Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ChromeFlashPlayersHardWare' = '"%APPDATA%\ChromeFlashPlayer_88e6680f8b982aa3.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] '*ChromeFlashPlayers32' = '"%APPDATA%\ChromeFlashPlayer_88e6680f8b982aa3.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Chrome Reader UpdateHardWare' = '"<Full path to virus>"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] '*Chrome Reader Update32' = '{22,00,43,00,3a,00,5c,00,62,00,66,00,33,00,32,00,64,00,33,00,62,00,30,00,5c,00,62,00,36,00,36,00,32,00,65...
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\HELP_DECRYPT_YOUR_FILES.TXT
- %HOMEPATH%\Start Menu\Programs\Startup\HELP_DECRYPT_YOUR_FILES.HTML
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\HELP_DECRYPT_YOUR_FILES.TXT
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\HELP_DECRYPT_YOUR_FILES.HTML
Modifies file system:
Creates the following files:
- C:\Far2\Addons\XLat\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Addons\XLat\Russian\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Addons\Shell\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Addons\XLat\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Addons\XLat\Russian\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Documentation\eng\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Documentation\eng\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Documentation\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Documentation\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Addons\Shell\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Addons\Colors\Custom Highlighting\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Addons\Colors\Default Highlighting\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Addons\Colors\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Addons\Colors\Custom Highlighting\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Addons\Colors\Default Highlighting\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Addons\SetUp\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Addons\SetUp\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Addons\Macros\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Addons\Macros\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Documentation\rus\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\arclite\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\AutoWrap\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\Align\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\arclite\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\AutoWrap\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\Colorer\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\Colorer\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\Brackets\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\Brackets\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\Align\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Encyclopedia\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\FExcept\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Documentation\rus\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Encyclopedia\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\FExcept\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\7-Zip\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\7-Zip\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Addons\Colors\HELP_DECRYPT_YOUR_FILES.TXT
- %HOMEPATH%\My Documents\My Pictures\HELP_DECRYPT_YOUR_FILES.HTML
- %HOMEPATH%\My Documents\My Received Files\HELP_DECRYPT_YOUR_FILES.TXT
- %HOMEPATH%\My Documents\My Music\HELP_DECRYPT_YOUR_FILES.HTML
- %HOMEPATH%\My Documents\My Pictures\HELP_DECRYPT_YOUR_FILES.TXT
- %HOMEPATH%\My Documents\My Received Files\HELP_DECRYPT_YOUR_FILES.HTML
- %HOMEPATH%\PrintHood\HELP_DECRYPT_YOUR_FILES.TXT
- %HOMEPATH%\PrintHood\HELP_DECRYPT_YOUR_FILES.HTML
- %HOMEPATH%\NetHood\HELP_DECRYPT_YOUR_FILES.TXT
- %HOMEPATH%\NetHood\HELP_DECRYPT_YOUR_FILES.HTML
- %HOMEPATH%\My Documents\My Music\HELP_DECRYPT_YOUR_FILES.TXT
- %TEMP%\HELP_DECRYPT_YOUR_FILES.HTML
- %HOMEPATH%\Local Settings\Temporary Internet Files\HELP_DECRYPT_YOUR_FILES.TXT
- %HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\HELP_DECRYPT_YOUR_FILES.HTML
- %TEMP%\HELP_DECRYPT_YOUR_FILES.TXT
- %HOMEPATH%\Local Settings\Temporary Internet Files\HELP_DECRYPT_YOUR_FILES.HTML
- %HOMEPATH%\My Documents\Downloads\HELP_DECRYPT_YOUR_FILES.TXT
- %HOMEPATH%\My Documents\Downloads\HELP_DECRYPT_YOUR_FILES.HTML
- %HOMEPATH%\My Documents\HELP_DECRYPT_YOUR_FILES.TXT
- %HOMEPATH%\My Documents\HELP_DECRYPT_YOUR_FILES.HTML
- %HOMEPATH%\Recent\HELP_DECRYPT_YOUR_FILES.TXT
- %HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\HELP_DECRYPT_YOUR_FILES.HTML
- %HOMEPATH%\Templates\HELP_DECRYPT_YOUR_FILES.TXT
- %HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\HELP_DECRYPT_YOUR_FILES.HTML
- %HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\HELP_DECRYPT_YOUR_FILES.TXT
- %HOMEPATH%\Templates\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Addons\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Addons\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\HELP_DECRYPT_YOUR_FILES.HTML
- %HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\HELP_DECRYPT_YOUR_FILES.TXT
- %HOMEPATH%\SendTo\HELP_DECRYPT_YOUR_FILES.HTML
- %HOMEPATH%\Start Menu\HELP_DECRYPT_YOUR_FILES.TXT
- %HOMEPATH%\Recent\HELP_DECRYPT_YOUR_FILES.HTML
- %HOMEPATH%\SendTo\HELP_DECRYPT_YOUR_FILES.TXT
- %HOMEPATH%\Start Menu\HELP_DECRYPT_YOUR_FILES.HTML
- %HOMEPATH%\Start Menu\Programs\Accessories\HELP_DECRYPT_YOUR_FILES.TXT
- %HOMEPATH%\Start Menu\Programs\Accessories\HELP_DECRYPT_YOUR_FILES.HTML
