Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Windows Explorer' = 'Exploer.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Windows Explorer' = 'Exploer.exe'
- <SYSTEM32>\Exploer.exe mElT<Полный путь к вирусу>
- ClassName: 'RegMonClass' WindowName: ''
- ClassName: 'FileMonClass' WindowName: ''
- %TEMP%\54995E53.TMP
- <SYSTEM32>\Exploer.exe
- <SYSTEM32>\Exploer.exe
- 'ir#.##larhome.com':6667
- 'localhost':6667
- DNS ASK ir#.##larhome.com