Technical Information
- hidden files
- file extensions
- %TEMP%\nss5.tmp\ns8.tmp cmd.exe /c regini "<SYSTEM32>\offreg.ini"
- %TEMP%\uninst.exe
- %TEMP%\~nsu.tmp\Au_.exe _?=%TEMP%\
- %TEMP%\nss5.tmp\ns7.tmp cmd.exe /c regini "<SYSTEM32>\onreg.ini"
- %TEMP%\nsp2.tmp\ns3.tmp %TEMP%\init.exe
- %TEMP%\init.exe
- %TEMP%\nss5.tmp\ns6.tmp cmd.exe /c attrib +h +s +r "%PROGRAM_FILES%\ie.exe"
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://%6####.##4%68%73%69%74%65.info/?i=##########
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://%6####.####68%73%69%74%65.%69%6E%66%6F/?i=#######
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://%6####.##4%68%73%69%74%65.info/?i=########
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://%6####.##4%68%73%69%74%65.info/?i=###########
- <SYSTEM32>\regini.exe "<SYSTEM32>\offreg.ini"
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://%6####.##4%68%73%69%74%65.info/?i=#######
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://%6####.##4%68%73%69%74%65.info/?i=##################################
- <SYSTEM32>\regini.exe "<SYSTEM32>\onreg.ini"
- <SYSTEM32>\attrib.exe +h +s +r "%PROGRAM_FILES%\ie.exe"
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoInternetIcon' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoInternetIcon' = '00000000'
- %HOMEPATH%\Favorites\БґЅУ\ІШН·К«ґК.url
- %HOMEPATH%\Favorites\БґЅУ\ёцРФЗ©Гы.url
- %HOMEPATH%\Favorites\Фµ·ЦЕд¶Ф.url
- %HOMEPATH%\Favorites\БґЅУ\°ЛШФЙ«Нј.url
- %HOMEPATH%\Favorites\БґЅУ\ЙМТµµјєЅ.url
- %HOMEPATH%\Favorites\БґЅУ\КЦ»ъЧЈёЈ.url
- %HOMEPATH%\Favorites\БґЅУ\»ўДкФЛіМ.url
- %HOMEPATH%\Favorites\БґЅУ\ГАЕ®КУЖµ.url
- %HOMEPATH%\Favorites\»ўДкФЛіМ.url
- %HOMEPATH%\Favorites\ГАЕ®КУЖµ.url
- %HOMEPATH%\Favorites\ІШН·К«ґК.url
- %HOMEPATH%\Favorites\ёцРФЗ©Гы.url
- %HOMEPATH%\Favorites\МФ±¦№єОп.url
- %HOMEPATH%\Favorites\НшЦ·ґуИ«.url
- %HOMEPATH%\Favorites\ЙМТµµјєЅ.url
- %HOMEPATH%\Favorites\КЦ»ъЧЈёЈ.url
- %HOMEPATH%\Favorites\bak\Links\Windows.url
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\go.dhsite[2]
- %HOMEPATH%\Favorites\bak\Links\Windows Marketplace.url
- %HOMEPATH%\Favorites\bak\Links\Windows Media.url
- %TEMP%\~nsu.tmp\Au_.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\go.dhsite[2]
- %TEMP%\temp.ini
- %TEMP%\uninst.exe
- %HOMEPATH%\Favorites\БґЅУ\Фµ·ЦЕд¶Ф.url
- %HOMEPATH%\Favorites\bak\Desktop.ini
- %HOMEPATH%\Favorites\БґЅУ\МФ±¦№єОп.url
- %HOMEPATH%\Favorites\БґЅУ\НшЦ·ґуИ«.url
- %HOMEPATH%\Favorites\bak\Links\Customize Links.url
- %HOMEPATH%\Favorites\bak\Links\Free Hotmail.url
- %HOMEPATH%\Favorites\bak\MSN.com.url
- %HOMEPATH%\Favorites\bak\Radio Station Guide.url
- <SYSTEM32>\onreg.ini
- %TEMP%\nss5.tmp\ns7.tmp
- %TEMP%\nss5.tmp\nsExec.dll
- %TEMP%\nss5.tmp\ns6.tmp
- %TEMP%\nss5.tmp\ns8.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\go.dhsite[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\go.dhsite[1]
- <SYSTEM32>\offreg.ini
- %TEMP%\init.exe
- %TEMP%\nsp2.tmp\nsExec.dll
- %TEMP%\nsp2.tmp\time.dll
- %TEMP%\nsp2.tmp\System.dll
- <SYSTEM32>\kkkk.ico
- %PROGRAM_FILES%\ie.exe
- %TEMP%\nsp2.tmp\ns3.tmp
- <SYSTEM32>\taobao.ico
- %WINDIR%\myfav\Links\Customize Links.url
- %WINDIR%\myfav\Links\Free Hotmail.url
- %WINDIR%\myfav\MSN.com.url
- %WINDIR%\myfav\Radio Station Guide.url
- %WINDIR%\myfav\Links\Windows.url
- %HOMEPATH%\Favorites\°ЛШФЙ«Нј.url
- %WINDIR%\myfav\Links\Windows Marketplace.url
- %WINDIR%\myfav\Links\Windows Media.url
- %TEMP%\nsp2.tmp\Math.dll
- %TEMP%\nsp2.tmp\InetLoad.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\go.dhsite[1]
- %TEMP%\nss5.tmp\locate.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\go.dhsite[2]
- %WINDIR%\myfav\Desktop.ini
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\31recall[1].htm
- %TEMP%\0
- %PROGRAM_FILES%\ie.exe
- %TEMP%\nsp2.tmp\Math.dll
- %TEMP%\nsp2.tmp\nsExec.dll
- %TEMP%\init.exe
- %TEMP%\nsp2.tmp\InetLoad.dll
- %TEMP%\uninst.exe
- %TEMP%\temp.ini
- %TEMP%\nsp2.tmp\System.dll
- %TEMP%\nsp2.tmp\time.dll
- <SYSTEM32>\onreg.ini
- %TEMP%\nss5.tmp\ns8.tmp
- %TEMP%\nss5.tmp\ns6.tmp
- %TEMP%\nss5.tmp\ns7.tmp
- %TEMP%\nss5.tmp\nsExec.dll
- %TEMP%\nsp2.tmp\ns3.tmp
- <SYSTEM32>\offreg.ini
- %TEMP%\nss5.tmp\locate.dll
- 'localhost':1044
- 'do##.##ayertoday.info':80
- 'localhost':1048
- 'localhost':1046
- 'localhost':1035
- 'localhost':1036
- 'localhost':1041
- 'go.##site.info':80
- go.##site.info/?i=###########
- go.##site.info/?i=########
- go.##site.info/?i=##########
- go.##site.info/?i=#######
- go.##site.info/?i=################################
- DNS ASK do##.##ayertoday.info
- DNS ASK go.##site.info
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: '#32770' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''