Техническая информация
- '%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' http://ww##.4728.net/setuptj.asp?a_#####
- '<SYSTEM32>\wscript.exe' <Текущая директория>\Killme.vbs
- '%WINDIR%\regedit.exe' /s "%CommonProgramFiles%\tk.reg"
- '<SYSTEM32>\cscript.exe' /nologo "%PROGRAM_FILES%\pack.wsf" "%PROGRAM_FILES%\1_umppnnyig.imoll"
- %PROGRAM_FILES%\umppnnyig.imoll
- C:\about blank.htm
- <Текущая директория>\Killme.vbs
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip[1].asp
- %CommonProgramFiles%\tk.reg
- %WINDIR%\My.ini
- %PROGRAM_FILES%\pack.wsf
- %PROGRAM_FILES%\1_umppnnyig.imoll
- C:\about blank.htm
- %PROGRAM_FILES%\pack.wsf
- <Текущая директория>\Killme.vbs
- %CommonProgramFiles%\tk.reg
- %PROGRAM_FILES%\1_umppnnyig.imoll
- 'up.##36688.com':80
- 'localhost':1036
- up.##36688.com/ip.asp
- DNS ASK up.##36688.com
- ClassName: 'SysListView32' WindowName: '(null)'
- ClassName: 'RegEdit_RegEdit' WindowName: '(null)'
- ClassName: 'Progman' WindowName: '(null)'
- ClassName: 'SHELLDLL_DefView' WindowName: '(null)'