Техническая информация
- %WINDIR%\system\csrss.exe /c set vvmm01=<DRIVERS>\vmx_svga.sys&set vvmm02=<SYSTEM32>\vmx_mode.dll&set stpw=,..,..x0x86,,&set ok_path=%commonprogramfiles%\Speech&set ok_exe=%commonprogramfiles%\Speech\smss.exe&set ok_old_exe=%commonprogramfiles%\Speech\csrss.exe&set ok_config=%commonprogramfiles%\Speech\okewb.ini&set r_g=HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run&set wgtdir=%windir%\network diagnostic&set _wget=%windir%\network diagnostic\svchost.exe&set okpw=A33CA126A732A7C34F822C2732FBC324C226873181B3231226C63156&set ok_url=http://an##ub.net/file/Z27-kiss_ok.mp3&set kk_exe=%temp%\KK.exe&set fuck=echo&set shit=del /f /q&set ok_ww1=%myfiles%\ok_ww1.sp&set ok_ww2=%myfiles%\ok_ww2.sp&call "%myfiles%\okok.bat"
- <SYSTEM32>\taskkill.exe /f /im "ok.exe"
- <SYSTEM32>\findstr.exe "o_k_o_k" ""%TEMP%\*.bat""
- <SYSTEM32>\taskkill.exe /F /IM explorer.exe
- <SYSTEM32>\taskkill.exe /im "<Имя вируса>.exe" /f
- <SYSTEM32>\taskkill.exe /im "okewb.exe" /f
- <SYSTEM32>\taskkill.exe /im "oke.exe" /f
- %WINDIR%\Explorer.EXE
- <LS_APPDATA>\ok_ww2.sp
- <LS_APPDATA>\okok.bat
- %WINDIR%\system\csrss.exe
- <LS_APPDATA>\ok_ww1.sp
- %TEMP%\~1.bat
- <LS_APPDATA>\ok.dat
- <LS_APPDATA>\ok.exe
- %TEMP%\~1.bat
- %WINDIR%\explorer.exe
- %TEMP%\~1.bat
- <LS_APPDATA>\ok.exe
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: ''