Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Protocol' = 'SADS:\Boot.ini'
- [<HKLM>\SOFTWARE\Classes\SADS\shell\open\command] '' = 'Rundll32 shell32.dll,ShellExec_RunDLLA "%CommonProgramFiles%\System\svcore.exe"'
- %CommonProgramFiles%\System\svcore.exe
- <SYSTEM32>\ping.exe 127.1 -n 1
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\shell[1].asp
- %CommonProgramFiles%\System\svcore.exe
- 'ad.##tshell.cc':80
- ad.##tshell.cc/config/shell.asp
- DNS ASK ad.##tshell.cc