Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\Kosfnq qagyba] 'Start' = '00000002'
- '%PROGRAM_FILES%\Ruzktc eusoa\Ymosuae.exe'
- '<SYSTEM32>\taskkill.exe' /f /im V3SP.exe
- '<SYSTEM32>\wscript.exe' "C:\250.vbs"
- '<SYSTEM32>\wbem\wmiadap.exe' /R /T
- '<SYSTEM32>\taskkill.exe' /f /im Ksafetray.exe
- '<SYSTEM32>\taskkill.exe' /f /im mcagent.exe
- '<SYSTEM32>\taskkill.exe' /f /im V3Main.exe
- MCAGENT.EXE
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\123456[1]
- C:\250.vbs
- %PROGRAM_FILES%\Ruzktc eusoa\Ymosuae.exe
- <SYSTEM32>\PerfStringBackup.TMP
- <SYSTEM32>\wbem\Performance\WmiApRpl.ini
- C:\250.vbs
- 'us##.#zone.qq.com':80
- 'localhost':1039
- 'localhost':12560
- us##.#zone.qq.com/123456
- DNS ASK us##.#zone.qq.com
- ClassName: '' WindowName: ''