Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = 'userinit.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\csrvc] 'ImagePath' = '"%TEMP%\csrvc\csrvc.exe"'
- [<HKLM>\SYSTEM\ControlSet001\Services\csrvc] 'Start' = '00000002'
- '%TEMP%\csrvc\csrvc.exe'
- '<SYSTEM32>\sc.exe' config "strt" type= interact type= own
- '<SYSTEM32>\sc.exe' failure "csrvc" reset= 0 actions= restart/60000
- '<SYSTEM32>\sc.exe' config "csrvc" type= interact type= own
- '<SYSTEM32>\sc.exe' config "csrvc" start=auto
- '<SYSTEM32>\sc.exe' config "strt" start=auto
- '<SYSTEM32>\sc.exe' failure "strt" reset= 0 actions= restart/60000
- %TEMP%\csrvc\csrvc.InstallLog
- %TEMP%\csrvc\csrvc.InstallState
- <Текущая директория>\InstallUtil.InstallLog
- %TEMP%\csrvc\csrvc.exe
- %ProgramFiles%\adwizz\adwizz.exe
- '18#.#0.133.109':445
- '18#.#0.133.109':139
- 'hi####novation.com':80
- '18#.#0.133.109':1433
- 'wp#d':80
- 'ip##fo.io':80
- 'fr###eoip.net':80
- http://fr###eoip.net/xml
- http://hi####novation.com/Extra/dlist.txt
- http://11#.#11.111.1/wpad.dat via wp#d
- http://ip##fo.io/ip
- DNS ASK fr###eoip.net
- DNS ASK hi####novation.com
- DNS ASK wp#d
- DNS ASK ip##fo.io