Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Internet' = '%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://www.q3q.com'
- '%TEMP%\is-1QF6L.tmp\KuGou7.6.15%2815244%29_NoAD_VIP.tmp' /SL5="$30092,12770291,175104,%PROGRAM_FILES%\KuGou7.6.15%2815244%29_NoAD_VIP.exe"
- '%PROGRAM_FILES%\KuGou7.6.15%2815244%29_NoAD_VIP.exe'
- '%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' http://www.q2#.com
- '<SYSTEM32>\regsvr32.exe' browsar.dll /s
- %TEMP%\is-421VG.tmp\Next5.bmp
- %TEMP%\is-421VG.tmp\Cancle1.bmp
- %TEMP%\is-421VG.tmp\Cancle2.bmp
- %TEMP%\is-421VG.tmp\Next4.bmp
- %TEMP%\is-421VG.tmp\Next1.bmp
- %TEMP%\is-421VG.tmp\Next2.bmp
- %TEMP%\is-421VG.tmp\Next3.bmp
- %WINDIR%\Media\qq.txt
- %WINDIR%\Media\dbase.qdb
- %WINDIR%\system\1
- %WINDIR%\Media\Windows »№Ф.wav
- %TEMP%\is-421VG.tmp\Cancle3.bmp
- %TEMP%\is-421VG.tmp\Folder.bmp
- %TEMP%\is-421VG.tmp\BlackLite.cjstyles
- %TEMP%\is-421VG.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-421VG.tmp\isskin.dll
- %TEMP%\is-421VG.tmp\ISTask.dll
- %TEMP%\is-421VG.tmp\_isetup\_RegDLL.tmp
- %PROGRAM_FILES%\KuGou7.6.15%2815244%29_NoAD_VIP.exe
- %TEMP%\is-1QF6L.tmp\KuGou7.6.15%2815244%29_NoAD_VIP.tmp
- <SYSTEM32>\browsar.dll
- %TEMP%\is-421VG.tmp\Close1.bmp
- %TEMP%\is-421VG.tmp\Close2.bmp
- %TEMP%\is-421VG.tmp\Close3.bmp
- %TEMP%\is-421VG.tmp\НкіЙ.bmp
- %TEMP%\is-421VG.tmp\»¶У.bmp
- %TEMP%\is-421VG.tmp\СЎПо.bmp
- %TEMP%\is-421VG.tmp\°ІЧ°.bmp
- ClassName: '' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'