Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\VMUSRV] 'Start' = '00000002'
- <SYSTEM32>\cmd.exe /c ""%TEMP%\\UNINS.bat""
- <SYSTEM32>\svchost.exe -k VMUSRV
- %WINDIR%\inf\atm.ldb
- <DRIVERS>\XSRProto.sys
- %WINDIR%\inf\atm.PNF
- <SYSTEM32>\VMUSRV.dll
- %TEMP%\UNINS.bat
- 'p4###.#hatthisdown.com':4003
- DNS ASK p4###.#hatthisdown.com