Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'system32.exe' = '%WINDIR%\t1emp\xregist.exe'
- <SYSTEM32>\wscript.exe "%WINDIR%\t1emp\runner.vbs"
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\regist[1].php
- %WINDIR%\t1emp\runner.vbs
- %WINDIR%\t1emp\xregist.exe
- %WINDIR%\t1emp\xregist.exe
- %WINDIR%\t1emp\runner.vbs
- 'd9####d90d90.co.cc':80
- 'localhost':1035
- d9####d90d90.co.cc/tmp/regist.php?re#####
- DNS ASK d9####d90d90.co.cc
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''