Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Diagnostic Manager' = '<Полный путь к вирусу>'
- скрытых файлов
- расширений файлов
- Редактора реестра (RegEdit)
- <SYSTEM32>\wbem\wmiadap.exe /R /T
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFolderOptions' = '00000001'
- <SYSTEM32>\wbem\Performance\WmiApRpl_new.ini
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\sh[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\sh[1].php
- 'sv###lper.com':80
- sv###lper.com/ff/sh.php?ve#####
- DNS ASK sv###lper.com
- ClassName: 'sdfa37ajdf' WindowName: 'sfakjh3w87huiaefndjkbfd'
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'jhsf78i3ujnkdsvc' WindowName: 'sdfcj9w83jkdmfnf'
- ClassName: 'pizdavamsuki' WindowName: 'klzfj98oklfdfd'