Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\Ghijkl Nopqrstu Wxy] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Ghijkl Nopqrstu Wxy] 'ImagePath' = '%ProgramFiles(x86)%\ArranCPO\Null.jpg'
- %TEMP%\auta772.tmp
- %WINDIR%\arsca.exe
- %ProgramFiles(x86)%\arrancpo\null.jpg
- %TEMP%\auta772.tmp
- %WINDIR%\arsca.exe
- DNS ASK ao##.xyz
- '%WINDIR%\arsca.exe'
- '%ProgramFiles(x86)%\arrancpo\null.jpg'
- '%ProgramFiles(x86)%\arrancpo\null.jpg' Win7