Техническая информация
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'windows' = '%HOMEPATH%\My Documents\windows.exe'
- %HOMEPATH%\start menu\programs\startup\windows.exe
- %HOMEPATH%\start menu\programs\startup\windows.vbs
- %HOMEPATH%\start menu\programs\startup\windows.js
- %WINDIR%\microsoft.net\framework\v2.0.50727\aspnet_regbrowsers.exe
- %TEMP%\vltdckeyu.txt
- %HOMEPATH%\my documents\windows.exe
- %TEMP%\-mh0g_4r.0.vb
- %TEMP%\-mh0g_4r.cmdline
- %TEMP%\-mh0g_4r.out
- %TEMP%\vbc1.tmp
- %TEMP%\res2.tmp
- %HOMEPATH%\start menu\programs\startup\windows.exe
- %TEMP%\res2.tmp
- %TEMP%\vbc1.tmp
- %TEMP%\-mh0g_4r.out
- %TEMP%\-mh0g_4r.0.vb
- %TEMP%\-mh0g_4r.cmdline
- '78#####ala.zapto.org':1111
- '10.##5.107.10':1111
- DNS ASK 78#####ala.zapto.org
- '%HOMEPATH%\my documents\windows.exe'
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\-mh0g_4r.cmdline"' (со скрытым окном)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2.tmp" "%TEMP%\vbc1.tmp"' (со скрытым окном)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\aspnet_regbrowsers.exe'
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\-mh0g_4r.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2.tmp" "%TEMP%\vbc1.tmp"