Trojan.MulDrop11.19195

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\sce46195.tmp
%TEMP%\nsf{nsf_tm}_sec.log
%TEMP%\nsf{nsf_tm}_domainrole.txt
%TEMP%\nsf{nsf_tm}_wmiav.vbs
%TEMP%\nsf{nsf_tm}_nameav.vbs
%TEMP%\nsf{nsf_tm}_processav.bat
%TEMP%\nsf{nsf_tm}_sharecheck.vbs
%TEMP%\nsf{nsf_tm}_checkfirewall.vbs
%TEMP%\nsf{nsf_tm}_fscheck.vbs
%TEMP%\nsf{nsf_tm}_morelines.vbs

Удаляет следующие файлы

%TEMP%\sce46195.tmp

Другое

Создает и запускает на исполнение

'<SYSTEM32>\cscript.exe' %TEMP%\NSF{nsf_tm}_checkfirewall.vbs //Nologo
'<SYSTEM32>\cscript.exe' %TEMP%\NSF{nsf_tm}_sharecheck.vbs //Nologo
'<SYSTEM32>\cscript.exe' %TEMP%\NSF{nsf_tm}_nameav.vbs //Nologo
'<SYSTEM32>\cscript.exe' %TEMP%\NSF{nsf_tm}_wmiav.vbs //Nologo
'<SYSTEM32>\cscript.exe' %TEMP%\NSF{nsf_tm}_fscheck.vbs //Nologo
'<SYSTEM32>\cmd.exe' /c echo Else>>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo Wscript.Echo "NoFirewallWindows">>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo End If>>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo Else>>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo On Error Resume Next>>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo On Error Goto ^0>>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo ErrNum = Err.Number>>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo End If>>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo If 0 ^<^> ErrNum Then>>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo Wscript.Echo "Enabled">>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo On Error Resume Next>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo set objPolicy = objFirewall.LocalPolicy.CurrentProfile>>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo Wscript.Echo "Disabled">>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo Wscript.Echo "Enabled">>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo Next >> %TEMP%\NSF{nsf_tm}_sharecheck.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo If InStr(FwSvcOut, "Running") Then>>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo If InStr(FwSvcOut, "State") Then>>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo FwSvcOut = FwSvcExec.StdOut.ReadAll>>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo FwSvcExec.StdIn.Close>>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo set FwSvcExec = ws.Exec("wmic service where name=""SharedAccess"" get state")>>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo set ws = CreateObject("WScript.Shell")>>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo If 0 ^<^> ErrNum Then>>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo On Error Goto ^0>>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo ErrNum = Err.Number>>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo set objFirewall = CreateObject("HNetCfg.FwMgr")>>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo If True = objPolicy.FirewallEnabled Then>>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo Else>>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo End If>>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo Set objWMIService = GetObject("winmgmts:\\.\root\CIMV2")>>%TEMP%\NSF{nsf_tm}_fscheck.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo objFile.Close()>>%TEMP%\NSF{nsf_tm}_morelines.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo loop>>%TEMP%\NSF{nsf_tm}_morelines.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo end if>>%TEMP%\NSF{nsf_tm}_morelines.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo Wscript.Echo Line>>%TEMP%\NSF{nsf_tm}_morelines.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo EchoNumber = EchoNumber + ^1>>%TEMP%\NSF{nsf_tm}_morelines.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo if Trim(Line) ^<^> "" and EchoNumber ^< MoreNumber then>>%TEMP%\NSF{nsf_tm}_morelines.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo Line = objFile.ReadLine()>>%TEMP%\NSF{nsf_tm}_morelines.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo do while objFile.AtEndOfStream ^<^> True>>%TEMP%\NSF{nsf_tm}_morelines.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo EchoNumber = ^0>>%TEMP%\NSF{nsf_tm}_morelines.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo set objFile = objFSO.OpenTextFile(FileName, 1)>>%TEMP%\NSF{nsf_tm}_morelines.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo set objFSO = CreateObject("Scripting.FileSystemObject")>>%TEMP%\NSF{nsf_tm}_morelines.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo MoreNumber = CInt(Wscript.arguments(1))>>%TEMP%\NSF{nsf_tm}_morelines.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo ResultStr = "">%TEMP%\NSF{nsf_tm}_fscheck.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo FileName = Wscript.arguments(0)>%TEMP%\NSF{nsf_tm}_morelines.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo Wscript.Echo(Right(ResultStr, Len(ResultStr) - 1))>>%TEMP%\NSF{nsf_tm}_fscheck.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo Else>>%TEMP%\NSF{nsf_tm}_fscheck.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo Wscript.Echo("AllNTFS")>>%TEMP%\NSF{nsf_tm}_fscheck.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo If 0 = Len(ResultStr) Then>>%TEMP%\NSF{nsf_tm}_fscheck.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo Next>>%TEMP%\NSF{nsf_tm}_fscheck.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo End If>>%TEMP%\NSF{nsf_tm}_fscheck.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo End If>>%TEMP%\NSF{nsf_tm}_fscheck.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo ResultStr = ResultStr + "," + objItem.Name + "=" + objItem.FileSystem>>%TEMP%\NSF{nsf_tm}_fscheck.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo If 0 = InStr(objItem.FileSystem, "NTFS") Then>>%TEMP%\NSF{nsf_tm}_fscheck.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo If (3 = objItem.DriveType) and (0 ^<^> Len(objItem.FileSystem)) Then>>%TEMP%\NSF{nsf_tm}_fscheck.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo For Each objItem in colItems>>%TEMP%\NSF{nsf_tm}_fscheck.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo Set colItems = objWMIService.ExecQuery("SELECT * FROM Win32_LogicalDisk",,48)>>%TEMP%\NSF{nsf_tm}_fscheck.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo End If>>%TEMP%\NSF{nsf_tm}_fscheck.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo End if >> %TEMP%\NSF{nsf_tm}_nameav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo End If >> %TEMP%\NSF{nsf_tm}_sharecheck.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo Exit For >> %TEMP%\NSF{nsf_tm}_sharecheck.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo For Each strkeyPath In arrKeyPath >> %TEMP%\NSF{nsf_tm}_nameav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo If InStr(objItem.Trustee, "S-1-1-0") Then >> %TEMP%\NSF{nsf_tm}_sharecheck.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo End If >> %TEMP%\NSF{nsf_tm}_wmiav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo Next >> %TEMP%\NSF{nsf_tm}_wmiav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo End If >> %TEMP%\NSF{nsf_tm}_wmiav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo Wscript.Echo "nsfocusyes" >> %TEMP%\NSF{nsf_tm}_wmiav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo Wscript.Echo objItem.DisplayName >> %TEMP%\NSF{nsf_tm}_wmiav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo If Not IsNull(objItem.DisplayName) Then >> %TEMP%\NSF{nsf_tm}_wmiav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo For Each objItem in colItemsSC >> %TEMP%\NSF{nsf_tm}_wmiav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo Set colItemsSC = objWMIServiceSC.ExecQuery("SELECT * FROM AntiVirusProduct",,48) >> %TEMP%\NSF{nsf_tm}_wmiav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo If Err.Number = 0 Then >> %TEMP%\NSF{nsf_tm}_wmiav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo Set objWMIServiceSC = GetObject(SCNameSpace) >> %TEMP%\NSF{nsf_tm}_wmiav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo On Error Resume Next >> %TEMP%\NSF{nsf_tm}_wmiav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo Set objReg = GetObject("winmgmts:\\.