Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'Explorer.exe <SYSTEM32>\config\systemprofile\CRNJEUFU.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '%USERNAME%' = '<SYSTEM32>\%USERNAME%.exe'
- <SYSTEM32>\reg.exe add "HKU\S-1-5-21-507921405-57989841-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d <SYSTEM32>\config\systemprofile\CRNJEUFU.exe,explorer.exe"
- <SYSTEM32>\regsvr32.exe /s %WINDIR%f}ѓ}~ow=<f]oxnOwksv8nvv
- <SYSTEM32>\reg.exe add "HKLM\SOFTWARE\Classes\exefile\shell\Enable Visual Styles\Command" /f /ve /t REG_SZ /d <SYSTEM32>\config\systemprofile\CRNJEUFU.exe
- <SYSTEM32>\reg.exe add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f /v %USERNAME% /t REG_SZ /d <SYSTEM32>\%USERNAME%.exe
- <SYSTEM32>\reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "Explorer.exe <SYSTEM32>\config\systemprofile\CRNJEUFU.exe
- из <Полный путь к вирусу> в <SYSTEM32>\%USERNAME%.exe
- ClassName: 'Shell_TrayWnd' WindowName: ''