Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Task Manager' = '%WINDIR%\wupdate.exe'
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\lenh[1].txt
- %WINDIR%\wupdate.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\trojan[1].txt
- 'lo##.#hatnghe.vn':80
- lo##.#hatnghe.vn/lenh.txt
- lo##.#hatnghe.vn/trojan.txt
- DNS ASK lo##.#hatnghe.vn