\root\default:StdRegProv") >> %TEMP%\NSF{nsf_tm}_nameav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo Exit For >> %TEMP%\NSF{nsf_tm}_wmiav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo Next >> %TEMP%\NSF{nsf_tm}_wmiav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo For Each objItem in colItemsOS >> %TEMP%\NSF{nsf_tm}_wmiav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo const HKEY_LOCAL_MACHINE = ^&H80000002 >> %TEMP%\NSF{nsf_tm}_nameav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c wmic computersystem get domainrole | find /i /v "domainrole" > %TEMP%\NSF{nsf_tm}_domainrole.txt' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo SCNameSpace = "" > %TEMP%\NSF{nsf_tm}_wmiav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo SCNameSpace = "winmgmts:\\.\root\SecurityCenter2" >> %TEMP%\NSF{nsf_tm}_wmiav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo Set colItemsOS = objWMIServiceOS.ExecQuery("SELECT * FROM Win32_OperatingSystem",,48) >> %TEMP%\NSF{nsf_tm}_wmiav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo Set objWMIServiceOS = GetObject("winmgmts:\\.\root\CIMV2") >> %TEMP%\NSF{nsf_tm}_wmiav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo FirstNumber = Left(objItem.Version, 1) >> %TEMP%\NSF{nsf_tm}_wmiav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo SecondNumber = Mid(objItem.Version, 2, 1) >> %TEMP%\NSF{nsf_tm}_wmiav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo If FirstNumber ^<= "5" And SecondNumber = "." Then >> %TEMP%\NSF{nsf_tm}_wmiav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo SCNameSpace = "winmgmts:\\.\root\SecurityCenter" >> %TEMP%\NSF{nsf_tm}_wmiav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo ElseIf SecondNumber ^<^> "." Then>> %TEMP%\NSF{nsf_tm}_wmiav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo End If >> %TEMP%\NSF{nsf_tm}_wmiav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo arrKeyPath = Array("SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall", "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall") >> %TEMP%\NSF{nsf_tm}_nameav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo Set colItems = objWMIService.ExecQuery("SELECT * FROM Win32_LogicalShareAccess",,48) >> %TEMP%\NSF{nsf_tm}_sharecheck.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo For Each objItem in colItems >> %TEMP%\NSF{nsf_tm}_sharecheck.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo allKeys = Split("В°ВІГ€В«ВІВїВ¶Г“,Г‰В±В¶Вѕ,В·ВґВІВЎВ¶Вѕ,В·ГЂВІВЎВ¶Вѕ,virus,Spyware,Symantec Endpoint Protection,ВµГ§Г„Г”В№ГњВјГ’",",") > %TEMP%\NSF{nsf_tm}_nameav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo Set objWMIService = GetObject("winmgmts:\\.\root\CIMV2") > %TEMP%\NSF{nsf_tm}_sharecheck.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c (echo wmic process where "name='360tray.exe' or name='ZhuDongFangYu.exe' or name = 'ds_agent' or name = 'ds_notifier' or name = 'QQPCTray.exe'" get name >> %TEMP%\NSF{nsf_tm}_processav.bat)' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c (echo wmic process where "name = 'spidernt.exe' or name = 'spiderml.exe' or name = 'drwebscd.exe' or name = 'spider.exe' or name = 'nod32kui.exe' or name = 'nod32krn.exe' or name = 'MPSVC.ex...' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c (echo wmic process where "name = 'Vstskmgr.exe' or name = 'Mcshield.exe' or name = 'Frameworkservice.exe' or name = 'naPrdMgr.exe' or name = 'mcafee.exe' or name = 'xcommsvr.exe' or name = '...' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c (echo wmic process where "name = 'ccSetMgr.exe' or name = 'defwatch.exe' or name = 'ISSVC.exe' or name = 'SPBBCSvc.exe' or name = 'SNDSrvc.exe' or name = 'KPFWSvc.exe' or name = 'KAVStart.ex...' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c (echo wmic process where "name = 'kvwsc.exe' or name = 'kvmonxp.exe' or name = 'ashserv.exe' or name = 'aswupdsv.exe' or name = 'ashdisp.exe' or name = 'ashwebsv.exe' or name = 'UpdaterUI.ex...' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo @echo off > %TEMP%\NSF{nsf_tm}_processav.bat' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo Exit For >> %TEMP%\NSF{nsf_tm}_nameav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo WScript.Echo "nsfocusyes" >> %TEMP%\NSF{nsf_tm}_nameav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo If InStr(allSoftNames, allKeys(i)) Then >> %TEMP%\NSF{nsf_tm}_nameav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo For i = 0 To UBound(allKeys) >> %TEMP%\NSF{nsf_tm}_nameav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo Wscript.Echo "Everyone" >> %TEMP%\NSF{nsf_tm}_sharecheck.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo Next >> %TEMP%\NSF{nsf_tm}_nameav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo Next >> %TEMP%\NSF{nsf_tm}_nameav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo End If >> %TEMP%\NSF{nsf_tm}_nameav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo End If >> %TEMP%\NSF{nsf_tm}_nameav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo allSoftNames = allSoftNames + sValue_Name + "," >> %TEMP%\NSF{nsf_tm}_nameav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo If not IsNull(sValue_Name) and IsNull(sValue_PDName) and IsNull(sValue_PKName) Then >> %TEMP%\NSF{nsf_tm}_nameav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo objReg.GetStringValue HKEY_LOCAL_MACHINE, strKeyPath + "\" + subkey, "ParentKeyName", sValue_PKName >> %TEMP%\NSF{nsf_tm}_nameav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo objReg.GetStringValue HKEY_LOCAL_MACHINE, strKeyPath + "\" + subkey, "ParentDisplayName", sValue_PDName >> %TEMP%\NSF{nsf_tm}_nameav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo objReg.GetStringValue HKEY_LOCAL_MACHINE, strKeyPath + "\" + subkey, "DisplayName", sValue_Name >> %TEMP%\NSF{nsf_tm}_nameav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo If IsNull(dwValue) or 0 = dwValue Then >> %TEMP%\NSF{nsf_tm}_nameav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath + "\" + subkey, "SystemComponent", dwValue >> %TEMP%\NSF{nsf_tm}_nameav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo For Each subkey In arrSubKeys >> %TEMP%\NSF{nsf_tm}_nameav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo If not IsNull(arrSubKeys) Then >> %TEMP%\NSF{nsf_tm}_nameav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo objReg.EnumKey HKEY_LOCAL_MACHINE, strKeyPath, arrSubKeys >> %TEMP%\NSF{nsf_tm}_nameav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo allSoftNames = "" >> %TEMP%\NSF{nsf_tm}_nameav.vbs' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c secedit /export /cfg %TEMP%\NSF{nsf_tm}_sec.log' (со скрытым окном)

Запускает на исполнение

'<SYSTEM32>\cmd.exe' /c secedit /export /cfg %TEMP%\NSF{nsf_tm}_sec.log
'<SYSTEM32>\cmd.exe' /c (type %TEMP%\NSF{nsf_tm}_domainrole.txt | findstr "1 3 4 5" && echo 100) || (cmd /c wmic useraccount where "Disabled=FALSE and Domain='xjypmm'" get name | find /i /v "name" | findstr /n . | ...
