Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\W32Time] 'Start' = '00000002'
- <SYSTEM32>\sc.exe config w32time start= auto
- <SYSTEM32>\sc.exe stop w32time
- <SYSTEM32>\rundll32.exe %PROGRAM_FILES%\Ikjrv\Pdsva.dll comdl2
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\w0[1].jpg
- <SYSTEM32>\kb-x86-anti.xml
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\w0[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\w0[1].jpg
- %PROGRAM_FILES%\Ikjrv\RCX2.tmp
- %TEMP%\kb-134546.tmp
- C:\Unlock.log
- %TEMP%\kb-136593.tmp
- %PROGRAM_FILES%\Eysms\RCX1.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\w0[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\w0[1].jpg
- %PROGRAM_FILES%\Eysms\Allrd.kvk
- %PROGRAM_FILES%\Ikjrv\Pdsva.dll
- 'yk.##77888.com':80
- 'jj.##77888.com':80
- 'yi####2009.3322.org':2112
- yk.##77888.com/temp/w0.jpg
- jj.##77888.com/temp/w0.jpg
- DNS ASK yk.##77888.com
- DNS ASK jj.##77888.com
- DNS ASK yi####2009.3322.org