Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,,C:\PROGRA~1\COMMON~1\Tencent\QQPlug\QQdoctor.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\AntiVirus] 'ImagePath' = '%WINDIR%\AntiVirus.sys'
- '<SYSTEM32>\regsvr32.exe' /s \\?\%CommonProgramFiles%\Tencent\QQPlug\domain.dll
- '<SYSTEM32>\cmd.exe' /c ""<SYSTEM32>\del.bat" "
- '<SYSTEM32>\cmd.exe' /c regsvr32 /s \\?\%CommonProgramFiles%\Tencent\QQPlug\domain.dll
- %WINDIR%\Explorer.EXE
- <SYSTEM32>\del.bat
- %WINDIR%\AntiVirus.sys
- %CommonProgramFiles%\Tencent\QQPlug\release.tmp
- %CommonProgramFiles%\Tencent\QQPlug\ClickLoadDrv.dll
- %CommonProgramFiles%\Tencent\QQPlug\release.tmp в %CommonProgramFiles%\Tencent\QQPlug\ClickLoadDrv.dll
- %CommonProgramFiles%\Tencent\QQPlug\QQPet.dll
- %CommonProgramFiles%\Tencent\QQPlug\release.tmp
- 'www.ma##2009.cn':80
- http://www.ma##2009.cn/Count.aspx?m=#############################################################################################################################################################...
- DNS ASK www.ma##2009.cn