'<SYSTEM32>\wbem\wmic.exe' group where Domain="xjypmm" get name,sid
'<SYSTEM32>\find.exe' /c ":"
'<SYSTEM32>\findstr.exe' /n .
'<SYSTEM32>\find.exe' /i /v "name"
'<SYSTEM32>\find.exe' /i /v "S-1-5-32-"
'<SYSTEM32>\cmd.exe' /c wmic group where Domain="xjypmm" get name,sid
'<SYSTEM32>\cmd.exe' /c wmic useraccount where "Disabled=FALSE and Domain='xjypmm'" get name
'<SYSTEM32>\findstr.exe' "1 3 4 5"
'<SYSTEM32>\find.exe' /i "LockoutDuration"
'<SYSTEM32>\cmd.exe' /c type %TEMP%\NSF{nsf_tm}_sec.log | find /i "LockoutDuration" || echo LockoutDuration = not config
'<SYSTEM32>\find.exe' /i "PasswordHistorySize"
'<SYSTEM32>\cmd.exe' /c type %TEMP%\NSF{nsf_tm}_sec.log | find /i "PasswordHistorySize" || echo PasswordHistorySize = not config
'<SYSTEM32>\find.exe' /i "MaximumPasswordAge"
'<SYSTEM32>\cmd.exe' /c type %TEMP%\NSF{nsf_tm}_sec.log | find /i "MaximumPasswordAge" || echo MaximumPasswordAge = not config
'<SYSTEM32>\find.exe' /i "NewAdministratorName"
'<SYSTEM32>\cmd.exe' /c (type %TEMP%\NSF{nsf_tm}_domainrole.txt | findstr "1 3 4 5" && echo 100) || (cmd /c wmic group where Domain="xjypmm" get name,sid | find /i /v "S-1-5-32-" | find /i /v "name" | findstr /n . ...
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System" /v MaxSize
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System" /v Retention
'<SYSTEM32>\find.exe' /i "MinimumPasswordAge"
'<SYSTEM32>\cmd.exe' /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System" /v Retention || echo Retention notfound not config
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber
'<SYSTEM32>\cmd.exe' /c reg query "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber || echo PortNumber notfound not config
'<SYSTEM32>\cmd.exe' /c cscript %TEMP%\NSF{nsf_tm}_checkfirewall.vbs //Nologo
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application" /v MaxSize
'<SYSTEM32>\cmd.exe' /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application" /v MaxSize || echo MaxSize notfound not config
'<SYSTEM32>\find.exe' /i "AuditProcessTracking"
'<SYSTEM32>\cmd.exe' /c type %TEMP%\NSF{nsf_tm}_sec.log | find /i "NewAdministratorName" || echo NewAdministratorName = not config
'<SYSTEM32>\cmd.exe' /c type %TEMP%\NSF{nsf_tm}_sec.log | find /i "AuditProcessTracking" || echo AuditProcessTracking = not config
'<SYSTEM32>\cmd.exe' /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System" /v MaxSize || echo MaxSize notfound not config
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application" /v Retention
'<SYSTEM32>\cmd.exe' /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application" /v Retention || echo Retention notfound not config
'<SYSTEM32>\reg.exe' query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /v TcpMaxConnectResponseRetransmissions
'<SYSTEM32>\cmd.exe' /c reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /v TcpMaxConnectResponseRetransmissions || echo TcpMaxConnectResponseRetransmissions notfound not config
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v TcpMaxPortsExhausted
'<SYSTEM32>\cmd.exe' /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v TcpMaxPortsExhausted || echo TcpMaxPortsExhausted notfound not config
'<SYSTEM32>\wbem\wmic.exe' useraccount where "Disabled=FALSE and Domain='xjypmm'" get name
'<SYSTEM32>\cmd.exe' /c type %TEMP%\NSF{nsf_tm}_sec.log | find /i "MinimumPasswordAge" || echo MinimumPasswordAge = not config
'<SYSTEM32>\find.exe' /i "EnableGuestAccount"
'<SYSTEM32>\cmd.exe' /c (cscript %TEMP%\NSF{nsf_tm}_wmiav.vbs //Nologo | find "nsfocusyes") || (cscript %TEMP%\NSF{nsf_tm}_nameav.vbs //Nologo | find "nsfocusyes") || (%TEMP%\NSF{nsf_tm}_processav.bat | find /i "....
'<SYSTEM32>\find.exe' "$"
'<SYSTEM32>\net.exe' share /n
'<SYSTEM32>\findstr.exe' "0 2"
'<SYSTEM32>\cmd.exe' /c type %TEMP%\NSF{nsf_tm}_domainrole.txt | findstr "0 2" && net share /n | find "$"
'<SYSTEM32>\wbem\wmic.exe' os get DataExecutionPrevention_SupportPolicy
'<SYSTEM32>\find.exe' /i /v "DataExecutionPrevention_SupportPolicy"
'<SYSTEM32>\cmd.exe' /S /D /c" ( wmic os get DataExecutionPrevention_SupportPolicy || echo NoDEPWindows )"
'<SYSTEM32>\net1.exe' share /n
'<SYSTEM32>\cmd.exe' /c (wmic os get DataExecutionPrevention_SupportPolicy || echo NoDEPWindows) | find /i /v "DataExecutionPrevention_SupportPolicy"
'<SYSTEM32>\cmd.exe' /c reg query HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system /v DisableCAD || echo DisableCAD notfound not config
'<SYSTEM32>\cmd.exe' /c (type %TEMP%\NSF{nsf_tm}_domainrole.txt | findstr "0 2 4 5" && echo CachedLogonsCount notfound 0) || (reg query "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v ...
'<SYSTEM32>\reg.exe' query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters /v enableforcedlogoff
'<SYSTEM32>\cmd.exe' /c reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters /v enableforcedlogoff || echo enableforcedlogoff notfound not config
'<SYSTEM32>\reg.exe' query "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaverIsSecure
'<SYSTEM32>\cmd.exe' /c reg query "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaverIsSecure || echo ScreenSaverIsSecure notfound not config
'<SYSTEM32>\reg.exe' query "HKEY_CURRENT_USER\Control Panel\Desktop" /v SCRNSAVE.EXE
'<SYSTEM32>\reg.exe' query HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system /v DisableCAD
'<SYSTEM32>\cmd.exe' /c type %TEMP%\NSF{nsf_tm}_sec.log | find /i "PasswordComplexity" || echo PasswordComplexity = not config
'<SYSTEM32>\find.exe' /i "ResetLockoutCount"
'<SYSTEM32>\find.exe' "nsfocusyes"
'<SYSTEM32>\cmd.exe' /c type %TEMP%\NSF{nsf_tm}_sec.log | find /i "ResetLockoutCount" || echo ResetLockoutCount = not config
'<SYSTEM32>\find.exe' /i "LockoutBadCount"
'<SYSTEM32>\cmd.exe' /c type %TEMP%\NSF{nsf_tm}_sec.log | find /i "LockoutBadCount" || echo LockoutBadCount = not config
'<SYSTEM32>\cmd.exe' /c (type %TEMP%\NSF{nsf_tm}_domainrole.txt | findstr "0 2 4 5" && echo RequireStrongKey REG_DWORD NotDomainMember) || (reg query HKEY_LOCAL_MACHINE\system\currentcontrolset\services\netlogon\pa...
