Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\W32Time] 'Start' = '00000002'
- <SYSTEM32>\sc.exe config w32time start= auto
- <SYSTEM32>\sc.exe stop w32time
- <SYSTEM32>\rundll32.exe %PROGRAM_FILES%\Blrhq\Wnhxh.dll comdl2
- <SYSTEM32>\kb-x86-anti.xml
- %PROGRAM_FILES%\Blrhq\RCX2.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\w0[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\w0[1].jpg
- %TEMP%\kb-200984.tmp
- C:\Unlock.log
- %TEMP%\kb-216937.tmp
- %PROGRAM_FILES%\Dhdlc\RCX1.tmp
- %PROGRAM_FILES%\Blrhq\Wnhxh.dll
- %PROGRAM_FILES%\Dhdlc\Adwxs.nej
- 'yk.##77888.com':80
- 'jj.##77888.com':80
- 'q2####2762.3322.org':123
- yk.##77888.com/temp/w0.jpg
- jj.##77888.com/temp/w0.jpg
- DNS ASK jj.##77888.com
- DNS ASK yk.##77888.com
- DNS ASK q2####2762.3322.org
- '<IP-адрес в локальной сети>':1037