Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'TcpIpCfg' = 'Rundll32 "%APPDATA%\tfhabhp.dll" MainThread'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyOverride' = '<local>'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyServer' = ''
- %APPDATA%\ini.ini
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\ini[1].txt
- %APPDATA%\tfhabhp.dll
- 'www.ht###p001.info':80
- 'localhost':1040
- 'www.he###jtj.info':80
- http://www.ht###p001.info/ini.txt
- http://www.he###jtj.info/mail.asp?MA############
- DNS ASK www.ht###p001.info
- DNS ASK www.he###jtj.info
- '<SYSTEM32>\rundll32.exe' "%APPDATA%\tfhabhp.dll" MainThread