'<SYSTEM32>\find.exe' /i "MinimumPasswordLength"
'<SYSTEM32>\cmd.exe' /c type %TEMP%\NSF{nsf_tm}_sec.log | find /i "MinimumPasswordLength" || echo MinimumPasswordLength = not config
'<SYSTEM32>\find.exe' /i "PasswordComplexity"
'<SYSTEM32>\cmd.exe' /c type %TEMP%\NSF{nsf_tm}_sec.log | find /i "EnableGuestAccount" || echo EnableGuestAccount = not config
'<SYSTEM32>\cmd.exe' /S /D /c" type %TEMP%\NSF{nsf_tm}_sec.log "
'<SYSTEM32>\wbem\wmic.exe' process where "name='360tray.exe' or name='ZhuDongFangYu.exe' or name = 'ds_agent' or name = 'ds_notifier' or name = 'QQPCTray.exe'" get name
'<SYSTEM32>\wbem\wmic.exe' process where "name = 'spidernt.exe' or name = 'spiderml.exe' or name = 'drwebscd.exe' or name = 'spider.exe' or name = 'nod32kui.exe' or name = 'nod32krn.exe' or name = 'MPSVC.exe' or name = '...
'<SYSTEM32>\wbem\wmic.exe' process where "name = 'Vstskmgr.exe' or name = 'Mcshield.exe' or name = 'Frameworkservice.exe' or name = 'naPrdMgr.exe' or name = 'mcafee.exe' or name = 'xcommsvr.exe' or name = 'bdss.exe' or n...
'<SYSTEM32>\wbem\wmic.exe' process where "name = 'ccSetMgr.exe' or name = 'defwatch.exe' or name = 'ISSVC.exe' or name = 'SPBBCSvc.exe' or name = 'SNDSrvc.exe' or name = 'KPFWSvc.exe' or name = 'KAVStart.exe' or name = '...
'<SYSTEM32>\wbem\wmic.exe' process where "name = 'kvwsc.exe' or name = 'kvmonxp.exe' or name = 'ashserv.exe' or name = 'aswupdsv.exe' or name = 'ashdisp.exe' or name = 'ashwebsv.exe' or name = 'UpdaterUI.exe' or name = '...
'<SYSTEM32>\find.exe' /i ".exe"
'<SYSTEM32>\cmd.exe' /S /D /c" %TEMP%\NSF{nsf_tm}_processav.bat "
'<SYSTEM32>\cmd.exe' /c (type %TEMP%\NSF{nsf_tm}_domainrole.txt | findstr "0 2" && echo ForceUnlockLogon REG_DWORD NotDomainRole) || (reg query "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlo...
'<SYSTEM32>\reg.exe' query HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters /v NullSessionPipes
'<SYSTEM32>\cmd.exe' /c wmic service where name="MSMQ" get state | find /i /v "state"
'<SYSTEM32>\cmd.exe' /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security" /v Retention || echo Retention notfound not config
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v TcpMaxHalfOpen
'<SYSTEM32>\cmd.exe' /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v TcpMaxHalfOpen || echo TcpMaxHalfOpen notfound not config
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v TcpMaxHalfOpenRetried
'<SYSTEM32>\cmd.exe' /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v TcpMaxHalfOpenRetried || echo TcpMaxHalfOpenRetried notfound not config
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v SynAttackProtect
'<SYSTEM32>\cmd.exe' /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v SynAttackProtect || echo SynAttackProtect notfound not config
'<SYSTEM32>\reg.exe' query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /v KeepAliveTime
'<SYSTEM32>\cmd.exe' /c (net start | find /i "SNMP Service" && (reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SNMP\Parameters\ValidCommunities" /f "public" || echo NoPublic)) || echo NoSNMP
'<SYSTEM32>\cmd.exe' /c reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /v KeepAliveTime || echo KeepAliveTime notfound not config
'<SYSTEM32>\cmd.exe' /c reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /v EnableICMPRedirect || echo EnableICMPRedirect notfound not config
'<SYSTEM32>\reg.exe' query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /v EnableDeadGWDetect
'<SYSTEM32>\cmd.exe' /c reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /v EnableDeadGWDetect || echo EnableDeadGWDetect notfound not config
'<SYSTEM32>\reg.exe' query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /v TcpMaxDataRetransmissions
'<SYSTEM32>\cmd.exe' /c reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /v TcpMaxDataRetransmissions || echo TcpMaxDataRetransmissions notfound not config
'<SYSTEM32>\reg.exe' query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /v PerformRouterDiscovery
'<SYSTEM32>\cmd.exe' /c reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /v PerformRouterDiscovery || echo PerformRouterDiscovery notfound not config
'<SYSTEM32>\reg.exe' query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /v EnableICMPRedirect
'<SYSTEM32>\reg.exe' query HKLM\System\CurrentControlSet\Services\Tcpip\Parameters /v DisableIPSourceRouting
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v EnableSecurityFilters
'<SYSTEM32>\net1.exe' start
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoAdminLogon
'<SYSTEM32>\cmd.exe' /c reg query "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoAdminLogon || echo AutoAdminLogon notfound 0
'<SYSTEM32>\wbem\wmic.exe' service where name="SimpTcp" get state
'<SYSTEM32>\cmd.exe' /c wmic service where name="SimpTcp" get state | find /i /v "state"
'<SYSTEM32>\wbem\wmic.exe' service where name="SMTPSVC" get state
'<SYSTEM32>\cmd.exe' /c wmic service where name="SMTPSVC" get state | find /i /v "state"
'<SYSTEM32>\wbem\wmic.exe' service where name="Dhcp" get state
'<SYSTEM32>\reg.exe' query HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths /v Machine
'<SYSTEM32>\cmd.exe' /c wmic service where name="Dhcp" get state | find /i /v "state"
'<SYSTEM32>\cmd.exe' /c reg query HKLM\System\CurrentControlSet\Services\Tcpip\Parameters /v DisableIPSourceRouting || echo DisableIPSourceRouting notfound not config
'<SYSTEM32>\find.exe' /i "SeRemoteShutdownPrivilege"
'<SYSTEM32>\cmd.exe' /c type %TEMP%\NSF{nsf_tm}_sec.log | find /i "SeRemoteShutdownPrivilege" || echo SeRemoteShutdownPrivilege = not config
'<SYSTEM32>\find.exe' /i "RestrictAnonymous"
