Техническая информация
- [<HKLM>\SOFTWARE\Classes\.ghi\shell\open\command] '' = 'rundll32.exe "%PROGRAM_FILES%\wisesoft\xec.cc" xxx '
- %TEMP%\is-UICS2.tmp\is-EAKF6.tmp /SL4 $40032 "<Полный путь к вирусу>" 93971 52224
- <SYSTEM32>\rundll32.exe "%PROGRAM_FILES%\wisesoft\gen.nn" ggg
- <SYSTEM32>\rundll32.exe "%PROGRAM_FILES%\wisesoft\qtc.dll" unknown
- <SYSTEM32>\rundll32.exe "%PROGRAM_FILES%\wisesoft\idi.ii" gis
- %WINDIR%\regedit.exe -s "%PROGRAM_FILES%\wisesoft\xec.err"
- %PROGRAM_FILES%\wisesoft\is-AHNJ3.tmp
- %PROGRAM_FILES%\wisesoft\is-4GD4B.tmp
- %PROGRAM_FILES%\wisesoft\is-QKDS9.tmp
- %PROGRAM_FILES%\wisesoft\is-O2DBO.tmp
- %PROGRAM_FILES%\wisesoft\is-6AKOV.tmp
- %PROGRAM_FILES%\wisesoft\is-IDPMU.tmp
- %PROGRAM_FILES%\wisesoft\unins000.dat
- C:\csrss.dat
- %PROGRAM_FILES%\wisesoft\is-1V3D9.tmp
- %PROGRAM_FILES%\wisesoft\is-LP516.tmp
- %PROGRAM_FILES%\wisesoft\is-913ML.tmp
- %TEMP%\is-FOEOU.tmp\reg.gg
- %PROGRAM_FILES%\wisesoft\is-506SI.tmp
- %TEMP%\is-FOEOU.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-UICS2.tmp\is-EAKF6.tmp
- %TEMP%\is-FOEOU.tmp\_isetup\_RegDLL.tmp
- %PROGRAM_FILES%\wisesoft\is-5UNMU.tmp
- %PROGRAM_FILES%\wisesoft\is-0DU0S.tmp
- %PROGRAM_FILES%\wisesoft\is-GQA4Q.tmp
- %PROGRAM_FILES%\wisesoft\is-1BMAO.tmp
- %PROGRAM_FILES%\wisesoft\is-0UD42.tmp
- %PROGRAM_FILES%\wisesoft\is-LH6JV.tmp
- %TEMP%\is-FOEOU.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-UICS2.tmp\is-EAKF6.tmp
- %TEMP%\is-FOEOU.tmp\reg.gg
- %TEMP%\is-FOEOU.tmp\_isetup\_RegDLL.tmp
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''