Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\r_server] 'Start' = '00000002'
- %WINDIR%\PIF\smss.exe /start /silence /service /install /silence /pass:xplicit /port:5445 /save /silence
- %TEMP%\work3.exe
- %TEMP%\pt tine.exe
- %WINDIR%\regedit.exe /s %WINDIR%\PIF\reg.reg
- %WINDIR%\regedit.exe /s %WINDIR%\PIF\reg1.reg
- <SYSTEM32>\wscript.exe "%WINDIR%\PIF\cmd.vbe"
- <SYSTEM32>\wscript.exe "%WINDIR%\PIF\firewall.vbe"
- %WINDIR%\PIF\firewall.vbe
- %WINDIR%\PIF\smss.exe
- %WINDIR%\PIF\cmd.vbe
- %TEMP%\Jgl_Rt\2_whiter_shade_of_pale.mp3
- %TEMP%\work3.exe
- %TEMP%\pt tine.exe
- %WINDIR%\PIF\AdmDll.dll
- %WINDIR%\PIF\reg.reg
- %WINDIR%\PIF\reg1.reg
- %WINDIR%\PIF\reg.reg
- %WINDIR%\PIF\reg1.reg
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''