- %HOMEPATH%\Start Menu\Programs\HELP_DECRYPT_YOUR_FILES.TXT
- %HOMEPATH%\Start Menu\Programs\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\WinSCP\components\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\WinSCP\components\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\WinSCP\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\WinSCP\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\WinSCP\console\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\WinSCP\core\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\WinSCP\dragext\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\WinSCP\console\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\WinSCP\core\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\TmpPanel\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\MacroView\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\MacroView\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\HlfViewer\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\HlfViewer\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\Network\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\ProcList\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\TmpPanel\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\Network\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\ProcList\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\WinSCP\dragext\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\WinSCP\packages\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\WinSCP\packages\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\WinSCP\lib\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\WinSCP\lib\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\WinSCP\putty\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\WinSCP\putty\charset\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\WinSCP\putty\windows\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\WinSCP\putty\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\WinSCP\putty\charset\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\WinSCP\forms\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\WinSCP\fari\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\WinSCP\fari\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\WinSCP\far\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\WinSCP\far\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\WinSCP\filezilla\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\WinSCP\filezilla\misc\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\WinSCP\forms\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\WinSCP\filezilla\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\WinSCP\filezilla\misc\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\FTP\lib\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\Colorer\hrd\console\contrib\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\Colorer\hrd\console\contrib\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\Colorer\hrd\console\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\Colorer\hrd\console\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\Compare\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\DrawLine\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\EditCase\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\Compare\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\DrawLine\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\Colorer\hrd\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\Colorer\hrc\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\Colorer\hrc\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\Colorer\bin\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\Colorer\bin\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\Colorer\hrc\auto\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\Colorer\hrc\auto\types\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\Colorer\hrd\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\Colorer\hrc\auto\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\Colorer\hrc\auto\types\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\EditCase\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\FarCmds\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\FarCmds\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\ExtSearch\sources\RegExp\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\ExtSearch\sources\RegExp\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\FileCase\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\FTP\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\FTP\lib\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\FileCase\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\FTP\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\ExtSearch\sources\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\ExtSearch\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\ExtSearch\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\EMenu\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\EMenu\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\ExtSearch\doc\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\ExtSearch\keys\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\ExtSearch\sources\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Far2\Plugins\ExtSearch\doc\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Far2\Plugins\ExtSearch\keys\HELP_DECRYPT_YOUR_FILES.TXT
- %ALLUSERSPROFILE%\Start Menu\Programs\Games\HELP_DECRYPT_YOUR_FILES.HTML
- %ALLUSERSPROFILE%\Templates\HELP_DECRYPT_YOUR_FILES.TXT
- %ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\HELP_DECRYPT_YOUR_FILES.HTML
- %ALLUSERSPROFILE%\Start Menu\Programs\Games\HELP_DECRYPT_YOUR_FILES.TXT
