Trojan.Encoder.26905

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%ALLUSERSPROFILE%\Start Menu\Programs\Startup\Dont_Worry.txt
%HOMEPATH%\Start Menu\Programs\Startup\Dont_Worry.txt
%HOMEPATH%\Start Menu\Programs\Startup\Shortcut to startup_local.lnk

Creates the following files on removable media:

<Drive name for removable media>:\Dont_Worry.txt

Malicious functions:

Reads files which store third party applications passwords:

%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\signons.sqlite

Modifies file system:

Creates the following files:

C:\Dont_Worry.txt
C:\Far2\Plugins\Compare\Dont_Worry.txt
C:\Far2\Plugins\Colorer\hrd\console\contrib\Dont_Worry.txt
C:\Far2\Plugins\Colorer\hrd\console\Dont_Worry.txt
C:\Far2\Plugins\Colorer\hrd\Dont_Worry.txt
C:\Far2\Plugins\Colorer\hrc\auto\types\Dont_Worry.txt
C:\Far2\Plugins\Colorer\hrc\auto\Dont_Worry.txt
C:\Far2\Plugins\Colorer\hrc\Dont_Worry.txt
C:\Far2\Plugins\Colorer\bin\Dont_Worry.txt
C:\Far2\Plugins\Colorer\Dont_Worry.txt
C:\Far2\Plugins\AutoWrap\Dont_Worry.txt
C:\Far2\Plugins\EditCase\Dont_Worry.txt
C:\Far2\Plugins\arclite\Dont_Worry.txt
C:\Far2\Plugins\Align\Dont_Worry.txt
C:\Far2\Plugins\7-Zip\Dont_Worry.txt
C:\Far2\Plugins\Dont_Worry.txt
C:\Far2\FExcept\Dont_Worry.txt
C:\Far2\Encyclopedia\Dont_Worry.txt
C:\Far2\Documentation\rus\Dont_Worry.txt
C:\Far2\Documentation\eng\Dont_Worry.txt
C:\Far2\Plugins\Brackets\Dont_Worry.txt
C:\Far2\Plugins\WinSCP\filezilla\misc\Dont_Worry.txt
C:\Far2\Plugins\EMenu\Dont_Worry.txt
C:\Far2\Plugins\WinSCP\fari\Dont_Worry.txt
C:\Far2\Plugins\WinSCP\far\Dont_Worry.txt
C:\Far2\Plugins\WinSCP\dragext\Dont_Worry.txt
C:\Far2\Plugins\WinSCP\core\Dont_Worry.txt
C:\Far2\Plugins\WinSCP\console\Dont_Worry.txt
C:\Far2\Plugins\WinSCP\components\Dont_Worry.txt
C:\Far2\Plugins\WinSCP\Dont_Worry.txt
C:\Far2\Plugins\TmpPanel\Dont_Worry.txt
C:\Far2\Plugins\ProcList\Dont_Worry.txt
C:\Far2\Documentation\Dont_Worry.txt
C:\Far2\Plugins\DrawLine\Dont_Worry.txt
C:\Far2\Plugins\HlfViewer\Dont_Worry.txt
C:\Far2\Plugins\FTP\lib\Dont_Worry.txt
C:\Far2\Plugins\FTP\Dont_Worry.txt
C:\Far2\Plugins\FileCase\Dont_Worry.txt
C:\Far2\Plugins\FarCmds\Dont_Worry.txt
C:\Far2\Plugins\ExtSearch\sources\RegExp\Dont_Worry.txt
C:\Far2\Plugins\ExtSearch\sources\Dont_Worry.txt
C:\Far2\Plugins\ExtSearch\keys\Dont_Worry.txt
C:\Far2\Plugins\ExtSearch\doc\Dont_Worry.txt
C:\Far2\Plugins\MacroView\Dont_Worry.txt
C:\Far2\Plugins\ExtSearch\Dont_Worry.txt
C:\Far2\Plugins\Network\Dont_Worry.txt
C:\Far2\Plugins\WinSCP\filezilla\Dont_Worry.txt
C:\Far2\Addons\Shell\Dont_Worry.txt
%HOMEPATH%\Local Settings\<INETFILES>\Dont_Worry.txt
%HOMEPATH%\Local Settings\History\History.IE5\Dont_Worry.txt
%HOMEPATH%\Local Settings\History\Dont_Worry.txt
<LS_APPDATA>\VMware\Dont_Worry.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\Dont_Worry.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\F\Dont_Worry.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\E\Dont_Worry.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\D\Dont_Worry.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\C\Dont_Worry.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\B\Dont_Worry.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\A\Dont_Worry.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\9\Dont_Worry.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\8\Dont_Worry.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\7\Dont_Worry.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\6\Dont_Worry.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\5\Dont_Worry.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\4\Dont_Worry.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\3\Dont_Worry.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\2\Dont_Worry.txt
%HOMEPATH%\My Documents\Dont_Worry.txt
%HOMEPATH%\My Documents\Downloads\Dont_Worry.txt
C:\Far2\Addons\SetUp\Dont_Worry.txt
%HOMEPATH%\Start Menu\Programs\Accessories\Dont_Worry.txt
%HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\Dont_Worry.txt
C:\Far2\Addons\Macros\Dont_Worry.txt
C:\Far2\Addons\Colors\Default Highlighting\Dont_Worry.txt
C:\Far2\Addons\Colors\Custom Highlighting\Dont_Worry.txt
C:\Far2\Addons\Colors\Dont_Worry.txt
C:\Far2\Addons\Dont_Worry.txt
C:\Far2\Dont_Worry.txt
%HOMEPATH%\Templates\Dont_Worry.txt
%HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\Dont_Worry.txt
C:\Far2\Addons\XLat\Russian\Dont_Worry.txt
