Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Coltion' = '%WINDIR%\Collection.exe'
- '%TEMP%\RarSFX0\_Data.inx'
- '%TEMP%\RarSFX0\setup.exe'
- %TEMP%\RarSFX0\internet.fne
- %TEMP%\RarSFX0\krnln.fnr
- %TEMP%\RarSFX0\README.TXT
- %TEMP%\RarSFX0\iext.fnr
- %TEMP%\RarSFX0\dp1.fne
- %TEMP%\RarSFX0\eCompress.fne
- %TEMP%\RarSFX0\ExtMenu.fnr
- %HOMEPATH%\Favorites\Links\НшЦ·Ц®јТ[ОТХТАІ].url
- %WINDIR%\Collection.ini
- %TEMP%\RarSFX0\data\main.ldb
- %HOMEPATH%\Favorites\НшЦ·Ц®јТ[ОТХТАІ].url
- %ALLUSERSPROFILE%\Start Menu\Internet Explorer.lnk
- %HOMEPATH%\Desktop\Internet Explorer.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk
- %TEMP%\RarSFX0\up.dll
- %TEMP%\RarSFX0\XGJ.dll
- %TEMP%\RarSFX0\г¤-¦T¦+ў.txt
- %TEMP%\RarSFX0\uninstall.ini
- %TEMP%\RarSFX0\setup.exe
- %TEMP%\RarSFX0\shell.fne
- %TEMP%\RarSFX0\uninstall.exe
- %TEMP%\RarSFX0\data\XLTDZ.DAT
- %TEMP%\RarSFX0\data\L¦+¦=-¦м.gif
- %TEMP%\RarSFX0\_Data.inx
- %TEMP%\RarSFX0\data\XLT.LT
- %TEMP%\RarSFX0\data\main.mdb
- %TEMP%\RarSFX0\data\movie.gif
- %TEMP%\RarSFX0\data\sys.dat
- 'sq#.##173.com,2433':445
- 'sq#.#s173.com':2433
- DNS ASK sq#.##173.com,2433
- DNS ASK sq#.#s173.com
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''