Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\SubLineIDE] 'Start' = '00000002'
- %PROGRAM_FILES%\FunshionMedia\ipseccmd.exe -p Block0 -r Block0 -f 118.145.31.*+0 -n BLOCK -x
- %TEMP%\nsv2.tmp\nsF.tmp ipseccmd -p Block0 -r Block0 -f 118.145.31.*+0 -n BLOCK -x
- %PROGRAM_FILES%\FunshionMedia\setup794464.exe /VERYSILENT /NORESTART
- %PROGRAM_FILES%\FunshionMedia\feixin.exe uncompress -s dsop7.xml -d setup794464.exe
- %PROGRAM_FILES%\FunshionMedia\ipseccmd.exe -p Block8 -r Block8 -f 220.181.126.*+0 -n BLOCK -x
- %TEMP%\nsv2.tmp\nsD.tmp ipseccmd -p Block8 -r Block8 -f 220.181.126.*+0 -n BLOCK -x
- %PROGRAM_FILES%\FunshionMedia\ipseccmd.exe -p Block9 -r Block9 -f 221.194.142.*+0 -n BLOCK -x
- %TEMP%\nsv2.tmp\nsE.tmp ipseccmd -p Block9 -r Block9 -f 221.194.142.*+0 -n BLOCK -x
- %TEMP%\is-49F2U.tmp\setup794464.tmp /SL5="$C0106,759121,54272,%PROGRAM_FILES%\FunshionMedia\setup794464.exe" /VERYSILENT /NORESTART
- %PROGRAM_FILES%\FunshionMedia\feixin.exe dns 125.43.78.126,60.12.232.235
- %PROGRAM_FILES%\FunshionMedia\feixin.exe md5 -s subidecom.dll -d subidecom.dll
- %TEMP%\~nsu.tmp\Au_.exe _?=%PROGRAM_FILES%\FunshionMedia\
- %PROGRAM_FILES%\FunshionMedia\un1226150501665.exe
- %PROGRAM_FILES%\FunshionMedia\ipseccmd.exe -p Pass1 -r Pass1 -f 125.39.100.74+0 -n PASS -x
- %PROGRAM_FILES%\FunshionMedia\feixin.exe md5 -s ipseccmd.exe -d ipseccmd.exe
- %PROGRAM_FILES%\FunshionMedia\feixin.exe md5 -s spass.dll -d spass.dll
- %PROGRAM_FILES%\FunshionMedia\ipseccmd.exe -p Pass2 -r Pass2 -f 220.181.126.15+0 -n PASS -x
- %PROGRAM_FILES%\FunshionMedia\ipseccmd.exe -p Block7 -r Block7 -f 125.39.102.*+0 -n BLOCK -x
- %PROGRAM_FILES%\FunshionMedia\ipseccmd.exe -p Block1 -r BlockTCP -f 119.147.91.*+0 -n BLOCK -x
- %TEMP%\nsv2.tmp\ns6.tmp ipseccmd -p Block1 -r BlockTCP -f 119.147.91.*+0 -n BLOCK -x
- %PROGRAM_FILES%\FunshionMedia\ipseccmd.exe -p Block2 -r BlockNEW -f 119.188.4.*+0 -n BLOCK -x
- %TEMP%\nsv2.tmp\ns7.tmp ipseccmd -p Block2 -r BlockNEW -f 119.188.4.*+0 -n BLOCK -x
- %PROGRAM_FILES%\FunshionMedia\feixin.exe uncompress -s s0001.xml -d ipseccmd.exe
- <Текущая директория>\mzone-5482.exe
- %TEMP%\nsv2.tmp\ns5.tmp sc start PolicyAgent
- %PROGRAM_FILES%\FunshionMedia\feixin.exe md5 -s ipseccmd.exe -d ipseccmd.exe -l 19000000
