Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] 'Windows Reg Services' = '<SYSTEM32>\ffservice.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Windows Reg Services' = '<SYSTEM32>\ffservice.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Windows Reg Services' = '<SYSTEM32>\ffservice.exe'
- [<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{a75aed00-d7bf-11d1-9947-00c0Cf98bbc9}] 'StubPath' = '<SYSTEM32>\lservice.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] 'DirectX For Microsoft® Windows' = '<SYSTEM32>\fservice.exe'
- [<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}] 'StubPath' = '%WINDIR%\system\sservice.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'Explorer.exe <SYSTEM32>\fservice.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
- Компонент восстановления системы (SR)
- %WINDIR%\services.exe -XP
- <SYSTEM32>\d_service.exe
- <SYSTEM32>\fservice.exe
- %WINDIR%\andresa-melacia@hotmail.exe
- %WINDIR%\down_server.exe
- <SYSTEM32>\d_service.exe (загружен из сети Интернет)
- <SYSTEM32>\net1.exe STOP srservice
- <SYSTEM32>\net1.exe STOP SharedAccess
- <SYSTEM32>\cmd.exe /c %WINDIR%\andresa-melacia@hotmail.exe.bat
- <SYSTEM32>\net1.exe STOP navapsvc
- <SYSTEM32>\net.exe STOP SharedAccess
- <SYSTEM32>\rundll32.exe <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %TEMP%\0,,15189608-EXH,00.jpg
- <SYSTEM32>\net.exe STOP navapsvc
- <SYSTEM32>\net.exe STOP srservice
- Библиотека-обработчик для всех процессов: <SYSTEM32>\winkey.dll
- <SYSTEM32>\alg.exe
- mpftray.exe
- NAVAPW32.EXE
- GUARD.EXE
- MCAGENT.EXE
- nod32.exe
- zapro.exe
- ZONEALARM.EXE
- outpost.exe
- smc.exe
- AVP.EXE
- AVP32.EXE
- AVGCC32.EXE
- AVGCTRL.EXE
- AVPCC.EXE
- fsav.exe
- fsav32.exe
- AVPM.EXE
- AVSYNMGR.EXE
- ClassName: 'pediy06' WindowName: ''
- ClassName: 'GBDYLLO' WindowName: ''
- ClassName: 'OLLYDBG' WindowName: ''
- <SYSTEM32>\winkey.dll
- %WINDIR%\services.exe
- <SYSTEM32>\ffservice.exe
- <SYSTEM32>\reginv.dll
- <SYSTEM32>\d_service.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\server[1].exe
- <SYSTEM32>\lservice.exe
- %WINDIR%\down_server.exe
- %WINDIR%\andresa-melacia@hotmail.exe
- %TEMP%\0,,15189608-EXH,00.jpg
- %WINDIR%\system\sservice.exe
- <SYSTEM32>\wservice.exe
- <SYSTEM32>\fservice.exe
- <SYSTEM32>\lservice.exe
- <SYSTEM32>\ffservice.exe
- %WINDIR%\services.exe
- <SYSTEM32>\fservice.exe
- <SYSTEM32>\wservice.exe
- %WINDIR%\system\sservice.exe
- <SYSTEM32>\ffservice.exe
- %WINDIR%\andresa-melacia@hotmail.exe
- <SYSTEM32>\Restore\MachineGuid.txt
- <SYSTEM32>\lservice.exe
- <SYSTEM32>\wservice.exe
- <SYSTEM32>\fservice.exe
- %WINDIR%\system\sservice.exe
- '21#.#01.97.7':53
- '15#.164.1.8':53
- '15#.#64.23.201':53
- '.###oo.com.br':25
- 'an###a.edu.tr':53
- 'eg#.edu.tr':53
- 'www.ic#.com':80
- 'ge######menta@yahoo.com.br':41100
- 'www.yo###ite.com':80
- 'localhost':1037
- '<IP-адрес в локальной сети>':53
- 'ge######menta@yahoo.com.br':4112
- 'ge######menta@yahoo.com.br':4110
- www.yo###ite.comhttp://www.yoursite.com/cgi-bin/prorat.cgi?bi#####################################################################################################################################################################################
- www.ic#.com/friendship/email_thank_you.php?fo#################################################################################################################################################################################
- www.yo###ite.com/server.exe
- DNS ASK an###a.edu.tr
- DNS ASK ya###.com.br
- DNS ASK .###oo.com.br
- DNS ASK eg#.edu.tr
- DNS ASK www.yo###ite.com
- DNS ASK ge######menta@yahoo.com.br
- DNS ASK www.ic#.com
- ClassName: '' WindowName: ''
- ClassName: '' WindowName: 'ProConnective'
- ClassName: '' WindowName: 'Windows services '
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'ShImgVw:CPreviewWnd' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: 'Windows services '