'<SYSTEM32>\cmd.exe' /c type %TEMP%\NSF{nsf_tm}_sec.log | find /i "RestrictAnonymous" || echo RestrictAnonymous = not config
'<SYSTEM32>\reg.exe' query HKLM\System\CurrentControlSet\Services\Tcpip\Parameters /v EnablePMTUDiscovery
'<SYSTEM32>\cmd.exe' /c reg query HKLM\System\CurrentControlSet\Services\Tcpip\Parameters /v EnablePMTUDiscovery || echo EnablePMTUDiscovery notfound not config
'<SYSTEM32>\net.exe' start
'<SYSTEM32>\cmd.exe' /c reg query "HKEY_CURRENT_USER\Control Panel\Desktop" /v SCRNSAVE.EXE || echo SCRNSAVE.EXE notfound not config
'<SYSTEM32>\cmd.exe' /c reg query HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths /v Machine
'<SYSTEM32>\find.exe' /i "AuditLogonEvents"
'<SYSTEM32>\cmd.exe' /c type %TEMP%\NSF{nsf_tm}_sec.log | find /i "AuditSystemEvents" || echo AuditSystemEvents = not config
'<SYSTEM32>\find.exe' /i "AuditPrivilegeUse"
'<SYSTEM32>\cmd.exe' /c type %TEMP%\NSF{nsf_tm}_sec.log | find /i "AuditPrivilegeUse" || echo AuditPrivilegeUse = not config
'<SYSTEM32>\find.exe' /i "AuditAccountLogon"
'<SYSTEM32>\cmd.exe' /c type %TEMP%\NSF{nsf_tm}_sec.log | find /i "AuditAccountLogon" || echo AuditAccountLogon = not config
'<SYSTEM32>\find.exe' /i "AuditPolicyChange"
'<SYSTEM32>\cmd.exe' /c type %TEMP%\NSF{nsf_tm}_sec.log | find /i "AuditPolicyChange" || echo AuditPolicyChange = not config
'<SYSTEM32>\find.exe' /i "AuditSystemEvents"
'<SYSTEM32>\find.exe' /i "AuditObjectAccess"
'<SYSTEM32>\find.exe' /i "AuditDSAccess"
'<SYSTEM32>\cmd.exe' /c type %TEMP%\NSF{nsf_tm}_sec.log | find /i "AuditDSAccess" || echo AuditDSAccess = not config
'<SYSTEM32>\find.exe' /i "AuditAccountManage"
'<SYSTEM32>\cmd.exe' /c type %TEMP%\NSF{nsf_tm}_sec.log | find /i "AuditAccountManage" || echo AuditAccountManage = not config
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security" /v MaxSize
'<SYSTEM32>\cmd.exe' /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security" /v MaxSize || echo MaxSize notfound not config
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security" /v Retention
'<SYSTEM32>\cmd.exe' /c type %TEMP%\NSF{nsf_tm}_sec.log | find /i "AuditObjectAccess" || echo AuditObjectAccess = not config
'<SYSTEM32>\cmd.exe' /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v EnableSecurityFilters || echo EnableSecurityFilters notfound NoFilters
'<SYSTEM32>\cmd.exe' /c type %TEMP%\NSF{nsf_tm}_sec.log | find /i "restrictanonymoussam" || echo restrictanonymoussam = not config
'<SYSTEM32>\cmd.exe' /c type %TEMP%\NSF{nsf_tm}_sec.log | find /i "SeShutdownPrivilege" || echo SeShutdownPrivilege = not config
'<SYSTEM32>\find.exe' /i "SeTakeOwnershipPrivilege"
'<SYSTEM32>\cmd.exe' /c type %TEMP%\NSF{nsf_tm}_sec.log | find /i "SeTakeOwnershipPrivilege" || echo SeTakeOwnershipPrivilege = not config
'<SYSTEM32>\reg.exe' query HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths /v Machine
'<SYSTEM32>\find.exe' /i "Windows XP"
'<SYSTEM32>\cmd.exe' /S /D /c" ver "
'<SYSTEM32>\cmd.exe' /c (ver | find /i "Windows XP" && reg query HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths /v Machine) || (reg query HKEY_LOCAL_MACHINE\System\Current...
'<SYSTEM32>\reg.exe' query HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters /v NullSessionShares
'<SYSTEM32>\find.exe' /i "restrictanonymoussam"
'<SYSTEM32>\cmd.exe' /c (type %TEMP%\NSF{nsf_tm}_domainrole.txt | findstr "4 5") || (reg query HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters /v NullSessionShares)
'<SYSTEM32>\cmd.exe' /c (type %TEMP%\NSF{nsf_tm}_domainrole.txt | findstr "4 5") || (reg query HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters /v NullSessionPipes)
'<SYSTEM32>\find.exe' /i "SeInteractiveLogonRight"
'<SYSTEM32>\cmd.exe' /c type %TEMP%\NSF{nsf_tm}_sec.log | find /i "SeInteractiveLogonRight" || echo SeInteractiveLogonRight = not config
'<SYSTEM32>\find.exe' /i "SeNetworkLogonRight"
'<SYSTEM32>\cmd.exe' /c type %TEMP%\NSF{nsf_tm}_sec.log | find /i "SeNetworkLogonRight" || echo SeNetworkLogonRight = not config
'<SYSTEM32>\cmd.exe' /c (type %TEMP%\NSF{nsf_tm}_domainrole.txt | findstr "0 2" && echo DisablePasswordChange REG_DWORD NotDomainRole) || (reg query HKEY_LOCAL_MACHINE\system\currentcontrolset\services\netlogon\par...
'<SYSTEM32>\find.exe' /i "SeShutdownPrivilege"
'<SYSTEM32>\cmd.exe' /c type %TEMP%\NSF{nsf_tm}_sec.log | find /i "AuditLogonEvents" || echo AuditLogonEvents = not config
'<SYSTEM32>\find.exe' /i "SNMP Service"
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v AUOptions
'<SYSTEM32>\wbem\wmic.exe' service where name="w32time" get state
'<SYSTEM32>\cmd.exe' /c (echo wmic process where "name = 'ccSetMgr.exe' or name = 'defwatch.exe' or name = 'ISSVC.exe' or name = 'SPBBCSvc.exe' or name = 'SNDSrvc.exe' or name = 'KPFWSvc.exe' or name = 'KAVStart.ex...
'<SYSTEM32>\cmd.exe' /c (echo wmic process where "name = 'kvwsc.exe' or name = 'kvmonxp.exe' or name = 'ashserv.exe' or name = 'aswupdsv.exe' or name = 'ashdisp.exe' or name = 'ashwebsv.exe' or name = 'UpdaterUI.ex...
'<SYSTEM32>\cmd.exe' /c echo @echo off > %TEMP%\NSF{nsf_tm}_processav.bat
'<SYSTEM32>\cmd.exe' /c echo Exit For >> %TEMP%\NSF{nsf_tm}_nameav.vbs
'<SYSTEM32>\cmd.exe' /c echo WScript.Echo "nsfocusyes" >> %TEMP%\NSF{nsf_tm}_nameav.vbs
'<SYSTEM32>\cmd.exe' /c echo If InStr(allSoftNames, allKeys(i)) Then >> %TEMP%\NSF{nsf_tm}_nameav.vbs
'<SYSTEM32>\cmd.exe' /c echo For i = 0 To UBound(allKeys) >> %TEMP%\NSF{nsf_tm}_nameav.vbs
'<SYSTEM32>\cmd.exe' /c (echo wmic process where "name = 'Vstskmgr.exe' or name = 'Mcshield.exe' or name = 'Frameworkservice.exe' or name = 'naPrdMgr.exe' or name = 'mcafee.exe' or name = 'xcommsvr.exe' or name = '...
