Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\NJax] 'Start' = '00000002'
- '%PROGRAM_FILES%\NJax\NJax.exe'
- '%PROGRAM_FILES%\NJax\NJax.exe' /install /SILENT
- '%PROGRAM_FILES%\NJax\nfregdrv.exe' <DRIVERS>\mosfilterdrv.sys
- '<SYSTEM32>\wbem\wmiadap.exe' /R /T
- '<SYSTEM32>\net1.exe' start NJax
- '%WINDIR%\explorer.exe'
- %WINDIR%\explorer.exe
- %PROGRAM_FILES%\NJax\remove_njax.exe
- <DRIVERS>\mosfilterdrv.sys
- %PROGRAM_FILES%\NJax\mosfilterdrv.sys
- %PROGRAM_FILES%\NJax\nfregdrv.exe
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\rules[1].txt
- %WINDIR%\Temp\P_RuleList.txt
- %TEMP%\nsy3.tmp\SimpleSC.dll
- %TEMP%\nsy3.tmp\SelfDel.dll
- %PROGRAM_FILES%\NJax\NJax.exe
- %PROGRAM_FILES%\NJax\nfapi.dll
- %TEMP%\nsr2.tmp
- %TEMP%\nsy3.tmp\UserInfo.dll
- %PROGRAM_FILES%\NJax\ProtocolFilters.dll
- %TEMP%\nsy3.tmp\System.dll
- %PROGRAM_FILES%\NJax\ssleay32.dll
- %PROGRAM_FILES%\NJax\libeay32.dll
- %TEMP%\nsy3.tmp\UserInfo.dll
- <SYSTEM32>\wbem\Performance\WmiApRpl.ini
- <SYSTEM32>\PerfStringBackup.TMP
- %TEMP%\nsy3.tmp\System.dll
- %PROGRAM_FILES%\NJax\mosfilterdrv.sys
- %TEMP%\nsy3.tmp\SelfDel.dll
- %TEMP%\nsy3.tmp\SimpleSC.dll
- 'www.ni#####ftwarellc.com':80
- 'localhost':1040
- www.ni#####ftwarellc.com/services/rules.txt?du#######
- DNS ASK www.ni#####ftwarellc.com
- ClassName: 'MS_WINHELP' WindowName: ''