Comment on Number 4: New Crypto does. It encrypts local documents and one version goes as far as to encrypt the entire C drive except for the Windows and Program Files directories. Also will go after USB drives.
In fact, the last infection I cleaned I found that Crypto had created a whole new Group Policy object such that as soon as a machine joined the domain then the group policy object would create a scheduled task that would run crypto.
JamesNT
.png "ACUF Donor I")
