Техническая информация
- <SYSTEM32>\dllcache\spoolsv.exe файлом <SYSTEM32>\dllcache\spoolsv.exe.new
- <SYSTEM32>\spoolsv.exe файлом <SYSTEM32>\spoolsv.exe.new
- <SYSTEM32>\spoolsv.exe
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1400' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1803' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'currentlevel' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1601' = '00000000'
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\8PI70DM3\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YN7RD19E\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\UP6P0HKP\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\RJBUV52Y\desktop.ini
- %TEMP%\1.tmp
- %WINDIR%\Temp\2.tmp
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YN7RD19E\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\UP6P0HKP\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\RJBUV52Y\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\8PI70DM3\desktop.ini
- %WINDIR%\Temp\2.tmp
- %TEMP%\1.tmp
- <SYSTEM32>\spoolsv.exe в %WINDIR%\Temp\4.tmp
- <SYSTEM32>\dllcache\spoolsv.exe.new в <SYSTEM32>\dllcache\spoolsv.exe
- из <Полный путь к вирусу> в %TEMP%\3.tmp
- 'ru####kumoet.com':8080
- '4s##rs.com':80
- 4s##rs.com/task/
- DNS ASK ru####kumoet.com
- DNS ASK 4s##rs.com