Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ' Avast ' = '%WINDIR%\help\nuj9374.exe'
- %WINDIR%\Help\nuj9374.exe
- %TEMP%\~DF2FCE.tmp
- 'co#####000.com.sapo.pt':80
- http://co#####000.com.sapo.pt/reenvio1.dll
- DNS ASK co#####000.com.sapo.pt