Техническая информация
- %HOMEPATH%\Start Menu\Programs\Startup\donload.exe
- %HOMEPATH%\Start Menu\Programs\Startup\svesht.exe
- %PROGRAM_FILES%\USER-4BB09A9C02\start.exe
- %PROGRAM_FILES%\USER-4BB09A9C02\gotan.exe
- %PROGRAM_FILES%\USER-4BB09A9C02\116.exe
- <SYSTEM32>\cmd.exe /c "c:\support338945a0.bat"
- %PROGRAM_FILES%\USER-4BB09A9C02\start.exe
- %PROGRAM_FILES%\USER-4BB09A9C02\gotan.exe
- %TEMP%\33223131000.jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\show[1].asp
- C:\support338945a0.bat
- %PROGRAM_FILES%\USER-4BB09A9C02\116.exe
- %TEMP%\$inst\4.tmp
- %TEMP%\$inst\2.tmp
- %TEMP%\$inst\5.tmp
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\$inst\15.tmp
- <SYSTEM32>\Darkbomb.dll
- C:\support338945a0.bat
- %TEMP%\$inst\15.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\show[1].asp
- %PROGRAM_FILES%\USER-4BB09A9C02\116.exe
- %TEMP%\$inst\2.tmp
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\$inst\5.tmp
- %TEMP%\$inst\4.tmp
- 'www.go##80.cn':80
- 'localhost':1038
- www.go##80.cn/show.asp?id####
- DNS ASK www.go##80.cn
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''