Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Microsoft' = '%WINDIR%\%WINDIR%\r_server.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Microsoft' = '<SYSTEM32>\r_server.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Microsoft' = '%WINDIR%\r_server.exe'
- '<SYSTEM32>\r_server.exe'
- '<SYSTEM32>\reg.exe' add hklm\software\microsoft\windows\currentversion\run /v Microsoft /d <SYSTEM32>\r_server.exe /f
- '<SYSTEM32>\reg.exe' add hklm\software\microsoft\windows\currentversion\run /v Microsoft /d %WINDIR%\%WINDIR%\r_server.exe /f
- '<SYSTEM32>\reg.exe' add hklm\software\microsoft\windows\currentversion\run /v Microsoft /d %WINDIR%\r_server.exe /f
- '<SYSTEM32>\cmd.exe' /c ""<SYSTEM32>\run.bat" "
- '%WINDIR%\regedit.exe' /s %WINDIR%\himem.reg
- <SYSTEM32>\AdmDll.dll
- <SYSTEM32>\raddrv.dll
- %WINDIR%\himem.reg
- <SYSTEM32>\run.bat
- <SYSTEM32>\run1.bat
- <SYSTEM32>\r_server.exe
- %WINDIR%\himem.reg
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''