Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\SuperServer] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\SuperServer] 'ImagePath' = '%WINDIR%\Terms.EXE.exe'
- 'SuperServer' %WINDIR%\Terms.EXE.exe
- %WINDIR%\terms.exe.exe
- %ProgramFiles%\apppatch\version.dll
- %WINDIR%\terms.exe.exe
- 'di##xe.com':80
- '47.#8.20.91':9090
- http://www.di##xe.com/version.dll
- '47.#8.20.91':9090
- DNS ASK di##xe.com
- '%WINDIR%\terms.exe.exe'