Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\neuhsi] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\xgokxg] 'Start' = '00000002'
- <SYSTEM32>\sc.exe stop xgokxg
- <SYSTEM32>\sc.exe create neuhsi type= kernel start= auto binpath= "%ALLUSERSPROFILE%\Application Data\UOSWEYJ\neuhsi.bin"
- <SYSTEM32>\sc.exe start xgokxg
- <SYSTEM32>\sc.exe create xgokxg type= kernel binpath= "%ALLUSERSPROFILE%\Application Data\UOSWEYJ\xgokxg.bin" start= auto
- <SYSTEM32>\sc.exe stop null
- %WINDIR%\inf\hy6329.PNF
- %WINDIR%\Help\mmh5421
- %WINDIR%\inf\vf1906.PNF
- %WINDIR%\Temp\{7f056218-11b2-4c1e-00b8-745aa039c25e}
- %ALLUSERSPROFILE%\Application Data\UOSWEYJ\neuhsi.bin
- %TEMP%\1.tmp
- %ALLUSERSPROFILE%\Application Data\UOSWEYJ\psv1776.hlp
- %ALLUSERSPROFILE%\Application Data\UOSWEYJ\xgokxg.bin
- %WINDIR%\Web\rd1180.htt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\pab[1].php
- %TEMP%\1.tmp
- %ALLUSERSPROFILE%\Application Data\UOSWEYJ\neuhsi.bin
- %ALLUSERSPROFILE%\Application Data\UOSWEYJ\xgokxg.bin
- 'rp.##q88.com':80
- 'up##.21civ.com':80
- 'rp##.21civ.com':80
- rp.##q88.com/rp.php?om#################################################################
- up##.21civ.com/pab.php?b=######################################
- rp##.21civ.com/az.php?st####################################
- DNS ASK rp.##q88.com
- DNS ASK www.ba##u.com
- DNS ASK rp##.21civ.com
- DNS ASK up##.21civ.com
- ClassName: 'Shell_TrayWnd' WindowName: ''