource\layout\overlay\async_notifications_requested.xml
<Drive name for removable media>:\fi51.doc
%ProgramFiles(x86)%\mozilla firefox\browser\searchplugins\yahoo.xml
%ProgramFiles%\microsoft office\clipart\pub60cor\j0178932.jpg
%ProgramFiles(x86)%\mozilla firefox\browser\searchplugins\wikipedia.xml
%ProgramFiles(x86)%\steam\tenfoot\resource\layout\oobe\timezonesettings.xml
<Drive name for removable media>:\lisp_success.doc
<Drive name for removable media>:\contoso.cer
<Drive name for removable media>:\pmd.cer
%ProgramFiles%\microsoft office\office14\groove\xml files\starterapplicationdescriptors.xml
<Drive name for removable media>:\contosoroot.cer
%ProgramFiles%\microsoft office\office14\groove\xml files\messenger.xml
%ProgramFiles%\microsoft office\clipart\pub60cor\j0178639.jpg
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\welcome tool\iconimages.jpg
%ProgramFiles(x86)%\mozilla thunderbird\searchplugins\twitter.xml
%ProgramFiles(x86)%\mozilla thunderbird\searchplugins\wikipedia.xml

Modifies multiple files.

Modifies user data files (Trojan.Encoder).

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial