Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'userinit' = 'svchostt.exe,<SYSTEM32>\userinit.exe,'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
- Средство контроля пользовательских учетных записей (UAC)
- <SYSTEM32>\net1.exe stop wscsvc
- <SYSTEM32>\net1.exe stop windefend
- <SYSTEM32>\netsh.exe firewall add portopening TCP 10001 enable
- <SYSTEM32>\netsh.exe firewall set opmode mode=DISABLE
- <SYSTEM32>\sc.exe config wscsvc start= disabled
- <SYSTEM32>\net.exe stop windefend
- <SYSTEM32>\sc.exe config AntiVirService start= disabled
- <SYSTEM32>\net.exe stop wscsvc
- <SYSTEM32>\sc.exe config windefend start= disabled
- <SYSTEM32>\libx2_2.dll
- <SYSTEM32>\serverx.dll
- <SYSTEM32>\serverf.dll
- 'www.ia##a.com':80
- www.ia##a.com/logs/crnjeufu.txt
- www.ia##a.com/base.htm
- DNS ASK www.ia##a.com
- '<IP-адрес в локальной сети>':1035