Tool.NirCmd.4

Техническая информация

Вредоносные функции

Запускает на исполнение

'%WINDIR%\syswow64\taskkill.exe' /IM "IDMan.exe" /F
'%WINDIR%\syswow64\taskkill.exe' /IM "IEMonitor.exe" /F
'%WINDIR%\syswow64\taskkill.exe' /IM "IDMGrHlp.exe" /F
'%WINDIR%\syswow64\taskkill.exe' /IM "idmBroker.exe" /F
'%WINDIR%\syswow64\taskkill.exe' /IM "IDMMsgHost.exe" /F
'%WINDIR%\syswow64\taskkill.exe' /IM "MediumILStart.exe" /F
'%WINDIR%\syswow64\taskkill.exe' /IM "IDMIntegrator64.exe" /F

Запускает большое число процессов

Изменения в файловой системе

Создает следующие файлы

%TEMP%\fx.bat
%TEMP%\kr.bat
%TEMP%\r.reg
%TEMP%\r_k.reg
%TEMP%\sl.bat
%TEMP%\sm.bat
%TEMP%\sn.bat
%TEMP%\lc.exe
%TEMP%\n.exe
%TEMP%\tl.exe
%TEMP%\wget.exe
nul

Другое

Ищет следующие окна

ClassName: '' WindowName: ''

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\fx.bat" /S" (со скрытым окном)
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{6B9EB066-DA1F-4C0A-AC62-01AC892EF175}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{6B9EB066-DA1F-4C0A-AC62-01AC892EF175}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{C950922F-897A-4E13-BA38-66C8AF2E0BF7}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}" /f
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{C950922F-897A-4E13-BA38-66C8AF2E0BF7}"
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}"
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{C950922F-897A-4E13-BA38-66C8AF2E0BF7}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{C950922F-897A-4E13-BA38-66C8AF2E0BF7}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}"
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}" /f
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{0F947660-8606-420A-BAC6-51B84DD22A47}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{0F947660-8606-420A-BAC6-51B84DD22A47}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{D0FB58BB-2C07-492F-8BD0-A587E4874B4E}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{D0FB58BB-2C07-492F-8BD0-A587E4874B4E}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{6B9EB066-DA1F-4C0A-AC62-01AC892EF175}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}" /f
'%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}" /f
'%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /f
'%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}" /f
'%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" /f
'%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{C950922F-897A-4E13-BA38-66C8AF2E0BF7}" /f
'%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}"
'%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{C950922F-897A-4E13-BA38-66C8AF2E0BF7}"
'%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}"
'%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}"
'%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{D0FB58BB-2C07-492F-8BD0-A587E4874B4E}" /f
'%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{D0FB58BB-2C07-492F-8BD0-A587E4874B4E}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /f
'%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /f
'%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f
'%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}" /f
'%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}" /f
'%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}" /f
'%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}"
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{D0FB58BB-2C07-492F-8BD0-A587E4874B4E}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\Wow6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{0F947660-8606-420A-BAC6-51B84DD22A47}" /f
'%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{0F947660-8606-420A-BAC6-51B84DD22A47}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}" /f
'%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{D0FB58BB-2C07-492F-8BD0-A587E4874B4E}" /f
'%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f
'%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /f
'%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{6B9EB066-DA1F-4C0A-AC62-01AC892EF175}" /f
'%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{6B9EB066-DA1F-4C0A-AC62-01AC892EF175}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /f
'%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /f
'%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKU\.DEFAULT\Software\Classes\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" /f
'%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}" /f
'%WINDIR%\syswow64\reg.exe' query "HKU\.DEFAULT\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{C950922F-897A-4E13-BA38-66C8AF2E0BF7}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{C950922F-897A-4E13-BA38-66C8AF2E0BF7}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{D0FB58BB-2C07-492F-8BD0-A587E4874B4E}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}"
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}"
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}"
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{D0FB58BB-2C07-492F-8BD0-A587E4874B4E}"
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{0F947660-8606-420A-BAC6-51B84DD22A47}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{0F947660-8606-420A-BAC6-51B84DD22A47}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /f
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /f
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}" /f
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /f
'%WINDIR%\syswow64\whoami.exe' /user /fo list
'%WINDIR%\syswow64\reg.exe' query HKU\S-1-5-19
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{0F947660-8606-420A-BAC6-51B84DD22A47}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{0F947660-8606-420A-BAC6-51B84DD22A47}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{6B9EB066-DA1F-4C0A-AC62-01AC892EF175}" /f
'%WINDIR%\syswow64\cmd.exe' /c whoami /user /fo list
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{6B9EB066-DA1F-4C0A-AC62-01AC892EF175}"
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /f
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Internet Download Manager" /f
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\Wow6432Node\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}"
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}"
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{0F947660-8606-420A-BAC6-51B84DD22A47}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{0F947660-8606-420A-BAC6-51B84DD22A47}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /f
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /f
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /f
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{6B9EB066-DA1F-4C0A-AC62-01AC892EF175}" /f
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKLM\Software\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}" /f
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Classes\CLSID\{6B9EB066-DA1F-4C0A-AC62-01AC892EF175}"
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}"
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{D0FB58BB-2C07-492F-8BD0-A587E4874B4E}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{D0FB58BB-2C07-492F-8BD0-A587E4874B4E}" /f
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /f
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}" /f
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{C950922F-897A-4E13-BA38-66C8AF2E0BF7}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{C950922F-897A-4E13-BA38-66C8AF2E0BF7}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}"
'%WINDIR%\syswow64\reg.exe' DELETE "HKCU\Software\Classes\Wow6432Node\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}" /f
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}"
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}"
'%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Classes\Wow6432Node\CLSID\{6B9EB066-DA1F-4C0A-AC62-01AC892EF175}"
'%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Internet Download Manager"

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней