Trojan.Encoder.854

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Classes\ENCTKRFRFZNZGAM\shell\open\command] '' = '%TEMP%\1Z7dCfmr9u291hD.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Alcmeter' = '%TEMP%\1Z7dCfmr9u291hD.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '<Virus name>.exe' = '<Full path to virus>'

Creates or modifies the following files:

%HOMEPATH%\Start Menu\Programs\Startup\Shortcut to startup_local.lnk
%HOMEPATH%\Start Menu\Programs\Startup\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\HOW TO DECRYPT FILES.txt

Malicious functions:

Creates and executes the following:

'%TEMP%\service.exe'

Modifies file system :

Creates the following files:

%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\preferences\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\profile\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\update\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\extensions\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\handling\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\plugins\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\pipnss\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\pippki\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\places\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\xpinstall\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\necko\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\passwordmgr\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\svg\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\xml\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\xpinstall\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\layout\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\search\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\security\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\win\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-region\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\downloads\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\xslt\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\mac\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\unix\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\profile\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\update\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\xpinstall\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\handling\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\plugins\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\preferences\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\alerts\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\passwordmgr\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\satchel\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\xbl-marquee\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\cookie\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\alerts\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\services\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\feedback\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\pippki\content\pippki\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\xml\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\downloads\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\extensions\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\svg\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\places\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\preferences\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\safebrowsing\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\history\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\migration\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\pageinfo\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\places\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\preferences\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\tabbrowser\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\search\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\feeds\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\System\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\System\msadc\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\System\Ole DB\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\SpeechEngines\Microsoft\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\SpeechEngines\Microsoft\TTS\1033\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\System\ado\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\bookmarks\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\certerror\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\feeds\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\content\branding\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\preferences\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\safebrowsing\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\sidebar\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\feeds\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\migration\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\places\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\cookie\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\dom\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser-region\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\alerts\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\autoconfig\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\places\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\preferences\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\tabbrowser\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\tabview\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\feeds\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\branding\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\downloads\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\tabview\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\communicator\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\searchplugins\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\uninstall\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\Internet Explorer\Connection Wizard\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\res\entityTables\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\res\fonts\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\res\html\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\Messenger\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\Microsoft.NET\RedistList\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\Movie Maker\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\Internet Explorer\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\Internet Explorer\MUI\0409\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\Internet Explorer\SIGNUP\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\modules\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\modules\services-crypto\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\defaults\profile\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\defaults\profile\chrome\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\dictionaries\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\modules\tabview\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\res\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\res\dtd\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\modules\services-sync\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\modules\services-sync\engines\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\modules\services-sync\ext\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.5\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.0\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\Windows NT\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\Windows NT\Pinball\HOW TO DECRYPT FILES.txt
C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\Windows Media Player\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\Windows Media Player\Skins\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\Windows NT\Accessories\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\MSN\MSNCoreFiles\Install\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\Movie Maker\MUI\0409\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\Movie Maker\Shared\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\Movie Maker\Shared\Profiles\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\NetMeeting\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\Online Services\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\Outlook Express\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\MSN\MSNCoreFiles\Install\MSN9Components\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\MSN\MSNCoreFiles\OOBE\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\MSN Gaming