Техническая информация
- [<HKLM>\SOFTWARE\Classes\.\Shell\open\command] '' = '"Rundll32.exe" "proser.bak" SetHP'
- '%TEMP%\is-03EDH.tmp\<Имя вируса>.tmp' /SL5="$30092,51982,51712,<Полный путь к вирусу>"
- '%WINDIR%\regedit.exe' -s %PROGRAM_FILES%\TaoBao\info.desc
- %TEMP%\is-HN2IC.tmp\_isetup\_shfoldr.dll
- %PROGRAM_FILES%\TaoBao\is-12JF8.tmp
- %TEMP%\is-03EDH.tmp\<Имя вируса>.tmp
- %TEMP%\is-HN2IC.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-03EDH.tmp\<Имя вируса>.tmp
- %TEMP%\is-HN2IC.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-HN2IC.tmp\_isetup\_RegDLL.tmp
- %PROGRAM_FILES%\TaoBao\is-12JF8.tmp в %PROGRAM_FILES%\TaoBao\info.desc
- 'www.tt##r.com':80
- 'localhost':1038
- www.tt##r.com/taobao11.htm
- DNS ASK www.tt##r.com
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: '' WindowName: ''