Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Internet Explorer ' = '<Полный путь к вирусу>'
- Средство контроля пользовательских учетных записей (UAC)
- '<SYSTEM32>\ID Man.exe'
- '<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip-pc.vcp[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\up01.vcp[1]
- <DRIVERS>\FirstRun.txt
- <SYSTEM32>\ID Man.exe
- <SYSTEM32>\ID Man.exe
- <Полный путь к вирусу>
- 'up##.vcp.ir':80
- 'ip###.vcp.ir':80
- 'localhost':1035
- up##.vcp.ir/
- ip###.vcp.ir/
- DNS ASK up##.vcp.ir
- DNS ASK ip###.vcp.ir
- ClassName: 'SysListView32' WindowName: '(null)'
- ClassName: 'Indicator' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: '#32770' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: '(null)' WindowName: 'Windows Task Manager'