C:\Far2\Addons\XLat\Dont_Worry.txt
%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\Dont_Worry.txt
%HOMEPATH%\Start Menu\Dont_Worry.txt
%HOMEPATH%\SendTo\Dont_Worry.txt
%HOMEPATH%\Recent\Dont_Worry.txt
%HOMEPATH%\PrintHood\Dont_Worry.txt
%HOMEPATH%\NetHood\Dont_Worry.txt
%HOMEPATH%\My Documents\My Received Files\Dont_Worry.txt
%HOMEPATH%\My Documents\My Pictures\Dont_Worry.txt
%HOMEPATH%\My Documents\My Music\Dont_Worry.txt
%HOMEPATH%\Start Menu\Programs\Dont_Worry.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\Dont_Worry.txt
C:\Far2\Plugins\WinSCP\forms\Dont_Worry.txt
%CommonProgramFiles%\SpeechEngines\Microsoft\Dont_Worry.txt
%CommonProgramFiles%\SpeechEngines\Dont_Worry.txt
%CommonProgramFiles%\Services\Dont_Worry.txt
%CommonProgramFiles%\ODBC\Data Sources\Dont_Worry.txt
%CommonProgramFiles%\ODBC\Dont_Worry.txt
%CommonProgramFiles%\MSSoap\Binaries\Resources\1033\Dont_Worry.txt
%CommonProgramFiles%\MSSoap\Binaries\Resources\Dont_Worry.txt
%CommonProgramFiles%\MSSoap\Binaries\Dont_Worry.txt
%CommonProgramFiles%\MSSoap\Dont_Worry.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\_vti_bin\_vti_aut\Dont_Worry.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\_vti_bin\Dont_Worry.txt
%CommonProgramFiles%\SpeechEngines\Microsoft\TTS\Dont_Worry.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\servsupp\Dont_Worry.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\isapi\_vti_aut\Dont_Worry.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\isapi\_vti_adm\Dont_Worry.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\isapi\Dont_Worry.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bots\vinavbar\Dont_Worry.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bots\Dont_Worry.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\1033\Dont_Worry.txt
%CommonProgramFiles%\SpeechEngines\Microsoft\Lexicon\Dont_Worry.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\_vti_bin\_vti_adm\Dont_Worry.txt
C:\Far2\Plugins\WinSCP\lib\Dont_Worry.txt
%CommonProgramFiles%\SpeechEngines\Microsoft\TTS\1033\Dont_Worry.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\places\Dont_Worry.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\Dont_Worry.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\migration\Dont_Worry.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\history\Dont_Worry.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\feeds\Dont_Worry.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\certerror\Dont_Worry.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\bookmarks\Dont_Worry.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\Dont_Worry.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\Dont_Worry.txt
%CommonProgramFiles%\SpeechEngines\Microsoft\TTS\1033\sam.sdf.new
%CommonProgramFiles%\SpeechEngines\Microsoft\Lexicon\1033\Dont_Worry.txt
%ProgramFiles%\FireFox\chrome\browser\Dont_Worry.txt
%ProgramFiles%\FireFox\chrome\Dont_Worry.txt
%ProgramFiles%\FireFox\Dont_Worry.txt
%ProgramFiles%\ComPlus Applications\Dont_Worry.txt
%CommonProgramFiles%\System\Ole DB\Dont_Worry.txt
%CommonProgramFiles%\System\msadc\Dont_Worry.txt
%CommonProgramFiles%\System\ado\Dont_Worry.txt
%CommonProgramFiles%\System\Dont_Worry.txt
%ProgramFiles%\FireFox\chrome\browser\content\branding\Dont_Worry.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admisapi\scripts\Dont_Worry.txt
<SYSTEM32>\dllcache\sam.sdf.new
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admisapi\Dont_Worry.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admcgi\scripts\Dont_Worry.txt
%CommonProgramFiles%\Microsoft Shared\Dont_Worry.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\1\Dont_Worry.txt
%ProgramFiles%\Dont_Worry.txt
C:\Muldrop\Dont_Worry.txt
C:\Far2\PluginSDK\Headers.pas\Dont_Worry.txt
C:\Far2\PluginSDK\Headers.c\Dont_Worry.txt
C:\Far2\PluginSDK\Dont_Worry.txt
C:\Far2\Plugins\WinSCP\windows\Dont_Worry.txt
C:\Far2\Plugins\WinSCP\resource\Dont_Worry.txt
%CommonProgramFiles%\Microsoft Shared\DAO\Dont_Worry.txt
%CommonProgramFiles%\Microsoft Shared\DW\Dont_Worry.txt
C:\Far2\Plugins\WinSCP\release\Dont_Worry.txt
C:\Far2\Plugins\WinSCP\putty\Dont_Worry.txt
C:\Far2\Plugins\WinSCP\packages\theme\Dont_Worry.txt
C:\Far2\Plugins\WinSCP\packages\tbx\Dont_Worry.txt
C:\Far2\Plugins\WinSCP\packages\tb2k\Dont_Worry.txt
C:\Far2\Plugins\WinSCP\packages\my\Dont_Worry.txt
C:\Far2\Plugins\WinSCP\packages\filemng\Dont_Worry.txt
