Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\System] 'Shell' = '%WINDIR%\Explorer.exe <SYSTEM32>\Pnkx.exe'
- '%TEMP%\info_168.exe'
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\srun86.bat" "
- '<SYSTEM32>\cacls.exe' "%PROGRAM_FILES%\Internet Explorer\ie\iexplore.exe" /G Everyone:R /C
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\srun24.bat" "
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\srun36.bat" "
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\srun67.bat" "
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\srun38.bat" "
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\srun51.bat" "
- '<SYSTEM32>\cacls.exe' "%HOMEPATH%\Desktop\Internet Explorer.lnk" /G Everyone:R /C
- %TEMP%\srun86.bat
- %TEMP%\srun51.bat
- %TEMP%\srun67.bat
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\?o¶? Internet Explorer a?AA??.lnk
- %TEMP%\srun24.bat
- %TEMP%\srun36.bat
- %TEMP%\nsq2.tmp\SimpleSC.dll
- %TEMP%\info_168.exe
- %TEMP%\nsq2.tmp\System.dll
- %TEMP%\srun38.bat
- %HOMEPATH%\Desktop\Internet Explorer.lnk
- %PROGRAM_FILES%\Internet Explorer\ie\iexplore.exe
- %PROGRAM_FILES%\Internet Explorer\ie\iexplore.exe
- %HOMEPATH%\Desktop\Internet Explorer.lnk
- %TEMP%\nsq2.tmp\System.dll
- %TEMP%\nsq2.tmp\SimpleSC.dll
- 'www.11##c.com':80
- www.11##c.com/count/xml.php
- www.11##c.com/count/yx85.php
- DNS ASK www.11##c.com
- ClassName: 'MS_WINHELP' WindowName: ''