Zone\Windows\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\places\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\plugins\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\profile\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\handling\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\passwordmgr\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\alerts\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\arrow\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\update\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\viewsource\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\xpinstall\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\media\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\printpreview\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\checkbox\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\console\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\dirListing\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\toolbar\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\tree\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\downloads\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\radio\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\scrollbar\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\splitter\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\places\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\plugins\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\profile\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\handling\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\passwordmgr\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\components\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\defaults\autoconfig\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\defaults\pref\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\update\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\viewsource\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\xpinstall\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\icons\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\media\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\printpreview\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\checkbox\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\console\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\dirListing\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\toolbar\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\tree\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\downloads\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\radio\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\scrollbar\HOW TO DECRYPT FILES.txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\splitter\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\SpeechEngines\Microsoft\Lexicon\1033\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\LBMMC3H3\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\MOE00UY1\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\BGGTYMH1\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\History\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Start Menu\Programs\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Templates\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\History\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Cookies\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\HOW TO DECRYPT FILES.txt
%APPDATA%\Mozilla\Firefox\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Cookies\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Favorites\HOW TO DECRYPT FILES.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\HOW TO DECRYPT FILES.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\HOW TO DECRYPT FILES.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\Microsoft\Media Player\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\Microsoft\Windows\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\Microsoft\Windows Media\9.0\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Favorites\Links\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\HOW TO DECRYPT FILES.txt
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\HOW TO DECRYPT FILES.txt
%APPDATA%\Microsoft\Media Player\HOW TO DECRYPT FILES.txt
%APPDATA%\Microsoft\Windows\Themes\HOW TO DECRYPT FILES.txt
%APPDATA%\HOW TO DECRYPT FILES.txt
%APPDATA%\Microsoft\Address Book\HOW TO DECRYPT FILES.txt
%APPDATA%\Microsoft\Internet Explorer\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Documents\My Music\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Documents\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\DRM\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Documents\My Pictures\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Documents\My Videos\HOW TO DECRYPT FILES.txt
%TEMP%\dsc00084.jpg
%TEMP%\1Z7dCfmr9u291hD.exe
C:\HOW TO DECRYPT FILES.txt
%TEMP%\aut1.tmp
%TEMP%\service.exe
%TEMP%\aut2.tmp
%ALLUSERSPROFILE%\Application Data\Microsoft\Dr Watson\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Player\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Pbk\HOW TO DECRYPT FILES.txt
<Current directory>\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Application Data\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\History\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\SendTo\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Start Menu\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Cookies\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\HOW TO DECRYPT FILES.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Games\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Application Data\HOW TO DECRYPT FILES.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Network\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\ProcList\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\TmpPanel\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\FTP\lib\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\HlfViewer\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\MacroView\HOW TO DECRYPT FILES.txt
<Auxiliary element>
%CommonProgramFiles%\Microsoft Shared\DAO\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1025\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\WinSCP\HOW TO DECRYPT FILES.txt
C:\Far2\PluginSDK\Headers.c\HOW TO DECRYPT FILES.txt
C:\Far2\PluginSDK\Headers.pas\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\EMenu\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\ExtSearch\doc\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\ExtSearch\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Compare\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\DrawLine\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\EditCase\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\FarCmds\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\FileCase\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\FTP\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\ExtSearch\keys\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\ExtSearch\sources\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\ExtSearch\sources\RegExp\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\Triedit\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\VC\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\VGX\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\Speech\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\Stationery\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\TextConv\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\MSSoap\Binaries\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\MSSoap\Binaries\Resources\1033\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Services\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\Web Folders\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\1033\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1036\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1040\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1041\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1028\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1031\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1033\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\MSInfo\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\Speech\1033\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\1042\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\2052\HOW TO DECRYPT FILES.txt
%CommonProgramFiles%\Microsoft Shared\DW\3082\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Start Menu\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Start Menu\Programs\Accessories\HOW TO DECRYPT FILES.txt
%HOMEPATH%\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Recent\HOW TO DECRYPT FILES.txt
%HOMEPATH%\SendTo\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\Colors\Custom Highlighting\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\Colors\Default Highlighting\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\Colors\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Start Menu\Programs\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Templates\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Local Settings\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Local Settings\History\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Local Settings\History\History.IE5\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\HOW TO DECRYPT FILES.txt
<LS_APPDATA>\VMware\HOW TO DECRYPT FILES.txt
%HOMEPATH%\My Documents\HOW TO DECRYPT FILES.txt
%HOMEPATH%\My Documents\My Music\HOW TO DECRYPT FILES.txt
%HOMEPATH%\My Documents\My Pictures\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\HOW TO DECRYPT FILES.txt
%TEMP%\HOW TO DECRYPT FILES.txt
%HOMEPATH%\Local Settings\Temporary Internet Files\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Brackets\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\bin\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Align\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\arclite\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\AutoWrap\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\hrd\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\hrd\console\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\hrd\console\contrib\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\hrc\auto\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\hrc\auto\types\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\Colorer\hrc\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\Shell\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\XLat\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\XLat\Russian\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\Macros\HOW TO DECRYPT FILES.txt
C:\Far2\Addons\SetUp\HOW TO DECRYPT FILES.txt
C:\Far2\Encyclopedia\HOW TO DECRYPT FILES.txt
C:\Far2\FExcept\HOW TO DECRYPT FILES.txt
C:\Far2\Plugins\7-Zip\HOW TO DECRYPT FILES.txt
C:\Far2\HOW TO DECRYPT FILES.txt
C:\Far2\Documentation\eng\HOW TO DECRYPT FILES.txt
C:\Far2\Documentation\rus\HOW TO DECRYPT FILES.txt

Deletes the following files:

%TEMP%\aut2.tmp
%TEMP%\aut1.tmp

Moves the following files:

from %TEMP%\dsc00084.jpg to %TEMP%\dsc00084.jpg.zasifrovano

Miscellaneous:

Searches for the following windows:

ClassName: 'Indicator' WindowName: ''
ClassName: 'Shell_TrayWnd' WindowName: ''

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial