Trojan.Siggen17.36959

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '"C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\csrss.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'lsass' = '"%ALLUSERSPROFILE%\Application Data\lsass.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'firefox' = '"C:\totalcmd\LANGUAGE\firefox.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'dwm' = '"%ALLUSERSPROFILE%\dwm.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'lsass' = '"%WINDIR%\LiveKernelReports\lsass.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'services' = '"C:\Users\Default\SendTo\services.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'firefox' = '"C:\Users\Public\Downloads\firefox.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplore' = '"%ProgramFiles%\vsmon\iexplore.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '"C:\Far2\FExcept\csrss.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplore' = '"C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\iexplore.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'services' = '"%WINDIR%\inf\Windows Workflow Foundation 4.0.0.0\services.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'smss' = '"%ALLUSERSPROFILE%\Adobe\ARM\Reader_15.007.20033\smss.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'Idle' = '"C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\Idle.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '"%ProgramFiles(x86)%\Windows Mail\en-US\csrss.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'audiodg' = '"C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\audiodg.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'WUDFHost' = '"C:\totalcmd\LANGUAGE\WUDFHost.exe"'
[<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\csrss.exe", "%WINDIR%\Globalization\MCT\MCT-CA\Theme\<F...
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] '<File name>' = '"%WINDIR%\Globalization\MCT\MCT-CA\Theme\<File name>.exe"'
[<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\csrss.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplore' = '"%WINDIR%\Vss\iexplore.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'explorer' = '"C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\explorer.exe"'

Creates or modifies the following files

<SYSTEM32>\tasks\csrss
<SYSTEM32>\tasks\lsassl
<SYSTEM32>\tasks\dwmd
<SYSTEM32>\tasks\dwm
<SYSTEM32>\tasks\firefoxf
<SYSTEM32>\tasks\firefox
<SYSTEM32>\tasks\lsass
<SYSTEM32>\tasks\servicess
<SYSTEM32>\tasks\smsss
<SYSTEM32>\tasks\services
<SYSTEM32>\tasks\iexplorei
<SYSTEM32>\tasks\iexplore
<SYSTEM32>\tasks\smss
<SYSTEM32>\tasks\idlei
<SYSTEM32>\tasks\idle
<SYSTEM32>\tasks\audiodga
<SYSTEM32>\tasks\audiodg
<SYSTEM32>\tasks\wudfhostw
<SYSTEM32>\tasks\wudfhost
<SYSTEM32>\tasks\<File name>g
<SYSTEM32>\tasks\<File name>
<SYSTEM32>\tasks\csrssc
<SYSTEM32>\tasks\explorer
<SYSTEM32>\tasks\explorere

Malicious functions

To complicate detection of its presence in the operating system,

blocks the following features:

User Account Control (UAC)

Reads files which store third party applications passwords

%ProgramFiles(x86)%\steam\config\config.vdf
%ProgramFiles(x86)%\steam\config\dialogconfig.vdf
%LOCALAPPDATA%\google\chrome\user data\default\cookies
%APPDATA%\opera software\opera stable\login data
%LOCALAPPDATA%\google\chrome\user data\default\login data
%LOCALAPPDATA%\google\chrome\user data\default\web data

