Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'НшВзµзКУ' = ''
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'KingSoft PowerWord PE' = ''
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'LeyuBoxData' = ''
- '%PROGRAM_FILES%\urlcore.exe' /h /r /t /b 1319355
- '%PROGRAM_FILES%\urlcore.exe' (загружен из сети Интернет)
- '<SYSTEM32>\cmd.exe' /c <Текущая директория>\$$del$$.bat
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\МФ±¦ЙМіЗ[1].url
- <Текущая директория>\$$del$$.bat
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\urlcore[1].exe
- %PROGRAM_FILES%\urlcore.exe
- 'www.ca###leep.cn':80
- 'up.###ritsoft.cn':80
- 'localhost':1037
- www.ca###leep.cn/???#########
- up.###ritsoft.cn/urlspirit/urlcore.exe
- DNS ASK www.ca###leep.cn
- DNS ASK up.###ritsoft.cn
- ClassName: '(null)' WindowName: '?????????????????? ???? '
- ClassName: '#32770' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'MS_WINHELP' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: '(null)' WindowName: '??????????????????2.0 ????'
- ClassName: 'Indicator' WindowName: '(null)'
- ClassName: '(null)' WindowName: '??????????????????2.0 ???? '
- ClassName: '(null)' WindowName: '?????????????????? ????'
- ClassName: '(null)' WindowName: '????????????2.0 ????????'