Техническая информация
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'Explorer "%HOMEPATH%\SendTo\explore.exe" Set'
- %HOMEPATH%\Start Menu\Programs\Startup\explore.exe
- '%HOMEPATH%\SendTo\explore.exe' Set
- %TEMP%\~DF8A3F.tmp
- %HOMEPATH%\SendTo\explore.exe
- %TEMP%\~DF6B02.tmp
- %TEMP%\~DF6B02.tmp
- ClassName: '' WindowName: 'Bermoda Hack Group'
- ClassName: 'WindowClass_0' WindowName: ''
- ClassName: '' WindowName: 'Windows Task Manager'
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''