Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'zSearch' = '%PROGRAM_FILES%\zSearch\Zstb.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'zSearch' = '%PROGRAM_FILES%\zSearch\Zstb.exe'
- %PROGRAM_FILES%\zSearch\Zstb.exe /force /update
- %HOMEPATH%\Local Settings\Temporary Internet Files\ZSearch.log
- %TEMP%\t3.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Logger.log
- %PROGRAM_FILES%\zSearch\u1.tmp
- %PROGRAM_FILES%\zSearch\u2.tmp
- %PROGRAM_FILES%\zSearch\u2.tmp в %PROGRAM_FILES%\zSearch\Zstb.exe
- %PROGRAM_FILES%\zSearch\u1.tmp в %PROGRAM_FILES%\zSearch\zSearch.dll
- 'ad#.##ntralmedia.ws':80
- 'www.zs####hresults.com':80
- ad#.##ntralmedia.wshttp://ads.centralmedia.ws/runner.htm?ap#######################################################################################################################
- DNS ASK ad#.##ntralmedia.ws
- DNS ASK www.ZS####hResults.com
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
- ClassName: '' WindowName: ''