Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\Wseaqc ewmueyqg] 'Start' = '00000002'
- '%PROGRAM_FILES%\Microsoft Lxfcsk\Oyyoqse.exe'
- '<SYSTEM32>\wscript.exe' "C:\2500.vbs"
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\Thumbs[1].db
- <SYSTEM32>\.o
- C:\2500.vbs
- %PROGRAM_FILES%\Microsoft Lxfcsk\Oyyoqse.exe
- <Текущая директория>\.o
- C:\2500.vbs
- 'localhost':1040
- '12#.#14.128.202':2012
- 'localhost':1037
- 'sk##bss.com':80
- http://sk##bss.com/Thumbs.db
- DNS ASK sk##bss.com