Техническая информация
- '%TEMP%\wh.exe'
- '%WINDIR%\Fonts\wh_2.exe' -pmuxach -d%HOMEPATH%\Local Settings\Temp
- '<SYSTEM32>\cmd.exe' /c ""%WINDIR%\Fonts\1.bat" "
- ClassName: 'RegmonClass' WindowName: '(null)'
- ClassName: 'PROCMON_WINDOW_CLASS' WindowName: '(null)'
- ClassName: 'FilemonClass' WindowName: '(null)'
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\member[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\31[1].html
- %TEMP%\wh.exe
- %WINDIR%\Fonts\1.bat
- %WINDIR%\Fonts\wh_2.exe
- 'ch###chok.ru':80
- 'pb##ck.ru':80
- 'localhost':1040
- 'localhost':1037
- 'bi##ack.ru':80
- pb##ck.ru/ph/31.html
- bi##ack.ru/member.php?u=###
- DNS ASK pb##ck.ru
- DNS ASK ch###chok.ru
- DNS ASK bi##ack.ru
- ClassName: '(null)' WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: '(null)' WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: '18467-41' WindowName: '(null)'
- ClassName: '(null)' WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
- ClassName: '' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'IEFrame' WindowName: '(null)'