Gpcoder.d is a trojan that searches the infected system for files of predefined formats and encrypts them. The list of file formats includes text documents (.txt, .doc, .rtf, .pdf), spreadsheets (.xls), web pages (.htm, .html), archives (.rar, .zip, .tar, .arj, .gzip), programming projects (.cpp, .cgi), databases, password files and files of other types. Once Gpcoder.d encrypts a file, it creates a text document in a folder containing that file.
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun[filename]HKEY_CURRENT_USERSoftwareMicrosoftSysinfcur_not_done