Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\byXNgddB] 'Logon' = 'o'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\byXNgddB] 'DllName' = 'byXNgddB.dll'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] '{7BEEF273-942D-47E7-8A30-0955B149FC30}' = ''
- <SYSTEM32>\cmd.exe /c %TEMP%\removalfile.bat "<Полный путь к вирусу>"
- <SYSTEM32>\winlogon.exe
- %TEMP%\removalfile.bat
- <SYSTEM32>\byXNgddB.dll