Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe ,<SYSTEM32>\Pnkd.exe'
- <SYSTEM32>\cmd.exe /c ""%TEMP%\srun32.bat" "
- <SYSTEM32>\cacls.exe "%PROGRAM_FILES%\Internet Explorer\ie\iexplore.exe" /G Everyone:R /C
- <SYSTEM32>\cmd.exe /c ""%TEMP%\srun49.bat" "
- <SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop\Internet Explorer.lnk" /G Everyone:R /C
- %WINDIR%\regedit.exe /s "%TEMP%\\\56.ini"
- <SYSTEM32>\cmd.exe /c ""%TEMP%\srun48.bat" "
- <SYSTEM32>\cmd.exe /c ""%TEMP%\srun3.bat" "
- %TEMP%\srun49.bat
- %TEMP%\srun32.bat
- <SYSTEM32>\pp.exe
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\?o¶? Internet Explorer a?AA??.lnk
- %TEMP%\srun3.bat
- %PROGRAM_FILES%\Internet Explorer\ie\iexplore.exe
- %TEMP%\56.ini
- %TEMP%\srun48.bat
- %HOMEPATH%\Desktop\Internet Explorer.lnk
- %PROGRAM_FILES%\Internet Explorer\ie\iexplore.exe
- %HOMEPATH%\Desktop\Internet Explorer.lnk
- 'www.xl##81.com':80
- www.xl##81.com/count/yx85.php
- www.xl##81.com/count/xml.php
- DNS ASK www.xl##81.com
- ClassName: 'MS_WINHELP' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''