Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Pootao' = '<Полный путь к вирусу> -autorun'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '<Полный путь к вирусу>' = '<Полный путь к вирусу>:*:Enabled:iPOOTAO'
- %APPDATA%\POOTAO\radio.xml.tmp
- %APPDATA%\POOTAO\syncdevice.xml.tmp
- %APPDATA%\POOTAO\radio.xml.tmp в %APPDATA%\POOTAO\radio.xml
- %APPDATA%\POOTAO\syncdevice.xml.tmp в %APPDATA%\POOTAO\syncdevice.xml
- 'www.po##ao.com':80
- www.po##ao.com/pootaoclient/player/getradio.poo?si#########
- www.po##ao.com/pootaoclient/get_default_album_image.poo
- www.po##ao.com/pootaoclient/autoupdate.poo?ve#########################
- www.po##ao.com/pootaoclient/ad.poo?si####################
- www.po##ao.com/pootaoclient/sync/getsyncdevicedriver.poo?do####
- www.po##ao.com/pootaoclient/get_default_syncdevice_image.poo
- www.po##ao.com/pootaoclient/ad.poo?si#####################
- www.po##ao.com/pootaoclient/ad.poo?si#########################
- DNS ASK www.po##ao.com
- ClassName: 'Shell_TrayWnd' WindowName: ''