Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\efcYQHBr] 'Logon' = 'o'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\efcYQHBr] 'DllName' = 'efcYQHBr.dll'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] '{B82F29E4-8368-4B14-9C00-5138C0D94034}' = ''
- <SYSTEM32>\cmd.exe /c %TEMP%\removalfile.bat "<Полный путь к вирусу>"
- <SYSTEM32>\winlogon.exe
- %TEMP%\removalfile.bat
- <SYSTEM32>\efcYQHBr.dll