Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Window Smart' = '%PROGRAM_FILES%\WindowSmart\smartwindow.exe'
- %PROGRAM_FILES%\WindowSmart\smartwindow.exe
- %PROGRAM_FILES%\WindowSmart\inssw.exe Y;<Полный путь к вирусу>;
- <SYSTEM32>\cmd.exe /c \smicd.bat
- %PROGRAM_FILES%\WindowSmart\smartwindow.ini
- %TEMP%\nsv2.tmp\System.dll
- %PROGRAM_FILES%\WindowSmart\uninstall.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\filechk[1].htm
- C:\smicd.bat
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\su[1].htm
- %PROGRAM_FILES%\WindowSmart\smartwindow.exe
- %PROGRAM_FILES%\WindowSmart\smartwindow.dll
- %PROGRAM_FILES%\WindowSmart\inssw.exe
- %PROGRAM_FILES%\WindowSmart\spacern.exe
- %PROGRAM_FILES%\WindowSmart\smartwindowvw2.exe
- %PROGRAM_FILES%\WindowSmart\smartwindowvw1.exe
- %PROGRAM_FILES%\WindowSmart\inssw.exe
- %TEMP%\nsv2.tmp\System.dll
- 'en#.###rtwindow.co.kr':80
- 'lo#.###rtwindow.co.kr':80
- en#.###rtwindow.co.kr/filechk.php
- lo#.###rtwindow.co.kr/su.php
- DNS ASK en#.###rtwindow.co.kr
- DNS ASK lo#.###rtwindow.co.kr