It does the following:
- It skips scanning filenames containing the following strings in its full path name:
- $Recycle.Bin
- AppData
- Application Data
- ApplicationData
- Boot
- cache2
- Content.IE5
- Cookies
- DriverStore
- DVD Maker
- emo_cache_v2
- Extensions
- GAC_MSIL
- Games
- GOG Games
- History.IE5
- httpcache
- INetCache
- iTunes.Resources
- lol_game_client
- Microsoft
- microsoft shared
- My Games
- Program Files
- Program Files (x86)
- ProgramData
- steamapps
- System Volume Information
- System32
- Temp
- Temporary Internet Files
- tmp
- Windows
- winnt
- WinSAT
- WinSxS
- WinWDF
- It scans filenames containing the following extensions:
- avi
- divx
- jpeg
- jpg
- mkv
- mov
- mpe
- mpeg
- mpg
- pdf
- png
- qt
- rar
- rm
- sfv
- vob
- wmv
- xvid
- zip
- It checks if the filename contains the following strings:
- 1 yo
- 1 yr
- 10 yo
- 10 yr
- 10yo
- 10yr
- 1yo
- 1yr
- 2 yo
- 2 yr
- 2yo
- 2yr
- 3 yo
- 3 yr
- 3yo
- 3yr
- 4 yo
- 4 yr
- 4yo
- 4yr
- 5 yo
- 5 yr
- 5yo
- 5yr
- 6 yo
- 6 yr
- 6yo
- 6yr
- 7 yo
- 7 yr
- 7yo
- 7yr
- 8 yo
- 8 yr
- 8yo
- 8yr
- 9 yo
- 9 yr
- 9yo
- 9yr
- abused
- alice
- aliens stars
- aliens strs
- alinag
- alone
- alyonag
- alyonar
- anastasiak
- anastasias
- anitad
- anjelikal
- annat
- annaz
- assorties
- babies
- barbie
- batman
- biyankas
- builders
- candydoll
- candydolls
- candygirl
- candygirls
- child
- children in cinema
- confidential
- daisies
- dinay
- dreams
- duchess
- elenav
- elisam
- elizabetas
- evag
- fa-
- fairyland
- fallen girls
- fallg-
- fantasy
- flash
- forbidden
- fresh
- fruit
- happy
- hawaiian breeze
- holidays
- home
- hots
- incest
- innal
- irak
- irinab
- irynam
- issue
- jasminp
- juliyar
- katerynav
- kinderkutje
- kleuterkutje
- la2
- larisah
- las-
- last
- last virgins
- laurab
- lav-
- lbs-
- lerac
- lhv-
- liliyay
- little
- lkd-
- lolita
- lsb-
- lsbar-
- lsd
- lsh-
- lsm
- ls
- ls-magazine
- lsn-
- lsv-
- lswfall
- margaritad
- mashap
- mashas
- mayal
- milav
- milenas
- monikad
- mouse
- nadyas
- nastiak
- natashac
- ninat
- oksana
- olgas
- olhad
- olyay
- pedo
- pedofilia
- pedoland
- pedophilia
- pionap
- porn
- preteen
- pthc
- ptsc
- real
- ritak
- sashad
- sashal
- sex
- sharlottas
- short skirts
- show
- siberian
- siberianm
- silviyar
- sofiyav
- sonyam
- sp_
- special set
- stars
- stunning dolls
- svetlanat
- sweet
- syuzannar
- t-
- touch it
- twins
- ufo-
- ulyanaa
- ulyanam
- underage
- valensiyas
- valentines
- valeriyal
- variety
- victoriad
- victorias
- vikaz
- violetak
- virgins
- waterfall
- young
- yulias
- yuliyaz
- zinab
- It does not encrypt files.
- It locks the desktop and displays a customized ransom note depending on the data found inside the computer.
- Facebook Account Information
- Skype Account Information
- LinkedIn Account Information
- System Information
- Geolocation
- Webcam Capture
- IP Address
- PC Name
- User Name
- Torrent files
- Files containing questionable content
- It scans for torrent files in the following locations:
- %Application Data%\uTorrent
- %Application Data%\Azureus\active
- %Application Data%\Vuze Leap\.resume
- %Application Data%\qBittorrent\BT_backup
- %Application Data%\deluge\state
- It checks the following files to retrieve user's Skype, Facebook, and LinkedIn information:
- %Application Data%\Skype\shared.xml
- %Temporary Internet Files%\Content.IE5\index.dat
- %User Profile%\Cookies\index.dat
- %User Profile%\Local Settings\History\History.IE5\index.dat
(Note:
%Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\user name\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\user name\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012..
%User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\user name on Windows 2000, XP, and Server 2003, or C:\Users\user name on Windows Vista and 7.)