Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] '{B03A4BE6-5E5A-483E-B9B3-C484D4B20B72}' = 'hook dll rising'
- [<HKLM>\SYSTEM\ControlSet001\Services\AVPsys] 'ImagePath' = '<DRIVERS>\cdaudio.sys'
- <DRIVERS>\cdaudio.sys
- '%ProgramFiles%\Internet Explorer\IEXPLORE.EXE'
- '%WINDIR%\AhnRpta.exe'
- %TEMP%\at1.txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\at1[1].txt
- %TEMP%\at2.txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\at2[1].txt
- <SYSTEM32>\dllcache\cdaudio.sys.new
- %WINDIR%\AhnRpta.exe
- <SYSTEM32>\softqq0.dll
- <DRIVERS>\SET2.tmp
- <DRIVERS>\SET1.tmp
- %TEMP%\at1.txt
- %TEMP%\at2.txt
- <DRIVERS>\cdaudio.sys
- <DRIVERS>\SET1.tmp
- 'localhost':1040
- 'www.go###ehkg.com':80
- 'localhost':1037
- http://www.go###ehkg.com/1tw/at2.txt
- http://www.go###ehkg.com/1tw/at1.txt
- DNS ASK www.go###ehkg.com