Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\wxpdrivers] 'Start' = '00000002'
- <SYSTEM32>\reg.exe add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\wxpdrivers /v "" /t REG_SZ /d Service /f
- <SYSTEM32>\reg.exe add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon /v AutoAdminLogon /t REG_SZ /d 1 /f
- <SYSTEM32>\reg.exe add HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\wxpdrivers /v "" /t REG_SZ /d Service /f
- <SYSTEM32>\reg.exe add HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot /v AlternateShell /t REG_SZ /d services32.exe /f
- <SYSTEM32>\chcp.com 1251
- <SYSTEM32>\cmd.exe /c """%TEMP%\65813278.bat"""
- <SYSTEM32>\reg.exe add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wxpdrivers /v "" /t REG_SZ /d Service /f
- <SYSTEM32>\reg.exe add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot /v AlternateShell /t REG_SZ /d services32.exe /f
- %WINDIR%\services32.exe
- %TEMP%\65813278.bat
- %WINDIR%\proc_list1.log
- 'bl###pot.com':80
- 'fr#####s-server1.com':80
- 'yo##ube.com':80
- bl###pot.com/
- yo##ube.com/
- DNS ASK bl###pot.com
- DNS ASK ba##u.com
- DNS ASK yo##ube.com
- DNS ASK fr#####s-server1.com
- ClassName: 'Shell_TrayWnd' WindowName: ''