Техническая информация
- %HOMEPATH%\Start Menu\Programs\Startup\MyExplorer.lnk
- %WINDIR%\system.exe
- %TEMP%\temp.exe 0
- <SYSTEM32>\reg.exe add HKCU\Software\yahoo\pager /t REG_DWORD /v "Auto Login" /d 0 /f
- <SYSTEM32>\taskkill.exe -f -im reg.exe
- %WINDIR%\regedit.exe "%TEMP%\plural.reg"
- <SYSTEM32>\reg.exe add HKCU\Software\yahoo\pager /t REG_DWORD /v "Save Password" /d 0 /f
- [<HKCU>\Software\yahoo\pager]
- %WINDIR%\system.exe
- %WINDIR%\pic.jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\getipadr1[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\getipadr1[1].php
- %TEMP%\plural.reg
- %TEMP%\temp.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\getipadr1[1].php
- %TEMP%\~DF5955.tmp
- %TEMP%\~DF263D.tmp
- 'localhost':1038
- 'www.pe###ler.com':80
- 'localhost':1035
- www.pe###ler.com/getipadr1.php
- DNS ASK www.pe###ler.com
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''