Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '<Имя вируса>' = '<Полный путь к вирусу>'
- <SYSTEM32>\ewfwbc133.tld
- <SYSTEM32>\ewfwbc133.tlt
- %TEMP%\A14C.tmp
- <SYSTEM32>\dalvcv.fxs
- %TEMP%\BD11.tmp
- <SYSTEM32>\ewfwbc133.tli
- <SYSTEM32>\ewfwbc133.tlt
- %TEMP%\A14C.tmp
- <SYSTEM32>\ewfwbc133.tli
- %TEMP%\BD11.tmp
- <SYSTEM32>\ewfwbc133.tld
- 'ww##.##onren563dzho1.cn':80
- 'zh####n563dzho2.cn':80
- ww##.##onren563dzho1.cn/RM?h=##############################
- zh####n563dzho2.cn/out2/msn_imailer_v8.txt
- DNS ASK ww##.##onren563dzho1.cn
- DNS ASK zh####n563dzho2.cn