Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WinSmsFi' = 'atay.exe'
- [<HKLM>\SOFTWARE\Classes\irc\Shell\open\command] '' = '"<SYSTEM32>\atay.exe" -noconnect'
- [<HKLM>\SOFTWARE\Classes\ChatFile\Shell\open\command] '' = '"<SYSTEM32>\atay.exe" -noconnect'
- '<SYSTEM32>\atay.exe'
- '%WINDIR%\regedit.exe' /s 1449.reg
- '%WINDIR%\regedit.exe' /s 1586.reg
- '%WINDIR%\msagent\agentsvr.exe' -Embedding
- '%WINDIR%\regedit.exe' /s 636.reg
- '%WINDIR%\regedit.exe' /s 81.reg
- <SYSTEM32>\server.dll
- <SYSTEM32>\Sfwwin32.dll
- <SYSTEM32>\mIRC.ini
- <SYSTEM32>\nHTMLn_2.95.dll
- <SYSTEM32>\1449.reg
- <SYSTEM32>\1586.reg
- <SYSTEM32>\636.reg
- <SYSTEM32>\81.reg
- <SYSTEM32>\atay.exe
- <SYSTEM32>\Chans.dll
- <SYSTEM32>\sysingB32.dll
- <SYSTEM32>\win.ini
- <SYSTEM32>\fn.xt
- <SYSTEM32>\fucker.jpg
- <SYSTEM32>\demo.xt
- <SYSTEM32>\email.txt
- <SYSTEM32>\1449.reg
- <SYSTEM32>\81.reg
- <SYSTEM32>\636.reg
- 'ir#.##limsinyar.net':6667
- DNS ASK ir#.##limsinyar.net
- ClassName: 'RegEdit_RegEdit' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'