Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '9oqe' = '%APPDATA%\b16pc7z.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
- [<HKLM>\SYSTEM\ControlSet001\Control\Print\Providers\1218419504] 'Name' = '%TEMP%\5.tmp'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Inoyikotadoqev' = 'rundll32.exe "%WINDIR%\kbawasve.dll",Startup'
- [<HKLM>\SYSTEM\ControlSet001\Services\MouseDriver] 'Start' = '00000002'
- %TEMP%\ojiunesf.exe
- %TEMP%\-1998166001
- %TEMP%\vhglsog.exe
- %TEMP%\dxybapfj.exe
- %TEMP%\ysxenhy.exe
- %TEMP%\hvgxrel.exe
- %TEMP%\vlflp.exe
- %APPDATA%\b16pc7z.exe
- %TEMP%\ikrjim.exe
- %TEMP%\nsa3.tmp\6tbp.exe
- %TEMP%\nsa3.tmp\2IC.exe
- %TEMP%\nsa3.tmp\3E4U - Bucks.exe
- %TEMP%\nsa3.tmp\1EuroP.exe
- %TEMP%\nsa3.tmp\Hxkds.exe
- %TEMP%\nsa3.tmp\IR.exe
- %TEMP%\rlupkh.exe
- %TEMP%\nsnu.exe
- %TEMP%\vhglsog.exe (загружен из сети Интернет)
- %TEMP%\hvgxrel.exe (загружен из сети Интернет)
- %TEMP%\ikrjim.exe (загружен из сети Интернет)
- %TEMP%\nsnu.exe (загружен из сети Интернет)
- %TEMP%\rlupkh.exe (загружен из сети Интернет)
- %TEMP%\dxybapfj.exe (загружен из сети Интернет)
- %TEMP%\ysxenhy.exe (загружен из сети Интернет)
- %TEMP%\-1998166001 (загружен из сети Интернет)
- <SYSTEM32>\sc.exe config SharedAccess start= DISABLED
- <SYSTEM32>\net.exe stop "Windows Firewall/Internet Connection Sharing (ICS)"
- <SYSTEM32>\net1.exe stop "Security Center"
- <SYSTEM32>\rundll32.exe setupapi,InstallHinfSection DefaultInstall 128 %APPDATA%\mdinstall.inf
- <SYSTEM32>\net1.exe stop "Windows Firewall/Internet Connection Sharing (ICS)"
- <SYSTEM32>\svchost.exe
- <SYSTEM32>\rundll32.exe "%WINDIR%\kbawasve.dll",Startup
- <SYSTEM32>\rundll32.exe "%WINDIR%\kbawasve.dll",iep
- <SYSTEM32>\sc.exe config wscsvc start= DISABLED
- <SYSTEM32>\net.exe stop "Security Center"
- <SYSTEM32>\svchost.exe
- %WINDIR%\Explorer.EXE
- <SYSTEM32>\spoolsv.exe
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1400' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1601' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'currentlevel' = '00000000'
- %TEMP%\ysxenhy.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\cpptuxlpc[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\sftkxkb[1].php
- %APPDATA%\b16pc7z.exe
- %TEMP%\-1998166001
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\CA8H6RKH.php
- %TEMP%\dxybapfj.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\iwwnnrvi[1].php
- %WINDIR%\iwoyeganowetur.dll
- %TEMP%\ikrjim.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\obcptx[1].php
- %TEMP%\vlflp.exe
- %APPDATA%\7ze70ah5.bat
- %TEMP%\ojiunesf.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\klppp[1].php
- %TEMP%\hvgxrel.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\xxobo[1].php
- %APPDATA%\mdinstall.inf
- %APPDATA%\MouseDriver.bat
- %TEMP%\nsa3.tmp\IR.exe
- %TEMP%\nsa3.tmp\6tbp.exe
- %WINDIR%\kbawasve.dll
- %TEMP%\4.tmp
- %TEMP%\nsa3.tmp\3E4U - Bucks.exe
- %TEMP%\nsa3.tmp\Hxkds.exe
- %TEMP%\nsj2.tmp
- %TEMP%\nsa3.tmp\2IC.exe
- %TEMP%\nsa3.tmp\1EuroP.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ndrei[1].php
- %TEMP%\rlupkh.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\wjwjwaobfs[1].php
- %TEMP%\vhglsog.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\jjnaeei[1].php
- %TEMP%\Aqz..bat
- %WINDIR%\Temp\6.tmp
- %TEMP%\nsnu.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\oyppct[1].php
- %APPDATA%\MouseDriver.bat
- %TEMP%\5.tmp
- %TEMP%\nsa3.tmp\IR.exe
- <DRIVERS>\etc\hosts
- %APPDATA%\mdinstall.inf
- %WINDIR%\Temp\6.tmp
- %TEMP%\nsa3.tmp\2IC.exe
- %TEMP%\nsa3.tmp\1EuroP.exe
- %TEMP%\nsa3.tmp\3E4U - Bucks.exe
- %TEMP%\nsa3.tmp\Hxkds.exe
- %TEMP%\nsa3.tmp\6tbp.exe
- %TEMP%\4.tmp в %TEMP%\5.tmp
- 'localhost':1039
- '03#####c0910.wordxs.net':80
- 'ma###ubas.in':80
- 'ca###iod.com':80
- ca###iod.com/pxxko/klppp.php?ad####################################
- ca###iod.com/pxxko/xxobo.php?ad####################################
- ca###iod.com/pxxko/sftkxkb.php?ad####################################
- ca###iod.com/pxxko/pcppgk.php?ad####################################
- ca###iod.com/pxxko/gqquulypp.php?ad####################################
- ca###iod.com/pxxko/obcptx.php?ad####################################
- ca###iod.com/pxxko/ndrei.php?ad####################################
- ca###iod.com/pxxko/jjnaeei.php?ad####################################
- ca###iod.com/pxxko/oyppct.php?ad####################################
- ca###iod.com/pxxko/cpptuxlpc.php?ad####################################
- ca###iod.com/pxxko/iwwnnrvi.php?ad####################################
- ca###iod.com/pxxko/wjwjwaobfs.php?ad####################################
- DNS ASK ma###ubas.in
- DNS ASK ca###iod.com
- DNS ASK 03#####c0910.wordxs.net
- DNS ASK ti##pic.com
- DNS ASK ma##h.com
- DNS ASK da##.net
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'SystemTray_Main' WindowName: ''
- ClassName: 'CSCHiddenWindow' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''