Modifies file system

Creates the following files

C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\csrss.exe
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\rcx6.tmp
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\rcxff0b.tmp
%ALLUSERSPROFILE%\application data\rcxfc2d.tmp
%ALLUSERSPROFILE%\application data\rcxfb42.tmp
C:\totalcmd\language\rcxf844.tmp
C:\totalcmd\language\rcxf74a.tmp
%ALLUSERSPROFILE%\rcxf46c.tmp
%ALLUSERSPROFILE%\rcxf390.tmp
%WINDIR%\livekernelreports\rcxf0a2.tmp
%WINDIR%\livekernelreports\rcxefa8.tmp
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\rcx313.tmp
C:\users\default\sendto\rcxecba.tmp
C:\users\public\downloads\rcxe8f1.tmp
C:\users\public\downloads\rcxe815.tmp
%ProgramFiles%\vsmon\rcxe537.tmp
%ProgramFiles%\vsmon\rcxe43d.tmp
C:\far2\fexcept\rcxe14f.tmp
C:\far2\fexcept\rcxe045.tmp
%WINDIR%\inf\windows workflow foundation 4.0.0.0\rcxdd28.tmp
%WINDIR%\inf\windows workflow foundation 4.0.0.0\rcxdc3d.tmp
%WINDIR%\vss\rcxd94f.tmp
%WINDIR%\vss\rcxd855.tmp
C:\users\default\sendto\rcxebcf.tmp
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\rcx3fe.tmp
%TEMP%\ed98ee82-8a2b-4f1a-9b27-49974bfb49d8.vbs
%TEMP%\54263a03ad1234cf15e91b253906cdef37b8b3b1.exe
%TEMP%\jm32rcitxs
%TEMP%\gpjizby8ym
%TEMP%\rx3etwztoa
%TEMP%\yvfbgyxc05
%TEMP%\wnnngsit5x
%TEMP%\znr8yyuob6
%TEMP%\3nvguhrtki
%TEMP%\akdikj8f6s
%TEMP%\9r815omadq
%TEMP%\3mbghr7rsr
%TEMP%\ptfxl8nr3h
%TEMP%\js0hzwfzqx
%TEMP%\cdcirh4poo
%TEMP%\xdicdgatg0
%TEMP%\vzz9z36mff
%TEMP%\6kc9bmj6n4
%TEMP%\qwiuwuzfrl
%TEMP%\o5httelsif
%TEMP%\vwsi7i4nke
%TEMP%\2xweujvyzj
%TEMP%\rsnoj0ydd1
%TEMP%\u7dkz6rppg
%TEMP%\5f37b673-5f86-4638-a6e6-811fd9117ec3.vbs
%ALLUSERSPROFILE%\adobe\arm\reader_15.007.20033\rcxd576.tmp
%TEMP%\5tzojjijnu
%ALLUSERSPROFILE%\adobe\arm\reader_15.007.20033\rcxd47c.tmp
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\rcxd0b3.tmp
C:\users\public\downloads\firefox.exe
%ProgramFiles%\vsmon\9db6e019d4f04e
%ProgramFiles%\vsmon\iexplore.exe
C:\far2\fexcept\886983d96e3d3e
C:\far2\fexcept\csrss.exe
%WINDIR%\inf\windows workflow foundation 4.0.0.0\c5b4cb5e9653cc
%WINDIR%\inf\windows workflow foundation 4.0.0.0\services.exe
%WINDIR%\vss\9db6e019d4f04e
%WINDIR%\vss\iexplore.exe
%ALLUSERSPROFILE%\adobe\arm\reader_15.007.20033\69ddcba757bf72
C:\users\public\downloads\0fc223bdacedc3
%ALLUSERSPROFILE%\adobe\arm\reader_15.007.20033\smss.exe
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\idle.exe
%ProgramFiles(x86)%\windows mail\en-us\886983d96e3d3e
%ProgramFiles(x86)%\windows mail\en-us\csrss.exe
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\42af1c969fbb7b
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\audiodg.exe
C:\totalcmd\language\480b7989c529f6
C:\totalcmd\language\wudfhost.exe
%WINDIR%\globalization\mct\mct-ca\theme\77772f2dac59a9
%WINDIR%\globalization\mct\mct-ca\theme\<File name>.exe
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\886983d96e3d3e
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\6ccacd8608530f
C:\users\default\sendto\services.exe
C:\users\default\sendto\c5b4cb5e9653cc
%WINDIR%\livekernelreports\lsass.exe
%ProgramFiles(x86)%\windows mail\en-us\rcxcdc5.tmp
%ProgramFiles(x86)%\windows mail\en-us\rcxccca.tmp
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\rcxc9dc.tmp
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\rcxc8e2.tmp
C:\totalcmd\language\rcxc604.tmp
C:\totalcmd\language\rcxc519.tmp
%WINDIR%\globalization\mct\mct-ca\theme\rcxc22b.tmp
%WINDIR%\globalization\mct\mct-ca\theme\rcxc140.tmp
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\rcxbd39.tmp
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\rcxbbe1.tmp
<Current directory>\rcxb848.tmp
<Current directory>\rcxb605.tmp
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\7a0fd90576e088
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\explorer.exe
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\9db6e019d4f04e
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\iexplore.exe
%ALLUSERSPROFILE%\application data\6203df4a6bafc7
%ALLUSERSPROFILE%\application data\lsass.exe
C:\totalcmd\language\0fc223bdacedc3
C:\totalcmd\language\firefox.exe
%ALLUSERSPROFILE%\6cb0b6c459d5d3
%ALLUSERSPROFILE%\dwm.exe
%WINDIR%\livekernelreports\6203df4a6bafc7
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\rcxd19e.tmp
%TEMP%\3sm6be9zoo

