Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Guardian] 'Logon' = 'WinLogon'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Guardian] 'DllName' = '<SYSTEM32>\abctres.dll'
- '<SYSTEM32>\rundll32.exe' "<SYSTEM32>\6lo4svc.dll", UMonitor
- '%WINDIR%\explorer.exe'
- %WINDIR%\Explorer.EXE
- <SYSTEM32>\6lo4svc.dll
- <SYSTEM32>\abctres.dll
- <SYSTEM32>\abctres.dll
- 'www.lo##2me.com':80
- DNS ASK www.lo##2me.com
- ClassName: 'OleMainThreadWndClass' WindowName: '(null)'
- ClassName: 'NDDEAgnt' WindowName: 'NetDDE Agent'
- ClassName: 'CSCHiddenWindow' WindowName: '(null)'
- ClassName: 'SystemTray_Main' WindowName: '(null)'
- ClassName: 'Proxy Desktop' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'SysListView32' WindowName: '(null)'
- ClassName: 'BaseBar' WindowName: 'ChanApp'