Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ArjvZHuHsrjyIwjC' = '%APPDATA%\fuXlYdUZvxj.exe'
- %WINDIR%\explorer.exe
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:"%TEMP%\RES2.tmp"" ""%TEMP%\vbc1.tmp""
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe /noconfig @"%TEMP%\ii3n1vd8.cmdline"
- ccapp.exe
- [<HKCU>\Software\Paltalk]
- [<HKCU>\Software\Google\Google Talk\Accounts]
- %TEMP%\vbc1.tmp
- %TEMP%\RES2.tmp
- %TEMP%\ii3n1vd8.dll
- %TEMP%\ii3n1vd8.out
- %APPDATA%\fuXlYdUZvxj.exe
- %TEMP%\ii3n1vd8.0.vb
- %TEMP%\ii3n1vd8.cmdline
- %TEMP%\ii3n1vd8.0.vb
- %TEMP%\ii3n1vd8.out
- %TEMP%\ii3n1vd8.dll
- %TEMP%\RES2.tmp
- %TEMP%\vbc1.tmp
- %TEMP%\ii3n1vd8.cmdline
- из <Полный путь к вирусу> в %TEMP%\tmpG343.tmp
- ClassName: 'VMDragDetectWndClass' WindowName: ''