Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\04QVMOAC0CH] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\YGB1XO2D] 'Start' = '00000002'
- %PROGRAM_FILES%\UCBDB4C.exe rb
- %PROGRAM_FILES%\UCBDB4C.exe <Полный путь к вирусу>
- <SYSTEM32>\reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Play_Animations /t REG_SZ /d no /F
- <SYSTEM32>\reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Play_Background_Sounds /t REG_SZ /d no /F
- <SYSTEM32>\reg.exe delete HKLM\Software\Microsoft\Windows\CurrentVersion\Run /F
- <SYSTEM32>\reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Display Inline Videos" /t REG_SZ /d no /F
- <SYSTEM32>\reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v DisableScriptDebuggerIE /t REG_SZ /d yes /F
- <SYSTEM32>\reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Disable Script Debugger" /t REG_SZ /d yes /F
- <SYSTEM32>\reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Display Inline Images" /t REG_SZ /d yes /F
- <SYSTEM32>\regsvr32.exe /u /s shimgvw.dll
- <SYSTEM32>\sc.exe create 04QVMOAC0CH BinPath= "%PROGRAM_FILES%\WHBD6Q\MNPNCPU.EXE -VXYKE1H9JQ" type= own type= interact start= auto DisplayName= 06RHN
- <SYSTEM32>\cmd.exe /c "%PROGRAM_FILES%\OPWVFPTLGV0.bat"
- <SYSTEM32>\regsvr32.exe /u /s itss.dll
- <SYSTEM32>\regsvr32.exe /s jscript.dll
- <SYSTEM32>\regsvr32.exe /u /s vbscript.dll
- <SYSTEM32>\regsvr32.exe /u /s scrrun.dll
- %WINDIR%\HDBC9I8.exe
- %TEMP%\RGI1.tmp
- %PROGRAM_FILES%\OPWVFPTLGV0.bat
- %PROGRAM_FILES%\UCBDB4C.exe
- %PROGRAM_FILES%\WHBD6Q\MNPNCPU.EXE
- <Полный путь к вирусу>
- %TEMP%\RGI1.tmp
- '58.#9.58.27':443
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'easyclickplus3' WindowName: ''
- ClassName: 'VNGUPYFKZTIOS' WindowName: 'galuahjuiryrty'