Техническая информация
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = 'explorer.exe,<SYSTEM32>\autoie.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = 'explorer.exe,<SYSTEM32>\W1NL0g0.exe'
- %TEMP%\autoie.exe
- <SYSTEM32>\Sveran.exe
- %TEMP%\p21.exe
- %TEMP%\ppp.exe
- %TEMP%\LongMa.exe
- <SYSTEM32>\cmd.exe /c ""%TEMP%\a.bat""
- <SYSTEM32>\attrib.exe <SYSTEM32>\W1NL0g0.exe +R +H +A +S
- <SYSTEM32>\regsvr32.exe /s <SYSTEM32>\QingYL.dll
- <SYSTEM32>\autoie.exe
- <SYSTEM32>\QingYL.dll
- <SYSTEM32>\W1NL0g0.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\543abc[1]
- %TEMP%\a.bat
- <SYSTEM32>\Sveran.exe
- %TEMP%\LongMa.exe
- %TEMP%\ppp.exe
- %TEMP%\autoie.exe
- %TEMP%\p21.exe
- <SYSTEM32>\W1NL0g0.exe
- %TEMP%\LongMa.exe
- %TEMP%\~DF4902.tmp
- 'localhost':1039
- 'www.54##bc.com':80
- 'localhost':1036
- www.54##bc.com/
- www.54##bc.com/tongji2/count/count.aspip.asp?ma###########################
- DNS ASK www.54##bc.com
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''