Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\cc622a8f26c2f76f] 'ImagePath' = '<DRIVERS>\cc622a8f26c2f76f.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\cc622a8f26c2f76f] 'Start' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\syshost32] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\21d52] 'Start' = '00000001'
- %WINDIR%\Installer\{A41672AB-06E3-D54E-4570-7BA42500FB60}\syshost.exe /service
- <SYSTEM32>\services.exe
- <SYSTEM32>\lsass.exe
- <SYSTEM32>\svchost.exe
- <SYSTEM32>\winlogon.exe
- System
- <SYSTEM32>\smss.exe
- <SYSTEM32>\csrss.exe
- %WINDIR%\pchealth\ERRORREP\UserDumps\csrss.exe.20120627-194448-00.mdmp
- %WINDIR%\pchealth\ERRORREP\UserDumps\csrss.exe.20120627-194448-00.hdmp
- <DRIVERS>\cc622a8f26c2f76f.sys
- %WINDIR%\Installer\{A41672AB-06E3-D54E-4570-7BA42500FB60}\syshost.exe
- <DRIVERS>\21d52.sys
- <DRIVERS>\21d52.sys
- из <Полный путь к вирусу> в %TEMP%\d294b537.tmp