Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'svhost' = '%APPDATA%\svhost\svhost.exe'
- %APPDATA%\svhost\svhost.exe
- <SYSTEM32>\winlogon.exe
- <SYSTEM32>\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "svhost" /t REG_SZ /d "%APPDATA%\svhost\svhost.exe" /f
- <SYSTEM32>\cmd.exe /c """%TEMP%\SonNl.bat"" "
- %WINDIR%32.exe
- %APPDATA%\svhost\svhost.exe
- %TEMP%\SonNl.bat
- %WINDIR%32.exe
- %APPDATA%\svhost\svhost.exe
- %TEMP%\SonNl.bat
- 'qq.########.cpanel.tech-leaderhost.ru':80
- 'www.my#p.ru':80
- www.my#p.ru/get_ip.php?lo##
- qq.########.cpanel.tech-leaderhost.ru/user2/index.php
- DNS ASK qq.########.cpanel.tech-leaderhost.ru
- DNS ASK www.my#p.ru
- ClassName: '' WindowName: '????????? ????? Windows'
- ClassName: '' WindowName: '????????? ???????'
- ClassName: '' WindowName: '??? ?????????'
- ClassName: '' WindowName: '?????? ?????????'
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
- ClassName: '' WindowName: '???????? ???????'
- ClassName: 'Progman' WindowName: ''