Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'msjagerw32' = 'C:\Winnt\System32\printercol\msnger32.exe'
- C:\Winnt\System32\printercol\msnq32.exe /n /fh /r "infsrv.exe"
- C:\Winnt\System32\printercol\infsrv.exe
- C:\Winnt\System32\printercol\msnger32.exe
- C:\Winnt\System32\printercol\msnq32.exe /n /fh WUPD
- <SYSTEM32>\net1.exe share "c$" /delete /y
- <SYSTEM32>\net1.exe share "a$" /delete /y
- <SYSTEM32>\net1.exe share "admin$" /delete /y
- %WINDIR%\msagent\agentsvr.exe -Embedding
- <SYSTEM32>\net1.exe share "ipc$" /delete /y
- C:\Winnt\System32\printercol\tvchost32.exe
- C:\Winnt\System32\printercol\pmmc32.exe
- C:\Winnt\System32\printercol\mtnm32.dll
- %WINDIR%\0DBC_cmd.exe_0.ndmp
- C:\Winnt\System32\printercol\regsvc.ocx
- C:\Winnt\System32\printercol\vtap.dll
- C:\Winnt\System32\printercol\mmsql32.bat
- C:\Winnt\System32\printercol\jnco32.exe
- C:\Winnt\System32\printercol\infsrv.exe
- C:\Winnt\System32\printercol\msnq32.exe
- C:\Winnt\System32\printercol\msnger32.exe
- C:\Winnt\System32\printercol\mnn32.exe
- 'te#.##rvegame.com':6667
- 'te####arpie.cjb.net':6667
- DNS ASK te#.##rvegame.com
- DNS ASK te####arpie.cjb.net
- ClassName: '' WindowName: 'WUPD'
- ClassName: 'Shell_TrayWnd' WindowName: ''