Техническая информация
- %WINDIR%\Tasks\Parker.job
- '<SYSTEM32>\wscript.exe' "%APPDATA%\windows.vbs"
- '<SYSTEM32>\ping.exe' -n 1 pn.ddlnp.com
- '<SYSTEM32>\taskkill.exe' /f /im wlmail.exe
- '<SYSTEM32>\schtasks.exe' /Create /TN Parker /SC ONLOGON /TR "wscript.exe /B """%APPDATA%\windows.vbs"""" /RU SYSTEM
- %ALLUSERSPROFILE%\ppctrl.dat
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\comphp[1].php
- %ALLUSERSPROFILE%\user.tmp
- %ALLUSERSPROFILE%\MZђ
- %ALLUSERSPROFILE%\pck.tmp
- %APPDATA%\windows.vbs
- %TEMP%\4311.tmp
- %ALLUSERSPROFILE%\ppctrl.dat
- %APPDATA%\windows.vbs
- %TEMP%\4311.tmp
- 'pq.##dbar.com':80
- 'localhost':1040
- 'pn.##lnp.com':80
- pq.##dbar.com/numbers/comphp.php?ti#######################################
- pn.##lnp.com/dtpck.txt
- pn.##lnp.com/updpck.txt
- DNS ASK pq.##dbar.com
- DNS ASK pn.##lnp.com
- ClassName: '' WindowName: ''