Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\WmiApsrve] 'Start' = '00000002'
- '%WINDIR%\wmiapsrv.exe'
- %WINDIR%\AppPatch\NetSyst72.dll
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\NetSyst72[1].jpg
- %WINDIR%\wmiapsrv.exe
- 'qy##yw.com':80
- qy##yw.com/ads/NetSyst72.jpg
- DNS ASK qy##yw.com