Trojan.Siggen17.28877

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'System' = '"C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\System.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'explorer' = '"C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\explorer.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '"C:\Documents and Settings\csrss.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'spoolsv' = '"%WINDIR%\Migration\WTR\spoolsv.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'Idle' = '"%WINDIR%\Globalization\Idle.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'explorer' = '"C:\Users\Default\My Documents\explorer.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'taskhost' = '"C:\totalcmd\LANGUAGE\taskhost.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'lsass' = '"%ALLUSERSPROFILE%\Microsoft\lsass.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'spoolsv' = '"%ProgramFiles%\sdloader\spoolsv.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'Idle' = '"%ProgramFiles%\NSMdtr\Idle.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'dwm' = '"%ProgramFiles(x86)%\Winamp\Plugins\Milkdrop2\presets\dwm.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'WUDFHost' = '"%HOMEPATH%\Application Data\WUDFHost.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'spoolsv' = '"%ALLUSERSPROFILE%\Oracle\Java\javapath\spoolsv.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplore' = '"%ProgramFiles%\stopsignav\iexplore.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'wininit' = '"%WINDIR%\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35...
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] '<Имя файла>' = '"C:\totalcmd\LANGUAGE\<Имя файла>.exe"'
[<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\System.exe", "%ProgramFiles%\lotroclient\...
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'wininit' = '"%ProgramFiles%\lotroclient\wininit.exe"'
[<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\System.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'dwm' = '"%ALLUSERSPROFILE%\Package Cache\{51adbf11-493f-431c-a862-967a0fae2944}\dwm.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'winlogon' = '"%ProgramFiles%\ih8run\winlogon.exe"'

Создает или изменяет следующие файлы

<SYSTEM32>\tasks\ccjusystem
<SYSTEM32>\tasks\zi2vidle
<SYSTEM32>\tasks\4iwmtaskhost
<SYSTEM32>\tasks\pcomspoolsv
<SYSTEM32>\tasks\fjfctaskhost
<SYSTEM32>\tasks\8eqrspoolsv
<SYSTEM32>\tasks\6coyidle
<SYSTEM32>\tasks\explorer
<SYSTEM32>\tasks\53u8explorer
<SYSTEM32>\tasks\bexlspoolsv
<SYSTEM32>\tasks\adsktaskhost
<SYSTEM32>\tasks\lsass
<SYSTEM32>\tasks\o4yelsass
<SYSTEM32>\tasks\3s24lsass
<SYSTEM32>\tasks\yrgjexplorer
<SYSTEM32>\tasks\eqebwudfhost
<SYSTEM32>\tasks\2mszspoolsv
<SYSTEM32>\tasks\ri14idle
<SYSTEM32>\tasks\csrss
<SYSTEM32>\tasks\0nyocsrss
<SYSTEM32>\tasks\99wwidle
<SYSTEM32>\tasks\kdpkexplorer
<SYSTEM32>\tasks\apsqidle
<SYSTEM32>\tasks\gt0uspoolsv
<SYSTEM32>\tasks\vrtyexplorer
<SYSTEM32>\tasks\bg8iidle
<SYSTEM32>\tasks\lnsswinlogon
<SYSTEM32>\tasks\uufywinlogon
<SYSTEM32>\tasks\knxpcsrss
<SYSTEM32>\tasks\fh2ocsrss
<SYSTEM32>\tasks\5jffspoolsv
<SYSTEM32>\tasks\rimawinlogon
<SYSTEM32>\tasks\idle
<SYSTEM32>\tasks\w0rtspoolsv
<SYSTEM32>\tasks\s2rfdwm
<SYSTEM32>\tasks\blyodwm
<SYSTEM32>\tasks\wininit
<SYSTEM32>\tasks\system
<SYSTEM32>\tasks\aoissystem
<SYSTEM32>\tasks\biagsystem
<SYSTEM32>\tasks\qqt8wininit
<SYSTEM32>\tasks\brr2wininit
<SYSTEM32>\tasks\v6ikexplorer
<SYSTEM32>\tasks\vqjzwininit
<SYSTEM32>\tasks\oectspoolsv
<SYSTEM32>\tasks\iaw8wininit
<SYSTEM32>\tasks\<Имя файла>
<SYSTEM32>\tasks\h9tzwininit
<SYSTEM32>\tasks\jtqf<Имя файла>
<SYSTEM32>\tasks\nkvhwininit
<SYSTEM32>\tasks\apt9<Имя файла>
<SYSTEM32>\tasks\winlogon
<SYSTEM32>\tasks\veejiexplore
<SYSTEM32>\tasks\zyc9iexplore
<SYSTEM32>\tasks\3dvsspoolsv
<SYSTEM32>\tasks\jarxdwm
<SYSTEM32>\tasks\ighydwm
<SYSTEM32>\tasks\taskhost
<SYSTEM32>\tasks\nzgflsass
<SYSTEM32>\tasks\dwm
<SYSTEM32>\tasks\yyariexplore
<SYSTEM32>\tasks\mvy3dwm
<SYSTEM32>\tasks\qudx<Имя файла>
<SYSTEM32>\tasks\92bnwudfhost
<SYSTEM32>\tasks\xqwqwudfhost
<SYSTEM32>\tasks\jcaodwm
<SYSTEM32>\tasks\spoolsv
<SYSTEM32>\tasks\iexplore
<SYSTEM32>\tasks\wudfhost
<SYSTEM32>\tasks\lipwexplorer

