Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'fpcxnergfhwyeil' = '<SYSTEM32>\regsvr32.exe /s "<SYSTEM32>\cokbtdzejohr.dll"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'fpcxnergfhwyeil' = '<SYSTEM32>\regsvr32.exe /s "%TEMP%\nss6.tmp.dll"'
- %TEMP%\setup.exe
- %TEMP%\ctffmon.exe
- %TEMP%\svhost.exe
- <SYSTEM32>\regsvr32.exe /s "<SYSTEM32>\cokbtdzejohr.dll"
- %TEMP%\ExtA.tmp
- %TEMP%\SPI7.tmp\setup.bmp
- %TEMP%\Ext9.tmp
- %TEMP%\SPI7.tmp\setup.lic
- %TEMP%\ap14E06.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\nsi_install[1].php
- <SYSTEM32>\mwxqpeailplg.exe
- %TEMP%\SPI7.tmp\setup.dat
- %TEMP%\ctffmon.exe
- %TEMP%\svhost.exe
- %TEMP%\setup.exe
- %TEMP%\nsc4.tmp
- %TEMP%\Ext8.tmp
- %TEMP%\nss6.tmp.dll
- %TEMP%\nsc5.tmp\System.dll
- %TEMP%\ap14E06.tmp
- %TEMP%\nsc5.tmp\System.dll
- %TEMP%\ExtA.tmp
- %TEMP%\Ext8.tmp
- %TEMP%\Ext9.tmp
- 're#####streaming.net':80
- 'localhost':1036
- '80.##.207.139':80
- re#####streaming.net/bc/nsi_install.php?in#######################################################################################
- 80.##.207.139/np/ok.php?ud###################################################################
- DNS ASK re#####streaming.net
- '<IP-адрес в локальной сети>':1037
- ClassName: 'MS_WINHELP' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''