Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{4D1A4566-A815-D2C3-843B-3C182378AE43}] 'StubPath' = ''
- <SYSTEM32>\net1.exe stop sharedaccess
- <SYSTEM32>\net1.exe start sharedaccess
- <SYSTEM32>\net.exe stop sharedaccess
- <SYSTEM32>\rundll32.exe "%PROGRAM_FILES%\Outlook Express\wab0ut.dll",installA
- %PROGRAM_FILES%\Outlook Express\wab0ut.dll
- %PROGRAM_FILES%\Outlook Express\msimn.dll
- из <Полный путь к вирусу> в %TEMP%\~wordtmp1.tmp