Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{EBVK57L8-JG25-81F8-H6WW-6C7S00V8116U}] 'StubPath' = '<SYSTEM32>\Svchdst.exe Restart'
- [<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{EBVK57L8-JG25-81F8-H6WW-6C7S00V8116U}] 'StubPath' = ''
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Sonrisa Lobster Crush' = ''
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Sonrisa Lobster Crush' = ''
- '<SYSTEM32>\Svchdst.exe'
- '%TEMP%\NDIMGBJJ\PWJXRKTL.exe'
- %WINDIR%\Explorer.EXE
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\sqlite3[1].dll
- %TEMP%\UuU.uUu
- %TEMP%\XxX.xXx
- %TEMP%\265265.tmp
- %APPDATA%\SQLite3.dll
- %TEMP%\175421.tmp
- %TEMP%\Mektup.Pdf
- %TEMP%\NDIMGBJJ\PWJXRKTL.exe
- %TEMP%\NDIMGBJJ\mzlvdf
- %APPDATA%\logs.dat
- %TEMP%\XX--XX--XX.txt
- <SYSTEM32>\Svchdst.exe
- %APPDATA%\logs.dat
- %TEMP%\~DFD167.tmp
- %TEMP%\XxX.xXx
- <SYSTEM32>\Svchdst.exe
- %TEMP%\UuU.uUu
- %TEMP%\~DF3F9.tmp
- %TEMP%\XX--XX--XX.txt
- %TEMP%\NDIMGBJJ\PWJXRKTL.exe
- 'or######cer666.bounceme.net':5006
- 'www.bu####pturizm.com':80
- 'localhost':1037
- www.bu####pturizm.com/sqlite3.dll
- DNS ASK or######cer666.bounceme.net
- DNS ASK www.bu####pturizm.com
- ClassName: 'Indicator' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'