Техническая информация
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://www.pi###bh.com.br/site/images/stories/CLIPPING/access/access.php
- <SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v svchost.exe /t reg_sz /d%HOMEPATH%\svchost.exe
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyOverride' = 'local'
- %APPDATA%\Mozilla\Firefox\Profiles\prefs.js
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\access[1].php
- %HOMEPATH%\hash1
- %HOMEPATH%\svchost.exe
- %HOMEPATH%\ddos.bat
- %HOMEPATH%\svchost.exe
- 'www.pi###bh.com.br':80
- 'localhost':1037
- www.pi###bh.com.br/site/images/stories/CLIPPING/access/access.php
- DNS ASK www.pi###bh.com.br
- '<IP-адрес в локальной сети>':1038
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''