Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%WINDIR%\system\ctfmon.exe'
- %WINDIR%\system\pchuli.bat
- %WINDIR%\system\ctfmon.exe
- ClassName: 'Address Band Root' WindowName: '(null)'
- ClassName: 'Edit' WindowName: '(null)'
- ClassName: 'ReBarWindow32' WindowName: '(null)'
- ClassName: 'IEFrame' WindowName: '(null)'
- ClassName: 'WorkerW' WindowName: '(null)'