Техническая информация
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\msg.lnk
- %HOMEPATH%\Start Menu\Programs\Startup\msg.lnk
- %HOMEPATH%\winupdate.exe
- <LS_APPDATA>\MZ?
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\root[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\root[1].php
- %HOMEPATH%\killings.doc
- %HOMEPATH%\winupdate.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\root[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\root[1].php
- 'go##obs.net':80
- go##obs.net/crest/CRNJEUFU/MZ?
- go##obs.net/crest/root.php?cn#########################
- DNS ASK go##obs.net
- ClassName: 'WordPadClass' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''