Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\test12reg] 'Startup' = 'test12reg'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\test12reg] 'DllName' = '%ALLUSERSPROFILE%\Documents\Settings\test12.dll'
- <SYSTEM32>\winlogon.exe
- %WINDIR%\Temp\tesE769.tmp
- %TEMP%\tes1F46.tmp
- %ALLUSERSPROFILE%\Documents\Settings\test12.dll
- 'localhost':80
- localhost/uragan_admin/work.php?df####################
- DNS ASK microsoft.com