Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnonBadCertRecving' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnOnZoneCrossing' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1601' = '00000000'
- %HOMEPATH%\Start Menu\Programs\Windows Recovery\Uninstall Windows Recovery.lnk
- %HOMEPATH%\Desktop\Windows Recovery.lnk
- %ALLUSERSPROFILE%\Application Data\1Z3yGVsB8YZE
- %HOMEPATH%\Start Menu\Programs\Windows Recovery\Windows Recovery.lnk
- из <Полный путь к вирусу> в %ALLUSERSPROFILE%\Application Data\1Z3yGVsB8YZE.exe
- 'se####article.org':80
- 'cl###clever.org':80
- 'se###harch.org':80
- 'se###hongs.org':80
- 'se###hadult.org':80
- http://se####article.org/dfrg/dfrg
- http://se###hadult.org/dfrg/dfrgr
- http://se####article.org/dfrg/dfrgr
- http://cl###clever.org/dfrg/dfrgr
- http://cl###clever.org/dfrg/dfrg
- http://se###hadult.org/dfrg/dfrg
- http://se###hongs.org/dfrg/dfrgr
- http://se###hongs.org/dfrg/dfrg
- http://se###hadult.org/404.php?ty###################################################
- http://se###harch.org/dfrg/dfrgr
- http://se###harch.org/dfrg/dfrg
- DNS ASK se####article.org
- DNS ASK cl###clever.org
- DNS ASK se###harch.org
- DNS ASK se###hongs.org
- DNS ASK se###hadult.org
- ClassName: 'Shell_TrayWnd' WindowName: ''