Техническая информация
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = '%APPDATA%\Microsoft\Windows\Good\1key.exe, explorer.exe'
- '%WINDIR%\regedit.exe' /s "%APPDATA%\Microsoft\Regedit.reg"
- '%APPDATA%\Microsoft\Windows\Good\1key.exe'
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\61515_host[1].zip
- %APPDATA%\Microsoft\Home.zip
- %APPDATA%\Microsoft\Windows\Good\1key.exe
- %APPDATA%\Microsoft\Regedit.reg
- 'ov##oad.ru':80
- http://ov##oad.ru/f/61515_host.zip
- DNS ASK ov##oad.ru
- ClassName: '' WindowName: 'Remote Manipulator System - '
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''