Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,<SYSTEM32>\Microsoft\network.exe,'
- <SYSTEM32>\Microsoft\network.exe
- <SYSTEM32>\reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /t reg_sz /d <SYSTEM32>\userinit.exe,<SYSTEM32>\Microsoft\network.exe, /f
- %WINDIR%\Explorer.EXE
- %HOMEPATH%\Local Settings\Tempnetlog
- %TEMP%\network.dll
- <SYSTEM32>\Microsoft\network.exe
- 'www.ne####k1.myz.info':1863
- 'fu####t.dyndns.info':443
- DNS ASK www.ne####k1.myZ.info
- DNS ASK fu####t.dyndns.info
- '<IP-адрес в локальной сети>':1035
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: '' WindowName: ''