Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'wextract_cleanup0' = 'rundll32.exe <SYSTEM32>\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"'
- '%TEMP%\IXP000.TMP\WinSnap_2.1.5.exe'
- '%TEMP%\IXP000.TMP\454.exe'
- '<SYSTEM32>\cmd.exe' /c %TEMP%\1.bat
- %TEMP%\1.bat
- %PROGRAM_FILES%\altcmd\uninstall.bat
- %TEMP%\nsy4.tmp\LangDLL.dll
- %TEMP%\nsi3.tmp
- %TEMP%\IXP000.TMP\454.exe
- %TEMP%\IXP000.TMP\WinSnap_2.1.5.exe
- %PROGRAM_FILES%\altcmd\altcmd.inf
- %PROGRAM_FILES%\altcmd\altcmd32.dll
- %TEMP%\IXP000.TMP\454.exe в <SYSTEM32>\454.exe
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'