Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'yckhd' = '%WINDIR%\csrss.exe'
- %HOMEPATH%\Start Menu\Programs\Startup\yckhd.lnk
- '%WINDIR%\xiezai.exe'
- '%WINDIR%\csrss.exe'
- %WINDIR%\xiezai.exe
- %WINDIR%\csrss.exe
- '<L###LNET>.0.2':0
- 'www.dn##8.com':5858
- DNS ASK www.dn##8.com