Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'safe360' = '%CommonProgramFiles%\sessavx\coiome.exe'
- %WINDIR%\Tasks\FQTb.exe
- [<HKLM>\SYSTEM\ControlSet001\Services\Browser] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\lanmanserver] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\lanmanworkstation] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\LmHosts] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\RpcLocator] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\NtLmSsp] 'Start' = '00000002'
- %CommonProgramFiles%\sessavx\coiome.exe
- %WINDIR%\Tasks\FQTb.exe 10.0.0.1 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.3 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.4 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.6 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.8 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.10 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.12 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.14 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.15 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.17 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.19 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.22 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.23 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.24 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.26 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.28 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.30 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.32 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.34 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.35 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.39 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.37 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.41 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.43 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.44 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.46 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.50 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.49 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.52 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.56 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.57 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.59 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.55 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.61 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.63 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.65 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.67 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.68 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.70 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.72 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.74 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.76 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.78 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.80 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.82 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.84 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.87 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.97 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.91 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.93 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.95 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.86 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.89 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.99 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.100 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.102 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.105 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.109 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.114 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.115 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.111 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.117 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.119 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.121 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.104 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.108 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.123 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.127 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.125 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.128 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.130 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.132 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.134 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.136 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.137 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.139 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.141 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.143 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.145 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.147 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.148 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.152 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.154 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.156 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.150 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.157 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.161 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.163 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.165 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.167 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.169 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.172 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.171 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.174 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.176 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.178 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.180 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.183 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.182 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.185 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.187 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.189 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.191 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.193 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.194 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.196 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.198 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.200 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.202 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.204 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.206 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.207 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.211 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.210 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.213 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.215 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.219 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.217 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.223 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.221 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.228 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.224 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.230 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.226 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.232 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.233 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.237 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.235 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.239 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.241 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.243 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.245 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.247 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.248 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.250 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.252 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.5 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.13 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.11 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.16 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.20 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.29 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.31 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.33 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.42 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.38 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.40 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.48 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.53 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.51 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.60 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.62 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.64 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.69 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.73 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.75 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.79 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.88 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.90 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.101 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.103 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.106 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.110 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.112 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.116 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.118 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.129 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.131 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.140 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.138 :
- %WINDIR%\Tasks\FQTb.exe /pid=3372
- %WINDIR%\Tasks\FQTb.exe 10.0.0.142 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.144 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.149 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.151 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.155 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.153 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.160 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.162 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.158 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.164 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.166 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.170 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.173 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.175 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.179 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.177 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.184 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.186 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.190 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.192 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.195 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.197 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.199 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.201 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.205 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.208 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.214 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.218 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.216 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.222 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.225 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.227 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.234 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.236 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.238 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.242 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.240 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.7 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.9 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.18 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.25 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.27 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.66 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.77 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.83 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.85 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.81 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.92 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.94 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.96 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.98 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.107 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.120 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.133 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.135 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.146 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.159 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.168 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.181 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.203 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.212 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.220 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.231 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.229 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.249 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.251 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.253 :
- %WINDIR%\Tasks\FQTb.exe 10.0.1.3 :
- %WINDIR%\Tasks\FQTb.exe 10.0.1.5 :
- %WINDIR%\Tasks\FQTb.exe 10.0.1.1 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.21 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.36 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.54 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.58 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.113 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.122 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.124 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.126 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.209 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.244 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.246 :
- %WINDIR%\Tasks\FQTb.exe 10.0.1.7 :
- %WINDIR%\Tasks\FQTb.exe 10.0.1.9 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.45 :
- %WINDIR%\Tasks\FQTb.exe 10.0.0.71 :
- <SYSTEM32>\mshta.exe "%PROGRAM_FILES%\HOD.hta"
- <SYSTEM32>\taskkill.exe /im coiome.exe /f
- <SYSTEM32>\sc.exe config Browser start= auto
- <SYSTEM32>\sc.exe config lanmanserver start= auto
- <SYSTEM32>\sc.exe config lanmanworkstation start= auto
- <SYSTEM32>\sc.exe config LmHosts start= auto
- <SYSTEM32>\sc.exe config RpcLocator start= auto
- <SYSTEM32>\sc.exe config NtLmSsp start= auto
- <SYSTEM32>\net1.exe start lanmanserver
- <SYSTEM32>\net1.exe start lanmanworkstation
- <SYSTEM32>\net1.exe start Browser
- <SYSTEM32>\net1.exe stop sharedaccess
- <SYSTEM32>\net1.exe start LmHosts
- <SYSTEM32>\net1.exe start RpcLocator
- <SYSTEM32>\net1.exe start NtLmSsp
- <SYSTEM32>\locator.exe
- <SYSTEM32>\sc.exe delete JavaServe
- <SYSTEM32>\attrib.exe -h -s -r -a "%HOMEPATH%\Cookies\*.*"
- <SYSTEM32>\attrib.exe -h -s -r -a "%TEMP%\Cookies\*.*"
- <SYSTEM32>\alg.exe 10.0.0.159 :
- <SYSTEM32>\alg.exe
- <SYSTEM32>\svchost.exe
- %PROGRAM_FILES%\HOD.hta
- %CommonProgramFiles%\sessavx\coiome.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\b[1].jpg
- %WINDIR%\Fonts\oh.ini
- \Device\LanmanRedirector\10.0.0.1\pipe\browser
- \Device\LanmanRedirector\10.0.0.3\pipe\browser
- \Device\LanmanRedirector\10.0.0.6\pipe\browser
- \Device\LanmanRedirector\10.0.0.4\pipe\browser
- \Device\LanmanRedirector\10.0.0.10\pipe\browser
- \Device\LanmanRedirector\10.0.0.8\pipe\browser
- \Device\LanmanRedirector\10.0.0.12\pipe\browser
- \Device\LanmanRedirector\10.0.0.17\pipe\browser
- \Device\LanmanRedirector\10.0.0.14\pipe\browser
- \Device\LanmanRedirector\10.0.0.15\pipe\browser
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\b[1].jpg
- 'localhost':1036
- 'j.###6800.com':80
- 'tj.##16800.com':80
- '<IP-адрес в локальной сети>':445
- '<IP-адрес в локальной сети>':139
- '<IP-адрес в локальной сети>':80
- j.###6800.com/b.jpg
- tj.##16800.com/t/Count.asp?ma################################
- DNS ASK j.###6800.com
- DNS ASK tj.##16800.com
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: ''