Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Windows System Recover!' = '<Полный путь к вирусу>'
- скрытых файлов
- расширений файлов
- Редактора реестра (RegEdit)
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFolderOptions' = '00000001'
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\sz[1].php
- %TEMP%\jisfije9fjoiee.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\sz[1].php
- 'ws##tgy.com':80
- ws##tgy.com/ff/sz.php?ve#####
- DNS ASK ws##tgy.com
- ClassName: 'ysr8787rhwuhe' WindowName: 'ajf8738ef049tkd'
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'sdfa37ajdf' WindowName: 'sfakjh3w87huiaefndjkbfd'
- ClassName: 'jhsf78i3ujnkdsvc' WindowName: 'sdfcj9w83jkdmfnf'
- ClassName: 'pizdavamsuki' WindowName: 'klzfj98oklfdfd'