Техническая информация
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'lctoxchuvyjsfsxslq' = '%WINDIR%\SysWOW64\srv866.exe'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\axylwrooxlSv\Parameters] 'ServiceDll' = '%WINDIR%\SysWOW64\svcaxylwro.dll'
- [<HKLM>\System\CurrentControlSet\Services\axylwrooxlSv] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\axylwrooxlSv] 'ImagePath' = '<SYSTEM32>\svchost.exe -k DcomSec'
- 'axylwrooxlSv' <SYSTEM32>\svchost.exe -k DcomSec
- C:\logbot.txt
- %TEMP%\lis9378.tmp
- %WINDIR%\syswow64\srv866.exe
- %WINDIR%\syswow64\svcaxylwro.dll
- %TEMP%\lse9452.tmp
- '%WINDIR%\syswow64\svchost.exe' -k DcomSec