Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'antivirus' = '<SYSTEM32>\wscript.exe %APPDATA%\gun.wsf'
- %HOMEPATH%\Start Menu\Programs\Startup\windowsupdate.Lnk
- '<SYSTEM32>\cscript.exe' %APPDATA%\gun.wsf
- '%ProgramFiles%\Windows NT\Accessories\wordpad.exe' "%APPDATA%\arabee.doc"
- %APPDATA%\gun.wsf
- %APPDATA%\arabee.doc
- %APPDATA%\gun.wsf
- %APPDATA%\arabee.doc
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'WordPadClass' WindowName: ''