C:\Far2\Plugins\WinSCP\packages\dragndrop\Dont_Worry.txt
C:\Far2\Plugins\WinSCP\packages\Dont_Worry.txt
C:\Far2\Plugins\WinSCP\putty\windows\Dont_Worry.txt
C:\Far2\Plugins\WinSCP\putty\charset\Dont_Worry.txt
%TEMP%\Dont_Worry.txt
%CommonProgramFiles%\Microsoft Shared\DW\1028\Dont_Worry.txt
%CommonProgramFiles%\Microsoft Shared\Speech\Dont_Worry.txt
%CommonProgramFiles%\Microsoft Shared\Speech\1033\Dont_Worry.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\Dont_Worry.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\Dont_Worry.txt
%CommonProgramFiles%\Microsoft Shared\Web Folders\Dont_Worry.txt
%CommonProgramFiles%\Microsoft Shared\VGX\Dont_Worry.txt
%CommonProgramFiles%\Microsoft Shared\VC\Dont_Worry.txt
%CommonProgramFiles%\Microsoft Shared\Triedit\Dont_Worry.txt
%CommonProgramFiles%\Microsoft Shared\TextConv\Dont_Worry.txt
%CommonProgramFiles%\Microsoft Shared\Stationery\Dont_Worry.txt
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admcgi\Dont_Worry.txt
%CommonProgramFiles%\Microsoft Shared\DW\1025\Dont_Worry.txt
%CommonProgramFiles%\Dont_Worry.txt
%CommonProgramFiles%\Microsoft Shared\DW\3082\Dont_Worry.txt
%CommonProgramFiles%\Microsoft Shared\DW\2052\Dont_Worry.txt
%CommonProgramFiles%\Microsoft Shared\DW\1042\Dont_Worry.txt
%CommonProgramFiles%\Microsoft Shared\DW\1041\Dont_Worry.txt
%CommonProgramFiles%\Microsoft Shared\DW\1040\Dont_Worry.txt
%CommonProgramFiles%\Microsoft Shared\DW\1036\Dont_Worry.txt
%CommonProgramFiles%\Microsoft Shared\DW\1033\Dont_Worry.txt
%CommonProgramFiles%\Microsoft Shared\DW\1031\Dont_Worry.txt
%CommonProgramFiles%\Microsoft Shared\MSInfo\Dont_Worry.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\0\Dont_Worry.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\Dont_Worry.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Dont_Worry.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\Dont_Worry.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Dont_Worry.txt
C:\Documents and Settings\Default User\Local Settings\Temp\Dont_Worry.txt
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\Dont_Worry.txt
C:\Documents and Settings\Default User\Local Settings\History\Dont_Worry.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\Dont_Worry.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\Dont_Worry.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\Dont_Worry.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Dont_Worry.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Dont_Worry.txt
C:\Documents and Settings\Default User\Local Settings\Dont_Worry.txt
C:\Documents and Settings\Default User\Favorites\Dont_Worry.txt
C:\Documents and Settings\Default User\Desktop\Dont_Worry.txt
C:\Documents and Settings\Default User\Cookies\Dont_Worry.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\Dont_Worry.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\Dont_Worry.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\Dont_Worry.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Dont_Worry.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\Dont_Worry.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\Dont_Worry.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\Dont_Worry.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\Dont_Worry.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\Dont_Worry.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\Dont_Worry.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\Dont_Worry.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\Dont_Worry.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\Dont_Worry.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\Dont_Worry.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Dont_Worry.txt
C:\Documents and Settings\LocalService\Application Data\Dont_Worry.txt
C:\Documents and Settings\LocalService\Dont_Worry.txt
C:\Documents and Settings\Default User\Templates\Dont_Worry.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\Dont_Worry.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\Dont_Worry.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\Dont_Worry.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Dont_Worry.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Dont_Worry.txt
C:\Documents and Settings\Default User\Start Menu\Dont_Worry.txt
C:\Documents and Settings\Default User\SendTo\Dont_Worry.txt
