Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\msliksurserv] 'start' = '00000001'
- [<HKLM>\SYSTEM\ControlSet001\Services\msliksurserv.sys] 'ImagePath' = 'globalroot<DRIVERS>\msliksurserv.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\msliksurserv.sys] 'Start' = '00000001'
- %TEMP%\is-655OQ.tmp\setup.exe
- %TEMP%\is-LP04I.tmp\<Имя вируса>.tmp /SL5="$40032,53248,53248,<Полный путь к вирусу>"
- <SYSTEM32>\msiexec.exe /V
- %TEMP%\FR243532.tmp
- <DRIVERS>\msliksurserv.sys
- %TEMP%\is-655OQ.tmp\setup.exe
- %TEMP%\tmp2.tmp
- %TEMP%\tmp1.tmp
- <SYSTEM32>\msliksurcredo.dll
- %TEMP%\is-655OQ.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-LP04I.tmp\<Имя вируса>.tmp
- %TEMP%\is-655OQ.tmp\_isetup\_shfoldr.dll
- <SYSTEM32>\msliksurdns.dll
- %TEMP%\is-655OQ.tmp\_isetup\_iscrypt.dll
- %TEMP%\tmp1.tmp
- %TEMP%\tmp2.tmp
- DNS ASK ae###zumbe.com
- DNS ASK vb###ticwb.com
- DNS ASK gf###bgpcj.com
- DNS ASK ym###rrcnf.com
- DNS ASK mh###cnfgn.com
- DNS ASK ks###yszgb.com
- DNS ASK mz###swmje.com
- DNS ASK www.microsoft.com
- DNS ASK jj###zydbb.com
- DNS ASK fx###sjnbi.com
- DNS ASK su###xijpw.com
- '19#.#5.232.148':1036
- '69.##.176.194':1034
- ClassName: 'Shell_TrayWnd' WindowName: ''