Техническая информация
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\DDHelper.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\DualDesk.lnk
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\DD20.4.8201210120033\DualDesk.exe' = '%PROGRAM_FILES%\DD20.4.8201210120033\DualDesk.exe:*:Enabled:DualDesk-Server'
- %TEMP%\nsx5.tmp\ns10.tmp REG.EXE DELETE "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\DD_Service" /f
- %TEMP%\nsx5.tmp\ns11.tmp REG.EXE DELETE "SYSTEM\CurrentControlSet\Services\DD_Service\Description" /f
- %TEMP%\nsx5.tmp\nsE.tmp REG.EXE DELETE "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\DD_Service\Security" /f
- %TEMP%\nsx5.tmp\nsF.tmp REG.EXE DELETE "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\DD_Service\Enum" /f
- %PROGRAM_FILES%\DD20.4.8201210120033\DualDesk.exe
- %PROGRAM_FILES%\DD20.4.8201210120033\DDHelper.exe
- %TEMP%\nsx5.tmp\ns12.tmp REG.EXE DELETE "SYSTEM\CurrentControlSet\Services\DD_Service\DependOnService" /f
- %TEMP%\nsx5.tmp\ns13.tmp REG.EXE DELETE "SYSTEM\CurrentControlSet\Services\DD_Service" /f
- %TEMP%\nsx5.tmp\nsD.tmp "netsh.exe" firewall add allowedprogram "%PROGRAM_FILES%\DD20.4.8201210120033\DualDesk.exe" "DualDesk-Server" ENABLE
- %TEMP%\nsx5.tmp\ns7.tmp "sc.exe" stop DD_CAD
- %TEMP%\nsx5.tmp\ns8.tmp "net.exe" stop DD_Service
- %TEMP%\nsj3.tmp\DD_inlinehelp.com_443.exe /337129532031331888678_Inline Computer Support Inc./0
- %TEMP%\nsx5.tmp\ns6.tmp "sc.exe" stop DD_Service
- %TEMP%\nsx5.tmp\nsB.tmp "sc.exe" delete DD_CAD
- %TEMP%\nsx5.tmp\nsC.tmp "netsh.exe" firewall add allowedprogram "%PROGRAM_FILES%\DD20.4.8201210120033\DualDesk.exe" "DualDesk-Server" ENABLE ALL
- %TEMP%\nsx5.tmp\ns9.tmp "net.exe" stop DD_CAD
- %TEMP%\nsx5.tmp\nsA.tmp "sc.exe" delete DD_Service
- <SYSTEM32>\reg.exe DELETE "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\DD_Service\Enum" /f
- <SYSTEM32>\reg.exe DELETE "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\DD_Service" /f
- <SYSTEM32>\netsh.exe firewall add allowedprogram "%PROGRAM_FILES%\DD20.4.8201210120033\DualDesk.exe" "DualDesk-Server" ENABLE
- <SYSTEM32>\reg.exe DELETE "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\DD_Service\Security" /f
- <SYSTEM32>\reg.exe DELETE "SYSTEM\CurrentControlSet\Services\DD_Service" /f
- <SYSTEM32>\ipconfig.exe /flushdns
- <SYSTEM32>\reg.exe DELETE "SYSTEM\CurrentControlSet\Services\DD_Service\Description" /f
- <SYSTEM32>\reg.exe DELETE "SYSTEM\CurrentControlSet\Services\DD_Service\DependOnService" /f
- <SYSTEM32>\netsh.exe firewall add allowedprogram "%PROGRAM_FILES%\DD20.4.8201210120033\DualDesk.exe" "DualDesk-Server" ENABLE ALL
- <SYSTEM32>\net.exe stop DD_Service
- <SYSTEM32>\net1.exe stop DD_Service
- <SYSTEM32>\sc.exe stop DD_Service
- <SYSTEM32>\sc.exe stop DD_CAD
- <SYSTEM32>\sc.exe delete DD_Service
- <SYSTEM32>\sc.exe delete DD_CAD
- <SYSTEM32>\net.exe stop DD_CAD
- <SYSTEM32>\net1.exe stop DD_CAD
- %TEMP%\nsj3.tmp\Configs\DD20.4.8.txt
- %PROGRAM_FILES%\DD20.4.8201210120033\DDuninst.exe
- %TEMP%\nsx5.tmp\ddUninst.exe
- %TEMP%\nsx5.tmp\nsD.tmp
- %TEMP%\nsx5.tmp\nsC.tmp
- %TEMP%\nsj3.tmp\ToolBox\DD20.4.8.txt
- %TEMP%\nsx5.tmp\cad.exe
- %PROGRAM_FILES%\DD20.4.8201210120033\DD.txt
- %TEMP%\nsx5.tmp\nsB.tmp
