Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\SvrWsc] 'ImagePath' = '<SYSTEM32>\svrwsc.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\SvrWsc] 'Start' = '00000002'
- '<SYSTEM32>\svrwsc.exe'
- <SYSTEM32>\cscript.exe
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\CL23SLMV\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\KBL9A5VX\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat
- C:\Documents and Settings\NetworkService\Cookies\index.dat
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\index.dat
- <SYSTEM32>\svrwsc.exe
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\S7KJ4367\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\472L0XYP\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\KBL9A5VX\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\CL23SLMV\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\472L0XYP\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\S7KJ4367\desktop.ini
- 'www.ta##sp.ru':80
- http://www.ta##sp.ru/pro/project/index.php
- DNS ASK www.ta##sp.ru