Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\W32Time] 'Start' = '00000002'
- <SYSTEM32>\sc.exe config w32time start= auto
- <SYSTEM32>\sc.exe stop w32time
- <SYSTEM32>\rundll32.exe %PROGRAM_FILES%\Klhtd\Vkrjb.dll comdl2
- <SYSTEM32>\kb-x86-anti.xml
- %PROGRAM_FILES%\Klhtd\RCX2.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\w0[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\w0[1].jpg
- %TEMP%\kb-94078.tmp
- C:\Unlock.log
- %TEMP%\kb-98781.tmp
- %PROGRAM_FILES%\Sbwvx\RCX1.tmp
- %PROGRAM_FILES%\Klhtd\Vkrjb.dll
- %PROGRAM_FILES%\Sbwvx\Vvubp.kth
- 'yk.##77888.com':80
- 'jj.##77888.com':80
- 'a4####8437.3322.org':7000
- yk.##77888.com/temp/w0.jpg
- jj.##77888.com/temp/w0.jpg
- DNS ASK jj.##77888.com
- DNS ASK yk.##77888.com
- DNS ASK a4####8437.3322.org
- '<IP-адрес в локальной сети>':1036