Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '刷QQ空间' = '"<Полный путь к вирусу>" -autorun '
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\f2[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\f8[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\h1[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\f8[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\f8[1].htm
- %APPDATA%\QQClient\qqclient.dat
- %APPDATA%\QQClient\cfg.ini
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\h1[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\f10[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\h1[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\f8[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\f8[1].htm
- 'localhost':1043
- 'localhost':1044
- 'localhost':1042
- 'ap#.##uliangbao.cn':80
- 'localhost':1041
- ap#.##uliangbao.cn/as/c/f8/
- ap#.##uliangbao.cn/ts/f2.1/
- ap#.##uliangbao.cn/as/c/f10.1/
- ap#.##uliangbao.cn/as/2/h1/
- DNS ASK i.##.com
- DNS ASK ap.###liangbao.cn
- DNS ASK ap#.##uliangbao.cn
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'Indicator' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'