Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Explorer' = 'c:\deyanemo.bat'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Explorer' = 'c:\deyanemo.bat'
- <SYSTEM32>\reg.exe add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Explorer /t REG_SZ /d c:\deyanemo.bat /f
- <SYSTEM32>\rundll32.exe user32,swapmousebutton
- <SYSTEM32>\reg.exe add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\run /v Explorer /t REG_SZ /d c:\deyanemo.bat /f
- <SYSTEM32>\cmd.exe /c c:\deyanemo.bat
- <SYSTEM32>\net1.exe user %USERNAME% /del
- C:\autexec.bat
- C:\deyanemo.bat
- C:\deyanemo.bat
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''