- %TEMP%\nsv2.tmp\ns8.tmp ipseccmd -p Block3 -r BlockTWO -f 122.70.130.*+0 -n BLOCK -x
- %TEMP%\nsv2.tmp\nsB.tmp ipseccmd -p Block6 -r Block6 -f 125.39.100.*+0 -n BLOCK -x
- %PROGRAM_FILES%\FunshionMedia\ipseccmd.exe -p Block5 -r Block5 -f 124.238.244.*+0 -n BLOCK -x
- %TEMP%\nsv2.tmp\nsC.tmp ipseccmd -p Block7 -r Block7 -f 125.39.102.*+0 -n BLOCK -x
- %PROGRAM_FILES%\FunshionMedia\ipseccmd.exe -p Block6 -r Block6 -f 125.39.100.*+0 -n BLOCK -x
- %TEMP%\nsv2.tmp\ns9.tmp ipseccmd -p Block4 -r BlockTHREE -f 124.238.243.*+0 -n BLOCK -x
- %PROGRAM_FILES%\FunshionMedia\ipseccmd.exe -p Block3 -r BlockTWO -f 122.70.130.*+0 -n BLOCK -x
- %TEMP%\nsv2.tmp\nsA.tmp ipseccmd -p Block5 -r Block5 -f 124.238.244.*+0 -n BLOCK -x
- %PROGRAM_FILES%\FunshionMedia\ipseccmd.exe -p Block4 -r BlockTHREE -f 124.238.243.*+0 -n BLOCK -x
- <SYSTEM32>\svchost.exe -k mysysgroup3
- <SYSTEM32>\rundll32.exe <SYSTEM32>\subidecom.dll RundllInstall SubLineIDE
- <SYSTEM32>\sc.exe start PolicyAgent
- %TEMP%\is-O0SG0.tmp\spass.dll
- %TEMP%\is-O0SG0.tmp\_isetup\_shfoldr.dll
- %PROGRAM_FILES%\FunshionMedia\is-5C286.tmp
- %PROGRAM_FILES%\FunshionMedia\is-G033J.tmp
- %PROGRAM_FILES%\FunshionMedia\is-E2QAC.tmp
- %TEMP%\is-O0SG0.tmp\_isetup\_RegDLL.tmp
- %TEMP%\nsv2.tmp\nsE.tmp
- %TEMP%\nsv2.tmp\nsD.tmp
- %TEMP%\nsv2.tmp\nsF.tmp
- %TEMP%\is-49F2U.tmp\setup794464.tmp
- %PROGRAM_FILES%\FunshionMedia\setup794464.exe
- %PROGRAM_FILES%\FunshionMedia\is-C298U.tmp
- <SYSTEM32>\sublung\MyIEData\SysDat.bin
- <SYSTEM32>\sublung\sublung.dll
- <SYSTEM32>\sublung\MyIEData\myad.dat
- %APPDATA%\NetHome\main.ini
- %TEMP%\~nsu.tmp\Au_.exe
- <SYSTEM32>\subidecom.dll
- %PROGRAM_FILES%\FunshionMedia\is-EU4NT.tmp
- %PROGRAM_FILES%\FunshionMedia\is-ABJ7T.tmp
- <SYSTEM32>\sublung\MyIEData\main.ini
- %PROGRAM_FILES%\FunshionMedia\subidecom.dll
- %PROGRAM_FILES%\FunshionMedia\spass.dll
- %TEMP%\nsv2.tmp\nsRandom.dll
- %PROGRAM_FILES%\FunshionMedia\un1226150501665.exe
- %TEMP%\nsv2.tmp\AccessControl.dll
- %TEMP%\nsm4.tmp\ioSpecial.ini
- %TEMP%\nsv2.tmp\Internet.dll
- %PROGRAM_FILES%\FunshionMedia\temp1226150501665.ini
- %PROGRAM_FILES%\FunshionMedia\feixin.exe
- %PROGRAM_FILES%\FunshionMedia\dsop7.xml
