Техническая информация
- скрытых файлов
- '%TEMP%\is-DJ7QA.tmp\Mad_Truckers.tmp' /SL5="$100EC,11202929,53248,%TEMP%\Mad_Truckers.exe"
- '%TEMP%\Mad_Truckers.exe'
- '%TEMP%\Game1.exe'
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /stext "%TEMP%\holdermail.txt"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe'
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe
- [<HKCU>\Software\Yahoo\Pager]
- [<HKCU>\Software\Microsoft\IdentityCRL]
- [<HKCU>\Software\Microsoft\MessengerService]
- [<HKCU>\Software\Google\Google Talk\Accounts]
- [<HKCU>\Software\Microsoft\MSNMessenger]
- %TEMP%\is-9M5HG.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-DJ7QA.tmp\Mad_Truckers.tmp
- %TEMP%\holdermail.txt
- %TEMP%\is-9M5HG.tmp\_isetup\_shfoldr.dll
- %APPDATA%\pidloc.txt
- %TEMP%\Game1.exe
- %TEMP%\sfx.ini
- %APPDATA%\pid.txt
- %TEMP%\Mad_Truckers.exe
- %TEMP%\holdermail.txt
- %TEMP%\sfx.ini
- 'pi####.atspace.cc':21
- 'wh#####yipaddress.com':80
- 'wp#d':80
- http://wh#####yipaddress.com/
- http://11#.#11.111.1/wpad.dat via wp#d
- DNS ASK pi####.atspace.cc
- DNS ASK wh#####yipaddress.com
- DNS ASK wp#d
- ClassName: 'Shell_TrayWnd' WindowName: ''