Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe] 'Debugger' = 'ntsd -d'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe] 'Debugger' = 'ntsd -d'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe] 'Debugger' = 'ntsd -d'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ctfmon.exe' = '<SYSTEM32>\ctfmon.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run] 'llajyn_df' = '%WINDIR%\system\lljyn081204.exe'
- [<HKLM>\SOFTWARE\Classes\HTTP\shell\open\command] '' = '"%PROGRAM_FILES%\InternetExplorer\iexplore.exe" -nohome'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe] 'Debugger' = 'ntsd -d'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVP.exe] 'Debugger' = 'ntsd -d'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Explorer' = '<DRIVERS>\suchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'vmdetdhc.exe' = '<SYSTEM32>\vmdetdhc.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe] 'Debugger' = 'ntsd -d'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exe] 'Debugger' = 'ntsd -d'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe] 'Debugger' = 'ntsd -d'
- <SYSTEM32>\spoolsv.exe
- %WINDIR%\Tasks\SA.DAT
- %WINDIR%\windows.ext
- %WINDIR%\Tasks\spoolsv.ext
- [<HKLM>\SYSTEM\ControlSet001\Services\tzatsu] 'Start' = '00000000'
- <SYSTEM32>\ctfmon.exe
- <DRIVERS>\beep.sys
- <SYSTEM32>\dllcache\beep.sys файлом <SYSTEM32>\dllcache\beep.sys.new
- <SYSTEM32>\dllcache\spoolsv.exe файлом <SYSTEM32>\dllcache\spoolsv.exe.new
- <SYSTEM32>\dllcache\ctfmon.exe файлом <SYSTEM32>\dllcache\ctfmon.exe.new
- <SYSTEM32>\ctfmon.exe файлом <SYSTEM32>\ctfmon.exe.new
- <SYSTEM32>\spoolsv.exe файлом <SYSTEM32>\spoolsv.exe
- <DRIVERS>\beep.sys файлом <DRIVERS>\beep.sys.new
- <SYSTEM32>\spoolsv.exe файлом <SYSTEM32>\spoolsv.exe.new
- <Имя диска съемного носителя>:\autorun.inf
- <Имя диска съемного носителя>:\ЎЎЎЎЎЎ.exe
- скрытых файлов
- %TEMP%\032.exe
- %TEMP%\setup_1027281.exe
- %TEMP%\8.exe
- <DRIVERS>\suchost.exe
- <SYSTEM32>\Com\ie.exe
- <SYSTEM32>\config.txt
- %WINDIR%\system\zhahss081202.exe i
- %TEMP%\yoyo1182.exe
- %TEMP%\1019.exe
- %TEMP%\9874.exe
- %TEMP%\ok1.exe
- <SYSTEM32>\vmdetdhc.exe -Start
- %TEMP%\setup1500.exe
- %WINDIR%\windows.ext
- <SYSTEM32>\config.txt (загружен из сети Интернет)
- <SYSTEM32>\cmd.exe /c %TEMP%\del75$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del7$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del2$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del60$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del49$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del38$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del97$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del80$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del18$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del77$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del11$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del5$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del66$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del95$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del79$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del14$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del99$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del86$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del20$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del40$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del55$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del36$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del48$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del93$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del81$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del39$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del42$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del4$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del85$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del52$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del53$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del3$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del12$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del64$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del22$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del62$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del21$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del70$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del74$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del30$$.bat
