Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\RasAuto] 'Start' = '00000002'
- '<SYSTEM32>\net1.exe' start rasauto
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\49QV8P2J\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\H4HU2WCS\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\WLMNGHMV\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YV8XKRC5\desktop.ini
- %TEMP%\hbrqpii.dll
- <SYSTEM32>\knrsysff.exe
- %WINDIR%\Temp\56acd8.tmp
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YV8XKRC5\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\WLMNGHMV\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\H4HU2WCS\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\49QV8P2J\desktop.ini
- %TEMP%\hbrqpii.dll в <SYSTEM32>\hbrqpii.dll
- 'www.tr###myip.org':80
- www.tr###myip.org/
- DNS ASK www.tr###myip.org