Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
- [<HKLM>\SOFTWARE\Classes\MSProgramGroup\Shell\Open\Command] '' = '<SYSTEM32>\grpconv.exe %1'
- %TEMP%\IXP000.TMP\LOGO.INF
- %TEMP%\IXP000.TMP\logo.sys
- %TEMP%\IXP000.TMP\logow.sys
- C:\SET3.tmp
- %WINDIR%\SET5.tmp
- %TEMP%\IXP000.TMP\logow.sys
- %TEMP%\IXP000.TMP\logo.sys
- %TEMP%\IXP000.TMP\LOGO.INF
- C:\SET3.tmp в C:\logo.sys
- %WINDIR%\SET5.tmp в %WINDIR%\logow.sys
- '<SYSTEM32>\rundll32.exe' setupapi.dll,InstallHinfSection DefaultInstall 128 %TEMP%\IXP000.TMP\LOGO.INF
- '<SYSTEM32>\runonce.exe' -r
- '<SYSTEM32>\grpconv.exe' -o