Техническая информация
- <SYSTEM32>\attrib.exe +r +h virus.bat
- %WINDIR%\regedit.exe "c:\regstart.reg"
- <SYSTEM32>\attrib.exe +r +h %WINDIR%\startm~1\program\startup\shroom.bat
- <SYSTEM32>\tskill.exe msnmsgr
- <SYSTEM32>\rundll32.exe USER32.DLL,SwapMouseButton
- <SYSTEM32>\attrib.exe +r +h
- <SYSTEM32>\net1.exe stop "Security center"
- <SYSTEM32>\net.exe stop "Security center"
- <SYSTEM32>\cmd.exe /c ""%TEMP%\1.tmp\shroom.bat" "
- <SYSTEM32>\netsh.exe firewall set opmode mode-disable
- <SYSTEM32>\net1.exe stop sharedaccess
- <SYSTEM32>\net.exe stop sharedaccess
- msnmsgr.exe
- %WINDIR%\shroom.bat
- <Текущая директория>\shroom.bat
- %TEMP%\1.tmp\shroom.bat
- C:\regstart.reg
- <Текущая директория>\shroom.bat
- <Полный путь к вирусу>
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''