Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Internet Explorer ' = '<Полный путь к вирусу>'
- '<SYSTEM32>\ID Man.exe'
- <DRIVERS>\notepad.sys
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\ip-pc.vcp[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\up01.vcp[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\format148.vcp[1]
- <DRIVERS>\win.sys
- <SYSTEM32>\ID Man.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip-pc.vcp[1]
- <SYSTEM32>\ID Man.exe
- <Полный путь к вирусу>
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip-pc.vcp[1]
- 'fo####148.vcp.ir':80
- 'up##.vcp.ir':80
- 'localhost':1036
- 'ip###.vcp.ir':80
- up##.vcp.ir/
- fo####148.vcp.ir/
- ip###.vcp.ir/
- DNS ASK up##.vcp.ir
- DNS ASK fo####148.vcp.ir
- DNS ASK ip###.vcp.ir
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'SysListView32' WindowName: '(null)'
- ClassName: 'Edit' WindowName: '(null)'
- ClassName: 'Notepad' WindowName: '(null)'
- ClassName: '#32770' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: '(null)' WindowName: 'Windows Task Manager'
- ClassName: 'Indicator' WindowName: '(null)'