Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'UpData' = '"%TEMP%\winchost4.exe" -hide'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Windows Defender' = '"C:\Programme\Windows Defender\MmSASCui.exe" -hide'
- '%TEMP%\winchost4.exe'
- '%TEMP%\RarSFX0\winhost04.exe'
- '%TEMP%\RarSFX0\zz08.exe'
- '%WINDIR%\regedit.exe' /s Update--Windows-98.reg
- '%WINDIR%\regedit.exe' /s Update--Windows-XP.reg
- '%WINDIR%\regedit.exe' /s Update--Windows-Me.reg
- '%WINDIR%\regedit.exe' /s Update--Windows-2000.reg
- '%WINDIR%\regedit.exe' /s Update--Windows-95.reg
- %TEMP%\RarSFX0\winhost04.exe
- %TEMP%\RarSFX0\Update--Windows-XP.reg
- %TEMP%\winchost4.exe
- %TEMP%\RarSFX0\zz08.exe
- %TEMP%\RarSFX0\Update--Windows-95.reg
- %TEMP%\RarSFX0\Update--Windows-2000.reg
- %TEMP%\RarSFX0\Update--Windows-Me.reg
- %TEMP%\RarSFX0\Update--Windows-98.reg
- %TEMP%\RarSFX0\Update--Windows-XP.reg
- %TEMP%\RarSFX0\winhost04.exe
- %TEMP%\RarSFX0\zz08.exe
- %TEMP%\RarSFX0\Update--Windows-Me.reg
- %TEMP%\RarSFX0\Update--Windows-2000.reg
- %TEMP%\RarSFX0\Update--Windows-95.reg
- %TEMP%\RarSFX0\Update--Windows-98.reg
- 'ko#####4.evangelion.nu':9222
- DNS ASK ko#####4.evangelion.nu
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''