Техническая информация
- [HKLM\Software\Classes\exefile\shell\open\command] '' = 'winlogon.exe "%1" %*'
- %TEMP%\ixp000.tmp\mswinsck.ocx
- %TEMP%\ixp000.tmp\mswinscn.ocx
- %TEMP%\ixp000.tmp\winlogon.exe
- %WINDIR%\syswow64\mswinscn.ocx
- %WINDIR%\syswow64\mswinsck.ocx
- %WINDIR%\syswow64\winlogon.exe
- %WINDIR%\winlogon.exe
- DNS ASK ho######er.redirectme.net
- '%TEMP%\ixp000.tmp\winlogon.exe'