Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Daswkcm.exe' = '<SYSTEM32>\Daswkcm.exe'
- <SYSTEM32>\Daswkcm.exe
- <SYSTEM32>\cmd.exe /c <Текущая директория>\_deleteme.bat
- <SYSTEM32>\net1.exe stop sharedaccess
- <SYSTEM32>\net.exe stop sharedaccess
- AVP.EXE
- NAVAPW32.EXE
- AVPM.EXE
- AVP32.EXE
- AVPCC.EXE
- <Текущая директория>\_deleteme.bat
- <SYSTEM32>\Daswkcm.exe
- <SYSTEM32>\Daswkcm.exe
- 'www.zh##ea.cn':80
- www.zh##ea.cn/google16.txt
- DNS ASK www.zh##ea.cn
- ClassName: 'ZAFrameWnd' WindowName: 'ZoneAlarm'
- ClassName: 'TfLockDownMain' WindowName: ''
- ClassName: 'Tapplication' WindowName: '????????????????'
- ClassName: 'MS_WINHELP' WindowName: ''
- ClassName: 'TForm1' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
- ClassName: '' WindowName: 'Symantec AntiVirus ??????'
- ClassName: 'RavMonClass' WindowName: 'RavMon.exe'
- ClassName: '' WindowName: '???????????? KV2004??????????'