Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'dk' = '%PROGRAM_FILES%\Microsoft ActiveSyncs\dk.exe'
- '%PROGRAM_FILES%\Microsoft ActiveSyncs\dk.exe'
- <Полный путь к вирусу>
- %PROGRAM_FILES%\Microsoft ActiveSyncs\dk.exe
- %TEMP%\~DFE672.tmp
- %PROGRAM_FILES%\Microsoft ActiveSyncs\dk.exe
- %TEMP%\~DFAF02.tmp
- %TEMP%\~DFAF02.tmp
- '18#.#11.80.39':8080
- 'hi###g.co.kr':80
- 'www.go###e.co.kr':443
- hi###g.co.kr/link.txt
- DNS ASK hi###g.co.kr
- DNS ASK www.go###e.co.kr
- ClassName: 'TCPViewClass' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''