Trojan.Siggen9.50235

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...

Creates or modifies the following files

<SYSTEM32>\tasks\fixit
<SYSTEM32>\tasks\virusscan1
<SYSTEM32>\tasks\antivirus
<SYSTEM32>\tasks\spybot
<SYSTEM32>\tasks\msmemory
<SYSTEM32>\tasks\mswindowsupdates
<SYSTEM32>\tasks\msnetwork
<SYSTEM32>\tasks\waitmessage
<SYSTEM32>\tasks\genmessage
<SYSTEM32>\tasks\virusscan
<SYSTEM32>\tasks\msmpdvd
<SYSTEM32>\tasks\mssystemmaint
<SYSTEM32>\tasks\mssound
<SYSTEM32>\tasks\msprogramcomp
<SYSTEM32>\tasks\msperformancediag
<SYSTEM32>\tasks\msiesafety
<SYSTEM32>\tasks\msie
<SYSTEM32>\tasks\mshomegroup
<SYSTEM32>\tasks\mshardware
<SYSTEM32>\tasks\msprinters
<SYSTEM32>\tasks\msaero
<SYSTEM32>\tasks\startw7
<SYSTEM32>\tasks\diskop
<SYSTEM32>\tasks\desktop
<SYSTEM32>\tasks\sfc
<SYSTEM32>\tasks\restore
<SYSTEM32>\tasks\removed
<SYSTEM32>\tasks\mrt

Malicious functions

To complicate detection of its presence in the operating system,

blocks the following features:

User Account Control (UAC)

Executes the following

'%WINDIR%\syswow64\net.exe' stop PcaSvc
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="LiveGooroo" dir=in action=allow protocol=TCP localport=1023
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="LiveGooroo2" dir=in action=allow protocol=TCP localport=5554
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="LiveGooroo3" dir=in action=allow protocol=TCP localport=5556

Modifies file system

Creates the following files

<Current directory>\adb.zip
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\folderprovider.dll.mui
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\intlprovider.dll.mui
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\logprovider.dll.mui
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\msiprovider.dll.mui
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\osprovider.dll.mui
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\smiprovider.dll.mui
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\dismprov.dll.mui
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\dmiprovider.dll.mui
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\transmogprovider.dll.mui
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\folderprovider.dll
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\intlprovider.dll
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\logprovider.dll
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\msiprovider.dll
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\osprovider.dll
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\smiprovider.dll
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\unattendprovider.dll.mui
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\wimprovider.dll.mui
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\dismcore.dll.mui
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\compatprovider.dll.mui
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\cbsprovider.dll.mui
C:\temp\lg\notes.html
C:\temp\lg\configuration.ini
C:\temp\lg\waitmessage.exe
C:\temp\lg\avmessage.exe
C:\temp\lg\about.txt
C:\temp\lg\cleanafterme.cfg
C:\temp\lg\logs\errors.txt
C:\temp\lg\mrt1.bat
<Current directory>\checkos.txt
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\cbsprovider.dll
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\compatprovider.dll
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\dismcore.dll
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\dismcoreps.dll
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\dismhost.exe
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\dismprov.dll
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\dmiprovider.dll
C:\temp\lg\output.txt.txt
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\transmogprovider.dll
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\wimprovider.dll
%HOMEPATH%\desktop\live gooroo reports\tasks.txt
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\wdscore.dll
<Current directory>\stinger.txt
<Current directory>\sysinfo.txt
<Current directory>\tasks.txt
%HOMEPATH%\desktop\live gooroo reports\about.txt
%HOMEPATH%\desktop\live gooroo reports\diagnostics.txt
%HOMEPATH%\desktop\live gooroo reports\disk.txt
<Current directory>\spyware.txt
<Current directory>\startup.txt
%HOMEPATH%\desktop\live gooroo reports\drivers.txt
%HOMEPATH%\desktop\live gooroo reports\ip.txt
%HOMEPATH%\desktop\live gooroo reports\services.txt
%HOMEPATH%\desktop\live gooroo reports\spyware.txt
%HOMEPATH%\desktop\live gooroo reports\startup.txt
%HOMEPATH%\desktop\live gooroo reports\stinger.txt
%HOMEPATH%\desktop\live gooroo reports\sysinfo.txt
%HOMEPATH%\desktop\live gooroo reports\errors.txt
%HOMEPATH%\desktop\live gooroo reports\health.txt
<Current directory>\services.txt
<Current directory>\ip.txt
<Current directory>\health.txt
C:\temp\lg\logs\sysinfo.txt
C:\temp\lg\logs\health.txt
C:\temp\lg\logs\ip.txt
C:\temp\lg\logs\tasks.txt
C:\temp\lg\logs\services.txt
C:\temp\lg\logs\spyware.txt
C:\temp\lg\logs\stinger.txt
C:\temp\lg\logs\drivers.txt
C:\temp\lg\logs\disk.txt
C:\temp\lg\logs\startup.txt
C:\temp\lg\logs\about.txt
<Current directory>\about.txt
<Current directory>\diagnostics.txt
<Current directory>\disk.txt
<Current directory>\drivers.txt
<Current directory>\errors.txt
C:\temp\lg\logs\diagnostics.txt
C:\temp\lg\notes.rtf
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\unattendprovider.dll
C:\temp\lg\spybot1.bat
C:\platfo~1\adb.exe
C:\temp\removed.exe
C:\temp\lg\uninstall.reg
C:\temp\uninstall.exe
C:\temp\lg\updates.exe
%WINDIR%\inf\i386\notice
%WINDIR%\inf\i386\wdfcoinstaller01009.dll
C:\temp\lg\usb-driver.zip
C:\temp\lg\diagnostics.zip
%WINDIR%\inf\i386\winusbcoinstaller2.dll
%WINDIR%\inf\androidwinusb86.cat
%WINDIR%\inf\androidwinusba64.cat
%WINDIR%\inf\source.properties
%WINDIR%\inf\amd64\notice
%WINDIR%\inf\amd64\wdfcoinstaller01009.dll
%WINDIR%\inf\amd64\winusbcoinstaller2.dll
%WINDIR%\inf\i386\wudfupdate_01009.dll
%WINDIR%\inf\android_winusb.inf
C:\temp\lg\adb.zip
C:\temp\lg\finish.exe
nul
<Current directory>\updates.exe
<Current directory>\usb-driver.zip
<Current directory>\finish.exe
<Current directory>\start.exe
<Current directory>\status.exe
<Current directory>\unzip.exe
<Current directory>\unzip2.exe
<Current directory>\setx.exe
<Current directory>\unzip3.exe
<Current directory>\removed.exe
<Current directory>\uninstall.reg
<Current directory>\removemessage.exe
<Current directory>\diagnostics.zip
<Current directory>\uninstall.exe
<Current directory>\completenew.bat
C:\temp\lg\status.exe
<Current directory>\unzip5.exe
%WINDIR%\inf\amd64\wudfupdate_01009.dll
C:\platfo~1\adbwinapi.dll
C:\temp\lg\gooroo.exe
C:\platfo~1\adbwinusbapi.dll
C:\temp\lg\mssystemmaint1.bat
C:\temp\lg\mssound1.bat
C:\temp\lg\msprogramcomp1.bat
C:\temp\lg\msiesafety1.bat
C:\temp\lg\msie1.bat
C:\temp\lg\mshomegroup1.bat
C:\temp\lg\msnetwork1.bat
C:\temp\lg\msmpdvd1.bat
C:\temp\lg\msprinters1.bat
C:\temp\lg\diskmxp.bat
C:\temp\lg\message.vbs
C:\temp\lg\microsoftfixit.winfilefolder.run.exe
C:\temp\lg\logo.jpg
C:\temp\lg\iefix.msi
C:\temp\lg\exefix.reg
C:\temp\lg\msaero1.bat
C:\temp\lg\fixitie.vbs
C:\temp\lg\mswindowsupdates1.bat
C:\temp\lg\memory1.bat
C:\temp\lg\removed.vbs
%WINDIR%\syswow64\adbwinapi.dll
%WINDIR%\syswow64\adbwinusbapi.dll
C:\temp\lg\cleanafterme.exe
C:\temp\lg\service.bat
C:\temp\lg\license.txt
C:\temp\lg\msmemory1.bat
C:\temp\lg\genmessage.exe
%WINDIR%\syswow64\adb.exe
C:\temp\lg\startup.vbs
C:\temp\lg\startsystemrestore.bat
C:\temp\lg\sfc1.bat
C:\temp\lg\fixuser.reg
C:\temp\lg\userfix.reg
C:\temp\lg\mshardware1.bat
C:\temp\lg\restorethemes.reg
C:\temp\lg\unzip4.vbs
C:\temp\lg\msperformancediag1.bat
C:\temp\lg\virusscan1.bat
%HOMEPATH%\desktop\live gooroo reports\license.txt

Deletes the following files

%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\cbsprovider.dll
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\transmogprovider.dll
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\unattendprovider.dll
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\wdscore.dll
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\wimprovider.dll
<Current directory>\completenew.bat
<Current directory>\adb.zip
<Current directory>\setx.exe
<Current directory>\updates.exe
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\osprovider.dll
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\smiprovider.dll
<Current directory>\usb-driver.zip
<Current directory>\status.exe
<Current directory>\unzip.exe
<Current directory>\unzip2.exe
<Current directory>\unzip3.exe
<Current directory>\unzip5.exe
<Current directory>\removed.exe
<Current directory>\uninstall.reg
<Current directory>\removemessage.exe
<Current directory>\finish.exe
<Current directory>\start.exe
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\msiprovider.dll
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\logprovider.dll
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\intlprovider.dll
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\dismcore.dll
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\dismcoreps.dll
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\dismhost.exe
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\dismprov.dll
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\dmiprovider.dll
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\cbsprovider.dll.mui
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\compatprovider.dll.mui
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\dismcore.dll.mui
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\dismprov.dll.mui
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\compatprovider.dll
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\dmiprovider.dll.mui
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\intlprovider.dll.mui
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\logprovider.dll.mui
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\msiprovider.dll.mui
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\osprovider.dll.mui
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\smiprovider.dll.mui
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\transmogprovider.dll.mui
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\unattendprovider.dll.mui
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\wimprovider.dll.mui
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\folderprovider.dll
%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\en-us\folderprovider.dll.mui
<Current directory>\diagnostics.zip
<Current directory>\uninstall.exe

Miscellaneous

Searches for the following windows

ClassName: 'WordPadClass' WindowName: ''
ClassName: 'RegEdit_RegEdit' WindowName: ''

Creates and executes the following

'<Current directory>\start.exe'
'<Current directory>\unzip2.exe'
'<Current directory>\unzip3.exe'
'<Current directory>\unzip.exe'
'<Current directory>\setx.exe' path "%PROGRAMDATA%\Oracle\Java\javapath;<SYSTEM32>;%WINDIR%;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;C:\platform-tools" /m
'<Current directory>\setx.exe' path "%PROGRAMDATA%\Oracle\Java\javapath;<SYSTEM32>;%WINDIR%;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;C:\platform-tools"
'%TEMP%\131c86c7-cb5a-44fc-980d-967858f8b276\dismhost.exe' {55A78167-99E3-4019-B609-EFB770F3DC91}
'C:\temp\lg\finish.exe'
'%WINDIR%\syswow64\cmd.exe' /c ""<Current directory>\completeNEW.bat" > NUL"' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c ""<Current directory>\completeNEW.bat" > NUL"
'%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/09/2014 /TN restore /TR c:\temp\lg\startsystemrestore.bat
'%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN sfc /TR c:\temp\lg\sfc1.bat
'%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN desktop /TR c:\temp\lg\MicrosoftFixit.WinFileFolder.Run.exe
'%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN diskop /TR c:\temp\lg\diskmxp.bat
'%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN startw7 /TR c:\temp\lg\startup.vbs
'%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN msaero /TR c:\temp\lg\msaero1.bat
'%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN msprinters /TR c:\temp\lg\msprinters1.bat
'%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN mshardware /TR c:\temp\lg\mshardware1.bat
'%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN mshomegroup /TR c:\temp\lg\mshomegroup1.bat
'%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN msie /TR c:\temp\lg\msie1.bat
'%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN msiesafety /TR c:\temp\lg\msiesafety1.bat
'%WINDIR%\syswow64\wbem\wmic.exe' startup get caption,command
'%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN fixit /TR c:\temp\lg\startup.vbs
'%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN msperformancediag /TR c:\temp\lg\msperformancediag1.bat
'%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN mssystemmaint /TR c:\temp\lg\mssystemmaint1.bat
'%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN msmpdvd /TR c:\temp\lg\msmpdvd1.bat
'%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN virusscan /TR c:\temp\lg\avmessage.exe
'%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN genmessage /TR c:\temp\lg\genmessage.exe
'%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN waitmessage /TR c:\temp\lg\waitmessage.exe
'%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN msnetwork /TR c:\temp\lg\msnetwork1.bat
'%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN mswindowsupdates /TR c:\temp\lg\mswindowsupdates1.bat
'%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN msmemory /TR c:\temp\lg\memory1.bat
'%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN spybot /TR C:\temp\lg\spybot1.bat
'%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN antivirus /TR C:\temp\lg\antivirus.exe
'%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN virusscan1 /TR C:\temp\lg\virusscan1.bat
'%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN msprogramcomp /TR c:\temp\lg\msprogramcomp1.bat
'%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN mssound /TR c:\temp\lg\mssound1.bat
'%WINDIR%\syswow64\fsutil.exe' dirty query c
'%WINDIR%\syswow64\fsutil.exe' volume diskfree C
'%WINDIR%\syswow64\fsutil.exe' fsinfo drives
'%WINDIR%\syswow64\reg.exe' ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
'%ProgramFiles(x86)%\windows nt\accessories\wordpad.exe' c:\temp\lg\notes.rtf
'%WINDIR%\syswow64\netsh.exe' interface tcp reset
'%WINDIR%\syswow64\netsh.exe' winsock reset
'%WINDIR%\syswow64\ipconfig.exe' /flushdns
'%WINDIR%\syswow64\reg.exe' Query HKLM\Hardware\Description\System\CentralProcessor\0
'%WINDIR%\syswow64\find.exe' /i "x86"
'<SYSTEM32>\cmd.exe' /c c:\temp\lg\service.bat
'<SYSTEM32>\dism.exe' /online /norestart /logpath:"c:\temp\lg\output.txt.txt" /enable-feature /ignorecheck /featurename:"TelnetServer"
'<SYSTEM32>\sc.exe' Config "TlntSvr" start= auto
'<SYSTEM32>\net.exe' START "TlntSvr"
'<SYSTEM32>\net1.exe' START "TlntSvr"
'%WINDIR%\syswow64\net1.exe' stop PcaSvc
'%WINDIR%\syswow64\net.exe' user /add liveg LiveG1
'%WINDIR%\syswow64\net.exe' localgroup administrators liveg /add
'%WINDIR%\syswow64\net1.exe' localgroup administrators liveg /add
'%WINDIR%\syswow64\net.exe' localgroup TelnetClients liveg /add
'%WINDIR%\syswow64\net1.exe' localgroup TelnetClients liveg /add
'%WINDIR%\syswow64\regedit.exe' /s c:\temp\lg\fixuser.reg
'%WINDIR%\syswow64\regedit.exe' /s uninstall.reg
'%WINDIR%\syswow64\driverquery.exe'
'%WINDIR%\syswow64\systeminfo.exe'
'%WINDIR%\syswow64\ipconfig.exe'
'%WINDIR%\syswow64\tasklist.exe'
'%WINDIR%\syswow64\tasklist.exe' /svc
'%WINDIR%\syswow64\wevtutil.exe' qe System /c:40 /rd:true /f:text
'%WINDIR%\syswow64\net1.exe' user /add liveg LiveG1
'%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN removed /TR C:\temp\removed.exe
'%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /ST 12:00:00 /SD 01/05/2014 /TN mrt /TR C:\temp\lg\mrt1.bat

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial