Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Adobe Flash Player ActiveX Installer' = '%APPDATA%\Adobe Flash Player ActiveX Installer\AdobeFlashPlayer.exe'
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Adobe Flash Player ActiveX Installer' = '%APPDATA%\Adobe Flash Player ActiveX Installer\AdobeFlashPlayer.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%APPDATA%\Adobe Flash Player ActiveX Installer\AdobeFlashPlayer.exe,'
- %APPDATA%\adobe flash player activex installer\adobeflashplayer.exe
- <Текущая директория>\eraseme.bat
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
- %APPDATA%\adobe flash player activex installer\adobeflashplayer.exe
- http://gk####es.comeze.com/Strike/Strike/index.php?ac#######################
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- DNS ASK gk####es.comeze.com
- DNS ASK 00###bhost.com
- '%APPDATA%\adobe flash player activex installer\adobeflashplayer.exe'
- '<SYSTEM32>\cmd.exe' /c <Текущая директория>\eraseme.bat' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c <Текущая директория>\eraseme.bat