Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ngfsVpIvCm' = '%ALLUSERSPROFILE%\Application Data\ngfsVpIvCm.exe'
- Диспетчера задач (Taskmgr)
- '%ALLUSERSPROFILE%\Application Data\ngfsVpIvCm.exe'
- '<SYSTEM32>\ntvdm.exe' -f -i1
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Associations] 'LowRiskFileTypes' = '/{hq:/s`s:/ogn:/uyu:/dyd:/c`u:/bnl:/ble:/sdf:/lrh:/iul:/iulm:/fhg:/clq:/kqf:/`wh:/lqf:/lqdf:/lnw:/...
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments] 'SaveZoneInformation' = '00000001'
- [<HKCU>\Software\Microsoft\Internet Explorer\Download] 'CheckExeSignatures' = 'no'
- %WINDIR%\Temp\scs2.tmp
- %WINDIR%\Temp\scs3.tmp
- %ALLUSERSPROFILE%\Application Data\ngfsVpIvCm.exe
- %TEMP%\InternetExplorerUpdate.exe
- %WINDIR%\Temp\scs3.tmp
- %WINDIR%\Temp\scs2.tmp
- из <Полный путь к вирусу> в %TEMP%\tmp1.tmp
- 'se####parallel.org':80
- 'se####grieving.org':80
- http://se####parallel.org/pica1/442-direct
- http://se####grieving.org/404.php?ty##################################
- DNS ASK se####parallel.org
- DNS ASK se####grieving.org
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-b94.b98.380001'
- ClassName: 'Indicator' WindowName: ''