Trojan.Encoder.41496

Technical Information

To ensure autorun and distribution

Creates the following files on removable media

<Drive name for removable media>:\price030215.zip.blocked
<Drive name for removable media>:\howtorestoremyfiles.txt
<Drive name for removable media>:\contractualdeadlines.zip.blocked
<Drive name for removable media>:\calculatorworksheet.zip.blocked
<Drive name for removable media>:\productos.zip.blocked
<Drive name for removable media>:\removedtitles_records.zip.blocked
<Drive name for removable media>:\2013_finalsummaryforweb.xlsx.blocked

Malicious functions

Executes the following

'<SYSTEM32>\taskkill.exe' /F /IM Raccine.exe
'<SYSTEM32>\taskkill.exe' /F /IM RaccineSettings.exe

Reads files which store third party applications passwords

%HOMEPATH%\desktop\tileimage.bmp
%HOMEPATH%\desktop\advice_process.htm
%HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
%HOMEPATH%\desktop\api-hashmap.html
%HOMEPATH%\desktop\archer.avi
%HOMEPATH%\desktop\browse.html
%HOMEPATH%\desktop\coffee.bmp
%HOMEPATH%\desktop\contoso.cer
%HOMEPATH%\desktop\contosoroot.cer
%HOMEPATH%\desktop\adadsi.html
%HOMEPATH%\desktop\contosoroot_1.cer
%HOMEPATH%\desktop\dial.bmp
%HOMEPATH%\desktop\dialmap.bmp
%HOMEPATH%\desktop\garden.htm
%HOMEPATH%\desktop\hanni_umami_chapter.doc
%HOMEPATH%\desktop\issi2013_template_for_posters.docx
%HOMEPATH%\desktop\ovp25012015.doc
%HOMEPATH%\desktop\sdksampleprivdeveloper.cer
%HOMEPATH%\desktop\sdksampleunprivdeveloper.cer
%HOMEPATH%\desktop\delete.avi
%HOMEPATH%\desktop\about.htm

