Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\ssst] 'Start' = '00000002'
- <SYSTEM32>\svchost.exe -k netsvcs
- <SYSTEM32>\rundll32.exe
- %PROGRAM_FILES%\nnno\kkkl\kkkl.ini
- %PROGRAM_FILES%\nnno\rrrs.ini
- %PROGRAM_FILES%\nnno\ddde.lex
- %PROGRAM_FILES%\nnno\qqqrlex\qqqrlex.ini
- %PROGRAM_FILES%\nnno\qqqr\qqqr.ini
- %PROGRAM_FILES%\nnno\iiij\iiij.ini
- %PROGRAM_FILES%\nnno\tttu.dll
- %PROGRAM_FILES%\nnno\iiij.ini
- %PROGRAM_FILES%\nnno\xxxy.dll
- %PROGRAM_FILES%\nnno\mmmn.ini
- %PROGRAM_FILES%\nnno\fffg.dll
- %PROGRAM_FILES%\nnno\cccd.dll
- %PROGRAM_FILES%\nnno\aaab.dll
- <Полный путь к вирусу>
- из <Полный путь к вирусу> в C:\~de1.tmp
- 'up####.borlander.cn':80
- up####.borlander.cn/upiniad5/updadini.ini
- up####.borlander.cn/upstdad5/userupdadlex.ini
- up####.borlander.cn/upstdad5/updstdix.ini
- up####.borlander.cn/upstdad5/updstdii.ini
- DNS ASK www.bo####der.com.cn
- DNS ASK ca#.###lander.com.cn
- DNS ASK up####.borlander.cn
- '<IP-адрес в локальной сети>':1035
- ClassName: '_stdup_cha_wnd_' WindowName: '_stdup_cha_wnd_'
- ClassName: '_std_ad_wnd_' WindowName: '_std_ad_wnd_'