Technical Information
- %WINDIR%\explorer.exe
- %TEMP%\nsk2.tmp\System.dll
- %TEMP%\nsk2.tmp\nsProcEx.dll
- %TEMP%\nsk2.tmp\winscrs.da_
- %TEMP%\nsk2.tmp\winscrs.dll
- %TEMP%\nsk2.tmp\SelfDel.dll
- %TEMP%\nsk2.tmp\ioSpecial.ini
- %TEMP%\nsk2.tmp\modern-wizard.bmp
- %TEMP%\nsk2.tmp\InstallOptions.dll
- %TEMP%\nsk2.tmp\winscrs.da_
- 'dd###zplus.com':80
- http://www.wi###are.net/runs/do.php via dd###zplus.com
- DNS ASK www.dd###zplus.com
- '%WINDIR%\explorer.exe'