Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'popupguide' = '%PROGRAM_FILES%\popupguide\popupguide.exe'
- %PROGRAM_FILES%\popupguide\popupguide_setup_02.exe /VERYSILENT
- <SYSTEM32>\cmd.exe /c ""<Текущая директория>\del_nsis_bat.cmd" "
- %PROGRAM_FILES%\popupguide\is-KLH7J.tmp
- %PROGRAM_FILES%\popupguide\is-DJ66K.tmp
- %PROGRAM_FILES%\popupguide\is-S0F2M.tmp
- %PROGRAM_FILES%\popupguide\is-SE5EL.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\ins[1].php
- %PROGRAM_FILES%\popupguide\unins000.dat
- %PROGRAM_FILES%\popupguide\is-SK3T8.tmp
- %PROGRAM_FILES%\popupguide\is-JAQDU.tmp
- %TEMP%\is-0H5MD.tmp\is-2S87E.tmp
- <Текущая директория>\del_nsis_bat.cmd
- %PROGRAM_FILES%\popupguide\popupguide_setup_02.exe
- %TEMP%\is-S6PUH.tmp\_isetup\_RegDLL.tmp
- %PROGRAM_FILES%\popupguide\is-BKHG2.tmp
- %PROGRAM_FILES%\popupguide\del_bat.cmd
- %TEMP%\is-S6PUH.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-S6PUH.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-0H5MD.tmp\is-2S87E.tmp
- %PROGRAM_FILES%\popupguide\del_bat.cmd
- <Текущая директория>\del_nsis_bat.cmd
- %PROGRAM_FILES%\popupguide\popupguide_setup_02.exe
- %TEMP%\is-S6PUH.tmp\_isetup\_RegDLL.tmp
- 'co#####.pop-upguide.com':80
- 'localhost':1033
- co#####.pop-upguide.com/analysis/ins.php?uq#########################################################
- DNS ASK co#####.pop-upguide.com
- '<IP-адрес в локальной сети>':1034
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''