Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = 'Explorer.exe %TEMP%\svchost.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%TEMP%\svchost.exe' = '%TEMP%\svchost.exe:*:Enabled:svchost.exe'
- %TEMP%\svchost.exe
- %TEMP%\system.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\flash_z78[1].gif
- %TEMP%\svchost.exe
- 'ed##21.net':80
- 'ma###media.com':80
- ed##21.net/zb41pl7/bbs/images/flash_z78.gif
- ma###media.com/
- DNS ASK ed##21.net
- DNS ASK ma###media.com