Вредоносные функции

Для затруднения выявления своего присутствия в системе

блокирует:

Средство контроля пользовательских учетных записей (UAC)

Изменения в файловой системе

Создает следующие файлы

C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\system.exe
%ALLUSERSPROFILE%\package cache\{51adbf11-493f-431c-a862-967a0fae2944}\rcxee94.tmp
%ALLUSERSPROFILE%\package cache\{51adbf11-493f-431c-a862-967a0fae2944}\rcxed99.tmp
%HOMEPATH%\application data\rcxea8c.tmp
%HOMEPATH%\application data\rcxe982.tmp
%ALLUSERSPROFILE%\oracle\java\javapath\rcxe656.tmp
%ALLUSERSPROFILE%\oracle\java\javapath\rcxe211.tmp
%ProgramFiles%\stopsignav\rcxded5.tmp
%WINDIR%\assembly\gac_32\microsoft.security.applicationid.policymanagement.policyengineapi.interop\6.1.0.0__31bf3856ad364e35\rcxd513.tmp
%ProgramFiles(x86)%\winamp\plugins\milkdrop2\presets\rcxf3e3.tmp
%WINDIR%\assembly\gac_32\microsoft.security.applicationid.policymanagement.policyengineapi.interop\6.1.0.0__31bf3856ad364e35\rcxd3ab.tmp
C:\totalcmd\language\rcxd002.tmp
C:\totalcmd\language\rcxce3d.tmp
%ProgramFiles%\lotroclient\rcxcac2.tmp
%ProgramFiles%\lotroclient\rcxc90d.tmp
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\rcxc564.tmp
%ProgramFiles%\stopsignav\rcxd9a6.tmp
%WINDIR%\migration\wtr\spoolsv.exe
%ProgramFiles%\sdloader\rcxf6e0.tmp
%ProgramFiles%\nsmdtr\rcx1e01.tmp
%ProgramFiles%\nsmdtr\rcx1d06.tmp
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\rcx19da.tmp
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\rcx18e0.tmp
C:\documents and settings\rcx15e2.tmp
C:\documents and settings\rcx14a9.tmp
%WINDIR%\migration\wtr\rcx119c.tmp
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\rcxc3cd.tmp
%ProgramFiles(x86)%\winamp\plugins\milkdrop2\presets\rcxf2c9.tmp
%WINDIR%\globalization\rcx921.tmp
C:\users\default\my documents\rcx539.tmp
C:\users\default\my documents\rcx393.tmp
C:\totalcmd\language\rcx76.tmp
C:\totalcmd\language\rcxfeff.tmp
%ALLUSERSPROFILE%\microsoft\rcxfbe2.tmp
%ALLUSERSPROFILE%\microsoft\rcxfae8.tmp
%WINDIR%\globalization\rcxb82.tmp
%ProgramFiles%\sdloader\rcxf7db.tmp
<Текущая директория>\rcxc014.tmp
<Текущая директория>\rcxbe5f.tmp
%ProgramFiles%\ih8run\cc11b995f2a76d
%ProgramFiles%\stopsignav\iexplore.exe
%ALLUSERSPROFILE%\package cache\{51adbf11-493f-431c-a862-967a0fae2944}\6cb0b6c459d5d3
%ALLUSERSPROFILE%\package cache\{51adbf11-493f-431c-a862-967a0fae2944}\dwm.exe
%HOMEPATH%\application data\480b7989c529f6
%HOMEPATH%\application data\wudfhost.exe
%ALLUSERSPROFILE%\oracle\java\javapath\f3b6ecef712a24
%ALLUSERSPROFILE%\oracle\java\javapath\spoolsv.exe
%ProgramFiles%\ih8run\rcx211e.tmp
%ProgramFiles(x86)%\winamp\plugins\milkdrop2\presets\6cb0b6c459d5d3
%WINDIR%\assembly\gac_32\microsoft.security.applicationid.policymanagement.policyengineapi.interop\6.1.0.0__31bf3856ad364e35\56085415360792
%WINDIR%\assembly\gac_32\microsoft.security.applicationid.policymanagement.policyengineapi.interop\6.1.0.0__31bf3856ad364e35\wininit.exe
C:\totalcmd\language\eb865b694bc31b
C:\totalcmd\language\<Имя файла>.exe
%ProgramFiles%\lotroclient\56085415360792
%ProgramFiles%\lotroclient\wininit.exe
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\27d1bcfc3c54e0
%ProgramFiles%\stopsignav\9db6e019d4f04e
%WINDIR%\migration\wtr\rcxf6a.tmp
%ProgramFiles%\sdloader\spoolsv.exe
%ALLUSERSPROFILE%\microsoft\6203df4a6bafc7
%ProgramFiles%\sdloader\f3b6ecef712a24
%ProgramFiles%\ih8run\winlogon.exe
%ProgramFiles%\nsmdtr\6ccacd8608530f
%ProgramFiles%\nsmdtr\idle.exe
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\7a0fd90576e088
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\explorer.exe
C:\documents and settings\886983d96e3d3e
%ALLUSERSPROFILE%\microsoft\lsass.exe
C:\documents and settings\csrss.exe
%ProgramFiles(x86)%\winamp\plugins\milkdrop2\presets\dwm.exe
%WINDIR%\globalization\6ccacd8608530f
%WINDIR%\globalization\idle.exe
C:\users\default\my documents\7a0fd90576e088
C:\users\default\my documents\explorer.exe
C:\totalcmd\language\b75386f1303e64
C:\totalcmd\language\taskhost.exe
%WINDIR%\migration\wtr\f3b6ecef712a24
%ProgramFiles%\ih8run\rcx2209.tmp

