Вход
Регистрация
Публикации
Мужчина
Выдержка касательно вашей "службы":
An interesting change the worm makes to the registry involves the following registry entries:
* HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\
DisplayName = %ServiceName%
Type = dword:00000020
Start = dword:00000002
ErrorControl = dword:00000000
ImagePath = "%SystemRoot%\system32\svchost.exe -k netsvcs"
ObjectName = "LocalSystem"
Description = %description%
* HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\[random]\Parameters
ServiceDll = %MalwarePath%
In these entries, %ServiceName% represents a two word combination taken from the following list:
* Boot
* Center
* Config
* Driver
* Helper
* Image
* Installer
* Manager
* Microsoft
* Monitor
* Network
* Security
* Server
* Shell
* Support
* System
* Task
* Time
* Universal
* Update
* Windows
p.s. У моего знакомого вирус сидел под именем "Universal Monitor"
