Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] 'kernel_srv' = '{98A4EAA2-EF17-474A-9389-FA92A29B0B9D}'
- %WINDIR%\httpmap.sys
- %WINDIR%\serv32.dll
- %WINDIR%\kernel32.exe
- 'lo####me.phpnet.us':80
- lo####me.phpnet.us/ex.php?cm###
- lo####me.phpnet.us/cmd.php
- DNS ASK lo####me.phpnet.us
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'