Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '360see' = '%WINDIR%\ime\360see.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'svchost' = '%WINDIR%\ime\360see.exe'
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\svchost.exe
- '%WINDIR%\ime\360see.exe' %ALLUSERSPROFILE%\start menu\programs\startup\svchost.exe
- '%ALLUSERSPROFILE%\Start Menu\Programs\Startup\svchost.exe'
- '%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' http://tj.##xth.com/01.html?00###############
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\01[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\1[1].txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\test[1].html
- %WINDIR%\ime\360see.exe
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\svchost.exe
- 'tj.##xth.com':80
- 'localhost':1037
- 'localhost':1035
- tj.##xth.com/01.html?00###############
- tj.##xth.com/1.txt
- tj.##xth.com/test.html
- DNS ASK tj.##xth.com
- ClassName: '' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'