Sets the 'hidden' attribute to the following files

<Full path to file>
%ALLUSERSPROFILE%\application data\lsass.exe
C:\totalcmd\language\firefox.exe
%ALLUSERSPROFILE%\dwm.exe
%WINDIR%\livekernelreports\lsass.exe
C:\users\default\sendto\services.exe
C:\users\public\downloads\firefox.exe
%ProgramFiles%\vsmon\iexplore.exe
C:\far2\fexcept\csrss.exe
%WINDIR%\inf\windows workflow foundation 4.0.0.0\services.exe
%WINDIR%\vss\iexplore.exe
%ALLUSERSPROFILE%\adobe\arm\reader_15.007.20033\smss.exe
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\idle.exe
%ProgramFiles(x86)%\windows mail\en-us\csrss.exe
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\audiodg.exe
C:\totalcmd\language\wudfhost.exe
%WINDIR%\globalization\mct\mct-ca\theme\<File name>.exe
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\csrss.exe
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\iexplore.exe
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\explorer.exe

Deletes the following files

%TEMP%\u7dkz6rppg
%TEMP%\jm32rcitxs
%TEMP%\gpjizby8ym
%TEMP%\rx3etwztoa
%TEMP%\yvfbgyxc05
%TEMP%\wnnngsit5x
%TEMP%\znr8yyuob6
%TEMP%\3nvguhrtki
%TEMP%\akdikj8f6s
%TEMP%\9r815omadq
%TEMP%\3mbghr7rsr
%TEMP%\ptfxl8nr3h
%TEMP%\js0hzwfzqx
%TEMP%\cdcirh4poo
%TEMP%\xdicdgatg0
%TEMP%\vzz9z36mff
%TEMP%\6kc9bmj6n4
%TEMP%\qwiuwuzfrl
%TEMP%\o5httelsif
%TEMP%\vwsi7i4nke
%TEMP%\2xweujvyzj
%TEMP%\rsnoj0ydd1
%TEMP%\5tzojjijnu
%TEMP%\3sm6be9zoo

Moves the following files

from <Current directory>\rcxb848.tmp to <Full path to file>
from %ProgramFiles%\vsmon\rcxe43d.tmp to %ProgramFiles%\vsmon\iexplore.exe
from %ProgramFiles%\vsmon\rcxe537.tmp to %ProgramFiles%\vsmon\iexplore.exe
from C:\users\public\downloads\rcxe815.tmp to C:\users\public\downloads\firefox.exe
from C:\users\public\downloads\rcxe8f1.tmp to C:\users\public\downloads\firefox.exe
from C:\users\default\sendto\rcxebcf.tmp to C:\users\default\sendto\services.exe
from C:\users\default\sendto\rcxecba.tmp to C:\users\default\sendto\services.exe
from %WINDIR%\livekernelreports\rcxefa8.tmp to %WINDIR%\livekernelreports\lsass.exe
from %ALLUSERSPROFILE%\rcxf390.tmp to %ALLUSERSPROFILE%\dwm.exe
from C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\rcx313.tmp to C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\explorer.exe
from %ALLUSERSPROFILE%\rcxf46c.tmp to %ALLUSERSPROFILE%\dwm.exe
from C:\totalcmd\language\rcxf74a.tmp to C:\totalcmd\language\firefox.exe
from C:\totalcmd\language\rcxf844.tmp to C:\totalcmd\language\firefox.exe
from %ALLUSERSPROFILE%\application data\rcxfb42.tmp to %ALLUSERSPROFILE%\application data\lsass.exe
from %ALLUSERSPROFILE%\application data\rcxfc2d.tmp to %ALLUSERSPROFILE%\application data\lsass.exe
from C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\rcxff0b.tmp to C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\iexplore.exe
from C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\rcx6.tmp to C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\iexplore.exe
from C:\far2\fexcept\rcxe14f.tmp to C:\far2\fexcept\csrss.exe
from %WINDIR%\livekernelreports\rcxf0a2.tmp to %WINDIR%\livekernelreports\lsass.exe
from C:\far2\fexcept\rcxe045.tmp to C:\far2\fexcept\csrss.exe
from C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\rcxc9dc.tmp to C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\audiodg.exe
from C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\rcxbbe1.tmp to C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\csrss.exe
from C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\rcxbd39.tmp to C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\csrss.exe
from %WINDIR%\globalization\mct\mct-ca\theme\rcxc140.tmp to %WINDIR%\globalization\mct\mct-ca\theme\<File name>.exe
from %WINDIR%\globalization\mct\mct-ca\theme\rcxc22b.tmp to %WINDIR%\globalization\mct\mct-ca\theme\<File name>.exe
from C:\totalcmd\language\rcxc519.tmp to C:\totalcmd\language\wudfhost.exe
from C:\totalcmd\language\rcxc604.tmp to C:\totalcmd\language\wudfhost.exe
from C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\rcxc8e2.tmp to C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\audiodg.exe
from %ProgramFiles(x86)%\windows mail\en-us\rcxccca.tmp to %ProgramFiles(x86)%\windows mail\en-us\csrss.exe
from %WINDIR%\inf\windows workflow foundation 4.0.0.0\rcxdc3d.tmp to %WINDIR%\inf\windows workflow foundation 4.0.0.0\services.exe
from %ProgramFiles(x86)%\windows mail\en-us\rcxcdc5.tmp to %ProgramFiles(x86)%\windows mail\en-us\csrss.exe
from C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\rcxd0b3.tmp to C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\idle.exe
from C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\rcxd19e.tmp to C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\idle.exe
from %ALLUSERSPROFILE%\adobe\arm\reader_15.007.20033\rcxd47c.tmp to %ALLUSERSPROFILE%\adobe\arm\reader_15.007.20033\smss.exe
from %ALLUSERSPROFILE%\adobe\arm\reader_15.007.20033\rcxd576.tmp to %ALLUSERSPROFILE%\adobe\arm\reader_15.007.20033\smss.exe
from %WINDIR%\vss\rcxd855.tmp to %WINDIR%\vss\iexplore.exe
from %WINDIR%\vss\rcxd94f.tmp to %WINDIR%\vss\iexplore.exe
from %WINDIR%\inf\windows workflow foundation 4.0.0.0\rcxdd28.tmp to %WINDIR%\inf\windows workflow foundation 4.0.0.0\services.exe
from C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\rcx3fe.tmp to C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\explorer.exe

Network activity

Connects to

'lk######fkjjsfh.drive-35.ru':80
'ap#.##legram.org':443
'ip##fo.io':443

TCP

HTTP GET requests

http://lk######fkjjsfh.drive-35.ru/eternalFlower.php?60##########################################################################################################################################...
http://lk######fkjjsfh.drive-35.ru/eternalFlower.php?bc##########################################################################################################################################...

Other

'ap#.##legram.org':443
'ip##fo.io':443

UDP

DNS ASK lk######fkjjsfh.drive-35.ru
DNS ASK ap#.##legram.org
DNS ASK ip##fo.io

Miscellaneous

Creates and executes the following

'%WINDIR%\vss\iexplore.exe'
'<SYSTEM32>\wscript.exe' "%TEMP%\ed98ee82-8a2b-4f1a-9b27-49974bfb49d8.vbs"
'<SYSTEM32>\wscript.exe' "%TEMP%\5f37b673-5f86-4638-a6e6-811fd9117ec3.vbs"
'%WINDIR%\vss\iexplore.exe' ' (with hidden window)