C:\Documents and Settings\Default User\Recent\Dont_Worry.txt
C:\Documents and Settings\Default User\PrintHood\Dont_Worry.txt
C:\Documents and Settings\Default User\NetHood\Dont_Worry.txt
C:\Documents and Settings\Default User\My Documents\Dont_Worry.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\Dont_Worry.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\Dont_Worry.txt
C:\Documents and Settings\Default User\Application Data\Dont_Worry.txt
%ALLUSERSPROFILE%\Start Menu\Dont_Worry.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\Dont_Worry.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Pbk\Dont_Worry.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Cm\Dont_Worry.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Dont_Worry.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Dont_Worry.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Player\Dont_Worry.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Index\Dont_Worry.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\HTML Help\Dont_Worry.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Dr Watson\Dont_Worry.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Dont_Worry.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\Dont_Worry.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\Dont_Worry.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\MachineKeys\Dont_Worry.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\Dont_Worry.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\Dont_Worry.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Dont_Worry.txt
%ALLUSERSPROFILE%\Application Data\Dont_Worry.txt
%ALLUSERSPROFILE%\Dont_Worry.txt
C:\Documents and Settings\Dont_Worry.txt
<Current directory>\Dont_Worry.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\Dont_Worry.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\Dont_Worry.txt
%ALLUSERSPROFILE%\Desktop\Dont_Worry.txt
%ALLUSERSPROFILE%\Documents\My Music\My Playlists\Dont_Worry.txt
%ALLUSERSPROFILE%\Documents\Dont_Worry.txt
C:\Documents and Settings\Default User\Dont_Worry.txt
%ALLUSERSPROFILE%\Templates\Dont_Worry.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Games\Dont_Worry.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\Dont_Worry.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\Dont_Worry.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\Dont_Worry.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\Dont_Worry.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\Dont_Worry.txt
%ALLUSERSPROFILE%\Documents\My Music\Dont_Worry.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Dont_Worry.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Dont_Worry.txt
%ALLUSERSPROFILE%\Favorites\Dont_Worry.txt
%ALLUSERSPROFILE%\DRM\Dont_Worry.txt
%ALLUSERSPROFILE%\Documents\My Videos\Dont_Worry.txt
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Dont_Worry.txt
%ALLUSERSPROFILE%\Documents\My Pictures\Dont_Worry.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\Dont_Worry.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\Dont_Worry.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\Dont_Worry.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Dont_Worry.txt
%ProgramFiles%\FireFox\chrome\browser\content\Dont_Worry.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\Dont_Worry.txt
C:\Documents and Settings\LocalService\Cookies\Dont_Worry.txt
%APPDATA%\Microsoft\SystemCertificates\My\Dont_Worry.txt
%APPDATA%\Mozilla\Firefox\Profiles\Dont_Worry.txt
%APPDATA%\Mozilla\Firefox\Dont_Worry.txt
%APPDATA%\Mozilla\Extensions\Dont_Worry.txt
%APPDATA%\Mozilla\Dont_Worry.txt
%APPDATA%\Microsoft\Windows\Themes\Dont_Worry.txt
%APPDATA%\Microsoft\Windows\Dont_Worry.txt
%APPDATA%\Microsoft\SystemCertificates\My\CTLs\Dont_Worry.txt
%APPDATA%\Microsoft\SystemCertificates\My\CRLs\Dont_Worry.txt
%APPDATA%\Microsoft\SystemCertificates\My\Certificates\Dont_Worry.txt
%APPDATA%\Microsoft\SystemCertificates\Dont_Worry.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\Dont_Worry.txt
%APPDATA%\Microsoft\MMC\Dont_Worry.txt
%APPDATA%\Microsoft\Media Player\Dont_Worry.txt
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Dont_Worry.txt
%APPDATA%\Microsoft\Internet Explorer\Dont_Worry.txt
%APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\Dont_Worry.txt
%APPDATA%\Microsoft\Credentials\Dont_Worry.txt
