Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ctfmon.exe' = '%APPDATA%\ctfmon.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'UserFaultCheck' = ''
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ctfmon.exe' = '%APPDATA%\ctfmon.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Windows Firewall' = '%PROGRAM_FILES%\winlogon.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Windows Firewall' = '%PROGRAM_FILES%\winlogon.exe'
- %PROGRAM_FILES%\winlogon.exe
- <SYSTEM32>\winlogon.exe
- %WINDIR%\pchealth\ERRORREP\UserDumps\winlogon.exe.20110714-161534-00.mdmp
- %APPDATA%\sjh4fgl24_Z4[j5-1]vk-w.tmp
- %WINDIR%\pchealth\ERRORREP\UserDumps\winlogon.exe.20110714-161534-00.hdmp
- %APPDATA%\ctfmon.exe
- %TEMP%\B1LN16mm.txt
- %TEMP%\keygen-all CS5.exe
- %PROGRAM_FILES%\winlogon.exe
- %APPDATA%\ctfmon.exe
- %PROGRAM_FILES%\winlogon.exe
- %WINDIR%\pchealth\ERRORREP\UserDumps\winlogon.exe.20110714-161534-00.mdmp
- %TEMP%\B1LN16mm.txt
- 'bo###.tatatata.info':6667
- DNS ASK bo###.tatatata.info
- ClassName: '' WindowName: 'BitDefender Firewall Alert'
- ClassName: 'ConsoleWindowClass' WindowName: ''
- ClassName: '' WindowName: 'Windows Security Alert'
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''