Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] '1999851' = '{4A6D4E96-7240-4D19-8654-E2F73B19F0E9}'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] '1985103' = '{4A6D4E96-7240-4D19-8654-E2F73B19F0E9}'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] '{4A6D4E96-7240-4D19-8654-E2F73B19F0E9}' = ''
- <SYSTEM32>\cmd.exe /c <SYSTEM32>\Deleteme.bat
- %WINDIR%\Explorer.EXE
- Библиотека-обработчик для всех процессов: <SYSTEM32>\Msenfi470.dll
- <SYSTEM32>\Deleteme.bat
- <SYSTEM32>\Msenfi470.dll
- <SYSTEM32>\Msenfi470.dll
- ClassName: 'Rejoice_3.2' WindowName: 'Windows IDE'