Modifies file system

Creates the following files

%APPDATA%\howtorestoremyfiles.txt
%ALLUSERSPROFILE%\microsoft help\ms.onenote.14.1033.hxn.blocked
%ALLUSERSPROFILE%\microsoft help\howtorestoremyfiles.txt
%ALLUSERSPROFILE%\microsoft help\ms.ois.14.1033.hxn.blocked
%ALLUSERSPROFILE%\package cache\{fd9b6070-d13e-45dc-819b-41806bf45b6b}\state.rsm.blocked
%ALLUSERSPROFILE%\microsoft help\ms.outlook.14.1033.hxn.blocked
%ALLUSERSPROFILE%\microsoft help\ms.outlook.dev.14.1033.hxn.blocked
%ALLUSERSPROFILE%\microsoft help\ms.msaccess.14.1033.hxn.blocked
%ALLUSERSPROFILE%\microsoft help\ms.winword.dev.14.1033.hxn.blocked
%ALLUSERSPROFILE%\microsoft help\ms.winword.14.1033.hxn.blocked
%ALLUSERSPROFILE%\package cache\{fd9b6070-d13e-45dc-819b-41806bf45b6b}\howtorestoremyfiles.txt
%ALLUSERSPROFILE%\microsoft help\ms.groove.14.1033.hxn.blocked
%ALLUSERSPROFILE%\package cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\howtorestoremyfiles.txt
%ALLUSERSPROFILE%\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm.blocked
%ALLUSERSPROFILE%\package cache\{295d1583-fdb9-414b-a4c8-da539362a26b}\state.rsm.blocked
%ALLUSERSPROFILE%\microsoft help\ms.powerpnt.14.1033.hxn.blocked
%ALLUSERSPROFILE%\microsoft help\ms.infopatheditor.14.1033.hxn.blocked
%ALLUSERSPROFILE%\microsoft help\ms.msaccess.dev.14.1033.hxn.blocked
%ALLUSERSPROFILE%\microsoft help\ms.powerpnt.dev.14.1033.hxn.blocked
%ALLUSERSPROFILE%\microsoft help\nslist.hxl.blocked
%ALLUSERSPROFILE%\microsoft help\ms.setlang.14.1033.hxn.blocked
%ALLUSERSPROFILE%\microsoft help\ms.excel.14.1033.hxn.blocked
%ALLUSERSPROFILE%\package cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\state.rsm.blocked
%ALLUSERSPROFILE%\sun\java\java update\howtorestoremyfiles.txt
C:\users\public\music\sample music\howtorestoremyfiles.txt
C:\users\public\pictures\sample pictures\howtorestoremyfiles.txt
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\xlintl32.dll.trx_dll.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\xlintl32.rest.trx_dll.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\xlslicer.dll.trx_dll.blocked
%ALLUSERSPROFILE%\microsoft\rac\publisheddata\racwmidatabase.sdf.blocked
%ALLUSERSPROFILE%\microsoft\rac\publisheddata\howtorestoremyfiles.txt
%ALLUSERSPROFILE%\microsoft\rac\statedata\racdatabase.sdf.blocked
%ALLUSERSPROFILE%\microsoft\rac\statedata\howtorestoremyfiles.txt
%ALLUSERSPROFILE%\microsoft\user account pictures\howtorestoremyfiles.txt
C:\users\public\libraries\recordedtv.library-ms.blocked
%ALLUSERSPROFILE%\microsoft help\ms.mstore.14.1033.hxn.blocked
C:\users\public\libraries\howtorestoremyfiles.txt
C:\users\public\desktop\steam.lnk.blocked
C:\users\public\desktop\opera.lnk.blocked
C:\users\public\desktop\mozilla thunderbird.lnk.blocked
%ALLUSERSPROFILE%\microsoft help\hx.hxn.blocked
C:\users\public\desktop\firefox.lnk.blocked
%ALLUSERSPROFILE%\microsoft help\ms.msouc.14.1033.hxn.blocked
%ALLUSERSPROFILE%\microsoft help\ms.mspub.14.1033.hxn.blocked
%ALLUSERSPROFILE%\microsoft help\ms.mspub.dev.14.1033.hxn.blocked
C:\users\public\desktop\acrobat reader dc.lnk.blocked
%ALLUSERSPROFILE%\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\packages\vcruntimeminimum_amd64\vc_runtimeminimum_x64.msi.blocked
%ALLUSERSPROFILE%\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\packages\vcruntimeadditional_amd64\howtorestoremyfiles.txt
%ALLUSERSPROFILE%\microsoft help\ms.graph.14.1033.hxn.blocked
%ALLUSERSPROFILE%\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\packages\vcruntimeminimum_x86\vc_runtimeminimum_x86.msi.blocked
%ALLUSERSPROFILE%\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\packages\vcruntimeminimum_amd64\cab1.cab.blocked
%ALLUSERSPROFILE%\package cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\howtorestoremyfiles.txt
%ALLUSERSPROFILE%\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\packages\vcruntimeminimum_amd64\howtorestoremyfiles.txt
%ALLUSERSPROFILE%\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\packages\vcruntimeadditional_x86\howtorestoremyfiles.txt
%ALLUSERSPROFILE%\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\packages\vcruntimeadditional_amd64\howtorestoremyfiles.txt
%ALLUSERSPROFILE%\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\packages\vcruntimeminimum_x86\howtorestoremyfiles.txt
%ALLUSERSPROFILE%\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\packages\vcruntimeminimum_amd64\cab1.cab.blocked
%ALLUSERSPROFILE%\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\packages\vcruntimeminimum_x86\cab1.cab.blocked
%ALLUSERSPROFILE%\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\state.rsm.blocked
%ALLUSERSPROFILE%\microsoft help\ms.infopath.14.1033.hxn.blocked
%ALLUSERSPROFILE%\package cache\{ec9807de-b577-47b1-a024-0251805acf24}v14.29.30133\packages\vcruntimeminimum_x86\vc_runtimeminimum_x86.msi.blocked
%ALLUSERSPROFILE%\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\packages\vcruntimeadditional_amd64\vc_runtimeadditional_x64.msi.blocked
%ALLUSERSPROFILE%\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\howtorestoremyfiles.txt
%ALLUSERSPROFILE%\package cache\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\packages\vcruntimeminimum_amd64\cab1.cab.blocked
