Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\Remote Messenger] 'Start' = '00000002'
- %TEMP%\haoxp108.exe
- %TEMP%\haoexp.exe
- %TEMP%\QQ_2012.exe
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://www.ha##08.com/ad1.html
- %WINDIR%\Explorer.EXE
- %HOMEPATH%\My Documents\AppData\Roaming\hao108\eAPI.fne
- %HOMEPATH%\My Documents\AppData\Roaming\hao108\hao108.1.0.0.1092.exe
- <SYSTEM32>\Setup\mssock.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ad1[1].html
- %HOMEPATH%\Desktop\hao108.lnk
- %HOMEPATH%\My Documents\AppData\Roaming\hao108\krnln.fnr
- %TEMP%\QQ_2012.exe
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\$inst\2.tmp
- <SYSTEM32>\Setup\svchot.exe
- %TEMP%\haoxp108.exe
- %TEMP%\haoexp.exe
- %TEMP%\$inst\2.tmp
- %TEMP%\$inst\temp_0.tmp
- 'www.ha##08.com':80
- 'localhost':1038
- 'dl###r.qq.com':80
- www.ha##08.com/ad1.html
- DNS ASK www.ha##08.com
- DNS ASK dl###r.qq.com
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'Progman' WindowName: 'Program Manager'
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: ''