Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Internet Security' = 'C:\ProgramData\indefender.exe'
- [<HKLM>\SYSTEM\ControlSet001\Control\Print\Providers\5fa15] 'Name' = '%TEMP%\F259.tmp'
- 'C:\ProgramData\indefender.exe'
- <SYSTEM32>\spoolsv.exe
- <Служебный элемент>
- <SYSTEM32>\cscript.exe
- <SYSTEM32>\cmd.exe
- C:\Users\Public\Desktop\Internet Security PRO 2013.lnk
- %WINDIR%\Temp\~DF878A6B9A602C5E93.TMP
- %TEMP%\F259.tmp
- C:\ProgramData\indefender
- C:\ProgramData\indefender в C:\ProgramData\indefender.exe
- из <Полный путь к вирусу> в %TEMP%\F5D3.tmp
- DNS ASK www.ba####masala.com
- DNS ASK so####rtal360.com
- DNS ASK sa###rboy.com
- DNS ASK dn#.##ftncsi.com
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''