Техническая информация
- %TEMP%\is-C1JTB.tmp\<Имя вируса>.tmp /SL5="$40036,154619,53248,<Полный путь к вирусу>"
- <SYSTEM32>\regsvr32.exe /s "%PROGRAM_FILES%\MicSNBHO\mod.dll"
- <SYSTEM32>\reg.exe ADD HKCU\Software\Mozilla\FireFox\Extensions /v site_advisor@module /t REG_SZ /d "%PROGRAM_FILES%\MicSNBHO\FF" /f
- opera.exe
- firefox.exe
- iexplore.exe
- %PROGRAM_FILES%\MicSNBHO\FF\defaults\preferences\is-31DG5.tmp
- %PROGRAM_FILES%\MicSNBHO\FF\locale\en-US\is-VA4CP.tmp
- %PROGRAM_FILES%\MicSNBHO\FF\content\is-26TCM.tmp
- %PROGRAM_FILES%\MicSNBHO\FF\components\is-VA3RR.tmp
- %PROGRAM_FILES%\MicSNBHO\FF\content\is-ULRCE.tmp
- %PROGRAM_FILES%\MicSNBHO\FF\skin\is-7VNQP.tmp
- %PROGRAM_FILES%\MicSNBHO\unins000.dat
- %PROGRAM_FILES%\MicSNBHO\FF\skin\is-FPS4P.tmp
- %PROGRAM_FILES%\MicSNBHO\FF\locale\en-US\is-ATUK2.tmp
- %PROGRAM_FILES%\MicSNBHO\FF\locale\en-US\is-0AGHQ.tmp
- %TEMP%\is-FMT6C.tmp\Inst_dll.dll
- %PROGRAM_FILES%\MicSNBHO\is-PSM0A.tmp
- %TEMP%\is-FMT6C.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-C1JTB.tmp\<Имя вируса>.tmp
- %TEMP%\is-FMT6C.tmp\_isetup\_RegDLL.tmp
- %PROGRAM_FILES%\MicSNBHO\FF\is-1K1VP.tmp
- %PROGRAM_FILES%\MicSNBHO\FF\is-T3C4J.tmp
- %PROGRAM_FILES%\MicSNBHO\FF\is-KHF6F.tmp
- %PROGRAM_FILES%\MicSNBHO\is-7IMC8.tmp
- %PROGRAM_FILES%\MicSNBHO\is-4GLR8.tmp
- 'www.go###ecs.net':80
- www.go###ecs.net/ping.php
- DNS ASK www.go###ecs.net
- ClassName: 'Shell_TrayWnd' WindowName: ''