Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\Sysmangwers32] 'Start' = '00000002'
- '%WINDIR%\Wiswsl.exe'
- %ALLUSERSPROFILE%\Application Data\systemskey.ini
- C:\Documents and Settings\LocalService\Application Data\ffifsssffsf4f.ini
- %WINDIR%\Wiswsl.exe
- 'co###hiwa.biz':80
- co###hiwa.biz/tl/
- DNS ASK co###hiwa.biz