Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\intyss] 'Startup' = 'SysLogon'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\intyss] 'DllName' = '%WINDIR%\msagent\chars\intyss.dll'
- Центр обеспечения безопасности (Security Center)
- %WINDIR%\SysNotifier.exe Tracking process activated.`*** ADDRESS: 0x17DA839A ***~Cannot deactivate spyware program.~Click this balloon to fix this problem.`http://www.xp###ield.cn/download/?ai###################
- <SYSTEM32>\winlogon.exe
- %WINDIR%\Explorer.EXE
- firefox.exe
- %WINDIR%\SysNotifier.exe
- %WINDIR%\msagent\chars\intyss.dll
- ClassName: 'tooltips_class32' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'TfrmSBPrompt' WindowName: 'Spyware Doctor'