Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'star6' = '<SYSTEM32>\MscheldB.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'star4' = '<SYSTEM32>\Zred2.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'star8' = '<SYSTEM32>\svscheld.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'star7' = '<SYSTEM32>\Mscheldncx.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'star1' = '<SYSTEM32>\Winrun.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'bne' = '<Полный путь к вирусу>'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'star3' = '<SYSTEM32>\Xred1.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'star2' = '<SYSTEM32>\ischot.exe'
- %WINDIR%\ponto.DLL
- %WINDIR%\control.ctr
- 'www.an####isagito.com':80
- http://www.an####isagito.com/help2.php
- DNS ASK www.an####isagito.com
- ClassName: 'Indicator' WindowName: ''