Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] '9f2o332t83' = '\DOCUME~1\%USERNAME%\9f2o332t83\imce.vbs'
- '%HOMEPATH%\9f2o332t83\update.exe' qjmu.XSW
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe'
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
- %TEMP%\tmp2.tmp.jpg
- %HOMEPATH%\9f2o332t83\imce.vbs
- %TEMP%\3C1EA.dmp
- %TEMP%\dw.log
- %HOMEPATH%\9f2o332t83\rafzzgkyfafn.cmd
- %HOMEPATH%\9f2o332t83\update.exe
- %HOMEPATH%\9f2o332t83\dvwtya.MNM
- %HOMEPATH%\9f2o332t83\roigrcz.SJM
- %HOMEPATH%\9f2o332t83\qjmu.XSW
- %HOMEPATH%\9f2o332t83\roigrcz.SJM
- %HOMEPATH%\9f2o332t83\imce.vbs
- %HOMEPATH%\9f2o332t83\rafzzgkyfafn.cmd
- %HOMEPATH%\9f2o332t83\dvwtya.MNM
- %HOMEPATH%\9f2o332t83\update.exe
- %HOMEPATH%\9f2o332t83\qjmu.XSW
- 'im##.gulfup.com':80
- 'wp#d':80
- im##.gulfup.com/UMtdmd.ico
- wp#d/wpad.dat
- DNS ASK im##.gulfup.com
- DNS ASK wp#d
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'