Техническая информация
- [<HKCU>\Software\Microsoft\Internet Explorer\Download] 'RunInvalidSignatures' = '00000001'
- [<HKCU>\Software\Microsoft\Internet Explorer\Download] 'CheckExeSignatures' = 'no'
- %HOMEPATH%\Start Menu\Virus Shield 2009.lnk
- %HOMEPATH%\Desktop\Virus Shield 2009.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Virus Shield 2009.lnk
- %HOMEPATH%\Start Menu\Programs\Virus Shield 2009.lnk
- <Текущая директория>\ProtectSystem\vd952342.bd
- %ALLUSERSPROFILE%\Application Data\ProtectSystem\shld.ini
- %APPDATA%\Virus Shield 2009\cookies.sqlite
- <Текущая директория>\BackUp\Shortcut to startup_local.lnk
- %ALLUSERSPROFILE%\Application Data\ProtectSystem\shld.ini
- 'pa####russhield.cn':80
- 'up###fnow.cn':80
- up###fnow.cn/reports/soft-report.php
- up###fnow.cn/reports/activate.php
- up###fnow.cn/reports/install-report.php
- DNS ASK pa####russhield.cn
- DNS ASK up###fnow.cn
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'TMainWindowVSH' WindowName: ''