Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5}] 'StubPath' = 'file:\\C:\sys.exe'
- %WINDIR%\sys.exe
- <SYSTEM32>\attrib.exe +h "%HOMEPATH%\「开始」菜单\程序\Internet Explorer.lnk"
- <SYSTEM32>\attrib.exe +h "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"
- <SYSTEM32>\attrib.exe +h "c:\sys.exe"
- <SYSTEM32>\attrib.exe +h "%WINDIR%\sys.exe"
- <SYSTEM32>\attrib.exe +h "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://www.ym##ku.com/xg/?ta#
- <SYSTEM32>\taskkill.exe /im KSafeTray.exe /f
- <SYSTEM32>\attrib.exe +h "%HOMEPATH%\桌面\Internet Explorer.lnk"
- <SYSTEM32>\attrib.exe +h "%ALLUSERSPROFILE%\桌面\Internet Explorer.lnk"
- %APPDATA%\Microsoft\Internet Explorer\Quick Launc\Internet Expiorer.lnk
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\xg[1]
- C:\sys.exe
- %WINDIR%\sys.exe
- C:\sys.exe
- %WINDIR%\sys.exe
- 'www.ym##ku.com':80
- 'localhost':1036
- www.ym##ku.com/xg/?ta#
- DNS ASK www.ym##ku.com
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'Progman' WindowName: 'Program Manager'
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''