Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\uqFPGD0e] 'ImagePath' = '%HOMEPATH%\My Documents\uqFPGD0e.sys'
- %HOMEPATH%\My Documents\uqFPGD0e.sys
- 'r.###gyou.com':80
- http://r.###gyou.com/fcg-bin/cgi_get_portrait.fcg?ui#############
- DNS ASK r.###gyou.com
- ClassName: '' WindowName: ''
- '<SYSTEM32>\cmd.exe' /c sc config "UxSms" start= demand
- '<SYSTEM32>\sc.exe' config "UxSms" start= demand