Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] 'Generic Host Process for WinXP Services' = 'mshelp.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Generic Host Process for WinXP Services' = 'mshelp.exe'
- <SYSTEM32>\mshelp.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\descript1[1].gif
- <SYSTEM32>\descript.lnk
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\descript1[1].txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\descript1[1].txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\descript1[1].txt
- <SYSTEM32>\sqla.dll
- <SYSTEM32>\mshelp.exe
- <SYSTEM32>\mqr.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\_2sys[1].php
- <SYSTEM32>\mqr.dll
- 'fe######a.awardspace.com':80
- 'bs######h.awardspace.com':80
- 'bi#####n.netfirms.com':80
- 'localhost':1035
- 'bu######a.awardspace.com':80
- fe######a.awardspace.com/descript1.txt
- bs######h.awardspace.com/descript1.txt
- bi#####n.netfirms.com/descript1.gif
- bu######a.awardspace.com/_2sys.php?PA###############
- bu######a.awardspace.com/descript1.txt
- DNS ASK fe######a.awardspace.com
- DNS ASK bs######h.awardspace.com
- DNS ASK bu######a.awardspace.com
- DNS ASK bi#####n.netfirms.com
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''