Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\LDMASERVICE] 'Start' = '00000002'
- '<SYSTEM32>\wzdjm.exe' /service
- '<SYSTEM32>\wzdjm.exe'
- '%TEMP%\Messenger\setup.exe' m3_ss
- '<SYSTEM32>\dawqn.exe'
- '<SYSTEM32>\net1.exe' start LDMASERVICE
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\update[1].htm
- <SYSTEM32>\adorder.ini
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\gt[1].asp
- %WINDIR%\Temp\Messenger\kbietmp2.ini
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\LBMMC3H3\index[1].htm
- %WINDIR%\Temp\Messenger\vycil.ini
- <SYSTEM32>\mssrcid.ini
- %TEMP%\Messenger\nvsys.ini
- %TEMP%\Messenger\nvmctray.dll
- %TEMP%\Messenger\ccfapi32.dll
- %TEMP%\Messenger\sysvc.dat
- %TEMP%\Messenger\sysmain.dat
- %TEMP%\Messenger\setup.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\gt[1].asp
- %TEMP%\Messenger\sysmain.dat в <SYSTEM32>\dawqn.exe
- %TEMP%\Messenger\nvsys.ini в <SYSTEM32>\ebxro.ini
- %TEMP%\Messenger\sysvc.dat в <SYSTEM32>\wzdjm.exe
- 'www.de##a.cn':80
- www.de##a.cn/up/update.htm
- www.de##a.cn/myconfig/index.htm
- www.de##a.cn/page/gt.asp?ve##############################################################################################
- www.de##a.cn/page/gt.asp?ve#################################
- DNS ASK www.de##a.cn
- ClassName: 'Shell_TrayWnd' WindowName: ''