- <SYSTEM32>\cmd.exe /c <SYSTEM32>\copy2090000.bat
- <SYSTEM32>\ping.exe -n 3 127.0.0.1
- <SYSTEM32>\cmd.exe /c %TEMP%\del19$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del68$$.bat
- <SYSTEM32>\net1.exe share Z$ /del /y
- <SYSTEM32>\net1.exe share E$ /del /y
- <SYSTEM32>\ctfmon.exe
- <SYSTEM32>\wbem\wmiadap.exe /R /T
- <SYSTEM32>\cmd.exe /c <SYSTEM32>\Ee6486.bat
- <SYSTEM32>\ntsd.exe -c q -p 1528
- <SYSTEM32>\cmd.exe /c %TEMP%\45$$.bat
- <SYSTEM32>\spoolsv.exe -Start
- <SYSTEM32>\ntvdm.exe -f -i1
- <SYSTEM32>\rundll32.exe <SYSTEM32>\fIDi.dll,DllRegisterServer
- <SYSTEM32>\rundll32.exe %WINDIR%\system\zhnahsdf081202c.dll a16zhqb
- <SYSTEM32>\rundll32.exe <SYSTEM32>\fIDi.dll,DllUnregisterServer
- <SYSTEM32>\attrib.exe +s +h "%WINDIR%\system\zhahss081202.exe"
- <SYSTEM32>\attrib.exe +s +h "%WINDIR%\system\zhnahsdf081202c.dll"
- <SYSTEM32>\net1.exe share C$ /del /y
- <SYSTEM32>\cmd.exe /c %TEMP%\del13$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del94$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del16$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del69$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del17$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del91$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del6$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del50$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del76$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del98$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del47$$.bat
- <SYSTEM32>\cmd.exe /c ""c:\dfDelmlljy.bat" "
- <SYSTEM32>\net1.exe share A$ /del /y
- <SYSTEM32>\net1.exe share admin$ /del /y
- <SYSTEM32>\cmd.exe /c %TEMP%\del37$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del35$$.bat
- <SYSTEM32>\ping.exe 127.0.0.1
- <SYSTEM32>\cmd.exe /c %TEMP%\del34$$.bat
- <SYSTEM32>\cmd.exe /c %TEMP%\del41$$.bat
- <SYSTEM32>\svchost.exe
- <SYSTEM32>\spoolsv.exe
- 360tray.exe
- <SYSTEM32>\ctfmon.exe
- AVP.EXE
- ClassName: 'AVP.TrafficMonConnectionTerm' WindowName: ''
- ClassName: 'AVP.Product_Notification' WindowName: ''
- ClassName: 'AVP.AlertDialog' WindowName: ''
- %TEMP%\del11$$.bat
- %TEMP%\del5$$.bat
- %TEMP%\del79$$.bat
- %TEMP%\del6$$.bat
- %TEMP%\del66$$.bat
- %TEMP%\del95$$.bat
- %TEMP%\del86$$.bat
- %TEMP%\del77$$.bat
- %TEMP%\del2$$.bat
- %TEMP%\del60$$.bat
- %TEMP%\del20$$.bat
- %TEMP%\del14$$.bat
- %TEMP%\del99$$.bat
- %TEMP%\del91$$.bat
- C:\Far2\Addons\XLat\Russian\Desk_top_.ini
- C:\Far2\Documentation\Desk_top_.ini
- %TEMP%\del94$$.bat
- C:\Far2\Addons\SetUp\Desk_top_.ini
- C:\Far2\Addons\Shell\Desk_top_.ini
- C:\Far2\Addons\XLat\Desk_top_.ini
- C:\Far2\Documentation\eng\Desk_top_.ini
- %TEMP%\del50$$.bat
- %TEMP%\33$$.Ico
- %TEMP%\del76$$.bat
- %TEMP%\del17$$.bat
- C:\Far2\Documentation\rus\Desk_top_.ini
- C:\Far2\Encyclopedia\Desk_top_.ini
- %TEMP%\del75$$.bat
- %TEMP%\del48$$.bat
- %TEMP%\del93$$.bat
- %TEMP%\del55$$.bat
- %TEMP%\del62$$.bat
- %TEMP%\del21$$.bat
- %TEMP%\del52$$.bat
- %TEMP%\del36$$.bat
- %TEMP%\del39$$.bat
- %TEMP%\del42$$.bat
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\mydown[1].asp
- %TEMP%\del81$$.bat
- %TEMP%\del4$$.bat
- %TEMP%\del85$$.bat
- %TEMP%\del74$$.bat
- %TEMP%\del18$$.bat
- %TEMP%\del38$$.bat
- %TEMP%\del97$$.bat
- %TEMP%\del7$$.bat
- %TEMP%\del49$$.bat
- %TEMP%\del80$$.bat
- %TEMP%\del40$$.bat
- %TEMP%\del3$$.bat
- %TEMP%\del22$$.bat
- %TEMP%\del70$$.bat
- %TEMP%\del12$$.bat
- %TEMP%\del64$$.bat
- %TEMP%\del53$$.bat
- %TEMP%\del13$$.bat
- <SYSTEM32>\fIDi.dll
- <DRIVERS>\suchost.exe
- <DRIVERS>\dauqhm.sys
- %TEMP%\45$$.bat