- %ALLUSERSPROFILE%\Templates\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Documents and Settings\Default User\Application Data\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Documents and Settings\Default User\Application Data\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Documents and Settings\Default User\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Documents and Settings\Default User\HELP_DECRYPT_YOUR_FILES.HTML
- %ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\HELP_DECRYPT_YOUR_FILES.TXT
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\HELP_DECRYPT_YOUR_FILES.HTML
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\HELP_DECRYPT_YOUR_FILES.TXT
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\HELP_DECRYPT_YOUR_FILES.HTML
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\HELP_DECRYPT_YOUR_FILES.TXT
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\HELP_DECRYPT_YOUR_FILES.HTML
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\HELP_DECRYPT_YOUR_FILES.TXT
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\HELP_DECRYPT_YOUR_FILES.HTML
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\HELP_DECRYPT_YOUR_FILES.TXT
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Documents and Settings\Default User\Cookies\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Documents and Settings\Default User\Local Settings\History\History.IE5\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Documents and Settings\Default User\Local Settings\Temp\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Documents and Settings\Default User\Local Settings\History\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Documents and Settings\Default User\Local Settings\History\History.IE5\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Documents and Settings\Default User\Local Settings\Temp\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Documents and Settings\Default User\My Documents\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Documents and Settings\Default User\My Documents\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Documents and Settings\Default User\Local Settings\History\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Documents and Settings\Default User\Desktop\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Documents and Settings\Default User\Favorites\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Documents and Settings\Default User\Cookies\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Documents and Settings\Default User\Desktop\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Documents and Settings\Default User\Favorites\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Documents and Settings\Default User\Local Settings\Application Data\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Documents and Settings\Default User\Local Settings\Application Data\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Documents and Settings\Default User\Local Settings\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Documents and Settings\Default User\Local Settings\HELP_DECRYPT_YOUR_FILES.HTML
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\HELP_DECRYPT_YOUR_FILES.TXT
- %ALLUSERSPROFILE%\Desktop\HELP_DECRYPT_YOUR_FILES.HTML
- %ALLUSERSPROFILE%\Documents\HELP_DECRYPT_YOUR_FILES.TXT
- %ALLUSERSPROFILE%\Application Data\HELP_DECRYPT_YOUR_FILES.HTML
- %ALLUSERSPROFILE%\Desktop\HELP_DECRYPT_YOUR_FILES.TXT
- %ALLUSERSPROFILE%\Documents\HELP_DECRYPT_YOUR_FILES.HTML
- %ALLUSERSPROFILE%\Documents\My Music\My Playlists\HELP_DECRYPT_YOUR_FILES.TXT
- %ALLUSERSPROFILE%\Documents\My Music\My Playlists\HELP_DECRYPT_YOUR_FILES.HTML
- %ALLUSERSPROFILE%\Documents\My Music\HELP_DECRYPT_YOUR_FILES.TXT
- %ALLUSERSPROFILE%\Documents\My Music\HELP_DECRYPT_YOUR_FILES.HTML
- %ALLUSERSPROFILE%\Application Data\HELP_DECRYPT_YOUR_FILES.TXT
- C:\HELP_DECRYPT_YOUR_FILES.HTML
- <Current directory>\HELP_DECRYPT_YOUR_FILES.TXT
- %APPDATA%\ChromeFlashPlayer_88e6680f8b982aa3.exe
- C:\HELP_DECRYPT_YOUR_FILES.TXT
- <Current directory>\HELP_DECRYPT_YOUR_FILES.HTML
- %ALLUSERSPROFILE%\HELP_DECRYPT_YOUR_FILES.TXT
- %ALLUSERSPROFILE%\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Documents and Settings\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Documents and Settings\HELP_DECRYPT_YOUR_FILES.HTML
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\HELP_DECRYPT_YOUR_FILES.TXT
- %ALLUSERSPROFILE%\DRM\HELP_DECRYPT_YOUR_FILES.HTML
- %ALLUSERSPROFILE%\Favorites\HELP_DECRYPT_YOUR_FILES.TXT
- %ALLUSERSPROFILE%\Documents\My Videos\HELP_DECRYPT_YOUR_FILES.HTML
- %ALLUSERSPROFILE%\DRM\HELP_DECRYPT_YOUR_FILES.TXT
- %ALLUSERSPROFILE%\Favorites\HELP_DECRYPT_YOUR_FILES.HTML
- %ALLUSERSPROFILE%\Start Menu\Programs\HELP_DECRYPT_YOUR_FILES.TXT
- %ALLUSERSPROFILE%\Start Menu\Programs\HELP_DECRYPT_YOUR_FILES.HTML
- %ALLUSERSPROFILE%\Start Menu\HELP_DECRYPT_YOUR_FILES.TXT
- %ALLUSERSPROFILE%\Start Menu\HELP_DECRYPT_YOUR_FILES.HTML
- %ALLUSERSPROFILE%\Documents\My Videos\HELP_DECRYPT_YOUR_FILES.TXT
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\HELP_DECRYPT_YOUR_FILES.HTML
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\HELP_DECRYPT_YOUR_FILES.TXT
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\HELP_DECRYPT_YOUR_FILES.HTML
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\HELP_DECRYPT_YOUR_FILES.TXT
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\HELP_DECRYPT_YOUR_FILES.HTML
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\HELP_DECRYPT_YOUR_FILES.TXT
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\HELP_DECRYPT_YOUR_FILES.HTML
- %ALLUSERSPROFILE%\Documents\My Pictures\HELP_DECRYPT_YOUR_FILES.TXT
