BackDoor.DarkCrystal.9

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Synaptics Pointing Device Driver' = '%ALLUSERSPROFILE%\Synaptics\Synaptics.exe'

Creates or modifies the following files

<SYSTEM32>\tasks\cmdc
<SYSTEM32>\tasks\cmd
<SYSTEM32>\tasks\winlogon
<SYSTEM32>\tasks\iexplorei
<SYSTEM32>\tasks\webdhcpw
<SYSTEM32>\tasks\webdhcp
<SYSTEM32>\tasks\iexplore
<SYSTEM32>\tasks\wininitw
<SYSTEM32>\tasks\conhost
<SYSTEM32>\tasks\wininit
<SYSTEM32>\tasks\winlogonw

Infects the following executable files

%HOMEPATH%\desktop\dotnetfx45_full_setup.exe
%HOMEPATH%\desktop\jre-7u75-windows-i586-iftw.exe
%HOMEPATH%\desktop\notepad.exe
%HOMEPATH%\desktop\skypesetup.exe
%HOMEPATH%\desktop\winmine.exe
%HOMEPATH%\downloads\chromesetup.exe
%HOMEPATH%\downloads\icq_rfrset.exe
%HOMEPATH%\downloads\k-lite_codec_pack_1110_mega.exe
%HOMEPATH%\downloads\k-lite_codec_pack_1110_mega_dlm.exe
%HOMEPATH%\downloads\magent_rfrset.exe
%HOMEPATH%\downloads\mirc741.exe
%HOMEPATH%\downloads\opera_ni_stable.exe
%HOMEPATH%\downloads\pidgin-2.10.11.exe
%HOMEPATH%\downloads\steamsetup.exe
%HOMEPATH%\downloads\thunderbird setup 31.6.0.exe
%HOMEPATH%\downloads\winamp5666_full_all.exe

Malicious functions

Searches for windows to

detect analytical utilities:

ClassName: 'FilemonClass', WindowName: ''
ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
ClassName: 'RegmonClass', WindowName: ''

