Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,<SYSTEM32>\wininit.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '<SYSTEM32>\wininit.exe' = '<SYSTEM32>\wininit.exe:*:Enabled:WinServices'
- '<SYSTEM32>\wininit.exe' /k <Полный путь к вирусу>
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "<SYSTEM32>\wininit.exe" WinServices Enable
- <SYSTEM32>\wininit.exe
- <SYSTEM32>\wininit.exe
- 'sn######syou.dyndns.info':3178
- DNS ASK sn######syou.dyndns.info
- ClassName: '' WindowName: 'BHH'