c:\WINDOWS\inf\1010\services.exe Size: 627,259 bytes
c:\WINDOWS\system32\dd.dll Size: 810 bytes
c:\WINDOWS\system32\ultravnc.ini Size: 683 bytes
Для автоматического запуска создаются следующие ключи реестра:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Services"
Data: C:\WINDOWS\inf\1010\services.exe
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile "DisableNotifications"
Data: 01, 00, 00, 00
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile "DoNotAllowExceptions"
Data: 00, 00, 00, 00
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile "DisableNotifications"
Data: 01, 00, 00, 00
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile "DoNotAllowExceptions"
Data: 00, 00, 00, 00