Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\wxpdrivers] 'Start' = '00000002'
- <SYSTEM32>\reg.exe add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wxpdrivers /v "" /t REG_SZ /d Service /f
- <SYSTEM32>\reg.exe add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon /v AutoAdminLogon /t REG_SZ /d 1 /f
- <SYSTEM32>\reg.exe add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\wxpdrivers /v "" /t REG_SZ /d Service /f
- <SYSTEM32>\cmd.exe /c ""%TEMP%\58639223.bat""
- <SYSTEM32>\chcp.com 1251
- <SYSTEM32>\reg.exe add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot /v AlternateShell /t REG_SZ /d services32.exe /f
- %WINDIR%\services32.exe
- %TEMP%\58639223.bat
- %WINDIR%\proc_list1.log
- 'dr#####portal-x86.com':80
- '93.##8.134.3':80
- DNS ASK dr#####portal-x86.com
- DNS ASK ya.ru
- '<IP-адрес в локальной сети>':1036
- ClassName: 'Shell_TrayWnd' WindowName: ''