Техническая информация
- [<HKLM>\SOFTWARE\Classes\MSProgramGroup\Shell\Open\Command] '' = '<SYSTEM32>\grpconv.exe %1'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
- [<HKLM>\SYSTEM\ControlSet001\Services\System Updater] 'Start' = '00000002'
- <SYSTEM32>\grpconv.exe -o
- <SYSTEM32>\runonce.exe -r
- <SYSTEM32>\rundll32.exe setupapi,InstallHinfSection DefaultInstall 128 "%TEMP%\\x1jkfdsal.inf"
- <SYSTEM32>\User.ini
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\W[1].ashx
- %TEMP%\x1jkfdsal.inf
- %WINDIR%\cftnom.exe
- %WINDIR%\cftnom.bat
- <SYSTEM32>\User.ini
- %WINDIR%\cftnom.bat
- %WINDIR%\cftnom.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\W[1].ashx
- 'se#.#i72.com':80
- 'localhost':1035
- se#.#i72.com/W.ashx?A=########################################################
- DNS ASK se#.#i72.com
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''