Техническая информация
- [<HKLM>\SOFTWARE\Classes\MSProgramGroup\Shell\Open\Command] '' = '<SYSTEM32>\grpconv.exe %1'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
- <SYSTEM32>\grpconv.exe -o
- <SYSTEM32>\wscript.exe "<Текущая директория>\tem.vbs"
- <SYSTEM32>\runonce.exe -r
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://www.so##.com/wbhp.shtml?ci#############################
- <SYSTEM32>\rundll32.exe SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\TmpInf.inf
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoInternetIcon' = '00000001'
- C:\TmpInf.inf
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\wbhp[1].shtml
- <Текущая директория>\tem.vbs
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\НшЦ·µјєЅ.lnk
- %HOMEPATH%\Desktop\Internet Explorer.lnk
- %HOMEPATH%\Desktop\НшЦ·µјєЅ.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Жф¶Ї Internet Explorer дЇААЖч.lnk
- C:\TmpInf.inf
- 'www.so##.com':80
- 'localhost':1035
- www.so##.com/wbhp.shtml?ci#############################
- DNS ASK www.so##.com
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''