'<SYSTEM32>\cmd.exe' /c echo Next >> %TEMP%\NSF{nsf_tm}_nameav.vbs
'<SYSTEM32>\cmd.exe' /c echo Next >> %TEMP%\NSF{nsf_tm}_nameav.vbs
'<SYSTEM32>\cmd.exe' /c echo End If >> %TEMP%\NSF{nsf_tm}_nameav.vbs
'<SYSTEM32>\cmd.exe' /c echo End If >> %TEMP%\NSF{nsf_tm}_nameav.vbs
'<SYSTEM32>\cmd.exe' /c echo allSoftNames = allSoftNames + sValue_Name + "," >> %TEMP%\NSF{nsf_tm}_nameav.vbs
'<SYSTEM32>\cmd.exe' /c echo If not IsNull(sValue_Name) and IsNull(sValue_PDName) and IsNull(sValue_PKName) Then >> %TEMP%\NSF{nsf_tm}_nameav.vbs
'<SYSTEM32>\cmd.exe' /c echo objReg.GetStringValue HKEY_LOCAL_MACHINE, strKeyPath + "\" + subkey, "ParentKeyName", sValue_PKName >> %TEMP%\NSF{nsf_tm}_nameav.vbs
'<SYSTEM32>\cmd.exe' /c echo objReg.GetStringValue HKEY_LOCAL_MACHINE, strKeyPath + "\" + subkey, "ParentDisplayName", sValue_PDName >> %TEMP%\NSF{nsf_tm}_nameav.vbs
'<SYSTEM32>\cmd.exe' /c echo End if >> %TEMP%\NSF{nsf_tm}_nameav.vbs
'<SYSTEM32>\cmd.exe' /c echo On Error Resume Next>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs
'<SYSTEM32>\cmd.exe' /c echo If InStr(FwSvcOut, "State") Then>>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs
'<SYSTEM32>\cmd.exe' /c echo Set objWMIService = GetObject("winmgmts:\\.\root\CIMV2") > %TEMP%\NSF{nsf_tm}_sharecheck.vbs
'<SYSTEM32>\cmd.exe' /c echo FwSvcOut = FwSvcExec.StdOut.ReadAll>>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs
'<SYSTEM32>\cmd.exe' /c echo FwSvcExec.StdIn.Close>>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs
'<SYSTEM32>\cmd.exe' /c echo set FwSvcExec = ws.Exec("wmic service where name=""SharedAccess"" get state")>>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs
'<SYSTEM32>\cmd.exe' /c echo set ws = CreateObject("WScript.Shell")>>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs
'<SYSTEM32>\cmd.exe' /c echo If 0 ^<^> ErrNum Then>>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs
'<SYSTEM32>\cmd.exe' /c echo On Error Goto ^0>>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs
'<SYSTEM32>\cmd.exe' /c echo ErrNum = Err.Number>>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs
'<SYSTEM32>\cmd.exe' /c echo objReg.GetStringValue HKEY_LOCAL_MACHINE, strKeyPath + "\" + subkey, "DisplayName", sValue_Name >> %TEMP%\NSF{nsf_tm}_nameav.vbs
'<SYSTEM32>\cmd.exe' /c echo set objFirewall = CreateObject("HNetCfg.FwMgr")>>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs
'<SYSTEM32>\cmd.exe' /c echo Next >> %TEMP%\NSF{nsf_tm}_sharecheck.vbs
'<SYSTEM32>\cmd.exe' /c echo End If >> %TEMP%\NSF{nsf_tm}_sharecheck.vbs
'<SYSTEM32>\cmd.exe' /c echo Exit For >> %TEMP%\NSF{nsf_tm}_sharecheck.vbs
'<SYSTEM32>\cmd.exe' /c echo Wscript.Echo "Everyone" >> %TEMP%\NSF{nsf_tm}_sharecheck.vbs
'<SYSTEM32>\cmd.exe' /c echo If InStr(objItem.Trustee, "S-1-1-0") Then >> %TEMP%\NSF{nsf_tm}_sharecheck.vbs
'<SYSTEM32>\cmd.exe' /c echo For Each objItem in colItems >> %TEMP%\NSF{nsf_tm}_sharecheck.vbs
'<SYSTEM32>\cmd.exe' /c echo Set colItems = objWMIService.ExecQuery("SELECT * FROM Win32_LogicalShareAccess",,48) >> %TEMP%\NSF{nsf_tm}_sharecheck.vbs
'<SYSTEM32>\cmd.exe' /c (echo wmic process where "name = 'spidernt.exe' or name = 'spiderml.exe' or name = 'drwebscd.exe' or name = 'spider.exe' or name = 'nod32kui.exe' or name = 'nod32krn.exe' or name = 'MPSVC.ex...
'<SYSTEM32>\cmd.exe' /c (echo wmic process where "name='360tray.exe' or name='ZhuDongFangYu.exe' or name = 'ds_agent' or name = 'ds_notifier' or name = 'QQPCTray.exe'" get name >> %TEMP%\NSF{nsf_tm}_processav.bat)
'<SYSTEM32>\cmd.exe' /c echo If IsNull(dwValue) or 0 = dwValue Then >> %TEMP%\NSF{nsf_tm}_nameav.vbs
'<SYSTEM32>\cmd.exe' /c echo Set objWMIServiceSC = GetObject(SCNameSpace) >> %TEMP%\NSF{nsf_tm}_wmiav.vbs
'<SYSTEM32>\cmd.exe' /c echo Exit For >> %TEMP%\NSF{nsf_tm}_wmiav.vbs
'<SYSTEM32>\cmd.exe' /c echo End If >> %TEMP%\NSF{nsf_tm}_wmiav.vbs
'<SYSTEM32>\cmd.exe' /c echo SCNameSpace = "winmgmts:\\.\root\SecurityCenter2" >> %TEMP%\NSF{nsf_tm}_wmiav.vbs
'<SYSTEM32>\cmd.exe' /c echo ElseIf SecondNumber ^<^> "." Then>> %TEMP%\NSF{nsf_tm}_wmiav.vbs
'<SYSTEM32>\cmd.exe' /c echo SCNameSpace = "winmgmts:\\.\root\SecurityCenter" >> %TEMP%\NSF{nsf_tm}_wmiav.vbs
'<SYSTEM32>\cmd.exe' /c echo If FirstNumber ^<= "5" And SecondNumber = "." Then >> %TEMP%\NSF{nsf_tm}_wmiav.vbs
'<SYSTEM32>\cmd.exe' /c echo SecondNumber = Mid(objItem.Version, 2, 1) >> %TEMP%\NSF{nsf_tm}_wmiav.vbs
'<SYSTEM32>\cmd.exe' /c echo Next >> %TEMP%\NSF{nsf_tm}_wmiav.vbs
'<SYSTEM32>\cmd.exe' /c echo FirstNumber = Left(objItem.Version, 1) >> %TEMP%\NSF{nsf_tm}_wmiav.vbs
'<SYSTEM32>\cmd.exe' /c echo Set colItemsOS = objWMIServiceOS.ExecQuery("SELECT * FROM Win32_OperatingSystem",,48) >> %TEMP%\NSF{nsf_tm}_wmiav.vbs
'<SYSTEM32>\cmd.exe' /c echo Set objWMIServiceOS = GetObject("winmgmts:\\.\root\CIMV2") >> %TEMP%\NSF{nsf_tm}_wmiav.vbs
'<SYSTEM32>\cmd.exe' /c echo SCNameSpace = "" > %TEMP%\NSF{nsf_tm}_wmiav.vbs
'<SYSTEM32>\find.exe' /i /v "domainrole"
'<SYSTEM32>\wbem\wmic.exe' computersystem get domainrole
'<SYSTEM32>\cmd.exe' /c wmic computersystem get domainrole | find /i /v "domainrole" > %TEMP%\NSF{nsf_tm}_domainrole.txt
'<SYSTEM32>\secedit.exe' /export /cfg %TEMP%\NSF{nsf_tm}_sec.log
'<SYSTEM32>\cmd.exe' /c echo For Each objItem in colItemsOS >> %TEMP%\NSF{nsf_tm}_wmiav.vbs
'<SYSTEM32>\cmd.exe' /c echo End If >> %TEMP%\NSF{nsf_tm}_wmiav.vbs
'<SYSTEM32>\cmd.exe' /c echo For Each subkey In arrSubKeys >> %TEMP%\NSF{nsf_tm}_nameav.vbs
'<SYSTEM32>\cmd.exe' /c echo If Err.Number = 0 Then >> %TEMP%\NSF{nsf_tm}_wmiav.vbs
'<SYSTEM32>\cmd.exe' /c echo If not IsNull(arrSubKeys) Then >> %TEMP%\NSF{nsf_tm}_nameav.vbs
'<SYSTEM32>\cmd.exe' /c echo objReg.EnumKey HKEY_LOCAL_MACHINE, strKeyPath, arrSubKeys >> %TEMP%\NSF{nsf_tm}_nameav.vbs
'<SYSTEM32>\cmd.exe' /c echo For Each strkeyPath In arrKeyPath >> %TEMP%\NSF{nsf_tm}_nameav.vbs
'<SYSTEM32>\cmd.exe' /c echo arrKeyPath = Array("SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall", "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall") >> %TEMP%\NSF{nsf_tm}_nameav.vbs
'<SYSTEM32>\cmd.exe' /c echo Set objReg = GetObject("winmgmts:\\.\root\default:StdRegProv") >> %TEMP%\NSF{nsf_tm}_nameav.vbs
'<SYSTEM32>\cmd.exe' /c echo const HKEY_LOCAL_MACHINE = ^&H80000002 >> %TEMP%\NSF{nsf_tm}_nameav.vbs
'<SYSTEM32>\cmd.exe' /c echo allSoftNames = "" >> %TEMP%\NSF{nsf_tm}_nameav.vbs
'<SYSTEM32>\cmd.exe' /c echo objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath + "\" + subkey, "SystemComponent", dwValue >> %TEMP%\NSF{nsf_tm}_nameav.vbs
'<SYSTEM32>\cmd.exe' /c echo allKeys = Split("В°ВІГ€В«ВІВїВ¶Г“,Г‰В±В¶Вѕ,В·ВґВІВЎВ¶Вѕ,В·ГЂВІВЎВ¶Вѕ,virus,Spyware,Symantec Endpoint Protection,ВµГ§Г„Г”В№ГњВјГ’",",") > %TEMP%\NSF{nsf_tm}_nameav.vbs
'<SYSTEM32>\cmd.exe' /c echo Next >> %TEMP%\NSF{nsf_tm}_wmiav.vbs
'<SYSTEM32>\cmd.exe' /c echo End If >> %TEMP%\NSF{nsf_tm}_wmiav.vbs
'<SYSTEM32>\cmd.exe' /c echo Wscript.Echo "nsfocusyes" >> %TEMP%\NSF{nsf_tm}_wmiav.vbs
'<SYSTEM32>\cmd.exe' /c echo Wscript.Echo objItem.DisplayName >> %TEMP%\NSF{nsf_tm}_wmiav.vbs
'<SYSTEM32>\cmd.exe' /c echo If Not IsNull(objItem.DisplayName) Then >> %TEMP%\NSF{nsf_tm}_wmiav.vbs
'<SYSTEM32>\cmd.exe' /c echo For Each objItem in colItemsSC >> %TEMP%\NSF{nsf_tm}_wmiav.vbs
'<SYSTEM32>\cmd.exe' /c echo Set colItemsSC = objWMIServiceSC.ExecQuery("SELECT * FROM AntiVirusProduct",,48) >> %TEMP%\NSF{nsf_tm}_wmiav.vbs
'<SYSTEM32>\cmd.exe' /c echo On Error Resume Next >> %TEMP%\NSF{nsf_tm}_wmiav.vbs
'<SYSTEM32>\cmd.exe' /c echo Wscript.Echo(Right(ResultStr, Len(ResultStr) - 1))>>%TEMP%\NSF{nsf_tm}_fscheck.vbs
'<SYSTEM32>\wbem\wmic.exe' os get caption
'<SYSTEM32>\cmd.exe' /c echo Else>>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs
'<SYSTEM32>\cmd.exe' /c reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\w32time\Parameters /v NtpServer || echo NtpServer notfound not config
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v PasswordExpiryWarning
'<SYSTEM32>\cmd.exe' /c reg query "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v PasswordExpiryWarning || echo PasswordExpiryWarning notfound not config
'<SYSTEM32>\find.exe' /i /v "startmode"
'<SYSTEM32>\wbem\wmic.exe' service where name="w32time" get startmode
'<SYSTEM32>\cmd.exe' /c wmic service where name="w32time" get startmode | find /i /v "startmode"
'<SYSTEM32>\cmd.exe' /c (type %TEMP%\NSF{nsf_tm}_domainrole.txt | findstr "0 2 4 5" && echo signsecurechannel REG_DWORD NotDomainMember) || (reg query HKEY_LOCAL_MACHINE\system\currentcontrolset\services\netlogon\p...
'<SYSTEM32>\reg.exe' query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\w32time\Parameters /v NtpServer
'<SYSTEM32>\cmd.exe' /c (type %TEMP%\NSF{nsf_tm}_domainrole.txt | findstr "0 2 4 5" && echo requiresignorseal REG_DWORD NotDomainMember) || (reg query HKEY_LOCAL_MACHINE\system\currentcontrolset\services\netlogon\p...
'<SYSTEM32>\findstr.exe' "4 5"
'<SYSTEM32>\cmd.exe' /c (type %TEMP%\NSF{nsf_tm}_domainrole.txt | findstr "4 5") || (cscript %TEMP%\NSF{nsf_tm}_sharecheck.vbs //Nologo | find /i "Everyone")
'<SYSTEM32>\findstr.exe' "0 2 4 5"
'<SYSTEM32>\cmd.exe' /S /D /c" type %TEMP%\NSF{nsf_tm}_domainrole.txt "
'<SYSTEM32>\cmd.exe' /c (type %TEMP%\NSF{nsf_tm}_domainrole.txt | findstr "0 2 4 5" && echo sealsecurechannel REG_DWORD NotDomainMember) || (reg query HKEY_LOCAL_MACHINE\system\currentcontrolset\services\netlogon\p...
'<SYSTEM32>\cmd.exe' /c echo objFile.Close()>>%TEMP%\NSF{nsf_tm}_morelines.vbs
'<SYSTEM32>\cmd.exe' /c echo loop>>%TEMP%\NSF{nsf_tm}_morelines.vbs
'<SYSTEM32>\find.exe' /i "Everyone"
'<SYSTEM32>\reg.exe' query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system /v DontDisplayLockedUserId
'<SYSTEM32>\cmd.exe' /c echo Wscript.Echo "Enabled">>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs
'<SYSTEM32>\find.exe' /i /v "state"
'<SYSTEM32>\cmd.exe' /c (wmic os get caption | findstr "2016" && (reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v AUOptions || "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Policie...
