Trojan.Encoder.41537

Technical Information

To ensure autorun and distribution

Creates the following files on removable media

<Drive name for removable media>:\@d0glun@.exe
<Drive name for removable media>:\1.bat
<Drive name for removable media>:\krsweden.rtf

Malicious functions

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Windows Task Manager (Taskmgr)

Reads files which store third party applications passwords

%HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
%HOMEPATH%\desktop\fi51.doc
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx
%HOMEPATH%\desktop\glidescope_review_rev_010.docx
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
%HOMEPATH%\desktop\lisp_success.doc
%HOMEPATH%\desktop\nwfieldnotes1966.docx
%HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
%HOMEPATH%\desktop\about.html
%HOMEPATH%\desktop\api-hashmap.html
%HOMEPATH%\desktop\ituneshelpunavailable.html
%HOMEPATH%\desktop\trivial-merge.html

Searches for windows to

detect analytical utilities:

ClassName: 'Regmonclass', WindowName: ''
ClassName: 'Filemonclass', WindowName: ''

Modifies file system

Creates the following files

C:\@d0glun@.exe
%HOMEPATH%\desktop\@d0glun@.key.vbs
%HOMEPATH%\desktop\0nion@ВќГ®ВґВЁ&.exe
%HOMEPATH%\desktop\0nion@ВќГ®ВґВЁ&.txt
C:\@main wallpaper.bmp
%HOMEPATH%\desktop\time 2025Г¤ГЄ1ГґГў25ГЁГµ10ГЄВ±20В·Г¶21ГЈГ«.txt
C:\ВќГ®ВґВЁ.ico
%WINDIR%\reg.reg
%WINDIR%\1.bat
%CommonProgramFiles%\microsoft shared\stationery\cave_drawings.gif.@d0glun@gif
%CommonProgramFiles%\microsoft shared\stationery\connectivity.gif.@d0glun@gif
%CommonProgramFiles%\microsoft shared\stationery\stucco.gif.@d0glun@gif
C:\@d0glun2@.bmp
C:\help.exe
%HOMEPATH%\desktop\@d0glun@.bmp
%CommonProgramFiles%\microsoft shared\stationery\tiki.gif.@d0glun@gif
%HOMEPATH%\desktop\lnk.0nion@ВќГ®ВґВЁ&
%CommonProgramFiles%\microsoft shared\stationery\wrinkled_paper.gif.@d0glun@gif
%HOMEPATH%\desktop\1.mp4.0nion@ВќГ®ВґВЁ&
%HOMEPATH%\desktop\1.docx.0nion@ВќГ®ВґВЁ&
D:\@d0glun@.exe
D:\1.bat
%HOMEPATH%\desktop\1.@d0glun@.key
%HOMEPATH%\desktop\2.@d0glun@.key
C:\1.bat
%HOMEPATH%\desktop\3.@d0glun@.key
%HOMEPATH%\desktop\4.@d0glun@.key
%HOMEPATH%\desktop\5.@d0glun@.key
%HOMEPATH%\desktop\6.@d0glun@.key
%HOMEPATH%\desktop\7.@d0glun@.key
%HOMEPATH%\desktop\1.exe.0nion@ВќГ®ВґВЁ&
%HOMEPATH%\desktop\2.txt.0nion@ВќГ®ВґВЁ&
%HOMEPATH%\desktop\3.zip.0nion@ВќГ®ВґВЁ&
%HOMEPATH%\desktop\1.rar.0nion@ВќГ®ВґВЁ&
%HOMEPATH%\desktop\1.doc.0nion@ВќГ®ВґВЁ&
%HOMEPATH%\desktop\1.pdf.0nion@ВќГ®ВґВЁ&
%TEMP%\temp_random_data.dat

