Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = 'Explorer.exe "%TEMP%\svchost.exe"'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '"%TEMP%\svchost.exe"' = '"%TEMP%\svchost.exe:*:Enabled:svchost.exe"'
- "%TEMP%\system.exe" (загружен из сети Интернет)
- %TEMP%\system.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\ldr[1].exe
- %TEMP%\svchost.exe
- 'se###welry.net':80
- 'ma###media.com':80
- se###welry.net/ie2/ldr.exe
- ma###media.com/
- DNS ASK se###welry.net
- DNS ASK ma###media.com