Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'TopSpace' = '%PROGRAM_FILES%\topspace\topspace.exe'
- '%PROGRAM_FILES%\topspace\topspace.exe'
- '%PROGRAM_FILES%\topspace\insts.exe' Y;<Полный путь к вирусу>;
- '<SYSTEM32>\cmd.exe' /c \smicd.bat
- %PROGRAM_FILES%\topspace\topspace.ini
- %TEMP%\nst2.tmp\System.dll
- %PROGRAM_FILES%\topspace\topspaces.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\filechk_ts[1].htm
- C:\smicd.bat
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\su[1].htm
- %PROGRAM_FILES%\topspace\uninstall.exe
- %PROGRAM_FILES%\topspace\topspace.exe
- %PROGRAM_FILES%\topspace\topspace.dll
- %PROGRAM_FILES%\topspace\insts.exe
- %PROGRAM_FILES%\topspace\spacern.exe
- %PROGRAM_FILES%\topspace\topspacevw2.exe
- %PROGRAM_FILES%\topspace\topspacevw1.exe
- %PROGRAM_FILES%\topspace\insts.exe
- %TEMP%\nst2.tmp\System.dll
- 'en#.###rtwindow.co.kr':80
- 'lo#.###rtwindow.co.kr':80
- en#.###rtwindow.co.kr/filechk_ts.php
- lo#.###rtwindow.co.kr/su.php
- DNS ASK en#.###rtwindow.co.kr
- DNS ASK lo#.###rtwindow.co.kr