Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'movies' = '<SYSTEM32>\IE5.exe'
- [<HKLM>\SOFTWARE\Classes\irc\Shell\open\command] '' = '"<SYSTEM32>\iexplorer.exe"'
- [<HKLM>\SOFTWARE\Classes\ChatFile\Shell\open\command] '' = '"<SYSTEM32>\iexplorer.exe"'
- <SYSTEM32>\IEXPLORER.EXE
- <SYSTEM32>\IE5.exe
- %WINDIR%\regedit.exe /s 862.reg
- %WINDIR%\regedit.exe /s 956.reg
- %WINDIR%\regedit.exe /s 353.reg
- %WINDIR%\regedit.exe /s 372.reg
- %WINDIR%\regedit.exe /s 738.reg
- %WINDIR%\regedit.exe /s 650.reg
- %WINDIR%\msagent\agentsvr.exe -Embedding
- %WINDIR%\regedit.exe /s 990.reg
- %WINDIR%\regedit.exe /s 467.reg
- %WINDIR%\regedit.exe
- <SYSTEM32>\990.reg
- <SYSTEM32>\738.reg
- <SYSTEM32>\650.reg
- <SYSTEM32>\467.reg
- <SYSTEM32>\372.reg
- <SYSTEM32>\353.reg
- <SYSTEM32>\956.reg
- <SYSTEM32>\862.reg
- <SYSTEM32>\TMP1.$$$
- <SYSTEM32>\IEXPLORER.EXE
- <SYSTEM32>\mirc.ini
- %TEMP%\GS1.tmp
- <SYSTEM32>\IE5.exe
- <SYSTEM32>\v1rg1n
- <SYSTEM32>\wnupdates.exe
- <SYSTEM32>\remote.ini
- <SYSTEM32>\systemac.dll
- <SYSTEM32>\TMP2.$$$
- %TEMP%\GS1.tmp
- 'ir#.vel.net':6667
- DNS ASK ir#.vel.net
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: 'NDDEAgnt' WindowName: 'NetDDE Agent'
- ClassName: 'Shell_TrayWnd' WindowName: ''