Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\updater] 'Start' = '00000002'
- '<SYSTEM32>\winsvc.exe'
- <SYSTEM32>\~update.exe
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\up[1].png
- <SYSTEM32>\winsvc.exe
- 'www.ex####gineering.com':80
- 'localhost':1035
- www.ex####gineering.com/images/pics/up.png
- DNS ASK www.ex####gineering.com