Техническая информация
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\netvouz[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\magnolia[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\slashdot[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\newsvine[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\livejournal[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\furl[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\fark[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\google_bookmarks[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\facebook[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\wists[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\yahoo_my_web[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\banner2[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\feed-3[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\technorati[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\smarking[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\reddit[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\spurl[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\stumbleupon[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\diigo[1].gif
- %TEMP%\e\78434-090830-143430-68.a2k\__tool.tb
- %TEMP%\e\78434-090830-143430-68.a2k\__lang.lng
- %TEMP%\e\78434-090830-143430-68.a2k\index.html
- %TEMP%\e\78434-090830-143430-68.a2k\__enc_index.html
- %WINDIR%\akebook.ini
- %TEMP%\bmp1.tmp
- %TEMP%\unc1.tmp
- %WINDIR%\a3kebook.ini
- %WINDIR%\ANS2000.INI
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\acne-cure[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\ga[1].js
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\delicious[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\digg[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\blinklist[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\waystogetridofacne[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\naturalwaystogetridofacne_styles[1].css
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\blogmarks[1].gif
Присваивает атрибут 'скрытый' для следующих файлов:
- %TEMP%\e\78434-090830-143430-68.a2k\__enc_index.html
- %TEMP%\e\78434-090830-143430-68.a2k\__tool.tb
- %TEMP%\e\78434-090830-143430-68.a2k\__lang.lng
Удаляет следующие файлы:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\stumbleupon[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\wists[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\blinklist[1].gif
- %TEMP%\unc1.tmp
- %TEMP%\bmp1.tmp
Сетевая активность:
Подключается к:
- 'www.go#####analytics.com':80
- 'na#######ystogetridofacne.com':80
- 'localhost':1035
TCP:
Запросы HTTP GET:
- na#######ystogetridofacne.com/images/slashdot.gif
- na#######ystogetridofacne.com/images/reddit.gif
- na#######ystogetridofacne.com/images/smarking.gif
- na#######ystogetridofacne.com/images/magnolia.gif
- na#######ystogetridofacne.com/images/netvouz.gif
- na#######ystogetridofacne.com/images/newsvine.gif
- na#######ystogetridofacne.com/images/stumbleupon.gif
- na#######ystogetridofacne.com/images/wists.gif
- na#######ystogetridofacne.com/images/feed-3.gif
- na#######ystogetridofacne.com/images/banner2.gif
- na#######ystogetridofacne.com/images/spurl.gif
- na#######ystogetridofacne.com/images/technorati.gif
- na#######ystogetridofacne.com/images/yahoo_my_web.gif
- na#######ystogetridofacne.com/images/livejournal.gif
- na#######ystogetridofacne.com/images/blinklist.gif
- www.go#####analytics.com/ga.js
- na#######ystogetridofacne.com/images/acne-cure.jpg
- na#######ystogetridofacne.com/naturalwaystogetridofacne_styles.css
- na#######ystogetridofacne.com/images/waystogetridofacne.jpg
- na#######ystogetridofacne.com/images/blogmarks.gif
- na#######ystogetridofacne.com/images/digg.gif
- na#######ystogetridofacne.com/images/furl.gif
- na#######ystogetridofacne.com/images/facebook.gif
- na#######ystogetridofacne.com/images/google_bookmarks.gif
- na#######ystogetridofacne.com/images/delicious.gif
- na#######ystogetridofacne.com/images/diigo.gif
- na#######ystogetridofacne.com/images/fark.gif
UDP:
- DNS ASK www.go#####analytics.com
- DNS ASK na#######ystogetridofacne.com
- '<IP-адрес в локальной сети>':1036
Другое:
Ищет следующие окна:
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
