Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{055D9835-CEFF-F341-1EBC-4B8C811F33E7}] 'StubPath' = '%TEMP%\IXP001.TMP\xxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'system32' = '%TEMP%\IXP001.TMP\xxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'wextract_cleanup0' = 'rundll32.exe <SYSTEM32>\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'wextract_cleanup1' = 'rundll32.exe <SYSTEM32>\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"'
- '%TEMP%\IXP001.TMP\xxx.exe'
- '%TEMP%\IXP000.TMP\xx.exe'
- %WINDIR%\Explorer.EXE
- msnmsgr.exe
- %TEMP%\IXP000.TMP\x2.jpg
- %TEMP%\IXP001.TMP\xxx.exe
- <Полный путь к вирусу>-up.txt
- %TEMP%\IXP000.TMP\xx.exe
- %TEMP%\IXP000.TMP\xx.exe
- %TEMP%\IXP000.TMP\x2.jpg
- %TEMP%\IXP001.TMP\xxx.exe
- 'kt###.no-ip.biz':3460
- DNS ASK kt###.no-ip.biz