Technical Information
- %HOMEPATH%\Start Menu\Programs\Startup\lpk.dll
- [<HKLM>\SYSTEM\ControlSet001\Services\FireFoxs] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\aspnet_states] 'Start' = '00000002'
- '%WINDIR%\ok3.exe'
- '<SYSTEM32>\fireqfox.exe'
- '%WINDIR%\ok2.exe'
- '%WINDIR%\ok1.exe'
- '<SYSTEM32>\mqucqg.exe'
- '%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' http://www.km##823.com
- '%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' http://www.as##dos.com
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\lpk.dll
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\lpk.dll
- <Auxiliary element>
- %WINDIR%\$NtUninstallKB942288-v3$\spuninst\lpk.dll
- %WINDIR%\$NtUninstallKB942288-v3$\lpk.dll
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\lpk.dll
- %PROGRAM_FILES%\Windows Media Player\lpk.dll
- %PROGRAM_FILES%\Outlook Express\lpk.dll
- %PROGRAM_FILES%\NetMeeting\lpk.dll
- %PROGRAM_FILES%\Windows NT\Pinball\lpk.dll
- %PROGRAM_FILES%\Windows NT\lpk.dll
- %PROGRAM_FILES%\Windows NT\Accessories\lpk.dll
- %WINDIR%\$NtUninstallWIC$\spuninst\lpk.dll
- %WINDIR%\assembly\NativeImages_v4.0.30319_32\ComSvcConfig\51819c709096229ee187a7feee395d9f\lpk.dll
- %WINDIR%\assembly\NativeImages_v2.0.50727_32\WsatConfig\7d2a3adbdcb675f872eb2dbf21f73596\lpk.dll
- %WINDIR%\assembly\NativeImages_v2.0.50727_32\SMSvcHost\b9c1a29e684bc02e49226ff1e9eec253\lpk.dll
- %WINDIR%\Help\Tours\mmTour\lpk.dll
- %WINDIR%\lpk.dll
- %WINDIR%\assembly\NativeImages_v4.0.30319_32\dfsvc\b9b6069e6da06eb57e89cc544397f735\lpk.dll
- %WINDIR%\assembly\NativeImages_v2.0.50727_32\dfsvc\a2865dcec9c5d3cc9c55f026cbad6fcc\lpk.dll
- %WINDIR%\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\19b50dd470540911fc5cc65331a769e4\lpk.dll
- %WINDIR%\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\lpk.dll
- %WINDIR%\assembly\NativeImages_v2.0.50727_32\ServiceModelReg\6781b87c8d3b55e6120b1e86bea6e040\lpk.dll
- %WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\9469981a17c01dd154c540127e678b35\lpk.dll
- %WINDIR%\assembly\NativeImages_v2.0.50727_32\MSBuild\87c84ffaaad81d8d106a9aa9d68b5926\lpk.dll
- %PROGRAM_FILES%\MSN Gaming Zone\Windows\lpk.dll
- <DRIVERS>\PCIDump.sys
- <Current directory>\lpk.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\kmy0823[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\s[1]
- <SYSTEM32>\fireqfox.exe
- %WINDIR%\ok3.exe
- %WINDIR%\ok2.exe
- %WINDIR%\ok1.exe
- C:\RCX1.tmp
- <SYSTEM32>\gei33.dll
- <SYSTEM32>\mqucqg.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\aspddos[1]
- %PROGRAM_FILES%\Messenger\lpk.dll
- %PROGRAM_FILES%\Internet Explorer\lpk.dll
- %PROGRAM_FILES%\Internet Explorer\Connection Wizard\lpk.dll
- %PROGRAM_FILES%\MSN\MSNCoreFiles\Install\lpk.dll
- %PROGRAM_FILES%\MSN\MSNCoreFiles\Install\MSN9Components\lpk.dll
- %PROGRAM_FILES%\Movie Maker\lpk.dll
- %CommonProgramFiles%\Microsoft Shared\MSInfo\lpk.dll
- %CommonProgramFiles%\Microsoft Shared\DW\lpk.dll
- C:\Far2\lpk.dll
- %PROGRAM_FILES%\FireFox\uninstall\lpk.dll
- %PROGRAM_FILES%\FireFox\lpk.dll
- %CommonProgramFiles%\Microsoft Shared\Speech\lpk.dll
