Техническая информация
- %HOMEPATH%\Start Menu\Programs\Startup1\TM.lnk
- '%PROGRAM_FILES%\snss.exe'
- '%HOMEPATH%\Favorites\wywg.exe'
- '<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\Thunder.dll"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\123.bat" "
- '%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' http://www.jj##g.com
- '%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' http://www.92##.net/
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\92wg[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\jjjwg[1]
- <SYSTEM32>\Thunder.dll
- %TEMP%\123.txt
- C:\2.lnk
- %PROGRAM_FILES%\Internet Explorer\wywg.exe
- <SYSTEM32>\sysini.ini
- %HOMEPATH%\Favorites\wywg.exe
- C:\1.lnk
- <SYSTEM32>\csys.dat
- %PROGRAM_FILES%\snss.exe
- %TEMP%\~DF7152.tmp
- %HOMEPATH%\Favorites\wywg.exe
- C:\1.lnk
- C:\2.lnk
- %TEMP%\123.txt в %TEMP%\123.bat
- 'www.jj##g.com':80
- 'www.92##.net':80
- 'www.26##.com':80
- 'localhost':1035
- 'localhost':1036
- 'localhost':1037
- www.92##.net/
- www.jj##g.com/
- DNS ASK www.26##.com
- DNS ASK www.92##.net
- DNS ASK www.jj##g.com
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: '' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'