%ALLUSERSPROFILE%\package cache\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\packages\vcruntimeminimum_amd64\howtorestoremyfiles.txt
%ALLUSERSPROFILE%\package cache\{ec9807de-b577-47b1-a024-0251805acf24}v14.29.30133\packages\vcruntimeminimum_x86\howtorestoremyfiles.txt
%ALLUSERSPROFILE%\package cache\{ec9807de-b577-47b1-a024-0251805acf24}v14.29.30133\packages\vcruntimeminimum_x86\cab1.cab.blocked
%ALLUSERSPROFILE%\package cache\{f1b0fb3a-e0ea-47a6-9383-3650655403b0}v14.16.27024\packages\vcruntimeminimum_amd64\vc_runtimeminimum_x64.msi.blocked
%ALLUSERSPROFILE%\package cache\{f1b0fb3a-e0ea-47a6-9383-3650655403b0}v14.16.27024\packages\vcruntimeminimum_amd64\howtorestoremyfiles.txt
%ALLUSERSPROFILE%\oracle\java\installcache_x64\howtorestoremyfiles.txt
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\wwintl.rest.trx_dll.blocked
%ALLUSERSPROFILE%\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\packages\vcruntimeminimum_amd64\howtorestoremyfiles.txt
%ALLUSERSPROFILE%\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\packages\vcruntimeadditional_amd64\vc_runtimeadditional_x64.msi.blocked
%ALLUSERSPROFILE%\microsoft help\ms.excel.dev.14.1033.hxn.blocked
%ALLUSERSPROFILE%\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\packages\vcruntimeadditional_x86\vc_runtimeadditional_x86.msi.blocked
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\x64\windows6.1-kb2999226-x64.msu.blocked
%ALLUSERSPROFILE%\package cache\{295d1583-fdb9-414b-a4c8-da539362a26b}\howtorestoremyfiles.txt
%ALLUSERSPROFILE%\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\howtorestoremyfiles.txt
%ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\packages\vcruntimeminimum_x86\howtorestoremyfiles.txt
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\x64\howtorestoremyfiles.txt
%ALLUSERSPROFILE%\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\packages\vcruntimeadditional_x86\vc_runtimeadditional_x86.msi.blocked
%ALLUSERSPROFILE%\package cache\{9d29fc96-9eee-4253-943f-96b3bbfdd0b6}v14.16.27024\packages\vcruntimeadditional_amd64\vc_runtimeadditional_x64.msi.blocked
%ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\packages\vcruntimeminimum_x86\vc_runtimeminimum_x86.msi.blocked
%ALLUSERSPROFILE%\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\packages\vcruntimeminimum_amd64\vc_runtimeminimum_x64.msi.blocked
%ALLUSERSPROFILE%\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\packages\vcruntimeadditional_x86\howtorestoremyfiles.txt
%ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\packages\vcruntimeminimum_x86\cab1.cab.blocked
%ALLUSERSPROFILE%\package cache\{38b2c744-ad08-4d5b-91a2-3fb6f739ff3e}\state.rsm.blocked
%ALLUSERSPROFILE%\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\packages\vcruntimeadditional_amd64\vc_runtimeadditional_x64.msi.blocked
%ALLUSERSPROFILE%\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\packages\vcruntimeadditional_x86\howtorestoremyfiles.txt
%ALLUSERSPROFILE%\package cache\{9d29fc96-9eee-4253-943f-96b3bbfdd0b6}v14.16.27024\packages\vcruntimeadditional_amd64\howtorestoremyfiles.txt
%ALLUSERSPROFILE%\package cache\{38b2c744-ad08-4d5b-91a2-3fb6f739ff3e}\howtorestoremyfiles.txt
%ALLUSERSPROFILE%\package cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\state.rsm.blocked
%ALLUSERSPROFILE%\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\packages\vcruntimeadditional_amd64\howtorestoremyfiles.txt
%ALLUSERSPROFILE%\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\packages\vcruntimeadditional_x86\vc_runtimeadditional_x86.msi.blocked
%ALLUSERSPROFILE%\package cache\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\packages\vcruntimeminimum_amd64\vc_runtimeminimum_x64.msi.blocked
C:\users\public\recorded tv\sample media\howtorestoremyfiles.txt
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\ppintl.dll.trx_dll.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\pub6intl.dll.trx_dll.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\ppintl.rest.trx_dll.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\pub6intl.rest.trx_dll.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\sgres.dll.trx_dll.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\pubwzint.rest.trx_dll.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\stintl.dll.trx_dll.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\visbrres.dll.trx_dll.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\wwintl.dll.trx_dll.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\visintl.dll.trx_dll.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\wwintl.rest.trx_dll.blocked
%HOMEPATH%\searches\indexed locations.search-ms.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\xlslicer.dll.trx_dll.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\envelopr.dll.trx_dll.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\howtorestoremyfiles.txt
