Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] '{90359234-04B2-4A5D-A8D9-F34B82327F64}' = 'hook dll rising'
- <DRIVERS>\cdaudio.sys файлом <DRIVERS>\SET2.tmp
- %WINDIR%\dwking.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\at1[1].txt
- <SYSTEM32>\dllcache\cdaudio.sys.new
- %TEMP%\at1.txt
- %TEMP%\at2.txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\at2[1].txt
- <SYSTEM32>\dwking0.dll
- \Device\HarddiskVolume1
- %WINDIR%\dwking.exe
- <DRIVERS>\SET2.tmp
- <DRIVERS>\SET1.tmp
- %TEMP%\at1.txt
- %TEMP%\at2.txt
- <DRIVERS>\cdaudio.sys
- <DRIVERS>\SET1.tmp
- 'localhost':1039
- 'www.ba###l90.com':80
- 'localhost':1037
- www.ba###l90.com/1tw/at2.txt
- www.ba###l90.com/1tw/at1.txt
- DNS ASK www.ba###l90.com