Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'wDefender' = '%WINDIR%\wdefender.exe'
- '%WINDIR%\wdefender.exe'
- 'C:\»п±№БцИ«єё±в.exe'
- 'C:\proxy.exe'
- '%WINDIR%\wdefender.exe' (загружен из сети Интернет)
- <SYSTEM32>\mswinsck.ocx
- %WINDIR%\decaptcher.dll
- %WINDIR%\wdefender.exe
- C:\samsung.txt
- C:\proxy.exe
- C:\»п±№БцИ«єё±в.exe
- 'po#####1.blogspot.com':80
- 'aj#####.dothome.co.kr':80
- 'localhost':1037
- '1.###.66.143':80
- po#####1.blogspot.com/2013/12/popmain.html
- aj#####.dothome.co.kr/popchat.html
- 1.###.66.143/svchost.exe
- 1.###.66.143/mswinsck.ocx
- 1.###.66.143/decaptcher.dll
- DNS ASK aj#####.dothome.co.kr
- DNS ASK po#####1.blogspot.com
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''