Техническая информация
- %TEMP%\cvtres.exe
- [<HKLM>\Software\Mirabilis\ICQ\NewOwners]
- [<HKCU>\Software\Yahoo\Pager]
- [<HKCU>\Software\AIM\AIMPRO]
- [<HKCU>\Software\Paltalk]
- [<HKCU>\Software\Google\Google Talk\Accounts]
- [<HKCU>\Software\Mirabilis\ICQ\NewOwners]
- [<HKCU>\Software\Microsoft\MSNMessenger]
- [<HKLM>\Software\Miranda]
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Trillian]
- [<HKCU>\Software\America Online\AIM6\Passwords]
- [<HKCU>\Software\Microsoft\IdentityCRL]
- [<HKCU>\Software\Microsoft\MessengerService]
- %TEMP%\chro.dat
- %TEMP%\dial.dat
- %TEMP%\mail.dat
- %TEMP%\opra.dat
- %TEMP%\ffox.dat
- %TEMP%\ptsg.dat
- %TEMP%\offc.dat
- %TEMP%\cvtres.exe
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\6321f8cc0e244bff9661b850e9f03d1c_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\Preferred
- %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\3ab102b6-4212-4922-bdd1-ee8abf94d090
- %TEMP%\ptsg.dat
- %TEMP%\ffox.dat
- %TEMP%\opra.dat
- %TEMP%\chro.dat
- %TEMP%\offc.dat
- %TEMP%\mail.dat
- %TEMP%\dial.dat
- 'bl###shades.ru':8080
- DNS ASK bl###shades.ru
- '<IP-адрес в локальной сети>':1036
- ClassName: 'Shell_TrayWnd' WindowName: ''