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\xlintl32.rest.trx_dll.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\grintl32.dll.trx_dll.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\grintl32.rest.trx_dll.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\mapir.dll.trx_dll.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\mor6int.rest.trx_dll.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\msointl.dll.trx_dll.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\outllibr.rest.trx_dll.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\xlintl32.dll.trx_dll.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\ppintl.dll.trx_dll.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\envelopr.dll.trx_dll.blocked
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\howtorestoremyfiles.txt
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acroread.msi.blocked
%ALLUSERSPROFILE%\microsoft\office\assetlibrary.ico.blocked
%ALLUSERSPROFILE%\microsoft\office\howtorestoremyfiles.txt
%ALLUSERSPROFILE%\microsoft\office\documentrepository.ico.blocked
%ALLUSERSPROFILE%\microsoft\office\mysharepoints.ico.blocked
%ALLUSERSPROFILE%\microsoft\office\sharepointportalsite.ico.blocked
%ALLUSERSPROFILE%\microsoft\office\mysite.ico.blocked
%ALLUSERSPROFILE%\microsoft\office\sharepointteamsite.ico.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\howtorestoremyfiles.txt
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\msointl.rest.trx_dll.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\grintl32.dll.trx_dll.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\grintl32.rest.trx_dll.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\mapir.dll.trx_dll.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\mor6int.rest.trx_dll.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\msointl.dll.trx_dll.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\omsintl.dll.trx_dll.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\onintl.dll.trx_dll.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\onintl.rest.trx_dll.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\outllibr.dll.trx_dll.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\outlwvw.dll.trx_dll.blocked
%HOMEPATH%\favorites\msn websites\msn money.url.blocked
C:\users\public\videos\sample videos\howtorestoremyfiles.txt
%HOMEPATH%\links\recentplaces.lnk.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\outllibr.dll.trx_dll.blocked
%HOMEPATH%\favorites\links\howtorestoremyfiles.txt
%HOMEPATH%\desktop\tileimage.bmp.blocked
%HOMEPATH%\desktop\telegram.lnk.blocked
%HOMEPATH%\desktop\sdksampleunprivdeveloper.cer.blocked
%HOMEPATH%\desktop\sdksampleprivdeveloper.cer.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\outllibr.rest.trx_dll.blocked
%HOMEPATH%\desktop\google chrome.lnk.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\outlwvw.dll.trx_dll.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\ppintl.rest.trx_dll.blocked
%HOMEPATH%\searches\everywhere.search-ms.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\pub6intl.dll.trx_dll.blocked
%HOMEPATH%\contacts\user.contact.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\pub6intl.rest.trx_dll.blocked
%HOMEPATH%\contacts\howtorestoremyfiles.txt
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\pubwzint.rest.trx_dll.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\sgres.dll.trx_dll.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\stintl.dll.trx_dll.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\visbrres.dll.trx_dll.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\visintl.dll.trx_dll.blocked
%HOMEPATH%\favorites\links\web slice gallery.url.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\wwintl.dll.trx_dll.blocked
%HOMEPATH%\favorites\links for united states\gobiernousa.gov.url.blocked
%HOMEPATH%\favorites\msn websites\msn sports.url.blocked
%HOMEPATH%\links\howtorestoremyfiles.txt
%HOMEPATH%\links\downloads.lnk.blocked
%HOMEPATH%\links\desktop.lnk.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\msointl.rest.trx_dll.blocked
%HOMEPATH%\favorites\msn websites\msnbc news.url.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\omsintl.dll.trx_dll.blocked
%HOMEPATH%\favorites\msn websites\howtorestoremyfiles.txt
%HOMEPATH%\favorites\msn websites\msn.url.blocked
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\onintl.dll.trx_dll.blocked
%HOMEPATH%\searches\howtorestoremyfiles.txt
%HOMEPATH%\favorites\links for united states\usa.gov.url.blocked
%HOMEPATH%\favorites\msn websites\msn entertainment.url.blocked
%HOMEPATH%\favorites\msn websites\msn autos.url.blocked
%HOMEPATH%\favorites\microsoft websites\microsoft store.url.blocked
%HOMEPATH%\favorites\microsoft websites\howtorestoremyfiles.txt
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\onintl.rest.trx_dll.blocked
%HOMEPATH%\favorites\microsoft websites\microsoft at work.url.blocked
%HOMEPATH%\favorites\microsoft websites\microsoft at home.url.blocked
%HOMEPATH%\favorites\microsoft websites\ie site on microsoft.com.url.blocked
%HOMEPATH%\favorites\microsoft websites\ie add-on site.url.blocked
%HOMEPATH%\favorites\links for united states\howtorestoremyfiles.txt
%ALLUSERSPROFILE%\package cache\{f1b0fb3a-e0ea-47a6-9383-3650655403b0}v14.16.27024\packages\vcruntimeminimum_amd64\cab1.cab.blocked

Modifies the following files

<Drive name for removable media>:\price030215.zip
%HOMEPATH%\favorites\microsoft websites\microsoft at home.url
%HOMEPATH%\favorites\microsoft websites\microsoft at work.url
%HOMEPATH%\favorites\microsoft websites\microsoft store.url
%HOMEPATH%\favorites\msn websites\msn autos.url
%HOMEPATH%\favorites\msn websites\msn entertainment.url
%HOMEPATH%\favorites\msn websites\msn money.url
%HOMEPATH%\favorites\msn websites\msn sports.url
%HOMEPATH%\favorites\msn websites\msn.url
%HOMEPATH%\favorites\msn websites\msnbc news.url
%HOMEPATH%\links\desktop.lnk
%HOMEPATH%\links\downloads.lnk
%HOMEPATH%\links\recentplaces.lnk
%HOMEPATH%\searches\everywhere.search-ms
%HOMEPATH%\searches\indexed locations.search-ms
%ALLUSERSPROFILE%\microsoft\office\sharepointteamsite.ico
%ALLUSERSPROFILE%\microsoft\office\mysite.ico
%ALLUSERSPROFILE%\microsoft\office\sharepointportalsite.ico
%ALLUSERSPROFILE%\microsoft\office\documentrepository.ico
%ALLUSERSPROFILE%\microsoft\office\mysharepoints.ico
%ALLUSERSPROFILE%\microsoft\office\assetlibrary.ico
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acroread.msi
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acrordrdcupd1501020056.msp.blocked
<Drive name for removable media>:\2013_finalsummaryforweb.xlsx
<Drive name for removable media>:\removedtitles_records.zip
<Drive name for removable media>:\productos.zip
<Drive name for removable media>:\calculatorworksheet.zip
<Drive name for removable media>:\contractualdeadlines.zip
%HOMEPATH%\favorites\microsoft websites\ie site on microsoft.com.url
%HOMEPATH%\favorites\microsoft websites\ie add-on site.url

Modifies multiple files.