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Жф¶Ї Internet Explorer дЇААЖч.lnk
- %HOMEPATH%\Favorites\НшЦ·µјєЅ.url
- %WINDIR%\system\zhahss081202.exe
- C:\go.sys
- C:\zhqbdf16d.bat
- <Текущая директория>\Desk_top_.ini
- %ALLUSERSPROFILE%\hsyhdf16.ini
- %WINDIR%\system\zhnahsdf081202c.dll
- <SYSTEM32>\Ee6486.bat
- %WINDIR%\Temp\scs2.tmp
- %TEMP%\setup1500.exe
- %TEMP%\setup_1027281.exe
- %TEMP%\yoyo1182.exe
- %TEMP%\8.exe
- %TEMP%\032.exe
- %TEMP%\9874.exe
- %TEMP%\OYJN02.EXE
- <SYSTEM32>\vmdetdhc.exe
- %WINDIR%\Temp\scs1.tmp
- %WINDIR%\ResetTest.txt
- %TEMP%\ok1.exe
- %TEMP%\1019.exe
- %WINDIR%\windows.ext
- %TEMP%\61$$.Ico
- %TEMP%\del35$$.bat
- %TEMP%\del98$$.bat
- C:\Far2\Desk_top_.ini
- %TEMP%\del37$$.bat
- %TEMP%\del34$$.bat
- %TEMP%\del41$$.bat
- C:\Far2\Addons\Desk_top_.ini
- %TEMP%\del16$$.bat
- C:\Far2\Addons\Macros\Desk_top_.ini
- %TEMP%\del69$$.bat
- C:\Far2\Addons\Colors\Desk_top_.ini
- C:\Far2\Addons\Colors\Custom Highlighting\Desk_top_.ini
- C:\Far2\Addons\Colors\Default Highlighting\Desk_top_.ini
- %TEMP%\del47$$.bat
- <SYSTEM32>\copy2090000.bat
- C:\ЎЎЎЎЎЎ.exe
- %TEMP%\del68$$.bat
- %TEMP%\del19$$.bat
- %TEMP%\del30$$.bat
- <SYSTEM32>\Com\ie.exe
- C:\autorun.inf
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\config[1].txt
- <SYSTEM32>\config.txt
- C:\dfDelmlljy.bat
- %WINDIR%\system\lljyn081204.exe
- %ALLUSERSPROFILE%\lljyndf16.ini
- %WINDIR%\system\llbjyn32bb.dll
- C:\Far2\Addons\SetUp\Desk_top_.ini
- C:\Far2\Addons\Shell\Desk_top_.ini
- C:\Far2\Addons\Macros\Desk_top_.ini
- C:\Far2\Addons\Colors\Custom Highlighting\Desk_top_.ini
- C:\Far2\Addons\Colors\Default Highlighting\Desk_top_.ini
- C:\Far2\Addons\XLat\Desk_top_.ini
- C:\Far2\Documentation\rus\Desk_top_.ini
- C:\Far2\Encyclopedia\Desk_top_.ini
- C:\Far2\Documentation\eng\Desk_top_.ini
- C:\Far2\Addons\XLat\Russian\Desk_top_.ini
- C:\Far2\Documentation\Desk_top_.ini
- <Текущая директория>\Desk_top_.ini
- <Имя диска съемного носителя>:\ЎЎЎЎЎЎ.exe
- %WINDIR%\system\zhnahsdf081202c.dll
- <SYSTEM32>\vmdetdhc.exe
- %WINDIR%\system\zhahss081202.exe
- <Имя диска съемного носителя>:\autorun.inf
- C:\Far2\Addons\Desk_top_.ini
- C:\Far2\Addons\Colors\Desk_top_.ini
- C:\Far2\Desk_top_.ini
- C:\ЎЎЎЎЎЎ.exe
- C:\autorun.inf
- %WINDIR%\Tasks\spoolsv.ext
- %TEMP%\setup_1027281.exe
- %TEMP%\61$$.Ico
- %TEMP%\9874.exe
- %TEMP%\33$$.Ico
- %TEMP%\8.exe
- <SYSTEM32>\ctfmon.exe.tmp
- %WINDIR%\Temp\scs2.tmp
- %WINDIR%\Temp\scs1.tmp
- %TEMP%\1019.exe
- %TEMP%\setup1500.exe
- C:\go.sys
- %TEMP%\ok1.exe
- %TEMP%\032.exe
- <SYSTEM32>\dllcache\ctfmon.exe.new в <SYSTEM32>\dllcache\ctfmon.exe
- <SYSTEM32>\ctfmon.exe в <SYSTEM32>\ctfmon.exe.tmp
- %TEMP%\setup1500.exe.exe в %TEMP%\setup1500.exe
- 'localhost':1389
- '44#.#r18.com':80
- 'id#.#kaka.com':80
- 'localhost':1431
- '<IP-адрес в локальной сети>':445
- 'aa.#234.net':82
- 'www.bu#####nchang.com.cn':80
- '<IP-адрес в локальной сети>':139
- id#.#kaka.com/idc1/mydown.asp?ve#########################################
- 44#.#r18.com/config.txt
- www.bu#####nchang.com.cn/api.php?bX##################################################################################################
- DNS ASK www.da###ng08.com
- DNS ASK id#.#kaka.com
- DNS ASK www.wo#####idongxi.com.cn
- DNS ASK aa.#234.net
- DNS ASK www.bu#####nchang.com.cn
- DNS ASK 44#.#r18.com
- ClassName: 'Indicator' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: '#32770' WindowName: ''
- ClassName: 'ATL:028644E0' WindowName: '??????????????????????????????'
- ClassName: 'msctls_statusbar32' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'Progman' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'Afx:400000:0' WindowName: ''
- ClassName: 'CabinetWClass' WindowName: ''
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-a60.a70.380001'
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '{F03B79CC-5B19-4D71-9EDD-FFDD44B441BF}' WindowName: '{F03B79CC-5B19-4D71-9EDD-FFDD44B441BF}'
- ClassName: '#32770' WindowName: '???????????????????? - IE??????'
- ClassName: '#32770' WindowName: '????????'
- ClassName: '#32770' WindowName: 'IE????????'
- ClassName: '#32770' WindowName: 'IE ????????'