Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'terrwinkl' = '<Полный путь к вирусу>'
- <Текущая директория>\tasunts.txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\tasunts[1].txt
- <Текущая директория>\tenvia.txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\tenvia[1].txt
- <Текущая директория>\tliskloads.txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\tliskloads[1].txt
- <Текущая директория>\tmsgter.txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\tmsgter[1].txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\tliskloads[1].txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\tenvia[1].txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\tasunts[1].txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\tmsgter[1].txt
- 'nh#####rarolamentos.com':80
- 'localhost':1035
- nh#####rarolamentos.com/terrarolamentos/tasunts.txt
- nh#####rarolamentos.com/terrarolamentos/tenvia.txt
- nh#####rarolamentos.com/terrarolamentos/tliskloads.txt
- nh#####rarolamentos.com/terrarolamentos/tmsgter.txt
- DNS ASK nh#####rarolamentos.com
- ClassName: 'NDDEAgnt' WindowName: 'NetDDE Agent'
- ClassName: 'Shell_TrayWnd' WindowName: ''