- %PROGRAM_FILES%\FunshionMedia\s0001.xml
- %TEMP%\nsv2.tmp\System.dll
- <Текущая директория>\mzone-5482.exe
- %TEMP%\nsm4.tmp\modern-wizard.bmp
- %TEMP%\nsv2.tmp\ns9.tmp
- %TEMP%\nsv2.tmp\ns8.tmp
- %TEMP%\nsv2.tmp\nsA.tmp
- %TEMP%\nsv2.tmp\nsC.tmp
- %TEMP%\nsv2.tmp\nsB.tmp
- %TEMP%\nsv2.tmp\ns7.tmp
- %PROGRAM_FILES%\FunshionMedia\ipseccmd.exe
- %TEMP%\nsm4.tmp\InstallOptions.dll
- %TEMP%\nsv2.tmp\nsExec.dll
- %TEMP%\nsv2.tmp\ns6.tmp
- %TEMP%\nsv2.tmp\ns5.tmp
- %TEMP%\is-O0SG0.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-49F2U.tmp\setup794464.tmp
- %PROGRAM_FILES%\FunshionMedia\setup794464.exe
- %TEMP%\is-O0SG0.tmp\_isetup\_RegDLL.tmp
- %PROGRAM_FILES%\FunshionMedia\myad.dat
- %PROGRAM_FILES%\FunshionMedia\SysDat.bin
- %TEMP%\is-O0SG0.tmp\spass.dll
- %TEMP%\nsv2.tmp\nsRandom.dll
- %TEMP%\nsv2.tmp\System.dll
- %PROGRAM_FILES%\FunshionMedia\un1226150501665.exe
- %TEMP%\nsv2.tmp\nsExec.dll
- %PROGRAM_FILES%\FunshionMedia\s0001.xml
- %TEMP%\nsv2.tmp\AccessControl.dll
- %TEMP%\nsv2.tmp\Internet.dll
- %PROGRAM_FILES%\FunshionMedia\subidecom.dll
- %TEMP%\nsv2.tmp\ns9.tmp
- %TEMP%\nsv2.tmp\nsA.tmp
- %TEMP%\nsv2.tmp\nsB.tmp
- %TEMP%\nsv2.tmp\ns8.tmp
- %TEMP%\nsv2.tmp\ns5.tmp
- %TEMP%\nsv2.tmp\ns6.tmp
- %TEMP%\nsv2.tmp\ns7.tmp
- %PROGRAM_FILES%\FunshionMedia\ipseccmd.exe
- %PROGRAM_FILES%\FunshionMedia\feixin.exe
- %PROGRAM_FILES%\FunshionMedia\spass.dll
- %TEMP%\nsv2.tmp\nsF.tmp
- %TEMP%\nsv2.tmp\nsC.tmp
- %TEMP%\nsv2.tmp\nsD.tmp
- %TEMP%\nsv2.tmp\nsE.tmp
- %PROGRAM_FILES%\FunshionMedia\is-C298U.tmp в %PROGRAM_FILES%\FunshionMedia\feixin.exe
- %PROGRAM_FILES%\FunshionMedia\is-ABJ7T.tmp в %PROGRAM_FILES%\FunshionMedia\myad.dat
- %PROGRAM_FILES%\FunshionMedia\is-EU4NT.tmp в %PROGRAM_FILES%\FunshionMedia\SysDat.bin
- %PROGRAM_FILES%\FunshionMedia\is-5C286.tmp в %PROGRAM_FILES%\FunshionMedia\ipseccmd.exe
- %PROGRAM_FILES%\FunshionMedia\is-E2QAC.tmp в %PROGRAM_FILES%\FunshionMedia\subidecom.dll
- %PROGRAM_FILES%\FunshionMedia\is-G033J.tmp в %PROGRAM_FILES%\FunshionMedia\spass.dll
- 'so.#21.org':88
- 'tj.#ogle.cn':80
- tj.#ogle.cn/svr.asp?t=###################################
- DNS ASK so.#21.org
- DNS ASK sd#.#60safe.com
- DNS ASK tj.#ogle.cn
- ClassName: 'Shell_TrayWnd' WindowName: ''