Техническая информация
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Handler\mhtml] 'CLSID' = ' '
- '<SYSTEM32>\ntvdm.exe' -f -i1
- '<SYSTEM32>\cmd.exe' /C del %ProgramFiles%\Windows Media Player\wmplayer.exe
- '%WINDIR%\regedit.exe' -s c:\ie.reg
- '%ProgramFiles%\Internet Explorer\IEXPLORE.EXE' http://21#.#40.137.40/yespop/counted.php?x=###
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ie[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\counted[1].php
- %WINDIR%\Temp\scs2.tmp
- C:\ie.reg
- %WINDIR%\Temp\scs1.tmp
- %WINDIR%\Temp\scs2.tmp
- %WINDIR%\Temp\scs1.tmp
- '21#.#40.137.40':80
- 'www.go####rsearch.com':80
- 'localhost':1037
- http://21#.#40.137.40/yespop/counted.php?x=###
- http://www.go####rsearch.com/ie/
- DNS ASK www.go####rsearch.com
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-b48.b4c.380001'
- ClassName: '' WindowName: ''