Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] 'Generic Host Process for WinXP Services' = 'mshelp.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Generic Host Process for WinXP Services' = 'mshelp.exe'
- '<SYSTEM32>\mshelp.exe'
- <SYSTEM32>\mqr.dll
- <SYSTEM32>\descript.lnk
- <SYSTEM32>\mshelp.exe
- <SYSTEM32>\sqla.dll
- <SYSTEM32>\mqr.dll
- 'bs######h.awardspace.com':80
- 'fe######n.awardspace.com':80
- 'le#####k.netfirms.com':80
- 'localhost':1037
- 'www.el####t-bunker.com':80
- bs######h.awardspace.com/descript1.txt
- fe######n.awardspace.com/descript1.txt
- le#####k.netfirms.com/cgi-bin/descript1.gif
- www.el####t-bunker.com/_2sys.php?PA################
- www.el####t-bunker.com/descript1.txt
- DNS ASK bs######h.awardspace.com
- DNS ASK fe######n.awardspace.com
- DNS ASK www.el####t-bunker.com
- DNS ASK le#####k.netfirms.com
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''