Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'updatesvc' = ''
- %HOMEPATH%\Start Menu\Programs\Startup\checkupdate.exe
- '<SYSTEM32>\cscript.exe' "%TEMP%\tempor.vbs"
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\user[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\user[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\user[2].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\user[2].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\user[1].htm
- %TEMP%\tempor.vbs
- %APPDATA%\Microsoft\Windows\updater.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\user[1].htm
- %TEMP%\sinfo.txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\user[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\user[2].htm
- %TEMP%\tempor.vbs
- %TEMP%\sinfo.txt
- 'ba####iketty.info':80
- 'da#####onthetable.in':80
- 'de####obanemenk.in':80
- 'ba###ulka.in':80
- 'ar#####serrrdrink.info':80
- ba####iketty.info/mp/user.php
- da#####onthetable.in/mp/user.php
- de####obanemenk.in/mp/user.php
- ba###ulka.in/mp/user.php
- ar#####serrrdrink.info/mp/user.php
- DNS ASK ba####iketty.info
- DNS ASK da#####onthetable.in
- DNS ASK de####obanemenk.in
- DNS ASK ba###ulka.in
- DNS ASK ar#####serrrdrink.info