Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft NT Update' = '<SYSTEM32>\winavi32.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunServices] 'Microsoft NT Update' = '<SYSTEM32>\winavi32.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Microsoft NT Update' = '<SYSTEM32>\winavi32.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] 'Microsoft NT Update' = '<SYSTEM32>\winavi32.exe'
- <SYSTEM32>\winavi32.exe
- GUARD.EXE
- AVSYNMGR.EXE
- MCAGENT.EXE
- ZONEALARM.EXE
- NAVAPW32.EXE
- AVPM.EXE
- AVGCTRL.EXE
- AVGCC32.EXE
- AVP.EXE
- AVPCC.EXE
- AVP32.EXE
- <SYSTEM32>\winavi32.exe
- <Полный путь к вирусу>
- 'ir#.#hrooms.tv':6667
- DNS ASK ir#.#hrooms.tv
- ClassName: 'Indicator' WindowName: ''