Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Internet Security' = 'C:\ProgramData\indefender.exe'
- [<HKLM>\SYSTEM\ControlSet001\Control\Print\Providers\5b475] 'Name' = '%TEMP%\B2E9.tmp'
- 'C:\ProgramData\indefender.exe'
- <SYSTEM32>\spoolsv.exe
- <Служебный элемент>
- <SYSTEM32>\cscript.exe
- <SYSTEM32>\cmd.exe
- C:\Users\Public\Desktop\Internet Security PRO 2013.lnk
- %WINDIR%\Temp\~DFD8E74A5B64487D3B.TMP
- %TEMP%\B2E9.tmp
- C:\ProgramData\indefender
- C:\ProgramData\indefender в C:\ProgramData\indefender.exe
- из <Полный путь к вирусу> в %TEMP%\B606.tmp
- DNS ASK www.ba####masala.com
- DNS ASK so####rtal360.com
- DNS ASK sa###rboy.com
- DNS ASK dn#.##ftncsi.com
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''