Техническая информация
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'java' = '<SYSTEM32>\java\3proxy.exe'
- %WINDIR%\syswow64\java\lastfripper.dll
- %WINDIR%\syswow64\java\run.bat
- %WINDIR%\syswow64\java\run.reg
- %WINDIR%\syswow64\java\rus-koi8-r.3ps
- %WINDIR%\syswow64\java\rus-win1251.3ps
- %WINDIR%\syswow64\java\utf8tocp1251.dll
- %WINDIR%\syswow64\java\mycrypt.exe
- %WINDIR%\syswow64\java\3proxy.cfg
- %WINDIR%\syswow64\java\windowsauthentication.dll
- %WINDIR%\syswow64\java\stringsplugin.dll
- %WINDIR%\syswow64\java\countersutil.exe
- %WINDIR%\syswow64\java\trafficplugin.dll
- %WINDIR%\syswow64\java\dighosts.exe
- %WINDIR%\syswow64\java\pcreplugin.dll
- %WINDIR%\syswow64\java\3proxy.exe
- %WINDIR%\syswow64\java\fileplugin.dll
- C:\hide.reg
- C:\hide.reg
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- '%WINDIR%\syswow64\java\3proxy.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""<SYSTEM32>\java\run.bat" "
- '%WINDIR%\syswow64\mode.com' CON: COLS=20 LINES=1
- '%WINDIR%\syswow64\regedit.exe' /S c:\hide.REG
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%WINDIR%\syswow64\java\3proxy.ex...