'<SYSTEM32>\find.exe' /i /c "disk"
'<SYSTEM32>\find.exe' /i /v "deviceid"
'<SYSTEM32>\wbem\wmic.exe' partition get deviceid
'<SYSTEM32>\cmd.exe' /c wmic partition get deviceid | find /i /v "deviceid" | find /i /c "disk"
'<SYSTEM32>\cmd.exe' /c cscript %TEMP%\NSF{nsf_tm}_fscheck.vbs //Nologo
'<SYSTEM32>\reg.exe' query HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system /v DontDisplayLastUserName
'<SYSTEM32>\cmd.exe' /c echo end if>>%TEMP%\NSF{nsf_tm}_morelines.vbs
'<SYSTEM32>\cmd.exe' /c reg query HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system /v DontDisplayLastUserName || echo DontDisplayLastUserName notfound not config
'<SYSTEM32>\cmd.exe' /c reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system /v DontDisplayLockedUserId || echo DontDisplayLockedUserId notfound not config
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters" /v autodisconnect
'<SYSTEM32>\cmd.exe' /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters" /v autodisconnect || echo autodisconnect notfound not config
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer" /v NoDriveTypeAutoRun
'<SYSTEM32>\cmd.exe' /c reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer" /v NoDriveTypeAutoRun || echo NoDriveTypeAutoRun notfound not config
'<SYSTEM32>\reg.exe' query "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaveTimeOut
'<SYSTEM32>\cmd.exe' /c reg query "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaveTimeOut || echo ScreenSaveTimeOut notfound not config
'<SYSTEM32>\cmd.exe' /c wmic service where name="w32time" get state | find /i /v "state"
'<SYSTEM32>\findstr.exe' "2016"
'<SYSTEM32>\cmd.exe' /c echo Wscript.Echo Line>>%TEMP%\NSF{nsf_tm}_morelines.vbs
'<SYSTEM32>\cmd.exe' /c echo If (3 = objItem.DriveType) and (0 ^<^> Len(objItem.FileSystem)) Then>>%TEMP%\NSF{nsf_tm}_fscheck.vbs
'<SYSTEM32>\cmd.exe' /c echo Set objWMIService = GetObject("winmgmts:\\.\root\CIMV2")>>%TEMP%\NSF{nsf_tm}_fscheck.vbs
'<SYSTEM32>\cmd.exe' /c echo ResultStr = "">%TEMP%\NSF{nsf_tm}_fscheck.vbs
'<SYSTEM32>\cmd.exe' /c echo End If>>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs
'<SYSTEM32>\cmd.exe' /c echo If True = objPolicy.FirewallEnabled Then>>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs
'<SYSTEM32>\cmd.exe' /c echo Wscript.Echo "Enabled">>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs
'<SYSTEM32>\cmd.exe' /c echo If 0 ^<^> ErrNum Then>>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs
'<SYSTEM32>\cmd.exe' /c echo On Error Goto ^0>>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs
'<SYSTEM32>\cmd.exe' /c echo Set colItems = objWMIService.ExecQuery("SELECT * FROM Win32_LogicalDisk",,48)>>%TEMP%\NSF{nsf_tm}_fscheck.vbs
'<SYSTEM32>\cmd.exe' /c echo ErrNum = Err.Number>>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs
'<SYSTEM32>\cmd.exe' /c echo On Error Resume Next>>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs
'<SYSTEM32>\cmd.exe' /c echo Else>>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs
'<SYSTEM32>\cmd.exe' /c echo End If>>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs
'<SYSTEM32>\cmd.exe' /c echo Wscript.Echo "NoFirewallWindows">>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs
'<SYSTEM32>\cmd.exe' /c echo Else>>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs
'<SYSTEM32>\cmd.exe' /c echo End If>>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs
'<SYSTEM32>\cmd.exe' /c echo Wscript.Echo "Disabled">>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs
'<SYSTEM32>\cmd.exe' /c echo set objPolicy = objFirewall.LocalPolicy.CurrentProfile>>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs
'<SYSTEM32>\cmd.exe' /c echo If InStr(FwSvcOut, "Running") Then>>%TEMP%\NSF{nsf_tm}_checkfirewall.vbs
'<SYSTEM32>\cmd.exe' /c echo if Trim(Line) ^<^> "" and EchoNumber ^< MoreNumber then>>%TEMP%\NSF{nsf_tm}_morelines.vbs
'<SYSTEM32>\cmd.exe' /c echo If 0 = InStr(objItem.FileSystem, "NTFS") Then>>%TEMP%\NSF{nsf_tm}_fscheck.vbs
'<SYSTEM32>\cmd.exe' /c echo Line = objFile.ReadLine()>>%TEMP%\NSF{nsf_tm}_morelines.vbs
'<SYSTEM32>\cmd.exe' /c echo do while objFile.AtEndOfStream ^<^> True>>%TEMP%\NSF{nsf_tm}_morelines.vbs
'<SYSTEM32>\cmd.exe' /c echo EchoNumber = ^0>>%TEMP%\NSF{nsf_tm}_morelines.vbs
'<SYSTEM32>\cmd.exe' /c echo set objFile = objFSO.OpenTextFile(FileName, 1)>>%TEMP%\NSF{nsf_tm}_morelines.vbs
'<SYSTEM32>\cmd.exe' /c echo set objFSO = CreateObject("Scripting.FileSystemObject")>>%TEMP%\NSF{nsf_tm}_morelines.vbs
'<SYSTEM32>\cmd.exe' /c echo MoreNumber = CInt(Wscript.arguments(1))>>%TEMP%\NSF{nsf_tm}_morelines.vbs
'<SYSTEM32>\cmd.exe' /c echo FileName = Wscript.arguments(0)>%TEMP%\NSF{nsf_tm}_morelines.vbs
'<SYSTEM32>\cmd.exe' /c echo EchoNumber = EchoNumber + ^1>>%TEMP%\NSF{nsf_tm}_morelines.vbs
'<SYSTEM32>\cmd.exe' /c echo End If>>%TEMP%\NSF{nsf_tm}_fscheck.vbs
'<SYSTEM32>\cmd.exe' /c echo Else>>%TEMP%\NSF{nsf_tm}_fscheck.vbs
'<SYSTEM32>\cmd.exe' /c echo Wscript.Echo("AllNTFS")>>%TEMP%\NSF{nsf_tm}_fscheck.vbs
'<SYSTEM32>\cmd.exe' /c echo If 0 = Len(ResultStr) Then>>%TEMP%\NSF{nsf_tm}_fscheck.vbs
'<SYSTEM32>\cmd.exe' /c echo Next>>%TEMP%\NSF{nsf_tm}_fscheck.vbs
'<SYSTEM32>\cmd.exe' /c echo End If>>%TEMP%\NSF{nsf_tm}_fscheck.vbs
'<SYSTEM32>\cmd.exe' /c echo End If>>%TEMP%\NSF{nsf_tm}_fscheck.vbs
'<SYSTEM32>\cmd.exe' /c echo ResultStr = ResultStr + "," + objItem.Name + "=" + objItem.FileSystem>>%TEMP%\NSF{nsf_tm}_fscheck.vbs
'<SYSTEM32>\cmd.exe' /c echo For Each objItem in colItems>>%TEMP%\NSF{nsf_tm}_fscheck.vbs
'<SYSTEM32>\wbem\wmic.exe' service where name="MSMQ" get state

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней