Техническая информация
- [<HKLM>\Software\Classes\Drive\shell\open\command] '' = '%WINDIR%\SysWOW64\QLFOKDVNGYQJ.EXE "%1"'
- [<HKLM>\System\CurrentControlSet\Services\BWMQURVW] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\BWMQURVW] 'ImagePath' = '<SYSTEM32>\svchost.exe -k JGDEQ'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\BWMQURVW\Parameters] 'ServiceDll' = '<SYSTEM32>\wbem\NNTOYTNHAUF.DLL'
- 'BWMQURVW' <SYSTEM32>\svchost.exe -k JGDEQ
- %WINDIR%\syswow64\i80e1gk1.dll
- %WINDIR%\syswow64\wbem\nntoytnhauf.dll.tmp
- %WINDIR%\syswow64\drivers\vdlkbjdivjs.dat
- %WINDIR%\syswow64\qlfokdvngyqj.exe.tmp
- %WINDIR%\syswow64\drivers\nznmppn.dat
- %WINDIR%\syswow64\kanji_2~.exe
- %WINDIR%\delself.bat
- %WINDIR%\xoaennzrusmjdc.dll
- %WINDIR%\syswow64\wbem\nntoytnhauf.dll
- %WINDIR%\syswow64\kanji_2~.exe
- %WINDIR%\syswow64\qlfokdvngyqj.exe
- %WINDIR%\syswow64\wbem\nntoytnhauf.dll.tmp в %WINDIR%\syswow64\wbem\nntoytnhauf.dll
- %WINDIR%\syswow64\qlfokdvngyqj.exe.tmp в %WINDIR%\syswow64\qlfokdvngyqj.exe
- ClassName: 'MS_WINHELP' WindowName: ''
- '%WINDIR%\syswow64\qlfokdvngyqj.exe' bak <Полный путь к файлу> <SYSTEM32>\wbem\NNTOYTNHAUF.DLL
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\DelSelf.bat' (со скрытым окном)
- '%WINDIR%\syswow64\svchost.exe' -k JGDEQ
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\DelSelf.bat
- '%WINDIR%\syswow64\ping.exe' -n 5 127.0.0.1