Присваивает атрибут 'скрытый' для следующих файлов

<Полный путь к файлу>
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\explorer.exe
C:\documents and settings\csrss.exe
%WINDIR%\migration\wtr\spoolsv.exe
%WINDIR%\globalization\idle.exe
C:\users\default\my documents\explorer.exe
C:\totalcmd\language\taskhost.exe
%ALLUSERSPROFILE%\microsoft\lsass.exe
%ProgramFiles%\sdloader\spoolsv.exe
%ProgramFiles(x86)%\winamp\plugins\milkdrop2\presets\dwm.exe
%ALLUSERSPROFILE%\package cache\{51adbf11-493f-431c-a862-967a0fae2944}\dwm.exe
%HOMEPATH%\application data\wudfhost.exe
%ALLUSERSPROFILE%\oracle\java\javapath\spoolsv.exe
%ProgramFiles%\stopsignav\iexplore.exe
%WINDIR%\assembly\gac_32\microsoft.security.applicationid.policymanagement.policyengineapi.interop\6.1.0.0__31bf3856ad364e35\wininit.exe
C:\totalcmd\language\<Имя файла>.exe
%ProgramFiles%\lotroclient\wininit.exe
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\system.exe
%ProgramFiles%\nsmdtr\idle.exe
%ProgramFiles%\ih8run\winlogon.exe

