Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\DevicePickerUserS_0xWindows] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\DevicePickerUserS_0xWindows] 'ImagePath' = '<SYSTEM32>\svchost.exe -k netsvcs -p'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\DevicePickerUserS_0xWindows\Parameters] 'ServiceDll' = '%ProgramFiles(x86)%\BmpToAvi.dll'
- %ProgramFiles(x86)%\bmptoavi.dll
- из <Полный путь к файлу> в %WINDIR%\syswow64\1088437.bak
- 'bj##tj.com':19950
- DNS ASK bj##tj.com
- '%WINDIR%\syswow64\svchost.exe' -k netsvcs -p