Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ExPlOrer' = '<SYSTEM32>\ExPlOrer.exe'
- <Текущая директория>\winrar.exe M -hp+++ %WINDIR%\windows.rar %WINDIR%\windows.gif
- <SYSTEM32>\reg.exe add HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Run /f /v ExPlOrer /t REG_SZ /d <SYSTEM32>\ExPlOrer.exe
- <SYSTEM32>\reg.exe add "HKLM\SOFTWARE\Classes\*\Shell\Ouvrir avec Other-Ghost\command" /f /ve /t REG_SZ /d <DRIVERS>\ExPlOrer.exe
- <SYSTEM32>\reg.exe add "HKLM\SOFTWARE\Classes\exefile\shell\Disable Visual Styles\Command" /f /ve /t REG_SZ /d <DRIVERS>\ExPlOrer.exe
- <SYSTEM32>\attrib.exe +r +s +h C:
- <SYSTEM32>\regsvr32.exe /s <SYSTEM32>\SendEmail.dll
- <SYSTEM32>\reg.exe add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f /v ExPlOrer /t REG_SZ /d <SYSTEM32>\ExPlOrer.exe
- %WINDIR%\windows.gif
- %WINDIR%\windows.rar
- <Текущая директория>\winrar.exe
- %WINDIR%\windows.gif
- 'wa####ack.p2h.info':80
- wa####ack.p2h.info/warinback.txt
- DNS ASK wa####ack.p2h.info
- ClassName: 'Shell_TrayWnd' WindowName: ''