Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'svhost' = '%WINDIR%\svhost\svhost.exe'
- %WINDIR%\svhost\svhost.exe
- <SYSTEM32>\svchost.exe
- <SYSTEM32>\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "svhost" /t REG_SZ /d "%WINDIR%\svhost\svhost.exe" /f
- <SYSTEM32>\cmd.exe /c """%TEMP%\kHXdG.bat"" "
- %WINDIR%\svhost\svhost.exe
- %TEMP%\kHXdG.bat
- %WINDIR%\svhost\svhost.exe
- 'mo###dreams.ru':80
- 'www.my#p.ru':80
- www.my#p.ru/get_ip.php?lo##
- mo###dreams.ru/user3/index.php
- DNS ASK mo###dreams.ru
- DNS ASK www.my#p.ru
- ClassName: '' WindowName: '????????? ????? Windows'
- ClassName: '' WindowName: '????????? ???????'
- ClassName: '' WindowName: '??? ?????????'
- ClassName: '' WindowName: '?????? ?????????'
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
- ClassName: '' WindowName: '???????? ???????'
- ClassName: 'Progman' WindowName: ''