Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\Rav] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Rav] 'ImagePath' = '%WINDIR%\Rav.exe'
- 'Rav' %WINDIR%\Rav.exe
- %TEMP%\ixp000.tmp\4.exe
- %WINDIR%\rav.exe
- %WINDIR%\uninstal.bat
- %WINDIR%\rav.exe
- %TEMP%\ixp000.tmp\4.exe
- 'jb###w.3322.org':8000
- DNS ASK jb###w.3322.org
- '%TEMP%\ixp000.tmp\4.exe'
- '%WINDIR%\rav.exe'
- '%TEMP%\ixp000.tmp\4.exe' ' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\uninstal.bat' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\uninstal.bat