Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{C49DD894-C6DE-4910-8C41-BA20F852D8BC}] 'ClsidExtension' = '{C49DD894-C6DE-4910-8C41-BA20F852D8BC}'
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://to#####.onlydown.com/ok.htm
- <SYSTEM32>\regsvr32.exe /s "%PROGRAM_FILES%\onlydown.com Toolbar\onlydown.dll"
- %PROGRAM_FILES%\onlydown.com Toolbar\onlydown.crc
- %PROGRAM_FILES%\onlydown.com Toolbar\msvcrt.dll
- %PROGRAM_FILES%\onlydown.com Toolbar\msvcp60.dll
- %PROGRAM_FILES%\onlydown.com Toolbar\version.txt
- %PROGRAM_FILES%\onlydown.com Toolbar\options.html
- %PROGRAM_FILES%\onlydown.com Toolbar\onlydown.dll
- %PROGRAM_FILES%\onlydown.com Toolbar\logo.bmp
- %PROGRAM_FILES%\onlydown.com Toolbar\blocked.cur
- %PROGRAM_FILES%\onlydown.com Toolbar\basis.xml
- %TEMP%\nsm2.tmp
- %PROGRAM_FILES%\onlydown.com Toolbar\icons.bmp
- %PROGRAM_FILES%\onlydown.com Toolbar\favicon.ico
- %PROGRAM_FILES%\onlydown.com Toolbar\blocked.wav
- ClassName: '' WindowName: ''