Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\Yisiocczi] 'Start' = '00000002'
- '%PROGRAM_FILES%\Ziioevrzs.exe'
- 'C:\ѕЄМѕЈЎХвГґЖЇББФхГґКЗј¦ДШ.exe'
- '<SYSTEM32>\wbem\wmiadap.exe' /R /T
- '<SYSTEM32>\cmd.exe' /c "c:\ѕЄМѕЈЎХвГґЖЇББФхГґКЗј¦ДШ.exe_And xMe.bat"
- %TEMP%\_eviip.tmp
- %TEMP%\BClib\krnln.fnr
- C:\ѕЄМѕЈЎХвГґЖЇББФхГґКЗј¦ДШ.exe_And xMe.bat
- %WINDIR%\Fonts\100715607988eaf98b572ef413d08c51.dat
- %TEMP%\BClib\dp1.fne
- %PROGRAM_FILES%\Ziioevrzs.db
- %PROGRAM_FILES%\Yisiocczi\srvany.exe
- %TEMP%\BClib\Exmlrpc.fne
- %TEMP%\BClib\krnln.fne
- %PROGRAM_FILES%\Ziioevrzs.dll
- %TEMP%\nsa2.tmp\System.dll
- %TEMP%\E_4\krnln.fnr
- C:\ѕЄМѕЈЎХвГґЖЇББФхГґКЗј¦ДШ.exe
- C:\ѕЄМѕЈЎХвГґЖЇББФхГґКЗј¦ДШ.doc
- %TEMP%\E_4\Exmlrpc.fne
- %TEMP%\ms2306.tmp
- %PROGRAM_FILES%\Ziioevrzs.exe
- %TEMP%\E_4\dp1.fne
- <Текущая директория>\<Имя вируса>.doc
- %PROGRAM_FILES%\Ziioevrzs.db
- %PROGRAM_FILES%\Ziioevrzs.dll
- %PROGRAM_FILES%\Ziioevrzs.exe
- <SYSTEM32>\PerfStringBackup.TMP
- %PROGRAM_FILES%\Ziioevrzs.exe
- %TEMP%\nsa2.tmp\System.dll
- <SYSTEM32>\wbem\Performance\WmiApRpl.ini
- 'we####007.gicp.net':19820
- DNS ASK we####007.gicp.net
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'WordPadClass' WindowName: ''