Техническая информация
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'run' = '<DRIVERS>\csrss.exe'
- '<DRIVERS>\csrss.exe'
- '<SYSTEM32>\wbem\wmiadap.exe' /R /T
- '<SYSTEM32>\net1.exe' localgroup %USERNAME%s HelpServiceGroup /add
- '<SYSTEM32>\net1.exe' user HelpServiceGroup hacker /add
- [<HKCU>\Software\yahoo\pager]
- <DRIVERS>\csrss.exe
- <SYSTEM32>\PerfStringBackup.TMP
- <SYSTEM32>\wbem\Performance\WmiApRpl.ini
- 'localhost':1040
- 'sm##ds.com':80
- 'ia###036.com':80
- 'ce###c-r.info':80
- 'dy####ate.no-ip.com':80
- ia###036.com/ip.php
- sm##ds.com/cgi-bin/mail/email.pl?to####################################################################################################
- ce###c-r.info/ip.php
- dy####ate.no-ip.com/ip.php
- DNS ASK ia###036.com
- DNS ASK sm##ds.com
- DNS ASK ce###c-r.info
- DNS ASK dy####ate.no-ip.com
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''