Перемещает следующие файлы

<Текущая директория>\rcxc014.tmp в <Полный путь к файлу>
%ALLUSERSPROFILE%\microsoft\rcxfae8.tmp в %ALLUSERSPROFILE%\microsoft\lsass.exe
%ALLUSERSPROFILE%\microsoft\rcxfbe2.tmp в %ALLUSERSPROFILE%\microsoft\lsass.exe
C:\totalcmd\language\rcxfeff.tmp в C:\totalcmd\language\taskhost.exe
C:\totalcmd\language\rcx76.tmp в C:\totalcmd\language\taskhost.exe
C:\users\default\my documents\rcx393.tmp в C:\users\default\my documents\explorer.exe
C:\users\default\my documents\rcx539.tmp в C:\users\default\my documents\explorer.exe
%WINDIR%\globalization\rcx921.tmp в %WINDIR%\globalization\idle.exe
%WINDIR%\migration\wtr\rcxf6a.tmp в %WINDIR%\migration\wtr\spoolsv.exe
%ProgramFiles%\ih8run\rcx211e.tmp в %ProgramFiles%\ih8run\winlogon.exe
%WINDIR%\migration\wtr\rcx119c.tmp в %WINDIR%\migration\wtr\spoolsv.exe
C:\documents and settings\rcx14a9.tmp в C:\documents and settings\csrss.exe
C:\documents and settings\rcx15e2.tmp в C:\documents and settings\csrss.exe
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\rcx18e0.tmp в C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\explorer.exe
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\rcx19da.tmp в C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\explorer.exe
%ProgramFiles%\nsmdtr\rcx1d06.tmp в %ProgramFiles%\nsmdtr\idle.exe
%ProgramFiles%\nsmdtr\rcx1e01.tmp в %ProgramFiles%\nsmdtr\idle.exe
%ProgramFiles%\sdloader\rcxf7db.tmp в %ProgramFiles%\sdloader\spoolsv.exe
%WINDIR%\globalization\rcxb82.tmp в %WINDIR%\globalization\idle.exe
%ProgramFiles%\sdloader\rcxf6e0.tmp в %ProgramFiles%\sdloader\spoolsv.exe
%WINDIR%\assembly\gac_32\microsoft.security.applicationid.policymanagement.policyengineapi.interop\6.1.0.0__31bf3856ad364e35\rcxd513.tmp в %WINDIR%\assembly\gac_32\microsoft.security.applicationid.policymanagement.policyengineapi.interop\6.1.0.0__31bf3856ad364e35\wininit.exe
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\rcxc3cd.tmp в C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\system.exe
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\rcxc564.tmp в C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\system.exe
%ProgramFiles%\lotroclient\rcxc90d.tmp в %ProgramFiles%\lotroclient\wininit.exe
%ProgramFiles%\lotroclient\rcxcac2.tmp в %ProgramFiles%\lotroclient\wininit.exe
C:\totalcmd\language\rcxce3d.tmp в C:\totalcmd\language\<Имя файла>.exe
C:\totalcmd\language\rcxd002.tmp в C:\totalcmd\language\<Имя файла>.exe
%WINDIR%\assembly\gac_32\microsoft.security.applicationid.policymanagement.policyengineapi.interop\6.1.0.0__31bf3856ad364e35\rcxd3ab.tmp в %WINDIR%\assembly\gac_32\microsoft.security.applicationid.policymanagement.policyengineapi.interop\6.1.0.0__31bf3856ad364e35\wininit.exe
%ProgramFiles%\stopsignav\rcxd9a6.tmp в %ProgramFiles%\stopsignav\iexplore.exe
%ProgramFiles(x86)%\winamp\plugins\milkdrop2\presets\rcxf2c9.tmp в %ProgramFiles(x86)%\winamp\plugins\milkdrop2\presets\dwm.exe
%ProgramFiles%\stopsignav\rcxded5.tmp в %ProgramFiles%\stopsignav\iexplore.exe
%ALLUSERSPROFILE%\oracle\java\javapath\rcxe211.tmp в %ALLUSERSPROFILE%\oracle\java\javapath\spoolsv.exe
%ALLUSERSPROFILE%\oracle\java\javapath\rcxe656.tmp в %ALLUSERSPROFILE%\oracle\java\javapath\spoolsv.exe
%HOMEPATH%\application data\rcxe982.tmp в %HOMEPATH%\application data\wudfhost.exe
%HOMEPATH%\application data\rcxea8c.tmp в %HOMEPATH%\application data\wudfhost.exe
%ALLUSERSPROFILE%\package cache\{51adbf11-493f-431c-a862-967a0fae2944}\rcxed99.tmp в %ALLUSERSPROFILE%\package cache\{51adbf11-493f-431c-a862-967a0fae2944}\dwm.exe
%ALLUSERSPROFILE%\package cache\{51adbf11-493f-431c-a862-967a0fae2944}\rcxee94.tmp в %ALLUSERSPROFILE%\package cache\{51adbf11-493f-431c-a862-967a0fae2944}\dwm.exe
%ProgramFiles(x86)%\winamp\plugins\milkdrop2\presets\rcxf3e3.tmp в %ProgramFiles(x86)%\winamp\plugins\milkdrop2\presets\dwm.exe
%ProgramFiles%\ih8run\rcx2209.tmp в %ProgramFiles%\ih8run\winlogon.exe

Изменяет файл HOSTS.

