Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Java update' = '"%APPDATA%\svchost.exe" ..'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Java update' = '"%APPDATA%\svchost.exe" ..'
- %HOMEPATH%\Start Menu\Programs\Startup\svchost.exe
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%APPDATA%\svchost.exe' = '%APPDATA%\svchost.exe:*:Enabled:svchost.exe'
- '%APPDATA%\svchost.exe'
- '<SYSTEM32>\attrib.exe' +H +S "%APPDATA%\svchost.exe"
- '<SYSTEM32>\attrib.exe' +H +S "%APPDATA%\xse1rgxF\svchost.exe"
- '<SYSTEM32>\attrib.exe' +H +S "%HOMEPATH%\Start Menu\Programs\Startup\svchost.exe"
- '%APPDATA%\svchost.exe'
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%APPDATA%\svchost.exe" "svchost.exe" ENABLE
- '<SYSTEM32>\schtasks.exe' /Create /SC minute /MO 1 /TN "Adobe" /TR "%APPDATA%\xse1rgxF\svchost.exe .." /F
- %APPDATA%\xse1rgxF\svchost.exe
- %APPDATA%\svchost.exe
- %HOMEPATH%\Start Menu\Programs\Startup\svchost.exe
- %APPDATA%\svchost.exe
- %APPDATA%\xse1rgxF\svchost.exe
- '92.#.3.121':5445