Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\wdnmiv] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\ilkprn] 'Start' = '00000002'
- <SYSTEM32>\sc.exe stop ilkprn
- <SYSTEM32>\sc.exe create wdnmiv type= kernel start= auto binpath= "%ALLUSERSPROFILE%\Application Data\PADVGVT\wdnmiv.bin"
- <SYSTEM32>\sc.exe start ilkprn
- <SYSTEM32>\sc.exe create ilkprn type= kernel binpath= "%ALLUSERSPROFILE%\Application Data\PADVGVT\ilkprn.bin" start= auto
- <SYSTEM32>\sc.exe stop null
- %WINDIR%\msagent\bj3072.tlb
- %WINDIR%\msagent\jsg1222
- %WINDIR%\srchasst\gp4711.lex
- %WINDIR%\Temp\{303c95d2-d645-4bb2-0089-8e8a67cde48e}
- %ALLUSERSPROFILE%\Application Data\PADVGVT\wdnmiv.bin
- %TEMP%\1.tmp
- %ALLUSERSPROFILE%\Application Data\PADVGVT\may3701.nfo
- %ALLUSERSPROFILE%\Application Data\PADVGVT\ilkprn.bin
- %WINDIR%\srchasst\ka3161.lex
- <SYSTEM32>\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\pab[1].php
- %TEMP%\1.tmp
- %ALLUSERSPROFILE%\Application Data\PADVGVT\wdnmiv.bin
- %ALLUSERSPROFILE%\Application Data\PADVGVT\ilkprn.bin
- 'rp.##q88.com':80
- 'up##.21civ.com':80
- 'rp##.21civ.com':80
- rp.##q88.com/rp.php?om#################################################################
- up##.21civ.com/pab.php?b=######################################
- rp##.21civ.com/az.php?st####################################
- DNS ASK rp.##q88.com
- DNS ASK www.ba##u.com
- DNS ASK wpad.localdomain
- DNS ASK rp##.21civ.com
- DNS ASK up##.21civ.com