Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'preeubo' = ''
- %APPDATA%\preeubo.exe
- <SYSTEM32>\cmd.exe /c \DelUS.bat
- %APPDATA%\VB6KO.DLL
- %TEMP%\nss2.tmp\SelfDelete.dll
- C:\DelUS.bat
- %APPDATA%\msvbvm60.dll
- %APPDATA%\preeubo.exe
- %APPDATA%\scrrun.dll
- %APPDATA%\MSINET.OCX
- %TEMP%\nss2.tmp\SelfDelete.dll
- 'fi##.#ongfile.net':80
- fi##.#ongfile.net/preeubo_d.php?AK#######
- DNS ASK fi##.#ongfile.net