Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\Pr0tected Storage] 'ImagePath' = '%WINDIR%\windos.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Pr0tected Storage] 'Start' = '00000002'
- '<SYSTEM32>\cmd.exe' /c %WINDIR%\DELME.BAT
- '%ProgramFiles%\Internet Explorer\IEXPLORE.EXE'
- '%WINDIR%\windos.exe'
- IEXPLORE.EXE
- %WINDIR%\DELME.BAT
- %WINDIR%\windos.exe
- %WINDIR%\windos.exe
- '32###.ipread.com':8000
- DNS ASK 32###.ipread.com
- ClassName: 'Shell_TrayWnd' WindowName: ''