Техническая информация
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'run' = '<DRIVERS>\csrss.exe'
- <DRIVERS>\csrss.exe
- <SYSTEM32>\net1.exe localgroup users HelpServiceGroup /delete
- <SYSTEM32>\net1.exe user HelpServiceGroup /expires:never /passwordchg:no
- <SYSTEM32>\net1.exe user HelpServiceGroup hacker /add
- <SYSTEM32>\net1.exe localgroup %USERNAME%s HelpServiceGroup /add
- [<HKCU>\Software\yahoo\pager]
- <DRIVERS>\csrss.exe