Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WinVNC' = ''
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WinVNC' = '"%WINDIR%\hedieh\WinVnc.exe" -servicehelper'
- [<HKLM>\SYSTEM\ControlSet001\Services\winvnc] 'Start' = '00000002'
- '%WINDIR%\hedieh\WinVnc.exe' -service
- '%WINDIR%\hedieh\WinVnc.exe' -install
- '<SYSTEM32>\net1.exe' start "VNC Server"
- '%WINDIR%\regedit.exe' /s %WINDIR%\hedieh\vnc.reg
- '<SYSTEM32>\cmd.exe' /c %WINDIR%\hedieh\q7x.bat
- [<HKLM>\SOFTWARE\ORL\WinVNC3]
- [<HKCU>\Software\ORL\WinVNC3]
- <SYSTEM32>\sendhmtl.htm
- %PROGRAM_FILES%\ORL\VNC\<Имя вируса>.exe
- %WINDIR%\hedieh\q7x.bat
- %WINDIR%\hedieh\WinVnc.exe
- %WINDIR%\hedieh\VNCHooks.dll
- %WINDIR%\hedieh\vnc.reg
- 'localhost':5900
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: '' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'RegEdit_RegEdit' WindowName: '(null)'