Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'flashget' = '%WINDIR%\20110714\ntjd882s5cbgpqeo\smss.exe '
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\ .jse
- %WINDIR%\20110714\Ntjd882S5CbgpQEO\smss.exe
- <SYSTEM32>\reg.exe add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v "flashget" /d "%WINDIR%\20110714\ntjd882s5cbgpqeo\smss.exe " /f
- <SYSTEM32>\cmd.exe /c ""<Полный путь к вирусу>.bat" "
- <SYSTEM32>\cmd.exe /c ""%WINDIR%\20110714\Ntjd882S5CbgpQEO\smss.exe.bat" "
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\data[1].xml
- <Полный путь к вирусу>.bat
- %WINDIR%\Survival_0.txt
- %WINDIR%\20110714\Ntjd882S5CbgpQEO\smss.exe
- %WINDIR%\20110714\Ntjd882S5CbgpQEO\smss.exe.bat
- 'tj.##ppin.cn':80
- 'da###.yoou8.com':80
- 'localhost':1038
- tj.##ppin.cnhttp://tj.vippin.cn/api/work.aspx?cm########################################################################################################
- da###.yoou8.com/data.xml
- DNS ASK tj.##ppin.cn
- DNS ASK da###.yoou8.com
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Maxthon2_Frame' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''