Техническая информация
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'Explorer "%HOMEPATH%\SendTo\explore.exe" Set'
- %HOMEPATH%\Start Menu\Programs\Startup\explore.exe
- '%HOMEPATH%\SendTo\explore.exe' Set
- %HOMEPATH%\SendTo\explore.exe
- %TEMP%\~DF195B.tmp
- ClassName: '(null)' WindowName: 'Bermoda Hack Group'
- ClassName: 'WindowClass_0' WindowName: '(null)'
- ClassName: '(null)' WindowName: 'Windows Task Manager'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'