Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\aspnet_statesuep] 'Start' = '00000002'
- '<SYSTEM32>\fsldsw.exe'
- '%WINDIR%\gy.exe'
- %CommonProgramFiles%\Microsoft Shared\DW\lpk.dll
- C:\Far2\lpk.dll
- %CommonProgramFiles%\Microsoft Shared\Speech\lpk.dll
- %CommonProgramFiles%\Microsoft Shared\MSInfo\lpk.dll
- <Текущая директория>\lpk.dll
- <SYSTEM32>\fsldsw.exe
- %WINDIR%\gy.exe
- C:\RCX1.tmp
- <SYSTEM32>\gei33.dll
- %CommonProgramFiles%\Microsoft Shared\MSInfo\lpk.dll
- %CommonProgramFiles%\Microsoft Shared\Speech\lpk.dll
- %CommonProgramFiles%\Microsoft Shared\DW\lpk.dll
- <Текущая директория>\lpk.dll
- C:\Far2\lpk.dll
- <SYSTEM32>\gei33.dll
- C:\RCX1.tmp в <SYSTEM32>\gei33.dll
- %WINDIR%\gy.exe в %TEMP%\SOFTWARE.LOG
- 'ge###.api520.com':1001
- 'ap#.#oho1z.com':80
- ap#.#oho1z.com/cf/wb/upbate.txt
- DNS ASK ge###.api520.com
- DNS ASK ap#.#oho1z.com
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'