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''

Executes the following

'<SYSTEM32>\cmd.exe' /c rd /s /q D:\\$Recycle.bin
'<SYSTEM32>\sc.exe' config SstpSvc start= disabled
'<SYSTEM32>\mountvol.exe' A: \\?\Volume{04a3ba4e-582d-11ef-9a48-806e6f6e6963}\
'<SYSTEM32>\mountvol.exe'
'<SYSTEM32>\mountvol.exe' G: \\?\Volume{04a3ba4f-582d-11ef-9a48-806e6f6e6963}\
'<SYSTEM32>\icacls.exe' "D:*" /grant Everyone:F /T /C /Q
'<SYSTEM32>\mountvol.exe' H: \\?\Volume{04a3ba50-582d-11ef-9a48-806e6f6e6963}\
'<SYSTEM32>\sc.exe' config MBAMService start= disabled
'<SYSTEM32>\icacls.exe' "C:*" /grant Everyone:F /T /C /Q
'<SYSTEM32>\cmd.exe' /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin
'<SYSTEM32>\mountvol.exe' I: \\?\Volume{04a3ba53-582d-11ef-9a48-806e6f6e6963}\
'<SYSTEM32>\sc.exe' config SQLTELEMETRY$ECWDB2 start= disabled
'<SYSTEM32>\sc.exe' config SQLTELEMETRY start= disabled
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Get-CimInstance Win32_ShadowCopy | Remove-CimInstance
'<SYSTEM32>\icacls.exe' "Z:*" /grant Everyone:F /T /C /Q
'<SYSTEM32>\schtasks.exe' /DELETE /TN "Raccine Rules Updater" /F
'<SYSTEM32>\mountvol.exe' B: \\?\Volume{907656e5-6a2a-11ef-872e-806e6f6e6963}\
'<SYSTEM32>\sc.exe' config SQLWriter start= disabled
'<SYSTEM32>\taskkill.exe' /F /IM Raccine.exe' (with hidden window)
'<SYSTEM32>\mountvol.exe' A: \\?\Volume{04a3ba4e-582d-11ef-9a48-806e6f6e6963}\' (with hidden window)
'<SYSTEM32>\mountvol.exe' H: \\?\Volume{04a3ba50-582d-11ef-9a48-806e6f6e6963}\' (with hidden window)
'<SYSTEM32>\icacls.exe' "C:*" /grant Everyone:F /T /C /Q' (with hidden window)
'<SYSTEM32>\mountvol.exe' G: \\?\Volume{04a3ba4f-582d-11ef-9a48-806e6f6e6963}\' (with hidden window)
'<SYSTEM32>\icacls.exe' "Z:*" /grant Everyone:F /T /C /Q' (with hidden window)
'<SYSTEM32>\mountvol.exe' I: \\?\Volume{04a3ba53-582d-11ef-9a48-806e6f6e6963}\' (with hidden window)
'<SYSTEM32>\cmd.exe' /c rd /s /q D:\\$Recycle.bin' (with hidden window)
'<SYSTEM32>\sc.exe' config SstpSvc start= disabled' (with hidden window)
'<SYSTEM32>\sc.exe' config MBAMService start= disabled' (with hidden window)
'<SYSTEM32>\sc.exe' config SQLWriter start= disabled' (with hidden window)
'<SYSTEM32>\sc.exe' config SQLTELEMETRY$ECWDB2 start= disabled' (with hidden window)
'<SYSTEM32>\sc.exe' config SQLTELEMETRY start= disabled' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Get-CimInstance Win32_ShadowCopy | Remove-CimInstance' (with hidden window)
'<SYSTEM32>\schtasks.exe' /DELETE /TN "Raccine Rules Updater" /F' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM RaccineSettings.exe' (with hidden window)
'<SYSTEM32>\cmd.exe' /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin' (with hidden window)
'<SYSTEM32>\mountvol.exe' B: \\?\Volume{907656e5-6a2a-11ef-872e-806e6f6e6963}\' (with hidden window)
'<SYSTEM32>\icacls.exe' "D:*" /grant Everyone:F /T /C /Q' (with hidden window)

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial