Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Window Smart' = '%PROGRAM_FILES%\WindowSmart\smartwindow.exe'
- '%PROGRAM_FILES%\WindowSmart\smartwindow.exe'
- '%PROGRAM_FILES%\WindowSmart\inssw.exe' Y;<Полный путь к вирусу>;
- '<SYSTEM32>\cmd.exe' /c \smicd.bat
- %PROGRAM_FILES%\WindowSmart\smartwindow.ini
- %TEMP%\nse2.tmp\System.dll
- %PROGRAM_FILES%\WindowSmart\uninstall.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\filechk[1].htm
- C:\smicd.bat
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\su[1].htm
- %PROGRAM_FILES%\WindowSmart\smartwindow.exe
- %PROGRAM_FILES%\WindowSmart\smartwindow.dll
- %PROGRAM_FILES%\WindowSmart\inssw.exe
- %PROGRAM_FILES%\WindowSmart\spacern.exe
- %PROGRAM_FILES%\WindowSmart\smartwindowvw2.exe
- %PROGRAM_FILES%\WindowSmart\smartwindowvw1.exe
- %PROGRAM_FILES%\WindowSmart\inssw.exe
- %TEMP%\nse2.tmp\System.dll
- 'en#.###rtwindow.co.kr':80
- 'lo#.###rtwindow.co.kr':80
- en#.###rtwindow.co.kr/filechk.php
- lo#.###rtwindow.co.kr/su.php
- DNS ASK en#.###rtwindow.co.kr
- DNS ASK lo#.###rtwindow.co.kr