Техническая информация
- '%WINDIR%\ime\svcuvlw.exe'
- '<SYSTEM32>\tasklist.exe'
- '<SYSTEM32>\findstr.exe' /i "ravmond.exe"
- '<SYSTEM32>\rundll32.exe' %WINDIR%\ime\svcuvlw.dat,Launch
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\sso.bat" "
- '<SYSTEM32>\attrib.exe' <SYSTEM32>\GroupPolicy\*.* -r -s -h /s /d
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager" /v "PendingFileRenameOperations2" /t "REG_MULTI_SZ" /d "\??\%WINDIR%\ime0\0\??%WINDIR%\ime\0\??\%WINDIR%\ime\scripts.ini\0\??\<SYSTEM32>\GroupPolicy\user\Scripts\scripts.ini" /f
- %WINDIR%\ime\svcuvlw.dat
- %WINDIR%\ime\scripts.ini
- %TEMP%\1.tmp\scripts.ini
- %WINDIR%\ime\svcuvlw.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\inf[1].js
- %CommonProgramFiles%\System\Ole DB\msadotb.htm
- %WINDIR%\ime\chsime\svcuvlw.ini
- <SYSTEM32>\GroupPolicy\gpt.ini
- %TEMP%\1.tmp\woti.dat
- %TEMP%\1.tmp\win.bat
- %TEMP%\1.tmp\sso.bat
- %TEMP%\1.tmp\tb.dat
- %WINDIR%\Debug\ttb.dat
- %WINDIR%\Debug\debug.dat
- %WINDIR%\Debug\error.gg
- %TEMP%\1.tmp\win.bat в %WINDIR%\Debug\win.bat
- %TEMP%\1.tmp\scripts.ini в %WINDIR%\Debug\scripts.ini
- %TEMP%\1.tmp\woti.dat в %WINDIR%\Debug\debug.dat
- %TEMP%\1.tmp\tb.dat в %WINDIR%\Debug\ttb.dat
- 'localhost':1041
- 'a.###mama.cn':80
- 'vi#.#fshd.cn':80
- '20#.#6.232.182':80
- a.###mama.cn/inf.js
- DNS ASK a.###mama.cn
- DNS ASK www.microsoft.com
- DNS ASK vi#.#fshd.cn
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'