- %ALLUSERSPROFILE%\Documents\My Pictures\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Documents and Settings\NetworkService\Local Settings\History\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Documents and Settings\NetworkService\Local Settings\History\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Documents and Settings\NetworkService\Local Settings\Temp\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\HELP_DECRYPT_YOUR_FILES.HTML
- %HOMEPATH%\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Documents and Settings\NetworkService\Local Settings\Temp\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Documents and Settings\NetworkService\Application Data\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Documents and Settings\NetworkService\Application Data\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Documents and Settings\NetworkService\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Documents and Settings\NetworkService\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Documents and Settings\NetworkService\Cookies\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Documents and Settings\NetworkService\Local Settings\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Documents and Settings\NetworkService\Cookies\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Documents and Settings\NetworkService\Local Settings\HELP_DECRYPT_YOUR_FILES.TXT
- %HOMEPATH%\HELP_DECRYPT_YOUR_FILES.HTML
- <LS_APPDATA>\HELP_DECRYPT_YOUR_FILES.TXT
- <LS_APPDATA>\HELP_DECRYPT_YOUR_FILES.HTML
- %HOMEPATH%\Local Settings\HELP_DECRYPT_YOUR_FILES.TXT
- %HOMEPATH%\Local Settings\HELP_DECRYPT_YOUR_FILES.HTML
- %HOMEPATH%\Local Settings\History\HELP_DECRYPT_YOUR_FILES.TXT
- %HOMEPATH%\Local Settings\History\History.IE5\HELP_DECRYPT_YOUR_FILES.HTML
- %HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\HELP_DECRYPT_YOUR_FILES.TXT
- %HOMEPATH%\Local Settings\History\HELP_DECRYPT_YOUR_FILES.HTML
- %HOMEPATH%\Local Settings\History\History.IE5\HELP_DECRYPT_YOUR_FILES.TXT
- %HOMEPATH%\Favorites\Links\HELP_DECRYPT_YOUR_FILES.HTML
- %HOMEPATH%\Cookies\HELP_DECRYPT_YOUR_FILES.TXT
- %HOMEPATH%\Cookies\HELP_DECRYPT_YOUR_FILES.HTML
- %APPDATA%\HELP_DECRYPT_YOUR_FILES.TXT
- %APPDATA%\HELP_DECRYPT_YOUR_FILES.HTML
- %HOMEPATH%\Desktop\HELP_DECRYPT_YOUR_FILES.TXT
- %HOMEPATH%\Favorites\HELP_DECRYPT_YOUR_FILES.HTML
- %HOMEPATH%\Favorites\Links\HELP_DECRYPT_YOUR_FILES.TXT
- %HOMEPATH%\Desktop\HELP_DECRYPT_YOUR_FILES.HTML
- %HOMEPATH%\Favorites\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Documents and Settings\Default User\Start Menu\Programs\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Documents and Settings\Default User\Start Menu\Programs\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Documents and Settings\Default User\Start Menu\Programs\Startup\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Documents and Settings\Default User\Start Menu\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Documents and Settings\Default User\PrintHood\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Documents and Settings\Default User\PrintHood\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Documents and Settings\Default User\NetHood\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Documents and Settings\Default User\NetHood\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Documents and Settings\Default User\Recent\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Documents and Settings\Default User\SendTo\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Documents and Settings\Default User\Start Menu\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Documents and Settings\Default User\Recent\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Documents and Settings\Default User\SendTo\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Documents and Settings\Default User\Start Menu\Programs\Startup\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Documents and Settings\LocalService\Local Settings\History\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Documents and Settings\LocalService\Local Settings\History\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Documents and Settings\LocalService\Local Settings\Application Data\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Documents and Settings\LocalService\Local Settings\Application Data\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Documents and Settings\LocalService\Local Settings\Temp\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Documents and Settings\LocalService\Local Settings\Temp\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Documents and Settings\LocalService\Local Settings\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Documents and Settings\LocalService\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Documents and Settings\LocalService\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Documents and Settings\Default User\Templates\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Documents and Settings\Default User\Templates\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Documents and Settings\LocalService\Application Data\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Documents and Settings\LocalService\Cookies\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Documents and Settings\LocalService\Local Settings\HELP_DECRYPT_YOUR_FILES.TXT
- C:\Documents and Settings\LocalService\Application Data\HELP_DECRYPT_YOUR_FILES.HTML
- C:\Documents and Settings\LocalService\Cookies\HELP_DECRYPT_YOUR_FILES.TXT
Network activity:
Connects to:
- '62.##.195.136':80
- '74.##5.232.51':80
TCP:
HTTP GET requests:
- http://62.##.195.136/default.jpg
UDP:
- DNS ASK google.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''