Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Malware Catcher 2009' = '"<Полный путь к вирусу>" /s /d'
- %WINDIR%\Explorer.EXE
- iexplore.exe
- [<HKCU>\Software\Microsoft\Internet Explorer\Download] 'RunInvalidSignatures' = '00000001'
- [<HKCU>\Software\Microsoft\Internet Explorer\Download] 'CheckExeSignatures' = 'no'
- %HOMEPATH%\Start Menu\Programs\Malware Catcher 2009.lnk
- %HOMEPATH%\Start Menu\Malware Catcher 2009.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Malware Catcher 2009.lnk
- %APPDATA%\Malware Catcher 2009\Instructions.ini
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\Instructions[1].ini
- <Текущая директория>\SystemFeed\vd952342.bd
- %ALLUSERSPROFILE%\Application Data\SystemFeed\mctch.ini
- <Текущая директория>\BackUp\Shortcut to startup_local.lnk
- %HOMEPATH%\Desktop\Malware Catcher 2009.lnk
- %APPDATA%\Malware Catcher 2009\cookies.sqlite
- %ALLUSERSPROFILE%\Application Data\SystemFeed\mctch.ini
- 'localhost':27777
- 'up#####.malwarecatcher.net':80
- 'up###fnow.cn':80
- 'pa####russhield.cn':80
- up#####.malwarecatcher.net/Instructions.ini
- DNS ASK up#####.malwarecatcher.net
- DNS ASK pa####russhield.cn
- DNS ASK up###fnow.cn
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'TMainWindowMCT' WindowName: ''