%APPDATA%\Microsoft\Address Book\Dont_Worry.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\Dont_Worry.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\Dont_Worry.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\Dont_Worry.txt
<LS_APPDATA>\Microsoft\Dont_Worry.txt
<LS_APPDATA>\Microsoft\CD Burning\Dont_Worry.txt
<LS_APPDATA>\Mozilla\Firefox\Dont_Worry.txt
<LS_APPDATA>\Mozilla\Dont_Worry.txt
<LS_APPDATA>\Microsoft\Windows Media\9.0\Dont_Worry.txt
<LS_APPDATA>\Microsoft\Windows Media\Dont_Worry.txt
<LS_APPDATA>\Microsoft\Windows\Dont_Worry.txt
<LS_APPDATA>\Microsoft\Media Player\Dont_Worry.txt
<LS_APPDATA>\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\Dont_Worry.txt
<LS_APPDATA>\Microsoft\Credentials\Dont_Worry.txt
%APPDATA%\Microsoft\Dont_Worry.txt
%APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Dont_Worry.txt
%HOMEPATH%\Cookies\Dont_Worry.txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Dont_Worry.txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Dont_Worry.txt
<LS_APPDATA>\Identities\Dont_Worry.txt
<LS_APPDATA>\Dont_Worry.txt
%HOMEPATH%\Local Settings\Dont_Worry.txt
%HOMEPATH%\Favorites\Links\Dont_Worry.txt
%HOMEPATH%\Favorites\Dont_Worry.txt
%HOMEPATH%\Desktop\Dont_Worry.txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\Dont_Worry.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Dont_Worry.txt
%APPDATA%\Identities\Dont_Worry.txt
%APPDATA%\Dont_Worry.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\Dont_Worry.txt
C:\Documents and Settings\LocalService\Local Settings\Temp\Dont_Worry.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Dont_Worry.txt
C:\Documents and Settings\NetworkService\Application Data\Dont_Worry.txt
C:\Documents and Settings\NetworkService\Dont_Worry.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\MOE00UY1\Dont_Worry.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\LBMMC3H3\Dont_Worry.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\CJCTQ25G\Dont_Worry.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\BGGTYMH1\Dont_Worry.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\Dont_Worry.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\Dont_Worry.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Dont_Worry.txt
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\Dont_Worry.txt
C:\Documents and Settings\LocalService\Local Settings\History\Dont_Worry.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\Dont_Worry.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\Dont_Worry.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\Dont_Worry.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Dont_Worry.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Dont_Worry.txt
C:\Documents and Settings\LocalService\Local Settings\Dont_Worry.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\Dont_Worry.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\Dont_Worry.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\Dont_Worry.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\Dont_Worry.txt
%HOMEPATH%\Dont_Worry.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\Dont_Worry.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\Dont_Worry.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\Dont_Worry.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\Dont_Worry.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\Dont_Worry.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\Dont_Worry.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Dont_Worry.txt
C:\Documents and Settings\NetworkService\Local Settings\Temp\Dont_Worry.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Dont_Worry.txt
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\Dont_Worry.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\Dont_Worry.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\Dont_Worry.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\Dont_Worry.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Dont_Worry.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Dont_Worry.txt
C:\Documents and Settings\NetworkService\Local Settings\Dont_Worry.txt
C:\Documents and Settings\NetworkService\Cookies\Dont_Worry.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\Dont_Worry.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\Dont_Worry.txt
C:\Documents and Settings\NetworkService\Local Settings\History\Dont_Worry.txt
%ProgramFiles%\FireFox\chrome\browser\content\browser\safebrowsing\Dont_Worry.txt

