Техническая информация
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'svchost' = '%APPDATA%\svchost\svchost.exe'
- [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'svchost' = '%APPDATA%\svchost\svchost.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%APPDATA%\svchost\svchost.exe,'
- %APPDATA%\svchost\svchost.exe
- DNS ASK ha###orum.fr
- '%APPDATA%\svchost\svchost.exe'