Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\HostSvc] 'ImagePath' = '%WINDIR%\svchost.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\HostSvc] 'Start' = '00000002'
- '<SYSTEM32>\sc.exe' delete HostSvc
- '<SYSTEM32>\taskkill.exe' /IM Installer.exe /f
- '<SYSTEM32>\sc.exe' create HostSvc binpath= %WINDIR%\svchost.exe type= share start= auto displayname= "Service Host Provider"
- '<SYSTEM32>\cmd.exe' /c start create
- '<SYSTEM32>\cmd.exe' /K create
- '<SYSTEM32>\sc.exe' stop HostSvc
- %WINDIR%\svchost.exe
- <Текущая директория>\create.bat
- <Текущая директория>\svchost.exe
- '19#.#8.90.143':80
- http://19#.#8.90.143/scanserver/report_install.php
- ClassName: '' WindowName: ''