Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'SecurityCRT' = 'Wscript.exe "%APPDATA%\windows.vbs"'
- '<SYSTEM32>\ping.exe' -n 1 qur.dnnslpn.com
- '<SYSTEM32>\wscript.exe' "%APPDATA%\windows.vbs"
- %ALLUSERSPROFILE%\ppctrl.dat
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\comphp[1].php
- %ALLUSERSPROFILE%\user.tmp
- %ALLUSERSPROFILE%\MZђ
- %ALLUSERSPROFILE%\pckt.tmp
- %APPDATA%\windows.vbs
- %TEMP%\6126.tmp
- %ALLUSERSPROFILE%\ppctrl.dat
- %APPDATA%\windows.vbs
- %TEMP%\6126.tmp
- 'localhost':1037
- 'qu#.#nnslpn.com':80
- qu#.#nnslpn.com/newdon/comphp.php?ti#######################################
- qu#.#nnslpn.com/bisdtpck.txt
- qu#.#nnslpn.com/bisupdpck.txt
- DNS ASK qu#.#nnslpn.com