Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'SAV' = '"%TEMP%\<Имя вируса>.exe" /cs:0 '
- <SYSTEM32>\taskkill.exe /F /IM firefox* /IM mozi*
- <SYSTEM32>\taskkill.exe /F /IM MSASCui* /IM avg* /IM ash* /IM McSA*
- AVGCC32.EXE
- AVGCTRL.EXE
- firefox.exe
- avgcc.exe
- ash.exe
- ashAvast.exe
- ashAvSrv.exe
- %TEMP%\<Имя вируса>.exe
- 'se###e-field.in':80
- 'pr####tedsystem.in':80
- se###e-field.in/Reports/MicroinstallServiceReport.php?p=############################################################################
- pr####tedsystem.in/index.php?co#############
- DNS ASK se###e-field.in
- DNS ASK pr####tedsystem.in
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''