Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] 'RealtekUpdate' = '"%HOMEPATH%\tmps\svchost.exe"'
- '%HOMEPATH%\tmps\svchost.exe'
- '%TEMP%\RarSFX0\svchost.exe'
- %HOMEPATH%\tmps\ACLEDIT.DLL
- %HOMEPATH%\tmps\EFa498b.log
- %HOMEPATH%\tmps\svchost.exe
- %TEMP%\RarSFX0\svchost.exe
- %TEMP%\RarSFX0\ACLEDIT.DLL
- %HOMEPATH%\tmps\EFa498b.log
- %TEMP%\RarSFX0\svchost.exe
- %TEMP%\RarSFX0\ACLEDIT.DLL
- 'www.ar#####newspress.com':443
- 'localhost':1037
- DNS ASK www.ar#####newspress.com
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''