Техническая информация
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Filter\text/html] 'CLSID' = '{A8981DB9-B2B3-47D7-A890-9C9D9F4C5552}'
- %WINDIR%\mf1.tmp
- 'ar###torok.info':80
- http://www.ar###torok.info/?ok############ via ar###torok.info
- DNS ASK www.ar###torok.info
- '<SYSTEM32>\regsvr32.exe' /s %WINDIR%\mf1.tmp