Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Windows32' = '%WINDIR%\system\system.exe'
- [<HKLM>\SYSTEM\ControlSet001\Control\Session Manager] 'BootExecute' = 'autocheck autochk *'
- [<HKLM>\SYSTEM\ControlSet002\Control\Session Manager] 'BootExecute' = 'autocheck autochk *'
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram %WINDIR%\system\system.exe RPCCC
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet002\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f
- '<SYSTEM32>\sc.exe' delete GbpSv
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f
- <SYSTEM32>\autoconvv.RRI
- '<L###LNET>.0.2':80
- 'th##js.net':80
- http://th##js.net/porkitolaco/carder.txt
- http://MZ� via <L###LNET>.0.2
- DNS ASK th##js.net
- ClassName: 'NDDEAgnt' WindowName: 'NetDDE Agent'