Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\W32Time] 'Start' = '00000002'
- C:\Update.rar
- <SYSTEM32>\sc.exe stop w32time
- <SYSTEM32>\sc.exe config w32time start= auto
- <SYSTEM32>\rundll32.exe <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen C:\view.jpg
- <SYSTEM32>\rundll32.exe %PROGRAM_FILES%\Uludm\Dhfan.dll comdl2
- %PROGRAM_FILES%\Uludm\RCX2.tmp
- %TEMP%\kb-121656.tmp
- %PROGRAM_FILES%\Ejjdi\RCX1.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\w0[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\w0[1].jpg
- <SYSTEM32>\kb-x86-anti.xml
- %HOMEPATH%\Recent\view.lnk
- C:\Update.rar
- C:\view.jpg
- %TEMP%\kb-117015.tmp
- C:\Unlock.log
- %HOMEPATH%\Recent\Local Disk (C).lnk
- %PROGRAM_FILES%\Uludm\Dhfan.dll
- %PROGRAM_FILES%\Ejjdi\Vccbj.mhx
- 'yk.##77888.com':80
- 'jj.##77888.com':80
- '15####azz.gicp.net':8999
- yk.##77888.com/temp/w0.jpg
- jj.##77888.com/temp/w0.jpg
- DNS ASK yk.##77888.com
- DNS ASK jj.##77888.com
- DNS ASK 15####azz.gicp.net
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'ShImgVw:CPreviewWnd' WindowName: ''