Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{B20BDD2B-5EF0-4428-9AEF-406F1EDBEE90}] 'Exec' = 'http://click.linkprice.com/click.php?m=11st&l=0000&a=A100370767'
- [<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{6AA4E1B7-5C2B-4064-83AA-0599C89FF7BE}] 'Exec' = 'http://click.linkprice.com/click.php?m=auction&l=0000&a=A100370767'
- [<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{C3552E8C-830F-40d2-8582-59C4936B74C0}] 'Exec' = 'http://click.linkprice.com/click.php?m=gmarket&l=0000&a=A100370767'
- <SYSTEM32>\cmd.exe /c \DelUS.bat
- <SYSTEM32>\cmd.exe /c \fivi.bat
- <SYSTEM32>\11market.ico
- <SYSTEM32>\auction.ico
- %WINDIR%\auction.ico
- %WINDIR%\gmarket.ico
- %TEMP%\nss2.tmp\SelfDelete.dll
- C:\DelUS.bat
- <SYSTEM32>\gmarket.ico
- %TEMP%\nss2.tmp\System.dll
- %WINDIR%\11market.ico
- %TEMP%\mylinkplus.exe
- %HOMEPATH%\Favorites\»х·Оїо јј»уА» ї©ґВ №®, Gё¶ДП.url
- %TEMP%\nss2.tmp\DLLWebCount.dll
- %TEMP%\domain.txt
- %HOMEPATH%\Favorites\јоЗО ЅєЖ®ё®Ж®, 11№ш°Ў.url
- C:\fivi.bat
- %HOMEPATH%\Favorites\µрѕШјҐ, ЅГБр 2.url
- %HOMEPATH%\Favorites\ґзЅЕАМ ГЈґВ ёрµз ЅєЕёАП, їБјЗ.url
- %TEMP%\nss2.tmp\SelfDelete.dll
- %TEMP%\nss2.tmp\System.dll
- %TEMP%\nss2.tmp\DLLWebCount.dll
- %TEMP%\domain.txt
- %TEMP%\mylinkplus.exe
- 'www.my####plus.co.kr':80
- www.my####plus.co.kr/favorites/www/count/counter_insert.php?pi##############
- DNS ASK www.my####plus.co.kr