Upon execution, the trojan searches for the files with following extensions. If found the files will be encrypted and a text file named read_me.txt will be placed in the directory.

.12m .3ds .3dx .4ge .4gl .7z .a .a86 .abc .acd .ace .act .ada .adi .aex .af3 .afd .ag4 .ai .aif .aifc
.aiff .ain .aio .ais .akf .alv .amp .ans .ap .apa .apo .app .arc .arh .arj .arx .asc .asm .ask .au
.bak .bas .bb .bcb .bcp .bdb .bh .bib .bpr .bsa .btr .bup .bwb .bz .bz2 .c .c86 .cac .cbl .cc .cdb
.cdr .cgi .cmd .cnt .cob .col .cpp .cpt .crp .cru .csc .css .csv .ctx .cvs .cwb .cwk .cxe .cxx .cyp
.d .db .db0 .db1 .db2 .db3 .db4 .dba .dbb .dbc .dbd .dbe .dbf .dbk .dbm .dbo .dbq .dbt .dbx .dfm
.djvu .dic .dif .dm .dmd .doc .dok .dot .dox .dsc .dwg .dxf .dxr .eps .exp .f .fas .fax .fdb .fla .flb
.frm .fm .fox .frm .frt .frx .fsl .gtd .gif .gz .gzip .h .ha .hh .hjt .hog .hpp .htm .html .htx .ice
.icf .inc .ish .iso .jar .jad .java .jpg .jpeg .js .jsp .key .kwm .lst .lwp .lzh .lzs .lzw .ma .mak
.man .maq .mar .mbx .mdb .mdf .mid .mo .myd .obj .old .p12 .pak .pas .pdf .pem .pfx .php
.php3 .php4 .pgp .pkr .pl .pm3 .pm4 .pm5 .pm6 .png .ppt .pps .prf .prx .ps .psd .pst .pw .pwa
.pwl .pwm .pwp .pxl .py .rar .res .rle .rmr .rnd .rtf .safe .sar .skr .sln .swf .sql .tar .tbb .tex
.tga .tgz .tif .tiff .txt .vb .vp .wps .xcr .xls .xml and .zip

The said read_me.txt file contains the following text.

Hello,    your   files   are   encrypted   with   RSA-4096   algorithm
(http://en.wikipedia.org/wiki/RSA).
You  will  need  at least few years to decrypt these files without our
software.  All  your  private  information  for  last  3  months  were
collected and sent to us.
To decrypt your files you need to buy our software. The price is $300.
To  buy  our software please contact us at: %s and provide us
your  personal code %d. After successful purchase we will send
your  decrypting  tool,  and  your private information will be deleted
from our system.
If  you  will not contact us until 07/15/2007 your private information
will be shared and you will lost all your data.
Glamorous team

It modifies the registry at the following location to load itself during each startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\winlogon\userinit

This trojan first appeared on July 16, 2007.

 Other names of W32/Gpcoder.H Trojan:

This trojan is also known as GPCoder.h, Win32/Kollah.D, Win32.Gpcode.ai.