Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Adobe Flash Update Service' = '%TEMP%\AdobeArm.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Realtime Clock Synchronization' = '%APPDATA%\Microsoft\Windows\Themes\timeserv.exe'
- '<SYSTEM32>\regini.exe' "%ALLUSERSPROFILE%\theme.txt"
- '<SYSTEM32>\reg.exe' add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Realtime Clock Synchronization" /d "%APPDATA%\Microsoft\Windows\Themes\timeserv.exe"
- '<SYSTEM32>\reg.exe' add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Adobe Flash Update Service" /d "%TEMP%\AdobeArm.exe"
- '%TEMP%\EZ Activator.exe'
- '%TEMP%\Office 2010 Toolkit.exe'
- '<SYSTEM32>\cmd.exe' /k cls && echo off && move /y "%APPDATA%\Microsoft\Windows\Themes\theme.txt" "%ALLUSERSPROFILE%\theme.txt" >nul && regini "%ALLUSERSPROFILE%\theme.txt" >nul && reg add HKLM\Software\Microsoft\W...
- %APPDATA%\Microsoft\Windows\Themes\theme.txt
- %APPDATA%\Microsoft\Windows\Themes\Flash_Updt.exe
- %TEMP%\Settings.ini
- %APPDATA%\Microsoft\Windows\Themes\timeserv.exe
- %TEMP%\Office 2010 Toolkit.exe
- %TEMP%\EZ Activator.exe
- %APPDATA%\Microsoft\Windows\Themes\AeroStart.EXE
- %APPDATA%\Microsoft\Windows\Themes\AdobeArm.EXE
- %APPDATA%\Microsoft\Windows\Themes\timeserv.exe
- %APPDATA%\Microsoft\Windows\Themes\theme.txt в %ALLUSERSPROFILE%\theme.txt
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''