Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\ProtectsStore] 'Start' = '00000002'
- '%PROGRAM_FILES%\NetMeeting\smss.exe' -s
- '%PROGRAM_FILES%\NetMeeting\smss.exe'
- '%PROGRAM_FILES%\NetMeeting\smss.exe' -i RtoAutos -n ProtectsStore
- '%PROGRAM_FILES%\NetMeeting\svchost.exe'
- '<SYSTEM32>\cmd.exe' /c ""%PROGRAM_FILES%\NetMeeting\go.bat" "
- %PROGRAM_FILES%\NetMeeting\go.bat
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\coms[1].php
- %PROGRAM_FILES%\NetMeeting\comsin.ini
- %PROGRAM_FILES%\NetMeeting\svchost.exe
- %PROGRAM_FILES%\NetMeeting\smss.ini
- %PROGRAM_FILES%\NetMeeting\smss.exe
- 'pr.##bot.com':80
- 'localhost':1038
- pr.##bot.com/ppx/coms.php
- DNS ASK pr.##bot.com
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'