Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'nntamo' = '<SYSTEM32>\nntamo.exe \u'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%HOMEPATH%\gmk.exe \s'
- <SYSTEM32>\nntamo.exe \d
- <SYSTEM32>\ping.exe 0.0.0.0
- <SYSTEM32>\cmd.exe /c ""%TEMP%\removeMe2726.bat" "
- %TEMP%\removeMe2726.bat
- <SYSTEM32>\nntamo.exe
- %HOMEPATH%\gmk.exe
- %HOMEPATH%\gmk.exe