Техническая информация
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe rundll32.exe lfrt.njo gxsgk'
- %WINDIR%\syswow64\svchost.exe
- %TEMP%\7406.tmp
- %WINDIR%\syswow64\lfrt.njo
- 'fr###apch.info':80
- http://www.fr###apch.info/flashcapch/bb.php?v=###############################
- DNS ASK fr###apch.info
- '%ProgramFiles%\microsoft office\office14\winword.exe' /Automation -Embedding
- '%WINDIR%\syswow64\svchost.exe'