Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = '%WINDIR%\explorer.exe, <SYSTEM32>\explorer.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Schedule] 'Start' = '00000002'
- скрытых файлов
- '%WINDIR%\svchost.exe'
- '%WINDIR%\spoolsv.exe' PR
- '<SYSTEM32>\explorer.exe'
- '%WINDIR%\spoolsv.exe' SE
- <SYSTEM32>\cmsys.cmn
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\cmsys[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\cmsys[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\cmsys[1].gif
- <SYSTEM32>\explorer.exe
- %WINDIR%\spoolsv.exe
- %WINDIR%\svchost.exe
- %WINDIR%\svchost.exe
- <SYSTEM32>\cmsys.cmn
- <SYSTEM32>\explorer.exe
- %WINDIR%\spoolsv.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\cmsys[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\cmsys[1].gif
- <SYSTEM32>\cmsys.cmn
- 'localhost':1038
- 'dl.#####oxusercontent.com':80
- 'localhost':1035
- 'nc####.googlecode.com':80
- dl.#####oxusercontent.com/u/252386920/cmsys.gif
- dl.#####oxusercontent.com/u/252386016/cmsys.gif
- nc####.googlecode.com/svn/trunk/cmsys.gif
- DNS ASK dl.#####oxusercontent.com
- DNS ASK nc####.googlecode.com