Sets the 'hidden' attribute to the following files

D:\1.bat
<Drive name for removable media>:\1.bat
C:\1.bat

Deletes the following files

%TEMP%\temp_random_data.dat

Moves the following files

from %HOMEPATH%\desktop\0nion@ВќГ®ВґВЁ&.txt to %HOMEPATH%\desktop\0nion@ВќГ®ВґВЁ&.txt.@d0glun@txt
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01245_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01245_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01244_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01244_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01243_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01243_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01242_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01242_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01241_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01241_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01240_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01240_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01239_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01239_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01238_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01238_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01237_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01237_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01219_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01219_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ph03014_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ph03014_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ph02845g.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ph02845g.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ph02752g.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ph02752g.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ph02750g.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ph02750g.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ph02749g.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ph02749g.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ph02748g.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ph02748g.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ph02746g.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ph02746g.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ph02743g.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ph02743g.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ph02742g.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ph02742g.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ph02740g.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ph02740g.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ph02736g.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ph02736g.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ph01255g.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ph01255g.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ph00601g.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ph00601g.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0099203.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\j0099203.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0099202.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\j0099202.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01246_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01246_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01253_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01253_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01268_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01268_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01292_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01292_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01839_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01839_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01838_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01838_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01770_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01770_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01751_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01751_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01750_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01750_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01749_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01749_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01748_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01748_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01747_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01747_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01746_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01746_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01745_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01745_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01744_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01744_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01743_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01743_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01740_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01740_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01742_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01742_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01734_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01734_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01330_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01330_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01304g.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01304g.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01301_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01301_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01300_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01300_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01299_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01299_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01298_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01298_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01297_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01297_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01296_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01296_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01295_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01295_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01294_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01294_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01293_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01293_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01840_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01840_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0099201.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\j0099201.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0099200.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\j0099200.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0099199.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\j0099199.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00130_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00130_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00129_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00129_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00126_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00126_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00120_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00120_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00103_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00103_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00092_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00092_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00090_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00090_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00057_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00057_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00052_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00052_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00040_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00040_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00038_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00038_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00037_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00037_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00021_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00021_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00011_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00011_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00004_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00004_.gif.@d0glun@gif
from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_movenodrop32x32.gif to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_movenodrop32x32.gif.@d0glun@gif
from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_movedrop32x32.gif to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_movedrop32x32.gif.@d0glun@gif
from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_linknodrop32x32.gif to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_linknodrop32x32.gif.@d0glun@gif
from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_linkdrop32x32.gif to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_linkdrop32x32.gif.@d0glun@gif
from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_copynodrop32x32.gif to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_copynodrop32x32.gif.@d0glun@gif
from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_copydrop32x32.gif to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\win32_copydrop32x32.gif.@d0glun@gif
from %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\invalid32x32.gif to %ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\invalid32x32.gif.@d0glun@gif
from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\splash@2x.gif to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\splash@2x.gif.@d0glun@gif
from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\splash.gif to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\splash.gif.@d0glun@gif
from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\ffjcext.zip to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\ffjcext.@d0glun@zip
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00135_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00135_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00139_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00139_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00142_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00142_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00154_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00154_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0099197.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\j0099197.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0099196.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\j0099196.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0099195.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\j0099195.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0099194.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\j0099194.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0099193.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\j0099193.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0099192.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\j0099192.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0075478.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\j0075478.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd19582_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\bd19582_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd19563_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\bd19563_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd10972_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\bd10972_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\bd10890_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\bd10890_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00176_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00176_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00174_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00174_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00175_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00175_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00172_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00172_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00171_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00171_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00170_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00170_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00169_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00169_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00167_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00167_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00165_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00165_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00164_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00164_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00163_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00163_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00161_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00161_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00160_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00160_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00158_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00158_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\ag00157_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\ag00157_.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\j0099198.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\j0099198.gif.@d0glun@gif
from %ProgramFiles%\microsoft office\clipart\pub60cor\wb01842_.gif to %ProgramFiles%\microsoft office\clipart\pub60cor\wb01842_.gif.@d0glun@gif

Modifies the following files

<Drive name for removable media>:\krsweden.rtf
%CommonProgramFiles%\microsoft shared\themes14\deepblue\preview.gif
%CommonProgramFiles%\microsoft shared\themes14\concrete\preview.gif
%CommonProgramFiles%\microsoft shared\themes14\compass\preview.gif
%CommonProgramFiles%\microsoft shared\themes14\cascade\preview.gif
%CommonProgramFiles%\microsoft shared\themes14\capsules\preview.gif
%CommonProgramFiles%\microsoft shared\themes14\canyon\preview.gif
%CommonProgramFiles%\microsoft shared\themes14\breeze\preview.gif
%CommonProgramFiles%\microsoft shared\themes14\boldstri\preview.gif
%CommonProgramFiles%\microsoft shared\themes14\blueprnt\preview.gif
%CommonProgramFiles%\microsoft shared\themes14\bluecalm\preview.gif
%CommonProgramFiles%\microsoft shared\themes14\blends\preview.gif
%CommonProgramFiles%\microsoft shared\themes14\axis\preview.gif
%CommonProgramFiles%\microsoft shared\themes14\arctic\preview.gif
%CommonProgramFiles%\microsoft shared\themes14\aftrnoon\preview.gif
%CommonProgramFiles%\microsoft shared\grphflt\ms.gif
%HOMEPATH%\desktop\trivial-merge.html
%HOMEPATH%\desktop\ituneshelpunavailable.html
%HOMEPATH%\desktop\api-hashmap.html
%HOMEPATH%\desktop\about.html
%HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
%HOMEPATH%\desktop\nwfieldnotes1966.docx
%HOMEPATH%\desktop\lisp_success.doc
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
%HOMEPATH%\desktop\glidescope_review_rev_010.docx
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx
%HOMEPATH%\desktop\fi51.doc
%HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
%CommonProgramFiles%\microsoft shared\themes14\echo\preview.gif
%CommonProgramFiles%\microsoft shared\themes14\eclipse\preview.gif

Modifies multiple files.

Modifies user data files (Trojan.Encoder).

Miscellaneous

Searches for the following windows

ClassName: '4823-00000029' WindowName: ''
ClassName: '18467-41' WindowName: ''
ClassName: '' WindowName: 'Taskmgr.exe'

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c D:\1.bat
'%WINDIR%\syswow64\cmd.exe' /c <Drive name for removable media>:\1.bat
'%WINDIR%\syswow64\cmd.exe' /c C:\1.bat
'%WINDIR%\syswow64\cmd.exe' /c D:\1.bat' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c <Drive name for removable media>:\1.bat' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c C:\1.bat' (with hidden window)

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial