Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'yown' = '<SYSTEM32>\yown.exe \u'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%HOMEPATH%\uudb.exe \s'
- <SYSTEM32>\yown.exe \d
- <SYSTEM32>\ping.exe 0.0.0.0
- <SYSTEM32>\cmd.exe /c """%TEMP%\removeMe3242.bat"" "
- %TEMP%\removeMe3242.bat
- <SYSTEM32>\yown.exe
- %HOMEPATH%\uudb.exe
- %HOMEPATH%\uudb.exe