Техническая информация
- %TEMP%\is-NDEJK.tmp\<Имя вируса>.tmp /SL5="$40036,162199,52736,<Полный путь к вирусу>"
- <SYSTEM32>\regsvr32.exe /s "%PROGRAM_FILES%\URLToolBHO\js.dll"
- <SYSTEM32>\reg.exe ADD HKCU\Software\Mozilla\FireFox\Extensions /v svtadn@svtadn /t REG_SZ /d "%PROGRAM_FILES%\URLToolBHO\FF_A" /f
- <SYSTEM32>\reg.exe ADD HKCU\Software\Mozilla\FireFox\Extensions /v site_advisor@module /t REG_SZ /d "%PROGRAM_FILES%\URLToolBHO\FF" /f
- opera.exe
- firefox.exe
- iexplore.exe
- %PROGRAM_FILES%\URLToolBHO\FF\defaults\preferences\is-KH9A0.tmp
- %PROGRAM_FILES%\URLToolBHO\FF\locale\en-US\is-MRPH7.tmp
- %PROGRAM_FILES%\URLToolBHO\FF\content\is-QQJA3.tmp
- %PROGRAM_FILES%\URLToolBHO\FF\content\is-JVR67.tmp
- %PROGRAM_FILES%\URLToolBHO\FF\locale\en-US\is-2D2QI.tmp
- %PROGRAM_FILES%\URLToolBHO\FF\skin\is-699I8.tmp
- %PROGRAM_FILES%\URLToolBHO\unins000.dat
- %PROGRAM_FILES%\URLToolBHO\FF\locale\en-US\is-D0I3F.tmp
- %PROGRAM_FILES%\URLToolBHO\FF\skin\is-LLAJ7.tmp
- %PROGRAM_FILES%\URLToolBHO\FF\components\is-9H8NB.tmp
- %TEMP%\is-7NKG9.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-7NKG9.tmp\Inst_dll.dll
- %TEMP%\is-NDEJK.tmp\<Имя вируса>.tmp
- %TEMP%\is-7NKG9.tmp\_isetup\_RegDLL.tmp
- %PROGRAM_FILES%\URLToolBHO\is-3LBUB.tmp
- %PROGRAM_FILES%\URLToolBHO\FF\is-B5ETO.tmp
- %PROGRAM_FILES%\URLToolBHO\FF\is-G25OK.tmp
- %PROGRAM_FILES%\URLToolBHO\is-6JR0R.tmp
- %PROGRAM_FILES%\URLToolBHO\is-41FQK.tmp
- 'to###arping.net':80
- to###arping.net/ping.php
- DNS ASK to###arping.net
- ClassName: 'Shell_TrayWnd' WindowName: ''