Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'System' = 'kdsxw.exe'
- Изменяет DNS-сервер на '85.255.112.92'
- Изменяет DNS-сервер на '85.255.116.132'
- '%WINDIR%\explorer.exe'
- '<SYSTEM32>\spoolsv.exe'
- '%TEMP%\inst3.exe'
- '%TEMP%\inst1.exe'
- '%TEMP%\inst2.exe'
- <SYSTEM32>\cmd.exe
- %WINDIR%\explorer.exe
- %WINDIR%\explorer.exe
- %TEMP%\nsd4.tmp\modern-header.bmp
- %TEMP%\tmp3.tmp
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\index[1].htm
- <SYSTEM32>\kdsxw.exe
- %TEMP%\inst2.exe
- %TEMP%\inst1.exe
- %TEMP%\tmp2.tmp
- %TEMP%\inst3.exe
- %TEMP%\tmp3.tmp
- %TEMP%\tmp2.tmp
- %TEMP%\inst3.exe
- %TEMP%\inst1.exe
- %TEMP%\inst2.exe
- %TEMP%\inst3.exe в %WINDIR%\Temp\tmp5.tmp
- '21#.#55.186.238':80
- '<L####NET_GATEWAY>':80
- '64.##.183.12':80
- http:/// via <L####NET_GATEWAY>
- http:///home.asp via <L####NET_GATEWAY>
- http:///wizard.htm via <L####NET_GATEWAY>
- http://64.##.183.12/
- http:///index.asp via <L####NET_GATEWAY>
- http:///dlink/hwiz.html via <L####NET_GATEWAY>
- http://21#.#55.186.238/index.php
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '#32770' WindowName: ''