Другое

Создает и запускает на исполнение

'%WINDIR%\globalization\idle.exe'
'%WINDIR%\globalization\idle.exe' ' (со скрытым окном)

Запускает на исполнение

'<SYSTEM32>\schtasks.exe' /create /tn "biAGSystem" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "Idle" /sc MINUTE /mo 6 /tr "'%WINDIR%\Globalization\Idle.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "aPsqIdle" /sc ONSTART /tr "'%WINDIR%\Globalization\Idle.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "6COYIdle" /sc ONLOGON /tr "'%WINDIR%\Globalization\Idle.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "ZI2vIdle" /sc MINUTE /mo 14 /tr "'%WINDIR%\Globalization\Idle.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "explorer" /sc MINUTE /mo 11 /tr "'C:\Users\Default\My Documents\explorer.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "YRGjexplorer" /sc ONSTART /tr "'C:\Users\Default\My Documents\explorer.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "kDpkexplorer" /sc ONLOGON /tr "'C:\Users\Default\My Documents\explorer.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "53u8explorer" /sc MINUTE /mo 5 /tr "'C:\Users\Default\My Documents\explorer.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "taskhost" /sc MINUTE /mo 9 /tr "'C:\totalcmd\LANGUAGE\taskhost.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "aDsKtaskhost" /sc ONSTART /tr "'C:\totalcmd\LANGUAGE\taskhost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "4Iwmtaskhost" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\taskhost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "FJfctaskhost" /sc MINUTE /mo 9 /tr "'C:\totalcmd\LANGUAGE\taskhost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "lsass" /sc MINUTE /mo 6 /tr "'%ALLUSERSPROFILE%\Microsoft\lsass.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "o4Yelsass" /sc ONSTART /tr "'%ALLUSERSPROFILE%\Microsoft\lsass.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "3s24lsass" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Microsoft\lsass.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "spoolsv" /sc MINUTE /mo 7 /tr "'%ProgramFiles%\sdloader\spoolsv.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "nzGFlsass" /sc MINUTE /mo 7 /tr "'%ALLUSERSPROFILE%\Microsoft\lsass.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "8Eqrspoolsv" /sc MINUTE /mo 10 /tr "'%WINDIR%\Migration\WTR\spoolsv.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "2Mszspoolsv" /sc ONLOGON /tr "'%WINDIR%\Migration\WTR\spoolsv.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "UUFywinlogon" /sc ONLOGON /tr "'%ProgramFiles%\ih8run\winlogon.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "lnsSwinlogon" /sc MINUTE /mo 7 /tr "'%ProgramFiles%\ih8run\winlogon.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "Idle" /sc MINUTE /mo 6 /tr "'%ProgramFiles%\NSMdtr\Idle.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "rI14Idle" /sc ONSTART /tr "'%ProgramFiles%\NSMdtr\Idle.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "99wWIdle" /sc ONLOGON /tr "'%ProgramFiles%\NSMdtr\Idle.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "Bg8IIdle" /sc MINUTE /mo 10 /tr "'%ProgramFiles%\NSMdtr\Idle.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "explorer" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\explorer.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "V6ikexplorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc MINUTE /mo 6 /tr "'%HOMEPATH%\Application Data\WUDFHost.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "Lipwexplorer" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc MINUTE /mo 9 /tr "'C:\Documents and Settings\csrss.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "0NYOcsrss" /sc ONSTART /tr "'C:\Documents and Settings\csrss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "KnXpcsrss" /sc ONLOGON /tr "'C:\Documents and Settings\csrss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "fh2ocsrss" /sc MINUTE /mo 14 /tr "'C:\Documents and Settings\csrss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "spoolsv" /sc MINUTE /mo 9 /tr "'%WINDIR%\Migration\WTR\spoolsv.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "5JFfspoolsv" /sc ONSTART /tr "'%WINDIR%\Migration\WTR\spoolsv.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "PcoMspoolsv" /sc ONSTART /tr "'%ProgramFiles%\sdloader\spoolsv.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "GT0Uspoolsv" /sc ONLOGON /tr "'%ProgramFiles%\sdloader\spoolsv.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "w0RTspoolsv" /sc MINUTE /mo 10 /tr "'%ProgramFiles%\sdloader\spoolsv.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "iaW8wininit" /sc ONSTART /tr "'%WINDIR%\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\wininit.exe'" /rl HIGHES...