Modifies file system

Creates the following files

<Current directory>\._cache_<File name>.exe
%TEMP%\vpbi8mas.exe
%TEMP%\rcxf7cf.tmp
%TEMP%\f8tlwr2z.ico
C:\far2\encyclopedia\tap\088424020bedd6
C:\far2\encyclopedia\tap\conhost.exe
%TEMP%\rcxf484.tmp
%TEMP%\f8tlwr2z.exe
C:\far2\documentation\eng\9db6e019d4f04e
C:\far2\documentation\eng\iexplore.exe
%TEMP%\vpbi8mas.ico
%TEMP%\rcxfe94.tmp
%TEMP%\rcxeab2.tmp
%TEMP%\v1lwvv7l.exe
%TEMP%\rcxe2b6.tmp
%TEMP%\crjfeowb.ico
%TEMP%\rcxdf6a.tmp
%TEMP%\crjfeowb.exe
%ProgramFiles%\luinit\56085415360792
%ProgramFiles%\spidernt\39173848c502cc
%ProgramFiles%\spidernt\webdhcp.exe
%TEMP%\rcxeeb9.tmp
%TEMP%\74miygqb.ico
%TEMP%\rcx356.tmp
%ProgramFiles(x86)%\reference assemblies\microsoft\framework\v3.5\subsetlist\088424020bedd6
%ProgramFiles(x86)%\reference assemblies\microsoft\framework\v3.5\subsetlist\conhost.exe
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\9db6e019d4f04e
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\iexplore.exe
C:\hyperwebbrokerdllnet\6ccacd8608530f
C:\hyperwebbrokerdllnet\idle.exe
<Current directory>\480b7989c529f6
<Current directory>\wudfhost.exe
%TEMP%\rcx34d5.tmp
%TEMP%\1u96jxk2.ico
C:\far2\addons\shell\69ddcba757bf72
C:\far2\addons\shell\smss.exe
%TEMP%\rcx297e.tmp
%TEMP%\1u96jxk2.exe
%TEMP%\rcx19c5.tmp
%TEMP%\cswa7vlu.ico
%TEMP%\rcxdf1.tmp
C:\far2\encyclopedia\42af1c969fbb7b
C:\far2\encyclopedia\audiodg.exe
%TEMP%\cswa7vlu.exe
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\ebf1f9fa8afd6d
%ProgramFiles%\luinit\wininit.exe
%TEMP%\v1lwvv7l.ico
%TEMP%\rcxb992.tmp
%TEMP%\p63meslr.ico
%HOMEPATH%\music\cc11b995f2a76d
%TEMP%\rcx3ce2.tmp
%TEMP%\k1pi3cim.ico
%TEMP%\rcx656c.tmp
%TEMP%\k1pi3cim.exe
%TEMP%\rcx5f15.tmp
%TEMP%\8dhieylm.ico
%TEMP%\rcx5b3d.tmp
%TEMP%\8dhieylm.exe
%TEMP%\rcx4617.tmp
%TEMP%\jlkonvzi.ico
%TEMP%\jlkonvzi.exe
%TEMP%\74miygqb.exe
%TEMP%\rcx366c.tmp
%TEMP%\mq4ugyaf.ico
%TEMP%\rcx2f78.tmp
%TEMP%\mq4ugyaf.exe
<Current directory>\._cache_synaptics.exe
C:\hyperwebbrokerdllnet\z896j9.vbe
C:\hyperwebbrokerdllnet\webdhcp.exe
C:\hyperwebbrokerdllnet\kkc2yahn.bat
%ALLUSERSPROFILE%\synaptics\synaptics.exe
C:\users\default user\taskhost.exe
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\cmd.exe
%TEMP%\rcx6b0a.tmp
%TEMP%\df9lvoka.exe
%TEMP%\rcx6879.tmp
%HOMEPATH%\music\winlogon.exe
<Current directory>\ebf1f9fa8afd6d
<Current directory>\cmd.exe
%TEMP%\rcxb1b4.tmp
%TEMP%\p63meslr.exe
%TEMP%\rcxad6f.tmp
%TEMP%\kkamxqgt.ico
%TEMP%\rcxab4c.tmp
%TEMP%\kkamxqgt.exe
%TEMP%\rcxa0e0.tmp
%TEMP%\hcnsf1k7.ico
%TEMP%\rcx9ac7.tmp
%TEMP%\hcnsf1k7.exe
%TEMP%\rcx8237.tmp
%TEMP%\q7kyot6j.ico
%TEMP%\rcx7d75.tmp
%TEMP%\q7kyot6j.exe
%TEMP%\rcx778b.tmp
%TEMP%\df9lvoka.ico
%TEMP%\rcx72c9.tmp
%TEMP%\rcx6c71.tmp
C:\users\default user\b75386f1303e64

Sets the 'hidden' attribute to the following files

<Current directory>\._cache_<File name>.exe
%ALLUSERSPROFILE%\synaptics\synaptics.exe
<Current directory>\._cache_synaptics.exe

Deletes the following files

%TEMP%\mq4ugyaf.exe
%TEMP%\cswa7vlu.ico
%TEMP%\cswa7vlu.exe
%TEMP%\vpbi8mas.ico
%TEMP%\vpbi8mas.exe
%TEMP%\f8tlwr2z.ico
%TEMP%\f8tlwr2z.exe
%TEMP%\v1lwvv7l.ico
%TEMP%\v1lwvv7l.exe
%TEMP%\crjfeowb.ico
%TEMP%\crjfeowb.exe
%TEMP%\p63meslr.ico
%TEMP%\p63meslr.exe
%TEMP%\kkamxqgt.ico
%TEMP%\kkamxqgt.exe
%TEMP%\hcnsf1k7.ico
%TEMP%\hcnsf1k7.exe
%TEMP%\q7kyot6j.ico
%TEMP%\q7kyot6j.exe
%TEMP%\df9lvoka.ico
%TEMP%\df9lvoka.exe
%TEMP%\74miygqb.ico
%TEMP%\74miygqb.exe
%TEMP%\k1pi3cim.ico
%TEMP%\k1pi3cim.exe
%TEMP%\8dhieylm.ico
%TEMP%\8dhieylm.exe
%TEMP%\jlkonvzi.ico
%TEMP%\jlkonvzi.exe
%TEMP%\mq4ugyaf.ico
%TEMP%\1u96jxk2.exe
%TEMP%\1u96jxk2.ico

Moves the following files

from %TEMP%\rcx2f78.tmp to %TEMP%\mq4ugyaf.exe
from %TEMP%\rcx19c5.tmp to %TEMP%\cswa7vlu.exe
from %TEMP%\rcxdf1.tmp to %TEMP%\cswa7vlu.exe
from %TEMP%\rcx356.tmp to %TEMP%\vpbi8mas.exe
from %TEMP%\rcxfe94.tmp to %TEMP%\vpbi8mas.exe
from %TEMP%\rcxf7cf.tmp to %TEMP%\f8tlwr2z.exe
from %TEMP%\rcxf484.tmp to %TEMP%\f8tlwr2z.exe
from %TEMP%\rcxeeb9.tmp to %TEMP%\v1lwvv7l.exe
from %TEMP%\rcxeab2.tmp to %TEMP%\v1lwvv7l.exe
from %TEMP%\rcxe2b6.tmp to %TEMP%\crjfeowb.exe
from %TEMP%\rcxdf6a.tmp to %TEMP%\crjfeowb.exe
from %TEMP%\rcxb992.tmp to %TEMP%\p63meslr.exe
from %TEMP%\rcxb1b4.tmp to %TEMP%\p63meslr.exe
from %TEMP%\rcxad6f.tmp to %TEMP%\kkamxqgt.exe
from %TEMP%\rcxab4c.tmp to %TEMP%\kkamxqgt.exe
from %TEMP%\rcxa0e0.tmp to %TEMP%\hcnsf1k7.exe
from %TEMP%\rcx9ac7.tmp to %TEMP%\hcnsf1k7.exe
from %TEMP%\rcx8237.tmp to %TEMP%\q7kyot6j.exe
from %TEMP%\rcx7d75.tmp to %TEMP%\q7kyot6j.exe
from %TEMP%\rcx778b.tmp to %TEMP%\df9lvoka.exe
from %TEMP%\rcx72c9.tmp to %TEMP%\df9lvoka.exe
from %TEMP%\rcx6c71.tmp to %TEMP%\74miygqb.exe
from %TEMP%\rcx6b0a.tmp to %TEMP%\74miygqb.exe
from %TEMP%\rcx6879.tmp to %TEMP%\k1pi3cim.exe
from %TEMP%\rcx656c.tmp to %TEMP%\k1pi3cim.exe
from %TEMP%\rcx5f15.tmp to %TEMP%\8dhieylm.exe
from %TEMP%\rcx5b3d.tmp to %TEMP%\8dhieylm.exe
from %TEMP%\rcx4617.tmp to %TEMP%\jlkonvzi.exe
from %TEMP%\rcx3ce2.tmp to %TEMP%\jlkonvzi.exe
from %TEMP%\rcx366c.tmp to %TEMP%\mq4ugyaf.exe
from %TEMP%\rcx297e.tmp to %TEMP%\1u96jxk2.exe
from %TEMP%\rcx34d5.tmp to %TEMP%\1u96jxk2.exe

Network activity

Connects to

'fr####s.afraid.org':80

TCP

HTTP GET requests

http://fr####s.afraid.org/api/?ac###########################################################

UDP

DNS ASK xr##.mooo.com
DNS ASK fr####s.afraid.org

Miscellaneous

Searches for the following windows

ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
ClassName: '18467-41' WindowName: ''
ClassName: 'EDIT' WindowName: ''
ClassName: 'MS_WINHELP' WindowName: ''

Creates and executes the following

'<Current directory>\._cache_<File name>.exe'
'%ALLUSERSPROFILE%\synaptics\synaptics.exe' InjUpdate
'%WINDIR%\syswow64\wscript.exe' "C:\hyperwebBrokerdllNet\Z896j9.vbe"
'<Current directory>\._cache_synaptics.exe' InjUpdate
'C:\hyperwebbrokerdllnet\webdhcp.exe'
'C:\far2\documentation\eng\iexplore.exe'
'%WINDIR%\syswow64\cmd.exe' /c ""C:\hyperwebBrokerdllNet\kkC2YahN.bat" "' (with hidden window)
'C:\far2\documentation\eng\iexplore.exe' ' (with hidden window)
'C:\hyperwebbrokerdllnet\webdhcp.exe' ' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c ""C:\hyperwebBrokerdllNet\kkC2YahN.bat" "
'<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\csrss.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "schtaskss" /sc MINUTE /mo 5 /tr "'C:\Far2\Encyclopedia\tap\schtasks.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "schtasks" /sc ONLOGON /tr "'C:\Far2\Encyclopedia\tap\schtasks.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "schtaskss" /sc MINUTE /mo 14 /tr "'C:\Far2\Encyclopedia\tap\schtasks.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\totalcmd\LANGUAGE\conhost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "conhost" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\conhost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\totalcmd\LANGUAGE\conhost.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 6 /tr "'%ProgramFiles%\swAgent\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONLOGON /tr "'%ProgramFiles%\swAgent\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 6 /tr "'%ProgramFiles%\swAgent\firefox.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\csrss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\totalcmd\LANGUAGE\Idle.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\totalcmd\LANGUAGE\Idle.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\hyperwebBrokerdllNet\taskhost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "taskhost" /sc ONLOGON /tr "'C:\hyperwebBrokerdllNet\taskhost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\hyperwebBrokerdllNet\taskhost.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 5 /tr "'%ProgramFiles%\YahooSync\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONLOGON /tr "'%ProgramFiles%\YahooSync\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 7 /tr "'%ProgramFiles%\YahooSync\firefox.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'%WINDIR%\debug\WIA\winlogon.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'%WINDIR%\debug\WIA\winlogon.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'%WINDIR%\debug\WIA\winlogon.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "Idle" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\Idle.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "schtaskss" /sc MINUTE /mo 13 /tr "'C:\Far2\Addons\SetUp\schtasks.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "schtaskss" /sc MINUTE /mo 12 /tr "'%ProgramFiles%\sporder\schtasks.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "taskhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\taskhost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "schtaskss" /sc MINUTE /mo 13 /tr "'%ProgramFiles%\MpEng\schtasks.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "schtasks" /sc ONLOGON /tr "'%ProgramFiles%\MpEng\schtasks.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "schtaskss" /sc MINUTE /mo 14 /tr "'%ProgramFiles%\MpEng\schtasks.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Far2\PluginSDK\Headers.pas\explorer.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "explorer" /sc ONLOGON /tr "'C:\Far2\PluginSDK\Headers.pas\explorer.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Far2\PluginSDK\Headers.pas\explorer.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "schtaskss" /sc MINUTE /mo 6 /tr "'C:\hyperwebBrokerdllNet\schtasks.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "schtasks" /sc ONLOGON /tr "'C:\hyperwebBrokerdllNet\schtasks.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "schtaskss" /sc MINUTE /mo 14 /tr "'C:\hyperwebBrokerdllNet\schtasks.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "schtaskss" /sc MINUTE /mo 13 /tr "'C:\Far2\Addons\SetUp\schtasks.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Far2\Documentation\eng\Idle.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "schtasks" /sc ONLOGON /tr "'C:\Far2\Addons\SetUp\schtasks.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\totalcmd\LANGUAGE\audiodg.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\audiodg.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\totalcmd\LANGUAGE\audiodg.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "servicess" /sc MINUTE /mo 6 /tr "'%ALLUSERSPROFILE%\Microsoft Toolkit\services.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "services" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Microsoft Toolkit\services.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "servicess" /sc MINUTE /mo 8 /tr "'%ALLUSERSPROFILE%\Microsoft Toolkit\services.