Техническая информация
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\startup.lnk
- <SYSTEM32>\system.exe
- <SYSTEM32>\taskkill.exe -f -im reg.exe
- <SYSTEM32>\reg.exe add HKCU\Software\yahoo\pager /t REG_DWORD /v "Auto Login" /d 0 /f
- <SYSTEM32>\reg.exe add HKCU\Software\yahoo\pager /t REG_DWORD /v "Save Password" /d 0 /f
- [<HKCU>\Software\yahoo\pager]
- <SYSTEM32>\system.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\getipadr1[1].php
- %TEMP%\~DF9EF6.tmp
- 'sm##.gmail.com':465
- 'www.pe###ler.com':80
- 'localhost':1035
- www.pe###ler.com/getipadr1.php
- DNS ASK sm##.gmail.com
- DNS ASK www.pe###ler.com
- '<IP-адрес в локальной сети>':1036
- ClassName: '' WindowName: ''