Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\Kingsoft Antivirus WebShield Service] 'Start' = '00000002'
- '%ALLUSERSPROFILE%\Application Data\wd\KSWebShield.exe'
- '%TEMP%\nse2.tmp\ns3.tmp' cmd.exe /c c:\clearerror.bat
- '<SYSTEM32>\route.exe' -p add 59.53.87.80 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 60.191.124.236 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 59.53.87.79 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 59.53.87.77 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 59.53.87.78 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 61.147.109.147 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 61.147.110.235 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 60.191.223.97 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 60.191.223.94 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 60.191.223.96 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 59.53.87.76 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 58.221.42.84 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 58.221.42.85 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 58.221.42.83 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 222.208.168.5 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 222.241.151.0 mask 255.255.255.0 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 59.53.87.106 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 59.53.87.107 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 59.53.87.102 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 59.51.114.16 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 59.53.87.101 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 61.183.62.187 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 67.215.65.132 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 61.183.62.186 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 61.183.62.178 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 61.183.62.179 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' /pid=3220
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 6
- '<SYSTEM32>\route.exe' -start
- '<SYSTEM32>\route.exe' cmd.exe /c "%ALLUSERSPROFILE%\Application Data\wd\u.bat"
- '<SYSTEM32>\route.exe' -install
- '<SYSTEM32>\route.exe' -p add 61.183.44.240 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 61.160.210.165 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 61.160.210.166 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 61.160.210.164 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 61.147.110.237 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 61.147.110.238 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 61.160.210.170 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 61.164.110.113 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 61.160.210.169 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 61.160.210.167 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 61.160.210.168 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 222.208.168.4 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 122.228.199.133 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 122.228.199.134 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 122.228.199.132 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 122.228.199.130 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 122.228.199.131 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 124.238.243.0 mask 255.255.255.0 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 124.238.244.0 mask 255.255.255.0 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 122.228.199.68 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 122.228.199.135 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 122.228.199.136 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 122.227.15.61 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 121.14.158.155 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 122.225.37.116 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 121.14.158.153 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 110.81.239.0 mask 255.255.255.0 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 113.105.146.25 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 122.227.15.59 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 122.227.15.60 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 122.226.213.145 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 122.225.37.117 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 122.225.37.118 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 220.170.193.71 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 220.170.193.72 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 220.170.193.70 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 220.170.193.68 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 220.170.193.69 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 222.186.16.181 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 222.186.189.0 mask 255.255.255.0 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 220.181.126.0 mask 255.255.255.0 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 220.170.193.73 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 220.170.193.74 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 218.77.10.73 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 218.21.68.70 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 218.77.10.66 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 218.16.227.66 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 124.238.254.0 mask 255.255.255.0 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 202.102.110.205 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 218.77.10.70 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 218.77.10.71 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 218.77.10.69 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 218.77.10.67 mask 255.255.255.255 10.0.0.3
- '<SYSTEM32>\route.exe' -p add 218.77.10.68 mask 255.255.255.255 10.0.0.3
- <SYSTEM32>\route.exe
- %ALLUSERSPROFILE%\Application Data\wd\u.bat
- %TEMP%\nse2.tmp\ns5.tmp
- %ALLUSERSPROFILE%\Application Data\wd\kwsui.dll
- %ALLUSERSPROFILE%\Application Data\wd\kswebshield.dll
- %ALLUSERSPROFILE%\Application Data\wd\kswbc.dll
- %ALLUSERSPROFILE%\Application Data\wd\KWSSVC.log
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\index308[1].htm
- <SYSTEM32>\i_e.ico
- <SYSTEM32>\txb.ico
- <SYSTEM32>\xxyx.ico
- %ALLUSERSPROFILE%\Application Data\wd\KSWebShield.exe
- %TEMP%\nse2.tmp\nsExec.dll
- %TEMP%\nse2.tmp\ns3.tmp
- C:\clearerror.bat
- %TEMP%\nse2.tmp\NSISArray.dll
- %TEMP%\nse2.tmp\ip.dll
- %ALLUSERSPROFILE%\Templates\nsj4.tmp.exe
- %ALLUSERSPROFILE%\Application Data\kingsoft\kws\spitesp.dat
- %ALLUSERSPROFILE%\Application Data\wd\kwssp.dll
- %ALLUSERSPROFILE%\Application Data\kingsoft\kws\kws.ini
- %TEMP%\nse2.tmp\System.dll
- %TEMP%\nse2.tmp\AccessControl.dll
- %TEMP%\nse2.tmp\nsExec.dll
- %TEMP%\nse2.tmp\NSISArray.dll
- %TEMP%\nse2.tmp\System.dll
- %TEMP%\nse2.tmp\ip.dll
- %TEMP%\nse2.tmp\ns3.tmp
- %TEMP%\nse2.tmp\ns5.tmp
- %TEMP%\nse2.tmp\AccessControl.dll
- 'ww#.#iyou.net':80
- 'localhost':1036
- ww#.#iyou.net/index308.htm
- DNS ASK ww#.#iyou.net
- ClassName: 'ComboBox' WindowName: ''
- ClassName: 'ComboBoxEx32' WindowName: ''
- ClassName: 'Address Band Root' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'Edit' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: '' WindowName: '(null)'
- ClassName: 'kws::OSUCWindowClass' WindowName: '(null)'
- ClassName: 'ReBarWindow32' WindowName: ''
- ClassName: 'WorkerW' WindowName: '(null)'
- ClassName: 'IEFrame' WindowName: '(null)'