Техническая информация
- [<HKLM>\SOFTWARE\Classes\IE\shell\open\command] '' = '%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE '
- расширений файлов
- '%TEMP%\52r2tpwq.exe'
- '%WINDIR%\takesoft.exe' <Полный путь к вирусу>===
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 1
- '<SYSTEM32>\taskkill.exe' /f /im ZhuDongFangyu.exe
- <SYSTEM32>\9.ico
- <SYSTEM32>\8.ico
- <SYSTEM32>\7.ico
- %TEMP%\52r2tpwq.exe
- %WINDIR%\dasoft.encode
- <SYSTEM32>\10.ico
- <SYSTEM32>\3.ico
- <SYSTEM32>\2.ico
- %WINDIR%\takesoft.exe
- <SYSTEM32>\6.ico
- <SYSTEM32>\5.ico
- <SYSTEM32>\4.ico
- %TEMP%\52r2tpwq.exe
- %WINDIR%\takesoft.exe в %WINDIR%\1imk1hgj.exe
- 'localhost':1036
- DNS ASK ge#.asp
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'Progman' WindowName: '(null)'
- ClassName: 'SHELLDLL_DefView' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: '(null)' WindowName: '(null)'
- ClassName: '' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'