Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'winupdate' = '%WINDIR%\svchost.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%WINDIR%\svchost.exe' = '%WINDIR%\svchost.exe:*:Enabled:svchost'
- <SYSTEM32>\netsh.exe firewall add allowedprogram "%WINDIR%\svchost.exe" svchost ENABLE
- <SYSTEM32>\reg.exe add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v winupdate /t REG_SZ /d "%WINDIR%\svchost.exe" /f
- <SYSTEM32>\cmd.exe /c ""%WINDIR%\copy.bat" "
- %WINDIR%\svclog.txt
- %WINDIR%\svchost.exe
- %WINDIR%\copy.bat
- ClassName: 'Shell_TrayWnd' WindowName: ''