Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\WebCliant] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\WebCliant] 'ImagePath' = 'cmd /c start %APPDATA%\Microsoft\Windows\desktop.vbs'
- [<HKLM>\SYSTEM\ControlSet001\Services\ChannelRent] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\ChannelRent] 'ImagePath' = 'cmd /c start <SYSTEM32>\Com\vsx.vbs'
- <Полный путь к файлу>
- '<SYSTEM32>\cmd.exe' /c sc Create WebCliant binPath= "cmd /c start %APPDATA%\Microsoft\Windows\desktop.vbs" type= own type= interact start= auto
- '<SYSTEM32>\cmd.exe' /c sc Create ChannelRent binPath= "cmd /c start <SYSTEM32>\Com\vsx.vbs" type= own type= interact start= auto
- '<SYSTEM32>\sc.exe' Create ChannelRent binPath= "cmd /c start <SYSTEM32>\Com\vsx.vbs" type= own type= interact start= auto
- '<SYSTEM32>\sc.exe' Create WebCliant binPath= "cmd /c start %APPDATA%\Microsoft\Windows\desktop.vbs" type= own type= interact start= auto