Техническая информация
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe] 'Debugger' = '<SYSTEM32>\iesafemode.exe -sb'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe] 'Debugger' = '<SYSTEM32>\iesafemode.exe -sb'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe] 'Debugger' = '<SYSTEM32>\iesafemode.exe -sb'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe] 'Debugger' = '<SYSTEM32>\iesafemode.exe -sb'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'AV8' = '%ProgramFiles(x86)%\AV8\av8.exe'
- iexplore.exe
- firefox.exe
- %WINDIR%\syswow64\iesafemode.exe
- %ProgramFiles(x86)%\av8\av8.exe
- %HOMEPATH%\desktop\antivirus8.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\av8\antivirus8.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\av8\uninstall.lnk
- 'we####r.yahoo.com':80
- 'we####r.yahoo.com':443
- 'microsoft.com':80
- 'oc##.thawte.com':80
- http://we####r.yahoo.com/
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- 'we####r.yahoo.com':443
- DNS ASK we####r.yahoo.com
- DNS ASK ch#####stemcenter.com
- DNS ASK microsoft.com
- DNS ASK oc##.thawte.com