Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SharedAPPs' = '%WINDIR%\system\<Имя вируса>.exe'
- %WINDIR%\regedit.exe /s %WINDIR%\system\sharedapp.reg
- %WINDIR%\inf\asynceql.inf
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\newbase[1]
- %WINDIR%\system\<Имя вируса>.exe
- %WINDIR%\system\sharedapp.reg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\newbase[1]
- %WINDIR%\system\sharedapp.reg
- 'ra####ipwiress.net':80
- 'sk#####dompriver.biz':80
- ra####ipwiress.net/newbase/
- sk#####dompriver.biz/newbase/
- DNS ASK ra####ipwiress.net
- DNS ASK sk#####dompriver.biz
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: '3GLIVEGOOD' WindowName: ''