'<SYSTEM32>\schtasks.exe' /create /tn "h9TZwininit" /sc ONLOGON /tr "'%WINDIR%\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\wininit.exe'" /rl HIGHES...
'<SYSTEM32>\schtasks.exe' /create /tn "nKvhwininit" /sc MINUTE /mo 12 /tr "'%WINDIR%\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\wininit.exe'" /rl ...
'<SYSTEM32>\schtasks.exe' /create /tn "<Имя файла>" /sc MINUTE /mo 13 /tr "'C:\totalcmd\LANGUAGE\<Имя файла>.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "QUDX<Имя файла>" /sc ONSTART /tr "'C:\totalcmd\LANGUAGE\<Имя файла>.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "JtQf<Имя файла>" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\<Имя файла>.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "ApT9<Имя файла>" /sc MINUTE /mo 13 /tr "'C:\totalcmd\LANGUAGE\<Имя файла>.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc MINUTE /mo 13 /tr "'%ProgramFiles%\lotroclient\wininit.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "Brr2wininit" /sc ONSTART /tr "'%ProgramFiles%\lotroclient\wininit.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "VQJZwininit" /sc ONLOGON /tr "'%ProgramFiles%\lotroclient\wininit.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "qqt8wininit" /sc MINUTE /mo 8 /tr "'%ProgramFiles%\lotroclient\wininit.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "System" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\System.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "AoISSystem" /sc ONSTART /tr "'C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "CcJuSystem" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "vEEjiexplore" /sc MINUTE /mo 11 /tr "'%ProgramFiles%\stopsignav\iexplore.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "yYARiexplore" /sc ONLOGON /tr "'%ProgramFiles%\stopsignav\iexplore.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc MINUTE /mo 6 /tr "'%WINDIR%\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\wininit.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "ZYc9iexplore" /sc ONSTART /tr "'%ProgramFiles%\stopsignav\iexplore.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "dwm" /sc MINUTE /mo 7 /tr "'%ProgramFiles(x86)%\Winamp\Plugins\Milkdrop2\presets\dwm.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc MINUTE /mo 9 /tr "'%ProgramFiles%\stopsignav\iexplore.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "S2rfdwm" /sc ONSTART /tr "'%ProgramFiles(x86)%\Winamp\Plugins\Milkdrop2\presets\dwm.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "igHYdwm" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Winamp\Plugins\Milkdrop2\presets\dwm.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "BlYodwm" /sc MINUTE /mo 7 /tr "'%ProgramFiles(x86)%\Winamp\Plugins\Milkdrop2\presets\dwm.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "dwm" /sc MINUTE /mo 11 /tr "'%ALLUSERSPROFILE%\Package Cache\{51adbf11-493f-431c-a862-967a0fae2944}\dwm.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "jArXdwm" /sc ONSTART /tr "'%ALLUSERSPROFILE%\Package Cache\{51adbf11-493f-431c-a862-967a0fae2944}\dwm.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "MVY3dwm" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Package Cache\{51adbf11-493f-431c-a862-967a0fae2944}\dwm.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "vRtyexplorer" /sc ONSTART /tr "'C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "riMAwinlogon" /sc ONSTART /tr "'%ProgramFiles%\ih8run\winlogon.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "XqwqWUDFHost" /sc ONSTART /tr "'%HOMEPATH%\Application Data\WUDFHost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "92bnWUDFHost" /sc ONLOGON /tr "'%HOMEPATH%\Application Data\WUDFHost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "eQEBWUDFHost" /sc MINUTE /mo 12 /tr "'%HOMEPATH%\Application Data\WUDFHost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "spoolsv" /sc MINUTE /mo 10 /tr "'%ALLUSERSPROFILE%\Oracle\Java\javapath\spoolsv.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "3DVsspoolsv" /sc ONSTART /tr "'%ALLUSERSPROFILE%\Oracle\Java\javapath\spoolsv.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "bexlspoolsv" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Oracle\Java\javapath\spoolsv.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "oECtspoolsv" /sc MINUTE /mo 8 /tr "'%ALLUSERSPROFILE%\Oracle\Java\javapath\spoolsv.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "JcAodwm" /sc MINUTE /mo 7 /tr "'%ALLUSERSPROFILE%\Package Cache\{51adbf11-493f-431c-a862-967a0fae2944}\dwm.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc MINUTE /mo 10 /tr "'%ProgramFiles%\ih8run\winlogon.exe'" /f

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней