Trojan.StartPage.47710

Technical Information

Malicious functions:

Executes the following:

<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {2877a654-1c9f-4cb5-8438-16022b2fdd9c}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {28188849-393f-42dc-bc29-676a2b78a059}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {2731c719-b8c5-4282-993d-b5ad0e77531d}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {291bccc1-6890-484a-89d3-318c928dac1b}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {28d23db1-ecd5-411d-828d-4ca547320182}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {28cfd934-9aad-4b84-947a-05e72cf655b1}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {26df2e07-6a86-4d94-bd24-a7d183f794ea}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {2388cb34-ae30-435f-86b7-6afd3a016f90}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {2361de61-056e-4442-ad1b-b7fac11df3a0}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {231f6fab-eced-4975-9ef2-c0c7bc81927b}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {25f97eb4-1c02-45ba-ba0c-e67aace64d4a}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {25d8bacf-3de2-4b48-ae22-d659b8d835b0}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {25557344-d3f8-441e-bc05-6dd9872ef925}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {2e8053c0-5d39-449d-9e6f-7165fd7d5db1}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {2e51ec4e-2fa9-40fa-9007-2411de34e7ca}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {2e4a4a8f-d725-1fb0-30dd-e04f9268c2cf}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {2ea061b2-11b5-4c4b-b385-f378b4b48648}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {2e9dddba-a2c0-4b42-998d-24dc8ad5c2d7}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {2e9937fc-cf2f-4f56-af54-5a6a3dd375cc}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {2df69f3c-56fa-4c5b-99e5-be861443de46}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {2ba521ac-b9b9-4433-ba45-dba2f02cba5a}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {2b721a27-d5e6-45fb-8f9c-a8d6aa4bf00d}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {2a0176fe-008b-4706-90f5-bba532a49731}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {2d6a91cf-37c6-4eb2-a8d8-f65f1db14ece}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {2cda7e11-6ecb-42bd-adce-5b86b7ca8969}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {2cb70935-c5d6-46a5-8785-4f5ecbf25a6f}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {22e03916-85c5-44b0-8dc9-1830c11238d9}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {1b7f9277-46dc-4938-a28e-910497149e72}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {1b6062a1-4ccd-400c-b2b4-e73a052d110c}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {1b5d40f4-4a4b-4202-89e8-eeba91293b3d}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {1c78ab3f-a857-482e-80c0-3a1e5238a565}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {1bb22d38-a411-4b13-a746-c2a4f4ec7344}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {1bac9a2a-4755-43c3-a430-d3512c5b8a4e}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {1b2588f5-45ce-4322-b755-d79944ad1b17}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {1a615ea8-4c56-49ee-be83-f9a264b79997}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {1962c5bc-e475-465b-823b-133e711bceb9}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {19480e4e-f264-4dfb-b991-c35664edbe49}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {1ac612ff-5065-4d98-8e76-66d2a34f7222}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {1a700eff-20f9-406c-b2c6-490bbbb30925}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {1a68b962-733c-46e5-ab75-a6d9796ea632}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {20b2f78b-e534-434e-b2d8-c77eaca12141}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {1fe2ebe5-42ff-4586-a144-ca420c84ff6a}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {1f2f95d9-bafd-4769-85a2-4169957db67e}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {22222222-2222-2222-2222-220022222258}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {2178c864-b8bc-41ae-a1fb-eb6a32f87eb1}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {21317ee7-275f-477f-baff-93a523b8dc64}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {1ed6a320-8af3-4f06-868a-9ba95585712e}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {1d0f7e4c-6dc1-90f8-4498-c4d7a97204c6}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {1d085c0a-e4f4-4f66-bdbf-4be51015bfc3}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {1cbf31fc-3c23-4ba6-af16-2cec501bd837}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {1e9ae952-269d-422b-9eab-b12803b8e22b}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {1e369edc-f64b-484f-b76a-6fefcb883f84}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {1e0de227-5ce4-4ea3-ab0c-8b03e1aa76bc}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {3f3714a9-89a4-46be-8af3-d0c9d1fb03f9}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {3e7c8b5a-96ab-438f-bf9b-782400655440}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {3e720453-b472-4954-b7aa-33069eb53906}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {421c1b53-dafb-4c55-9a5f-efba47d935b1}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {410d0ce8-6014-4f1d-9c3b-79d53a9245f9}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {3fe18adb-116b-4327-8fb8-f125b4cc2f51}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {3db422e6-cb77-472e-865e-474c2a6893d7}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {3d206148-6081-42e4-be5f-614ff2c73ce0}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {3d0bdab3-12f4-471c-8966-e35a2c6c7de7}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {3d05ee77-1305-438e-9e10-81d2f5d913ad}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {3d801591-e6a9-4860-bbd3-d528cac807b7}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {3d475351-3508-4de9-a7c0-b0ceb0859fbe}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {3d3628df-f34d-4dc2-ac8c-c89220aefc69}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {462be121-2b54-4218-bf00-b9bf8135b23f}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {4608db1b-c4e9-417b-8409-a645ddbe1a09}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {45a2e207-6bba-49e0-bce2-e2542f0ad7b7}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {49c96360-9da5-4e3a-8ff4-fad8e79dabf2}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {47e4e558-8835-4ea4-b3a8-628b6e0d5ebb}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {46caa407-fbfa-4911-9d50-93f8cdeda9d6}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {44a0f348-5ca1-45de-b346-7d9d88329200}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {439c8689-af56-4668-90fc-1452dd6ceb7d}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {438c2e7a-7327-4f2f-90d9-25400538f3f3}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {4319648b-98dc-4101-80c9-62f553da51de}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {448e181c-161a-4021-b8d5-6caf25d83d15}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {442ae524-eba5-4b17-82f3-888d68bc999a}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {43fd477d-9cc4-4e0c-a417-bd1741923340}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {3cb4c6b3-3576-45cc-aa1f-287141a9f29e}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {32eff74a-2d8f-4f05-bb36-60bf1a765452}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {32d9c40f-793b-47ee-aa7c-45686f307b41}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {31c7d459-9cc3-44f2-9dca-fc11795309b4}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {33727f97-486d-4d19-97c3-23f432ef93fc}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {336d0c35-8a85-403a-b9d2-65c292c39087}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {33333333-3333-3333-3333-330033223358}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {31af2c4c-c0f5-4478-8f6c-477026348c86}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {2feb0820-1f47-4579-8322-daefb255c273}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {2f13f84e-cf84-4416-bf38-86d17e1d2c81}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {2eecd738-5844-4a99-b4b6-146bf802613b}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {311873ad-4e97-41e4-8e32-85d6dcf38b3b}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {30f9b915-b755-4826-820b-08fba6bd249d}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {3041d03e-fd4b-44e0-b742-2d9b88305f98}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {3a4336e3-ca32-44df-9d3e-46c65d58bb62}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {3a188115-b81b-48f2-a958-f974c8f3f309}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {38bc6857-67fa-4358-afae-28e0f9ad2128}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {3c471948-f874-49f5-b338-4f214a2ee0b1}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {3bdf6d05-34ce-4ad8-93b4-08358fab2e11}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {3bd44f0e-0596-4008-aee0-45d47e3a8f0e}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {37540f19-dd4c-478b-b2df-c19281bcaf27}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {348bd83c-b2cd-4319-a605-c96bb458dd80}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {33e31d42-9e93-4e81-a16d-5a05e4721419}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {3385e2d6-567b-4fc6-8f0f-d7a8c6e6118c}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {35c1605e-438b-4d64-aab1-8885f097a9b1}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {35a98f6e-9322-4cde-ae38-b284b6bed648}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {34f459b8-1d37-4ff2-9efa-192d8e3aba6f}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {0290bf93-2a4d-4b1a-b43d-0789441b7f67}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {0231292d-63c1-4731-a82d-f126f11ee8b3}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {020b192b-60fc-4301-bfd4-9d86668d3ff8}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {047773d7-f320-4fd1-8e8a-39fc582e437c}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {03cddd3d-68d7-4b12-9bd8-54de251c460b}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {02ffc86e-283e-4faa-95d6-addca024f30a}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {01bc00c7-1125-4e41-bd93-3266121fe690}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {000f18f2-09eb-4a59-82b2-5ae4184c39c3}
<SYSTEM32>\taskkill.exe /f /im visicom_antiphishing.exe
<SYSTEM32>\taskkill.exe /f /im uninstall.exe
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {011f9246-da13-4555-9998-6e4805bd533f}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {00cbb66b-1d3b-46d3-9577-323a336acb50}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {00a6faf1-072e-44cf-8957-5838f569a31d}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {07b18eac-a523-4961-b6bb-170de4475cca}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {078fed71-52f2-4a49-a0ab-6453e2ca72ba}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {074e329a-2728-4255-8f51-cb2eaa0f1027}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {08858af6-42ad-4914-95d2-ac3ab0dc8e28}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {082c74b9-c1a7-42b0-a2a3-e520e1ea81d1}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {07b7f771-1b8e-4b7b-823e-ffac1732aa9f}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {0722a2ac-4cf8-4310-afee-f87aa9be10aa}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {05d31295-1b4c-4812-8776-5cc1df279aaf}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {04c7b109-8162-a0d6-b186-dbe176064a3e}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {0494d0de-f8e0-41ad-92a3-14154ece70ac}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {06c050b6-ce38-4f3a-b865-5707182d6e3c}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {067c5591-c9fb-4dcc-835f-6cb5dc169d41}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {063812c7-dbeb-467f-a9c2-8270462f54f9}
<SYSTEM32>\taskkill.exe /f /im questscan.exe
<SYSTEM32>\reg.exe query "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-20" /v "ProfileImagePath"
<SYSTEM32>\reg.exe query "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-19" /v "ProfileImagePath"
<SYSTEM32>\findstr.exe /iec:"\\%USERNAME%"
<SYSTEM32>\taskkill.exe /f /im clickoncesetup.exe
<SYSTEM32>\taskkill.exe /f /im iexplore.exe
<SYSTEM32>\reg.exe query "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-2052111302-484763869-725345543-1003" /v "ProfileImagePath"
<SYSTEM32>\reg.exe query "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18" /v "ProfileImagePath"
<SYSTEM32>\reg.exe QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName
<SYSTEM32>\mode.com con cols=100 lines=60
<SYSTEM32>\cmd.exe /c ""C:\JRT\get.bat" "
<SYSTEM32>\findstr.exe /ibc:"HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-"
<SYSTEM32>\reg.exe query "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList"
<SYSTEM32>\reg.exe IMPORT C:\JRT\startpage_x86.reg
<SYSTEM32>\taskkill.exe /f /im babylonhelper.exe
<SYSTEM32>\taskkill.exe /f /im babylon.exe
<SYSTEM32>\taskkill.exe /f /im sweetim.exe
<SYSTEM32>\taskkill.exe /f /im iwintrusted.exe
<SYSTEM32>\taskkill.exe /f /im funmoodssrv.exe
<SYSTEM32>\taskkill.exe /f /im babylontc.exe
<SYSTEM32>\taskkill.exe /f /im optproreminder.exe
<SYSTEM32>\taskkill.exe /f /im defaulttabsearch.exe
<SYSTEM32>\taskkill.exe /f /im datamngrui.exe
<SYSTEM32>\taskkill.exe /f /im dtupdate.exe
<SYSTEM32>\taskkill.exe /f /im iminent.exe
<SYSTEM32>\taskkill.exe /f /im iminent.messengers.exe
<SYSTEM32>\taskkill.exe /f /im extensionupdaterservice.exe
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {1450c9ca-50a7-5b2a-aa7b-101798c0b1a8}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {13c9f1f9-2322-4d5c-81df-6d4bf8476ba4}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {1392b8d2-5c05-419f-a8f6-b9f15a596612}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {1564bbf5-15d3-41d2-95c6-bf3686ae6cd9}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {154d932f-dc51-4a4f-9d52-b78b1419d3b4}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {14ceeaff-96dd-4101-ae37-d5ecdc23c3f6}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {12da1bc4-5384-42fd-a119-3c99d2d146a2}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {1185823f-f22f-4027-80e5-4f68acd5de5e}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {11111111-1111-1111-1111-110111691112}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {11111111-1111-1111-1111-110011501160}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {1212bcb8-67dd-475e-8025-9d2198fb8f61}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {11bf46c6-b3de-48bd-bf70-3ad85cab80b5}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {11b97cf9-c40e-4127-801d-0fe00eb35705}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {17f75c4b-1ffa-43b6-99cd-c93bf2641add}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {17de5e5e-bfe3-4e83-8e1f-8755795359ec}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {17bfcf1a-b579-48a7-9849-719ddd11d340}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {184aa5e6-741d-464a-820e-94b3abc2f3b4}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {1813785d-9cfb-45a0-9cbc-3e84f7a8471f}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {180175c0-913e-451c-9419-2d5500368d43}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {17996e72-ee06-4d59-943f-4c3ebba5a916}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {167c4103-657d-4db3-aaf8-11965125a381}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {1631550f-191d-4826-b069-d9439253d926}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {15f56b17-a0f8-4288-a24c-0f913b34d67b}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {171debeb-c3d4-40b7-ac73-056a5eba4a7e}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {16cdff19-861d-48e3-a751-d99a27784753}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {167d9323-f7cc-48f5-948a-6f012831a69f}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {11111111-1111-1111-1111-110011441179}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {0c483849-889d-4573-a21f-57d8585b430d}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {0c2e529c-a82c-4ac6-8807-0b51f7ad7bb2}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {0c2e030d-6ee7-44d3-9826-54e62745d95d}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {0cb66ba8-5e1f-4963-93d1-e1d6b78fe9a2}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {0c9f4179-6ce2-4c6a-a3e5-67ff3592a12e}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {0c5f997d-f664-4afb-9652-ea7fd92f383d}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {0becc7b3-d208-4379-90a8-b5205535ba5b}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {098facc1-3507-4be3-9d26-52b6916c24b9}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {0974ba1e-64ec-11de-b2a5-e43756d89593}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {08ed9ab9-ce1c-4c28-9e43-0f561ab6f30d}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {0bc6e3fa-78ef-4886-842c-5a1258c4455a}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {0abb1aed-804d-4cdf-b549-88c595fc2512}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {09c554c3-109b-483c-a06b-f14172f1a947}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {109038c2-71c0-47ea-9691-15a4a2b0cab1}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {10834e9a-d475-4a24-ad01-f3f24f71b28e}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {107a7b48-a430-42fa-8c8f-dd050e0210f9}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {11111111-1111-1111-1111-110011221158}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {10f3e8bd-257a-4702-a2f5-dc02055b068c}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {10b64bdf-2e05-4a8a-b470-a3c651d0ad00}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {10000000-1000-1000-1000-100000000000}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {0da7bd04-8279-46d0-91ea-f7eb8cc275d9}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {0d80f1c5-d17b-4177-ac68-955f3ef9f191}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {0d7562ae-8ef6-416d-a838-ab665251703a}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {0f385432-1c24-454b-ae21-6b30887952b1}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {0ecdf796-c2dc-4d79-a620-cce0c0a66cc9}
<SYSTEM32>\reg.exe query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {0e677229-e309-4341-81bd-3cc3018bf5b3}

Terminates or attempts to terminate

the following user processes:

iexplore.exe

Sets a new unauthorized home page for Windows Internet Explorer.

Modifies file system :

Creates the following files:

C:\JRT\get.bat
C:\JRT\misc.bat
C:\JRT\regkey_x64.dat
C:\JRT\FFregkey_x86.dat
C:\JRT\FFXML.dat
C:\JRT\firefox.bat
C:\JRT\startpage_x86.reg
C:\JRT\temp\OS.txt
C:\JRT\temp\architecture.txt
C:\JRT\regkey_x86.dat
C:\JRT\services.dat
C:\JRT\startpage_x64.reg
C:\JRT\askregkey_x86.dat
C:\JRT\askservices.dat
C:\JRT\CLSID.dat
C:\JRT\ask.bat
C:\JRT\askCLSID.dat
C:\JRT\askregkey_x64.dat
C:\JRT\FFextensions.dat
C:\JRT\FFprefs.dat
C:\JRT\FFregkey_x64.dat
C:\JRT\clsid_keys.bat
C:\JRT\clsid_values.bat
C:\JRT\ev_clear.bat

Miscellaneous:

Searches for the following windows:

ClassName: '' WindowName: ''

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial