Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Microsoft windows sytems' = '%PROGRAM_FILES%\sytems.exe'
- '%APPDATA%\mx1.exe'
- '%PROGRAM_FILES%\sytems.exe'
- %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\Preferred
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\ec702f375e1b12d218f67ab9ef19ca23_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\hao123[1]
- %PROGRAM_FILES%\sytems.exe
- %APPDATA%\mx1.exe
- %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\11f01ff7-ad08-4240-be9b-44f80cd9c6ea
- 'localhost':1040
- 'www.ha##23.com':80
- 'localhost':1036
- www.ha##23.com/?tn################
- DNS ASK fm.##idu.com
- DNS ASK www.tt##23.cn
- DNS ASK www.36##.com
- DNS ASK www.ha##23.com
- DNS ASK www.23##.com
- DNS ASK www.du##.com
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: '(null)' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'