Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,<SYSTEM32>\d21j\takesoft.exe'
- [<HKLM>\SOFTWARE\Classes\IE\shell\open\command] '' = '%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE Ѓт*ЧћЮЭЎЎт?x/№Ё€ЇC“PшЉrщ4ЙлОvє“‚P’"0Z¶ў-OD yZо bWГlЊtіфБцJ]ЎуИ‘z!z¤U‹+vђхp9ј|ЏуЭtЫEYm¤ ]вВRИ®Ѕ ‡JђNеРC ъ1Pшощ'
- расширений файлов
- <SYSTEM32>\4467\06yd0bjx.exe
- <SYSTEM32>\4467\takesoft.exe <Полный путь к вирусу>===
- <SYSTEM32>\ping.exe 127.0.0.1 -n 1
- %WINDIR%\regedit.exe /s "<SYSTEM32>\4467\test.reg"
- <SYSTEM32>\taskkill.exe /f /im ZhuDongFangyu.exe
- <SYSTEM32>\4467\10.ico
- <SYSTEM32>\4467\9.ico
- <SYSTEM32>\4467\8.ico
- <SYSTEM32>\4467\06yd0bjx.exe
- <SYSTEM32>\4467\test.reg
- <SYSTEM32>\4467\dasoft.encode
- <SYSTEM32>\4467\7.ico
- <SYSTEM32>\4467\3.ico
- <SYSTEM32>\4467\2.ico
- <SYSTEM32>\4467\takesoft.exe
- <SYSTEM32>\4467\6.ico
- <SYSTEM32>\4467\5.ico
- <SYSTEM32>\4467\4.ico
- <SYSTEM32>\4467\test.reg
- <SYSTEM32>\4467\06yd0bjx.exe
- ClassName: 'Progman' WindowName: ''
- ClassName: 'SHELLDLL_DefView' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''