Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Extra Antivirus' = '"<Полный путь к вирусу>" /s /d'
- <SYSTEM32>\wbem\mofcomp.exe "<Текущая директория>\8478.mof"
- %WINDIR%\Explorer.EXE
- iexplore.exe
- [<HKCU>\Software\Microsoft\Internet Explorer\Download] 'RunInvalidSignatures' = '00000001'
- [<HKCU>\Software\Microsoft\Internet Explorer\Download] 'CheckExeSignatures' = 'no'
- %HOMEPATH%\Desktop\Extra Antivirus.lnk
- %TEMP%\tmp1.tmp
- %HOMEPATH%\Start Menu\Extra Antivirus.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Extra Antivirus.lnk
- %HOMEPATH%\Start Menu\Programs\Extra Antivirus.lnk
- <Текущая директория>\RootSys\vd952342.bd
- %ALLUSERSPROFILE%\Application Data\RootSys\extrav.cfg
- <Текущая директория>\BackUp\Shortcut to startup_local.lnk
- %APPDATA%\Extra Antivirus\cookies.sqlite
- <Текущая директория>\8478.mof
- %ALLUSERSPROFILE%\Application Data\RootSys\extrav.cfg
- %TEMP%\tmp1.tmp
- 'pa#.###raantivir.com':80
- 'up###fnow.cn':80
- DNS ASK pa#.###raantivir.com
- DNS ASK up###fnow.cn
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'TMainWindowEXAVR' WindowName: ''