- %TEMP%\nsx5.tmp\nsA.tmp
- %TEMP%\nsx5.tmp\DualDesk.exe
- %PROGRAM_FILES%\DD20.4.8201210120033\UnDD.txt
- %PROGRAM_FILES%\DD20.4.8201210120033\Flag.txt
- %TEMP%\nsx5.tmp\ns13.tmp
- %TEMP%\nsx5.tmp\ns12.tmp
- %TEMP%\nsx5.tmp\ns11.tmp
- %PROGRAM_FILES%\DD20.4.8201210120033\ToolBox\DDHelper.lnk
- %TEMP%\31331888678.txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\31331888678[1].txt
- %TEMP%\nsx5.tmp\ns10.tmp
- %HOMEPATH%\Desktop\ToolBox 20.4.8.0.lnk
- %HOMEPATH%\Desktop\Stop Remote Support.lnk
- %PROGRAM_FILES%\DD20.4.8201210120033\StopDD.reg
- %TEMP%\nsx5.tmp\nsF.tmp
- %TEMP%\nsx5.tmp\nsE.tmp
- %PROGRAM_FILES%\DD20.4.8201210120033\ToolBox\DualDesk.lnk
- %TEMP%\nsj3.tmp\Ring.wav
- %TEMP%\nsj3.tmp\Blank.bmp
- %TEMP%\nsj3.tmp\Icon2.ico
- %TEMP%\nsj3.tmp\Configs\Kris.txt
- %TEMP%\nsj3.tmp\Configs\Jim.txt
- %TEMP%\nsj3.tmp\Configs\Greg.txt
- %TEMP%\nsj3.tmp\Icon1.ico
- %TEMP%\nsj3.tmp\ddHelper.exe
- %TEMP%\nsj3.tmp\DD_inlinehelp.com_443.exe
- %TEMP%\nse2.tmp
- %TEMP%\nsj3.tmp\Logo.bmp
- %TEMP%\nsj3.tmp\Splash.bmp
- %TEMP%\nsj3.tmp\DD.txt
- %TEMP%\nsx5.tmp\ns6.tmp
- %TEMP%\nsx5.tmp\nsExec.dll
- %HOMEPATH%\My Documents\My Videos\Desktop.ini
- %TEMP%\nsx5.tmp\ns9.tmp
- %TEMP%\nsx5.tmp\ns8.tmp
- %TEMP%\nsx5.tmp\ns7.tmp
- %HOMEPATH%\Start Menu\Programs\Administrative Tools\desktop.ini
- %TEMP%\nsj3.tmp\Splash.dll
- %TEMP%\nsj3.tmp\Configs\Paul.txt
- %TEMP%\nsj3.tmp\Configs\Mike.txt
- %TEMP%\nsj3.tmp\DD-Done.txt
- %PROGRAM_FILES%\DD20.4.8201210120033\Advantig.txt
- %TEMP%\nsisdt.dll
- %HOMEPATH%\My Documents\My Videos\Desktop.ini
- %TEMP%\nsx5.tmp\nsE.tmp
- %TEMP%\nsx5.tmp\nsF.tmp
- %TEMP%\nsx5.tmp\nsD.tmp
- %TEMP%\nsj3.tmp\DD-Done.txt
- %TEMP%\nsx5.tmp\nsC.tmp
- %TEMP%\nsx5.tmp\ns10.tmp
- %TEMP%\nsx5.tmp\cad.exe
- %TEMP%\nsx5.tmp\nsExec.dll
- %TEMP%\nsx5.tmp\ns13.tmp
- %TEMP%\nsx5.tmp\ns11.tmp
- %TEMP%\nsx5.tmp\ns12.tmp
- %TEMP%\nsx5.tmp\ns7.tmp
- %TEMP%\nsx5.tmp\ns8.tmp
- %TEMP%\nsx5.tmp\ns6.tmp
- %TEMP%\nsisdt.dll
- %PROGRAM_FILES%\DD20.4.8201210120033\Advantig.txt
- %TEMP%\nsx5.tmp\ns9.tmp
- %PROGRAM_FILES%\DD20.4.8201210120033\UnDD.txt
- %PROGRAM_FILES%\DD20.4.8201210120033\Flag.txt
- %PROGRAM_FILES%\DD20.4.8201210120033\DD.txt
- %TEMP%\nsx5.tmp\nsA.tmp
- %TEMP%\nsx5.tmp\nsB.tmp
- %TEMP%\nsj3.tmp\ddHelper.exe в %PROGRAM_FILES%\DD20.4.8201210120033\DDHelper.exe
- %TEMP%\nsj3.tmp\DD.txt в %PROGRAM_FILES%\DD20.4.8201210120033\DD.txt
- %TEMP%\nsx5.tmp\DualDesk.exe в %PROGRAM_FILES%\DD20.4.8201210120033\DualDesk.exe
- %TEMP%\nsx5.tmp\ddUninst.exe в %PROGRAM_FILES%\DD20.4.8201210120033\Uninst.exe
- %TEMP%\nsj3.tmp\Ring.wav в %PROGRAM_FILES%\DD20.4.8201210120033\Ring.wav
- %TEMP%\nsj3.tmp\Icon1.ico в %PROGRAM_FILES%\DD20.4.8201210120033\icon1.ico
- %TEMP%\nsj3.tmp\Logo.bmp в %PROGRAM_FILES%\DD20.4.8201210120033\Logo.bmp
- %TEMP%\nsj3.tmp\Blank.bmp в %PROGRAM_FILES%\DD20.4.8201210120033\Blank.bmp
- %TEMP%\nsj3.tmp\Icon2.ico в %PROGRAM_FILES%\DD20.4.8201210120033\icon2.ico
- 'in###ehelp.com':443
- 'www.du###esk.net':80
- 'localhost':1039
- www.du###esk.net/unreg/31331888678.txt
- DNS ASK in###ehelp.com
- DNS ASK www.du###esk.net
- ClassName: 'DualDesk Tray Icon' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
- ClassName: 'DualDesk desktop sink' WindowName: ''
- ClassName: '#32770' WindowName: ''