Техническая информация
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'Policies' = '%WINDIR%\install\msnmsg.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'Policies' = '%WINDIR%\install\msnmsg.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'msnmsg' = '%WINDIR%\install\msnmsg.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'msnmsg' = '%WINDIR%\install\msnmsg.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{O8W0FL38-CYD6-SH27-0NCB-WX85Q2MYCW2Y}] 'StubPath' = '%WINDIR%\install\msnmsg.exe Restart'
- %WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe
- %WINDIR%\install\msnmsg.exe
- %TEMP%\xx--xx--xx.txt
- %APPDATA%\logs.dat
- %TEMP%\xxx.xxx
- %TEMP%\sv.exe
- %TEMP%\uuu.uuu
- %APPDATA%\logs.dat
- %TEMP%\xx--xx--xx.txt
- %TEMP%\uuu.uuu
- %TEMP%\xxx.xxx
- %TEMP%\uuu.uuu
- %TEMP%\xxx.xxx
- DNS ASK em####msn.no-ip.org
- '%WINDIR%\install\msnmsg.exe'
- '%TEMP%\sv.exe'
- '%TEMP%\sv.exe' ' (со скрытым окном)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe'
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe'