Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] '{B03A4BE6-5E5A-483E-B9B3-C484D4B20B72}' = 'hook dll rising'
- %WINDIR%\dosRpta.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\huofukr[1].txt
- %TEMP%\huofukr.txt
- %WINDIR%\dosRpta.exe
- <SYSTEM32>\vmpus0.dll
- \Device\HarddiskVolume1
- %TEMP%\huofukr.txt
- 'www.yu###y03.com':80
- 'localhost':1035
- www.yu###y03.com/xz/huofukr.txt
- DNS ASK www.yu###y03.com