Техническая информация
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Handler\mhtml] 'CLSID' = ' '
- <SYSTEM32>\ntvdm.exe -f -i1
- <SYSTEM32>\wbem\wmiadap.exe /R /T
- %WINDIR%\regedit.exe -s c:\ie.reg
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://21#.#40.137.40/yespop/counted.php?x=#
- <SYSTEM32>\wbem\Performance\WmiApRpl_new.ini
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\counted[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ie[1]
- C:\ie.reg
- %WINDIR%\Temp\scs1.tmp
- %WINDIR%\Temp\scs2.tmp
- %WINDIR%\Temp\scs2.tmp
- %WINDIR%\Temp\scs1.tmp
- 'www.to###archer.com':80
- '21#.#40.137.40':80
- 'localhost':1036
- www.to###archer.com/ie/
- 21#.#40.137.40/yespop/counted.php?x=#
- DNS ASK www.to###archer.com
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-bb8.bbc.380001'
- ClassName: '' WindowName: ''