Техническая информация
- [<HKLM>\SOFTWARE\Classes\IE\shell\open\command] '' = '%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE qs[*тлl`БvM‹|0Kтa‡ъЪhЈAcYЭ‘muBjj4тuиР%НFьґз<о=ћx Л?b·этGСїVY;9sЮпњ?ЇШ”їlD“ZЩJhѓIК^Аы в1eЂUи«’gd:Ы{_ќ9ъю)•іспМjNeщЃБµ^7а† “ед:ЖMGМчЊ!Т30ЏO^›Б•Гwµ 4ОЎЈД/®OњO»JІ®_mиHwи7°Dй/мСЄ'і56&<–kЁйГьЁQq•ыmо/Cґµцw/w],>И%еYПе‰'љэ$„—?Q џЮ"е5Мgbв4)»ц] sљбз”kш:Ає„ЩhЄmCy№a¬uAІGЙ>n|Р`0ШJЌга’R У:S빓Zюў€fй{Kщвuї0оЬЇЫрвД°Б— tМ”ЩT-*)pG ЎF€qэС #ЋІsSЎ8TnъcAС'
- расширений файлов
- %WINDIR%\takesoft.exe <Полный путь к вирусу>===
- <SYSTEM32>\ping.exe 127.0.0.1 -n 1
- <SYSTEM32>\taskkill.exe /f /im ZhuDongFangyu.exe
- <SYSTEM32>\10.ico
- <SYSTEM32>\9.ico
- <SYSTEM32>\8.ico
- %WINDIR%\dasoft.encode
- %TEMP%\2dbllljp.exe
- %HOMEPATH%\Cookies\%USERNAME%@msn[1].txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\CADK4Z5D.asp
- <SYSTEM32>\3.ico
- <SYSTEM32>\2.ico
- %WINDIR%\takesoft.exe
- <SYSTEM32>\4.ico
- <SYSTEM32>\7.ico
- <SYSTEM32>\6.ico
- <SYSTEM32>\5.ico
- %TEMP%\2dbllljp.exe
- 'au##.#earch.msn.com':80
- 'localhost':1036
- DNS ASK au##.#earch.msn.com
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'Progman' WindowName: ''
- ClassName: 'SHELLDLL_DefView' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''