Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'Explorer.exe jorj.exe'
- <SYSTEM32>\reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v Shell /t REG_SZ /d "Explorer.exe jorj.exe"
- <SYSTEM32>\jorj.exe
- %TEMP%\vp.exe
- <SYSTEM32>\sendhmtl.htm
- %TEMP%\vp.exe.tmp
- C:\wrpext1383-donotdeleteormodifythisfileplease.exe
- %TEMP%\jorj.exe.tmp
- %TEMP%\jorj.exe
- <SYSTEM32>\jorj.exe
- C:\wrpext1383-donotdeleteormodifythisfileplease.exe
- %TEMP%\vp.exe.tmp
- %TEMP%\jorj.exe.tmp
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: ''