Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Windows Live' = '%TEMP%\winini.exe'
- %WINDIR%\proticalcrypt.exe
- %TEMP%\winlogon.exe
- %TEMP%\winini.exe
- %WINDIR%\proticalcrypt.exe (загружен из сети Интернет)
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\MSCOMCTL[1].OCX
- %WINDIR%\COMDLG32.OCX
- %WINDIR%\MSCOMCTL.OCX
- %WINDIR%\MSWINSCK.OCX
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\MSWINSCK[1].OCX
- %TEMP%\winlogon.exe
- %TEMP%\winini.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\proticalcrypt[1].exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\COMDLG32[1].OCX
- %WINDIR%\proticalcrypt.exe
- 'yo#####r.serveftp.com':80
- 'localhost':1035
- yo#####r.serveftp.com/downloads/messing%20files/MSCOMCTL.OCX
- yo#####r.serveftp.com/downloads/messing%20files/MSWINSCK.OCX
- yo#####r.serveftp.com/proticalcrypt.exe
- yo#####r.serveftp.com/downloads/messing%20files/COMDLG32.OCX
- DNS ASK yo#####r.serveftp.com
- '<IP-адрес в локальной сети>':1036
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''