Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'helper' = '<SYSTEM32>\help32.exe'
- <SYSTEM32>\net1.exe stop sharedaccess
- <SYSTEM32>\reg.exe add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v helper /t Reg_SZ /d <SYSTEM32>\help32.exe /f
- <SYSTEM32>\ftp.exe -s:%WINDIR%\in.txt
- <SYSTEM32>\net.exe stop sharedaccess
- <SYSTEM32>\wscript.exe "%TEMP%\mes.js"
- <SYSTEM32>\net.exe stop wscsvc
- <SYSTEM32>\net1.exe stop wscsvc
- %WINDIR%\in.txt
- %TEMP%\mes.js
- %TEMP%\a74675.bat
- %TEMP%\a74675.bat
- %TEMP%\a74675.bat
- %WINDIR%\in.txt
- 'ft#.#arod.ru':21
- 'localhost':1036
- DNS ASK ft#.#arod.ru
- ClassName: 'Shell_TrayWnd' WindowName: ''