Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,<SYSTEM32>\desk.exe'
- скрытых файлов
- %CommonProgramFiles%\System\mdm.exe
- %CommonProgramFiles%\System\sound.jpg
- %CommonProgramFiles%\System\sound.jpg (загружен из сети Интернет)
- <SYSTEM32>\net1.exe stop SharedAccess
- <SYSTEM32>\net.exe stop SharedAccess
- 360tray.exe
- %CommonProgramFiles%\System\sound.jpg
- %CommonProgramFiles%\System\mdm.exe
- <SYSTEM32>\desk.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\mswinsck[1].ocx
- <SYSTEM32>\MSWINSCK.OCX
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\msdtc[1].exe
- <SYSTEM32>\desk.exe
- %CommonProgramFiles%\System\mdm.exe
- '88##04.com':80
- 'localhost':1036
- 88##04.com/config.asp
- 88##04.com/msdtc.exe
- 88##04.com/mswinsck.ocx
- DNS ASK 88##04.com