Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '*YtTxe46' = ''
- <SYSTEM32>\rundll32.exe "%HOMEPATH%\Local Settings\hsL8SIxt\Ut0_DuMm.2Qo",HFF8
- <SYSTEM32>\cscript.exe
- %WINDIR%\Explorer.EXE
- <SYSTEM32>\ctfmon.exe
- <SYSTEM32>\rundll32.exe
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE
- %HOMEPATH%\Local Settings\hsL8SIxt\feuR78gX.iBZ
- %HOMEPATH%\Local Settings\hsL8SIxt\ERxYDaE6ZcaEcHQgE3LZFu6EcH6.0tq
- %HOMEPATH%\Local Settings\hsL8SIxt\BSK0GcRD.OYf
- %HOMEPATH%\Local Settings\hsL8SIxt\Ut0_DuMm.2Qo
- %HOMEPATH%\Local Settings\hsL8SIxt\MIVGcF7u.Z_d
- %HOMEPATH%\Local Settings\hsL8SIxt\gOFJLnt8.KRk
- '18#.#3.229.12':80
- 'bg###.servebbs.org':80
- 'wp#d':80
- wp#d/wpad.dat
- 18#.#3.229.12/
- DNS ASK bg###.servebbs.org
- DNS ASK wp#d
- ClassName: 'Indicator' WindowName: ''