Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '<Полный путь к вирусу>' = '<Полный путь к вирусу>:*:Enabled:<Имя вируса>.exe'
- <SYSTEM32>\sc.exe config UI0Detect start= disabled
- <SYSTEM32>\sc.exe stop UI0Detect
- <SYSTEM32>\cmd.exe /c %TEMP%\_tmp90.bat
- %TEMP%\_tmp90.bat
- DNS ASK we#.##oye123.net
- DNS ASK c1.##d3322.com
- DNS ASK ma##.#td3322.com
- 'c1.##d3322.com':7788
- 'we#.##oye123.net':8899
- 'ma##.#td3322.com':7788
- ClassName: 'XFrame_Wnd' WindowName: ''
- ClassName: 'Maxthon2_View' WindowName: ''
- ClassName: 'Container' WindowName: ''
- ClassName: 'TT_WebCtrl' WindowName: ''
- ClassName: 'TCnNuoIEBrowser' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'SE_AxControl' WindowName: ''