Техническая информация
- [<HKLM>\SOFTWARE\Classes\.ghi\shell\open\command] '' = '%PROGRAM_FILES%\lvegned\sysinit.exe'
- %PROGRAM_FILES%\lvegned\scvhost.exe
- %PROGRAM_FILES%\lvegned\sstatic.exe
- %TEMP%\is-OU8O9.tmp\is-MQD6H.tmp /SL4 $30092 "<Полный путь к вирусу>" 81672 52224
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE Explorer\iexplore.exe http://12#.##4.9.113:8022/Insertbz.aspx?mc##############################
- %PROGRAM_FILES%\lvegned\is-28MA7.tmp
- %PROGRAM_FILES%\lvegned\is-AOQIB.tmp
- %PROGRAM_FILES%\lvegned\is-19UMK.tmp
- %PROGRAM_FILES%\iedw.ghi
- %PROGRAM_FILES%\iedw.lnk
- %PROGRAM_FILES%\lvegned\unins000.dat
- %PROGRAM_FILES%\lvegned\is-KL3MO.tmp
- %TEMP%\is-9Q94T.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-9Q94T.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-OU8O9.tmp\is-MQD6H.tmp
- %PROGRAM_FILES%\lvegned\is-0OJ9Q.tmp
- %PROGRAM_FILES%\lvegned\is-SNMES.tmp
- %PROGRAM_FILES%\lvegned\is-5K8MH.tmp
- %TEMP%\is-OU8O9.tmp\is-MQD6H.tmp
- %TEMP%\is-9Q94T.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-9Q94T.tmp\_isetup\_RegDLL.tmp
- '12#.#24.9.113':8022
- 'localhost':1037
- 'localhost':1036
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: ''