Техническая информация
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = 'Explorer.exe C:\PROGRA~1\COMMON~1\Microsoft\CTHELPER.EXE'
- %TEMP%\e_4\krnln.fnr
- %CommonProgramFiles%\mi.g
- %CommonProgramFiles%\res\tc4.tmp
- %CommonProgramFiles%\res\tc3.tmp
- %CommonProgramFiles%\res\tc2.tmp
- %CommonProgramFiles%\res\tc1.tmp
- %CommonProgramFiles%\com.run
- %CommonProgramFiles%\pps.tv
- %CommonProgramFiles%\krnln.fnr
- %TEMP%\e_4\com.run
- %CommonProgramFiles%\microsoft\com.run
- %CommonProgramFiles%\microsoft\krnln.fnr
- %CommonProgramFiles%\microsoft\storeymyadmin.exe
- <Текущая директория>\res\fz2.tmp
- <Текущая директория>\res\fz1.tmp
- %CommonProgramFiles%\storeymyadmin.exe
- %CommonProgramFiles%\microsoft\cver.ini
- %CommonProgramFiles%\pps.tv
- %CommonProgramFiles%\microsoft\storeymyadmin.exe в %CommonProgramFiles%\microsoft\cthelper.exe
- %CommonProgramFiles%\storeymyadmin.exe в %CommonProgramFiles%\cthelper.exe
- DNS ASK do###.alibaba99.com
- '%CommonProgramFiles%\cthelper.exe'