Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'Antivirus' = '<SYSTEM32>\CatRoot\WServ.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'Antivirus' = '<Полный путь к вирусу>'
- '<SYSTEM32>\CatRoot\WServ.exe'
- <SYSTEM32>\CatRoot\WServ.exe
- <SYSTEM32>\logger_currv.version
- <SYSTEM32>\PCID_MS.txt
- <SYSTEM32>\bannedpcs.lst
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bannedpcs[1].txt
- <SYSTEM32>\bannedpcs.lst
- 'va###.#wardspace.com':80
- va###.#wardspace.com/current_version.txt
- va###.#wardspace.com/bannedpcs.txt
- DNS ASK va###.#wardspace.com
- ClassName: 'MS_WINHELP' WindowName: ''