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "schtaskss" /sc MINUTE /mo 9 /tr "'<Current directory>\schtasks.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "schtasks" /sc ONLOGON /tr "'<Current directory>\schtasks.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "schtaskss" /sc MINUTE /mo 10 /tr "'<Current directory>\schtasks.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\taskhost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\csrss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\taskhost.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "Idle" /sc ONLOGON /tr "'C:\Far2\Documentation\eng\Idle.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Far2\Addons\Shell\smss.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc ONLOGON /tr "'C:\Far2\Encyclopedia\audiodg.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\cmd.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\Far2\Encyclopedia\audiodg.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\cmd.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Far2\Encyclopedia\tap\conhost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 11 /tr "'C:\Far2\Documentation\eng\iexplore.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "conhost" /sc ONLOGON /tr "'C:\Far2\Encyclopedia\tap\conhost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\Far2\Documentation\eng\iexplore.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Far2\Encyclopedia\tap\conhost.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 9 /tr "'C:\Far2\Documentation\eng\iexplore.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\cmd.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'%ProgramFiles%\LUInit\wininit.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc ONLOGON /tr "'%ProgramFiles%\LUInit\wininit.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "webdhcp" /sc ONLOGON /tr "'%ProgramFiles%\spidernt\webdhcp.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'%ProgramFiles%\LUInit\wininit.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "webdhcpw" /sc MINUTE /mo 6 /tr "'%ProgramFiles%\spidernt\webdhcp.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'%HOMEPATH%\Music\winlogon.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'<Current directory>\cmd.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'%HOMEPATH%\Music\winlogon.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "cmd" /sc ONLOGON /tr "'<Current directory>\cmd.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'%HOMEPATH%\Music\winlogon.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'<Current directory>\cmd.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "webdhcpw" /sc MINUTE /mo 6 /tr "'%ProgramFiles%\spidernt\webdhcp.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'%ProgramFiles(x86)%\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\conhost.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\hyperwebBrokerdllNet\csrss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "smss" /sc ONLOGON /tr "'C:\Far2\Addons\Shell\smss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'C:\hyperwebBrokerdllNet\csrss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\hyperwebBrokerdllNet\csrss.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 6 /tr "'%ProgramFiles(x86)%\Windows Sidebar\iexplore.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Windows Sidebar\iexplore.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 14 /tr "'%ProgramFiles(x86)%\Windows Sidebar\iexplore.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\taskhost.exe'" /rl HIGHEST /f
'%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
'<SYSTEM32>\schtasks.exe' /create /tn "taskhost" /sc ONLOGON /tr "'C:\Users\Default User\taskhost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\taskhost.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'%ProgramFiles(x86)%\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\conhost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Far2\Documentation\eng\Idle.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "conhost" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\conhost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\iexplore.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\iexplore.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\iexplore.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\hyperwebBrokerdllNet\Idle.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "Idle" /sc ONLOGON /tr "'C:\hyperwebBrokerdllNet\Idle.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\hyperwebBrokerdllNet\Idle.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 8 /tr "'<Current directory>\WUDFHost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc ONLOGON /tr "'<Current directory>\WUDFHost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 5 /tr "'<Current directory>\WUDFHost.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Far2\Addons\Shell\smss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\Far2\Encyclopedia\audiodg.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "schtasks" /sc ONLOGON /tr "'%ProgramFiles%\sporder\schtasks.exe'" /rl HIGHEST /f

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней