Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = 'Explorer.exe, %CommonProgramFiles%\Recovery\svhost.exe'
- '<SYSTEM32>\cmd.exe' /c attrib +h "%CommonProgramFiles%\Recovery"
- '<SYSTEM32>\reg.exe' add "hkey_local_machine\software\microsoft\windows nt\currentversion\winlogon " /v shell /t reg_sz /d "Explorer.exe, %CommonProgramFiles%\Recovery\svhost.exe" /f
- '<SYSTEM32>\attrib.exe' +h "%CommonProgramFiles%\Recovery"
- '<SYSTEM32>\attrib.exe' +h "%CommonProgramFiles%\Recovery\svhost.exe"
- '<SYSTEM32>\cmd.exe' /c attrib +h "%CommonProgramFiles%\Recovery\svhost.exe"
- '<SYSTEM32>\cmd.exe' /c reg add "hkey_local_machine\software\microsoft\windows nt\currentversion\winlogon" /v shell /t reg_sz /d "Explorer.exe, %CommonProgramFiles%\Recovery\svhost.exe" /f
- '<SYSTEM32>\cmd.exe' /c move /y "<Полный путь к вирусу>" "%CommonProgramFiles%\Recovery\svhost.exe"
- '<SYSTEM32>\reg.exe' add "hkey_local_machine\software\microsoft\windows nt\currentversion\winlogon" /v shell /t reg_sz /d "Explorer.exe, %CommonProgramFiles%\Recovery\svhost.exe" /f
- '<SYSTEM32>\cmd.exe' /c reg add "hkey_local_machine\software\microsoft\windows nt\currentversion\winlogon " /v shell /t reg_sz /d "Explorer.exe, %CommonProgramFiles%\Recovery\svhost.exe" /f
- из <Полный путь к вирусу> в %CommonProgramFiles%\Recovery\svhost.exe