Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'EnableFirewall' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'DoNotAllowExceptions' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'DisableNotifications' = '00000001'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DisableNotifications' = '00000001'
- Центр обеспечения безопасности (Security Center)
- <LS_APPDATA>\inb.exe -gav <Полный путь к вирусу>
- %TEMP%\34doq32hhk7283tluyi68cfexf6cb52mvq7c07h0t23gcr
- %HOMEPATH%\Templates\34doq32hhk7283tluyi68cfexf6cb52mvq7c07h0t23gcr
- %ALLUSERSPROFILE%\Application Data\34doq32hhk7283tluyi68cfexf6cb52mvq7c07h0t23gcr
- <LS_APPDATA>\inb.exe
- <LS_APPDATA>\34doq32hhk7283tluyi68cfexf6cb52mvq7c07h0t23gcr
- 'se####faqago.com':80
- 'su##ai.com':80
- se####faqago.com/1032000112
- su##ai.com/summer.htm
- DNS ASK se####faqago.com
- DNS ASK su##ai.com
- '<IP-адрес в локальной сети>':1038