Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\RemoteServer] 'Start' = '00000002'
- '<SYSTEM32>\ping.exe' -n 5 127.0.0.1
- '<SYSTEM32>\cmd.exe' /c %WINDIR%\DelSelf.bat
- '<SYSTEM32>\rundll32.exe' "<SYSTEM32>\<Имя вируса>.dll" InstallService
- %WINDIR%\DelSelf.bat
- <SYSTEM32>\<Имя вируса>.dll
- 'co###.iemao.com':810
- DNS ASK ls###.hzads.cn
- DNS ASK co###.iemao.com
- 'ls###.hzads.cn':25345
- ClassName: 'MS_WINHELP' WindowName: ''