- %WINDIR%\$NtUninstallKB942288-v3$\spuninst\lpk.dll
- %WINDIR%\$NtUninstallKB942288-v3$\lpk.dll
- %WINDIR%\$NtUninstallWIC$\spuninst\lpk.dll
- %WINDIR%\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\19b50dd470540911fc5cc65331a769e4\lpk.dll
- %WINDIR%\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\lpk.dll
- <Auxiliary element>
- %PROGRAM_FILES%\Windows NT\Pinball\lpk.dll
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\lpk.dll
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\lpk.dll
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\lpk.dll
- %WINDIR%\assembly\NativeImages_v4.0.30319_32\ComSvcConfig\51819c709096229ee187a7feee395d9f\lpk.dll
- %WINDIR%\assembly\NativeImages_v2.0.50727_32\WsatConfig\7d2a3adbdcb675f872eb2dbf21f73596\lpk.dll
- %WINDIR%\assembly\NativeImages_v4.0.30319_32\dfsvc\b9b6069e6da06eb57e89cc544397f735\lpk.dll
- %WINDIR%\Help\Tours\mmTour\lpk.dll
- %WINDIR%\lpk.dll
- %WINDIR%\assembly\NativeImages_v2.0.50727_32\MSBuild\87c84ffaaad81d8d106a9aa9d68b5926\lpk.dll
- %WINDIR%\assembly\NativeImages_v2.0.50727_32\dfsvc\a2865dcec9c5d3cc9c55f026cbad6fcc\lpk.dll
- %WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\9469981a17c01dd154c540127e678b35\lpk.dll
- %WINDIR%\assembly\NativeImages_v2.0.50727_32\SMSvcHost\b9c1a29e684bc02e49226ff1e9eec253\lpk.dll
- %WINDIR%\assembly\NativeImages_v2.0.50727_32\ServiceModelReg\6781b87c8d3b55e6120b1e86bea6e040\lpk.dll
- %PROGRAM_FILES%\Windows NT\lpk.dll
- %CommonProgramFiles%\Microsoft Shared\Speech\lpk.dll
- %CommonProgramFiles%\Microsoft Shared\MSInfo\lpk.dll
- %PROGRAM_FILES%\FireFox\lpk.dll
- %PROGRAM_FILES%\Internet Explorer\Connection Wizard\lpk.dll
- %PROGRAM_FILES%\FireFox\uninstall\lpk.dll
- <SYSTEM32>\fireqfox.exe
- <Current directory>\lpk.dll
- %HOMEPATH%\Start Menu\Programs\Startup\lpk.dll
- %CommonProgramFiles%\Microsoft Shared\DW\lpk.dll
- C:\Far2\lpk.dll
- %PROGRAM_FILES%\NetMeeting\lpk.dll
- %PROGRAM_FILES%\MSN Gaming Zone\Windows\lpk.dll
- %PROGRAM_FILES%\Outlook Express\lpk.dll
- %PROGRAM_FILES%\Windows NT\Accessories\lpk.dll
- %PROGRAM_FILES%\Windows Media Player\lpk.dll
- %PROGRAM_FILES%\Messenger\lpk.dll
- %PROGRAM_FILES%\Internet Explorer\lpk.dll
- %PROGRAM_FILES%\Movie Maker\lpk.dll
- %PROGRAM_FILES%\MSN\MSNCoreFiles\Install\lpk.dll
- %PROGRAM_FILES%\MSN\MSNCoreFiles\Install\MSN9Components\lpk.dll
- %WINDIR%\ok3.exe
- <SYSTEM32>\gei33.dll
- from %WINDIR%\ok2.exe to killmdx
- from C:\RCX1.tmp to <SYSTEM32>\gei33.dll
- from %WINDIR%\ok1.exe to %TEMP%\SOFTWARE.LOG
- 'ra##.#00geili.com':8000
- 'ra##.#00geili.com':9000
- 'www.as##dos.com':80
- 'any':1990
- 'any':8000
- 'any':9000
- 'www.km##823.com':80
- 'localhost':1040
- '12#.#25.114.144':80
- 'localhost':1036
- 'yk.##pddos.com':51
- 'yk.##pddos.com':1990
- 'localhost':1041
- www.as##dos.com/
- www.km##823.com/
- 12#.#25.114.144/s?wo#################################################
- DNS ASK www.as##dos.com
- DNS ASK ra##.#00geili.com
- DNS ASK www.km##823.com
- DNS ASK www.ba##u.com
- DNS ASK yk.##pddos.com
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: '' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'