Moves the following files:

from %APPDATA%\Microsoft\Internet Explorer\brndlog.bak to %APPDATA%\Microsoft\Internet Explorer\brndlog.bak.UPS-4666761d690b5093
from C:\Muldrop\dibohfmph_4 to C:\Muldrop\dibohfmph_4.UPS-331a405d26b7edd2
from C:\Muldrop\dibohfmph_5 to C:\Muldrop\dibohfmph_5.UPS-2a874cd75a4f69c4
from C:\Muldrop\dibohfmph_6 to C:\Muldrop\dibohfmph_6.UPS-1aa8a1a72937e654
from C:\Muldrop\dibohfmph_7 to C:\Muldrop\dibohfmph_7.UPS-759084e30197eee1
from C:\Muldrop\dibohfmph_8 to C:\Muldrop\dibohfmph_8.UPS-5f8090a316e16fa0
from C:\Muldrop\dibohfmph_9 to C:\Muldrop\dibohfmph_9.UPS-1d43e3943db72e3e
from C:\Muldrop\dibohfmph_foh_0 to C:\Muldrop\dibohfmph_foh_0.UPS-342e63513ba927b7
from C:\Muldrop\e42dd0d3858b58ec2ec37658219f6400_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_0 to C:\Muldrop\e42dd0d3858b58ec2ec37658219f6400_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_0.UPS-35a41e83347f1801
from C:\Muldrop\LICENSE_0 to C:\Muldrop\LICENSE_0.UPS-692b652a68c90f1c
from C:\Muldrop\mjdfodf_0 to C:\Muldrop\mjdfodf_0.UPS-334855cc07b8e015
from C:\Muldrop\dibohfmph_2 to C:\Muldrop\dibohfmph_2.UPS-21369d1f2d1a886c
from C:\Muldrop\dibohfmph_3 to C:\Muldrop\dibohfmph_3.UPS-2ac73890396f2589
from C:\Muldrop\README_0 to C:\Muldrop\README_0.UPS-56a537627304a0f4
from C:\Muldrop\_CACHE_002__0 to C:\Muldrop\_CACHE_002__0.UPS-6623dd3a3f890deb
from C:\Muldrop\_CACHE_003__0 to C:\Muldrop\_CACHE_003__0.UPS-5e127aad7e0d21e2
from C:\Muldrop\_CACHE_MAP__0 to C:\Muldrop\_CACHE_MAP__0.UPS-7f965187754208b4
from %ProgramFiles%\FireFox\blocklist.xml to %ProgramFiles%\FireFox\blocklist.xml.UPS-169f47d9548be59f
from %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutSyncTabs-bindings.xml to %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutSyncTabs-bindings.xml.UPS-4dafe0c507bcea1b
from %ProgramFiles%\FireFox\chrome\browser\content\browser\browser-tabPreviews.xml to %ProgramFiles%\FireFox\chrome\browser\content\browser\browser-tabPreviews.xml.UPS-5a1977557ff1e56b
from %ProgramFiles%\FireFox\chrome\browser\content\browser\feeds\subscribe.xml to %ProgramFiles%\FireFox\chrome\browser\content\browser\feeds\subscribe.xml.UPS-0b49f23e703f389f
from %ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\feeds.xml to %ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\feeds.xml.UPS-7271c96147d47c87
from %ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\pageInfo.xml to %ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\pageInfo.xml.UPS-1f6620416f95b9e7
from %ProgramFiles%\FireFox\chrome\browser\content\browser\places\menu.xml to %ProgramFiles%\FireFox\chrome\browser\content\browser\places\menu.xml.UPS-2990b54f13f574dc
from C:\Muldrop\sfbenf_0 to C:\Muldrop\sfbenf_0.UPS-73de7cee2ddfe58f
from C:\Muldrop\_CACHE_001__0 to C:\Muldrop\_CACHE_001__0.UPS-0f32afce3179ceef
from C:\Muldrop\dibohfmph_17 to C:\Muldrop\dibohfmph_17.UPS-3563658751ab8cb5
from C:\Muldrop\dibohfmph_16 to C:\Muldrop\dibohfmph_16.UPS-02e81efa65a18cab
from C:\Muldrop\dibohfmph_15 to C:\Muldrop\dibohfmph_15.UPS-3a7ad8323cd97983
from %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk to %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk.UPS-12ec25e02d569099
from %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk to %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk.UPS-4f39533b0d669a59
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db.UPS-603549c74a153bf5
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chromeappsstore.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chromeappsstore.sqlite.UPS-520903b23aa2ff04
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\content-prefs.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\content-prefs.sqlite.UPS-759938137304da51
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cookies.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cookies.sqlite.UPS-005fcfbc417eeb46
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\downloads.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\downloads.sqlite.UPS-7183131012fe2e09
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.sqlite.UPS-1bf503e12f876507
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\formhistory.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\formhistory.sqlite.UPS-5f5323ad701316e2
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db.UPS-37a2eb9823b6cff1
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\permissions.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\permissions.sqlite.UPS-395bd4ab4e27d708
from %APPDATA%\Microsoft\Internet Explorer\brndlog.txt to %APPDATA%\Microsoft\Internet Explorer\brndlog.txt.UPS-5921064968701b4e
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\places.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\places.sqlite.UPS-0723ccf66ef568f8
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db.UPS-3e520c4245b78454
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak.UPS-75aefbfe50bcdf60
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\signons.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\signons.sqlite.UPS-5bb0e9787c462852
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\webappsstore.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\webappsstore.sqlite.UPS-03fc70781190a351
from C:\Muldrop\dibohfmph_0 to C:\Muldrop\dibohfmph_0.UPS-3dcdc346503fa908
from C:\Muldrop\dibohfmph_1 to C:\Muldrop\dibohfmph_1.UPS-1e8731bb225956d8
from C:\Muldrop\dibohfmph_10 to C:\Muldrop\dibohfmph_10.UPS-31e8dcc77c54d2f4
from C:\Muldrop\dibohfmph_11 to C:\Muldrop\dibohfmph_11.UPS-1da952191071c2de
from C:\Muldrop\dibohfmph_12 to C:\Muldrop\dibohfmph_12.UPS-68da310a17941d7c
from C:\Muldrop\dibohfmph_13 to C:\Muldrop\dibohfmph_13.UPS-303a1f145baf83bd
from C:\Muldrop\dibohfmph_14 to C:\Muldrop\dibohfmph_14.UPS-4b88b14e3f8d7270
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.sqlite.UPS-43386a35695f8eca
from %ProgramFiles%\FireFox\chrome\browser\content\browser\places\tree.xml to %ProgramFiles%\FireFox\chrome\browser\content\browser\places\tree.xml.UPS-3972146e72e06710
from %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\handlers.xml to %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\handlers.xml.UPS-301b4d8d154f2b43

Substitutes the following files:

<SYSTEM32>\dllcache\sam.sdf.new

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Tecnologías

Términos

Formación y educación

Mitos

Technical Information

Curing recommendations

Free trial