Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\AutoUpgrade] 'Start' = '00000002'
- <SYSTEM32>\svchost.exe -k AutoUpgrade
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\exists[1].htm
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\CAERGZG3.asp
- <SYSTEM32>\vga32.dll
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\exists[1].htm
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\CAERGZG3.asp
- 'up##.ni94.com':80
- 'up#.#i94.com':80
- 'in####l.ni94.com':80
- up##.ni94.com/3/exists.htm?wh#####
- up#.#i94.com/3/exists.htm?wh#####
- DNS ASK up##.ni94.com
- DNS ASK up#.#i94.com
- DNS ASK in####l.ni94.com