Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Msdriver' = '<SYSTEM32>\dwin32.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run] 'Msdriver' = '<SYSTEM32>\dwin32.exe'
- скрытых файлов
- Средство контроля пользовательских учетных записей (UAC)
- <SYSTEM32>\dwin32.exe
- ClassName: 'OLLYDBG' WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS' WindowName: ''
- ClassName: 'gdkWindowToplevel' WindowName: ''
- <SYSTEM32>\dwin32.exe
- <SYSTEM32>\dwin32.exe
- ClassName: '' WindowName: 'CommView - The Team ZWT 2008'
- ClassName: '' WindowName: 'The Wireshark Network Analyzer'
- ClassName: '' WindowName: 'SysAnalyzer'
- ClassName: '' WindowName: 'CommView'
- ClassName: 'TCPViewClass' WindowName: ''
- ClassName: '' WindowName: 'TCPView - Sysinternals: www.sysinternals.com'