Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Google_Update.exe' = '%TEMP%\Google_Update.exe'
- '%TEMP%\kxw.exe'
- '%TEMP%\kxw.exe' (загружен из сети Интернет)
- '%WINDIR%\explorer.exe' http://20#.#.142.42/images/Ei3.php
- '<SYSTEM32>\taskkill.exe' /f /im cfp.exe /t
- %TEMP%\remove\psexec.exe
- %TEMP%\remove\movefile.exe
- %TEMP%\remove\pskill.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\Ei3[1].php
- %TEMP%\remove\setACL.exe
- %TEMP%\Google_Update.exe
- %TEMP%\kxw.exe
- %TEMP%\remove\clngbuster.reg
- %TEMP%\remove\setreg.cmd
- %TEMP%\remove\mata.cmd
- 'localhost':1039
- '20#.#.142.42':80
- 'wp#d':80
- 20#.#.142.42/images/psexec.gif
- 20#.#.142.42/images/movefile.gif
- 20#.#.142.42/images/pskill.gif
- 20#.#.142.42/images/Ei3.php
- 20#.#.142.42/images/setACL.gif
- 20#.#.142.42/images/setreg.gif
- 20#.#.142.42/images/kxw.gif
- wp#d/wpad.dat
- 20#.#.142.42/images/3.gif
- 20#.#.142.42/images/mata.gif
- 20#.#.142.42/images/clngbuster.gif
- DNS ASK wp#d
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
- ClassName: '' WindowName: ''