Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Internet Security' = 'C:\ProgramData\btdefender.exe'
- [<HKLM>\SYSTEM\ControlSet001\Control\Print\Providers\6b140] 'Name' = '%TEMP%\B98E.tmp'
- 'C:\ProgramData\btdefender.exe'
- <SYSTEM32>\spoolsv.exe
- <Служебный элемент>
- <SYSTEM32>\cscript.exe
- <SYSTEM32>\cmd.exe
- C:\Users\Public\Desktop\Internet Security Plus.lnk
- %WINDIR%\Temp\~DF704F40B547FD61ED.TMP
- %TEMP%\B98E.tmp
- C:\ProgramData\btdefender
- C:\ProgramData\btdefender в C:\ProgramData\btdefender.exe
- из <Полный путь к вирусу> в %TEMP%\BAA8.tmp
- DNS ASK ci###myn.com
- DNS ASK so####rtal360.com
- DNS ASK tw###cam.net
- DNS ASK dn#.##ftncsi.com
- ClassName: 'OleMainThreadWndClass' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''