Executes the following

'<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc MINUTE /mo 12 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\csrss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'%WINDIR%\LiveKernelReports\lsass.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "lsass" /sc ONSTART /tr "'%WINDIR%\LiveKernelReports\lsass.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "lsass" /sc ONLOGON /tr "'%WINDIR%\LiveKernelReports\lsass.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "lsass" /sc MINUTE /mo 7 /tr "'%WINDIR%\LiveKernelReports\lsass.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Users\Default\SendTo\services.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "services" /sc ONSTART /tr "'C:\Users\Default\SendTo\services.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "services" /sc ONLOGON /tr "'C:\Users\Default\SendTo\services.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "services" /sc MINUTE /mo 13 /tr "'C:\Users\Default\SendTo\services.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Downloads\firefox.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONSTART /tr "'C:\Users\Public\Downloads\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONLOGON /tr "'C:\Users\Public\Downloads\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Downloads\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 10 /tr "'%ProgramFiles%\vsmon\iexplore.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONSTART /tr "'%ProgramFiles%\vsmon\iexplore.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'%ProgramFiles%\vsmon\iexplore.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Far2\FExcept\csrss.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc MINUTE /mo 10 /tr "'%ProgramFiles%\vsmon\iexplore.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "dwm" /sc MINUTE /mo 6 /tr "'%ALLUSERSPROFILE%\dwm.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "dwm" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\dwm.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\explorer.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "explorer" /sc MINUTE /mo 5 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\explorer.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 6 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\iexplore.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONSTART /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\iexplore.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\iexplore.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc MINUTE /mo 5 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\iexplore.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'%ALLUSERSPROFILE%\Application Data\lsass.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "lsass" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Application Data\lsass.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "smsss" /sc MINUTE /mo 8 /tr "'%ALLUSERSPROFILE%\Adobe\ARM\Reader_15.007.20033\smss.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "lsass" /sc MINUTE /mo 9 /tr "'%ALLUSERSPROFILE%\Application Data\lsass.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 13 /tr "'C:\totalcmd\LANGUAGE\firefox.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONSTART /tr "'C:\totalcmd\LANGUAGE\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc MINUTE /mo 8 /tr "'C:\totalcmd\LANGUAGE\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'%ALLUSERSPROFILE%\dwm.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "dwm" /sc ONSTART /tr "'%ALLUSERSPROFILE%\dwm.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONSTART /tr "'C:\Far2\FExcept\csrss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'C:\Far2\FExcept\csrss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc MINUTE /mo 12 /tr "'C:\Far2\FExcept\csrss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc ONSTART /tr "'C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\audiodg.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\audiodg.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\audiodg.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 11 /tr "'C:\totalcmd\LANGUAGE\WUDFHost.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc ONSTART /tr "'C:\totalcmd\LANGUAGE\WUDFHost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\WUDFHost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc MINUTE /mo 10 /tr "'C:\totalcmd\LANGUAGE\WUDFHost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "<File name>g" /sc MINUTE /mo 6 /tr "'%WINDIR%\Globalization\MCT\MCT-CA\Theme\<File name>.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "<File name>" /sc ONSTART /tr "'%WINDIR%\Globalization\MCT\MCT-CA\Theme\<File name>.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "<File name>" /sc ONLOGON /tr "'%WINDIR%\Globalization\MCT\MCT-CA\Theme\<File name>.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "<File name>" /sc MINUTE /mo 8 /tr "'%WINDIR%\Globalization\MCT\MCT-CA\Theme\<File name>.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\csrss.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONSTART /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\csrss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\csrss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc MINUTE /mo 13 /tr "'%ProgramFiles(x86)%\Windows Mail\en-US\csrss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Windows Mail\en-US\csrss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\audiodg.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONSTART /tr "'%ProgramFiles(x86)%\Windows Mail\en-US\csrss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "servicess" /sc MINUTE /mo 14 /tr "'%WINDIR%\inf\Windows Workflow Foundation 4.0.0.0\services.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'%ProgramFiles(x86)%\Windows Mail\en-US\csrss.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "services" /sc ONSTART /tr "'%WINDIR%\inf\Windows Workflow Foundation 4.0.0.0\services.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "services" /sc ONLOGON /tr "'%WINDIR%\inf\Windows Workflow Foundation 4.0.0.0\services.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "services" /sc MINUTE /mo 12 /tr "'%WINDIR%\inf\Windows Workflow Foundation 4.0.0.0\services.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 5 /tr "'%WINDIR%\Vss\iexplore.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONSTART /tr "'%WINDIR%\Vss\iexplore.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'%WINDIR%\Vss\iexplore.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "lsass" /sc ONSTART /tr "'%ALLUSERSPROFILE%\Application Data\lsass.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "explorer" /sc ONSTART /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\explorer.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "smss" /sc ONSTART /tr "'%ALLUSERSPROFILE%\Adobe\ARM\Reader_15.007.20033\smss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "smss" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Adobe\ARM\Reader_15.007.20033\smss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "smss" /sc MINUTE /mo 7 /tr "'%ALLUSERSPROFILE%\Adobe\ARM\Reader_15.007.20033\smss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\Idle.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "Idle" /sc ONSTART /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\Idle.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\Idle.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "Idle" /sc MINUTE /mo 8 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\Idle.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc MINUTE /mo 11 /tr "'%WINDIR%\Vss\iexplore.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\explorer.exe'" /f

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial