Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\aeefhtph] 'Start' = '00000002'
- '%TEMP%\is-MUJMP.tmp\TysxClient_setup_2.0.107.tmp' /SL5="$30092,1115413,71168,%PROGRAM_FILES%\TysxClient_setup_2.0.107.exe"
- '%PROGRAM_FILES%\TysxClient_setup_2.0.107.exe'
- '<SYSTEM32>\regsvr32.exe' %WINDIR%\Media\ActiveX.ocx /s
- %WINDIR%\Media\Desktop.ini:dbase.mdb
- %WINDIR%\pp.jpg
- %WINDIR%\Media\ActiveX.ocx
- %WINDIR%\Media\Desktop.ini:dbase.ldb
- <Полный путь к вирусу>
- %TEMP%\is-MUJMP.tmp\TysxClient_setup_2.0.107.tmp
- %PROGRAM_FILES%\TysxClient_setup_2.0.107.exe
- %TEMP%\is-GMDTE.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-GMDTE.tmp\_isetup\_RegDLL.tmp
- из <Полный путь к вирусу> в %TEMP%\218312\...\TemporaryFile
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'