Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Control\Lsa] 'Notification Packages' = ''
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'tibarojume' = 'Rundll32.exe "<SYSTEM32>\wuyojogi.dll",s'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 'AppInit_DLLs' = '<SYSTEM32>\vanabesa.dll'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 'LoadAppInit_DLLs' = '00000001'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%WINDIR%\explorer.exe' = '%WINDIR%\explorer.exe:*:Enabled:Explorer'
- Центр обеспечения безопасности (Security Center)
- <SYSTEM32>\wuyojogi.dll
- <SYSTEM32>\vanabesa.dll
- <SYSTEM32>\jefugapu
- <SYSTEM32>\fosepoyo.dll
- DNS ASK 15.#####################52df50ef5df.nka100009.lg20.0.-.261.0.<Служебное имя>.0.200011.uroledup.com