Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'Cleanup' = 'C:\cleanup.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'lansuport' = '"<Полный путь к вирусу>" -no'
- [<HKLM>\SYSTEM\ControlSet001\Services\vhzhtr] 'Start' = '00000000'
- <SYSTEM32>\dellplg.exe /nogui <SYSTEM32>\lst_del.txt
- %WINDIR%\regedit.exe /e C:\3.reg "HKEY_LOCAL_MACHINE\SYSTEM\CurrentontrolSet1\Services\GbpSv"
- %WINDIR%\regedit.exe /e C:\4.reg "HKEY_LOCAL_MACHINE\SYSTEM\CurrentontrolSet2\Services\GbpSv"
- %WINDIR%\regedit.exe /e C:\5.reg "HKEY_LOCAL_MACHINE\SYSTEM\CurrentontrolSet3\Services\GbpSv"
- <SYSTEM32>\cmd.exe /c ""C:\avexport.bat" "
- %WINDIR%\regedit.exe /e C:\1.reg "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\GbpSv"
- %WINDIR%\regedit.exe /e C:\2.reg "HKEY_LOCAL_MACHINE\SYSTEM\CurrentontrolSet\Services\GbpSv"
- C:\cleanup.bat
- C:\zip.exe
- C:\avexport.bat
- C:\cleanup.exe
- <SYSTEM32>\lst_del.txt
- <SYSTEM32>\dellplg.exe
- <DRIVERS>\iatcey.sys
- <SYSTEM32>\jzfjq.txt
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: 'MS_WINHELP' WindowName: ''
- ClassName: 'Indicator' WindowName: ''