Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SharedAPPs' = '%WINDIR%\system\<Имя вируса>.exe'
- %WINDIR%\regedit.exe /s %WINDIR%\system\sharedapp.reg
- <Текущая директория>\tmp
- %WINDIR%\inf\asynceql.inf
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\newbase[1]
- %WINDIR%\system\<Имя вируса>.exe
- %WINDIR%\system\sharedapp.reg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\logo[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\newbase[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\logo[1].gif
- %WINDIR%\system\sharedapp.reg
- '69.##2.109.178':80
- 'www.ne######evirtual24hs.biz':80
- 'localhost':1036
- 'www.go###e.com.br':80
- www.ne######evirtual24hs.biz/newbase/
- 69.##2.109.178/~modx03/newbase/
- www.go###e.com.br/intl/pt-BR_br/images/logo.gif
- 69.##2.109.178/~modx02/newbase/
- DNS ASK www.ne######evirtual24hs.biz
- DNS ASK www.go###e.com.br
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: 'Estratux2009' WindowName: ''