Техническая информация
- [<HKLM>\SOFTWARE\Classes\MSProgramGroup\Shell\Open\Command] '' = '<SYSTEM32>\grpconv.exe %1'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
- [<HKLM>\SYSTEM\ControlSet001\Control\Session Manager] 'BootExecute' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\RsNTGDI] 'Start' = '00000000'
- <SYSTEM32>\grpconv.exe -o
- %WINDIR%\explorer.exe http://on####.rising.com.cn/free/rav.htm
- <SYSTEM32>\runonce.exe -r
- <SYSTEM32>\cmd.exe /c ""%TEMP%\ravolbcs.cmd""
- <SYSTEM32>\rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 0 %TEMP%\$Ravolbcs$.inf
- %TEMP%\BsMain.ini
- <SYSTEM32>\BsMain.ini
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\rav[1].htm
- %TEMP%\ravolbcs.cmd
- %TEMP%\exe1.tmp
- %TEMP%\$Ravolbcs$.inf
- %TEMP%\exe1.tmp
- %TEMP%\ravolbcs.cmd
- %TEMP%\$Ravolbcs$.inf
- %TEMP%\BsMain.ini
- 'on####.rising.com.cn':80
- 'localhost':1036
- on####.rising.com.cn/free/rav.htm
- DNS ASK on####.rising.com.cn
- '<IP-адрес в локальной сети>':1037
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''