Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\Userinit.exe,%CommonProgramFiles%\System\secuers32.exe,%WINDIR%\svchost.exe'
- <DRIVERS>\secdrv.sys файлом <DRIVERS>\secdrv.txt
- %CommonProgramFiles%\System\secuers32.exe
- %CommonProgramFiles%\System\server32.exe
- <DRIVERS>\secdrv.txt
- <SYSTEM32>\vsdertl.dig
- %CommonProgramFiles%\System\server32.exe
- %CommonProgramFiles%\System\secuers32.exe
- <DRIVERS>\secdrv.sys