Technical Information
- [<HKLM>\SYSTEM\ControlSet001\Services\RDSessMgr] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\RDSessMgr] 'ImagePath' = '%WINDIR%\Help\csrs.exe'
- '%WINDIR%\Help\Rar.exe' (downloaded from the Internet)
- '<SYSTEM32>\sc.exe' config rdsessmgr binpath= "%WINDIR%\Help\csrs.exe"
- '<SYSTEM32>\net.exe' stop sharedacce0x73,0x73
- '<SYSTEM32>\cmd.exe' /c net stop sharedacce0x73,0x73
- '<SYSTEM32>\cmd.exe' /c sc config rdsessmgr binpath= "%WINDIR%\Help\csrs.exe"
- '<SYSTEM32>\cmd.exe' /c sc config rdsessmgr start= auto
- '<SYSTEM32>\cmd.exe' /c ""%WINDIR%\Help\2.bat" "
- '%WINDIR%\Help\Rar.exe' X %WINDIR%\Help\vvt.part01.rar %WINDIR%\Help\ -p4399
- '<SYSTEM32>\cmd.exe' /C @echo %WINDIR%\help\rar X %WINDIR%\Help\vvt.part01.rar %WINDIR%\Help\ -p4399>%WINDIR%\Help\2.bat
- '<SYSTEM32>\sc.exe' config rdsessmgr start= auto
- '<SYSTEM32>\net1.exe' stop sharedacce0x73,0x73
- '<SYSTEM32>\cmd.exe' /c del %WINDIR%\Help\*.htm
- '<SYSTEM32>\taskkill.exe' /f /t /im firefox.exe /im alg.exe /im Privoxy.exe
- '<SYSTEM32>\cmd.exe' /c del %WINDIR%\Help\*.cnt
- '<SYSTEM32>\cmd.exe' /c taskkill /f /t /im firefox.exe /im alg.exe /im Privoxy.exe
- '<SYSTEM32>\cmd.exe' /c del %WINDIR%\Help\*.chm
- '<SYSTEM32>\cmd.exe' /c del %WINDIR%\Help\config.ini
- '<SYSTEM32>\cmd.exe' /c rd /s /q %windir%\help\browser
- '<SYSTEM32>\cmd.exe' /c del %WINDIR%\Help\appface.dll
- '<SYSTEM32>\cmd.exe' /c del %WINDIR%\Help\*.hlp
- '<SYSTEM32>\cmd.exe' /c del %WINDIR%\Help\alg.exe
- <SYSTEM32>\alg.exe
- firefox.exe
- %WINDIR%\Help\Rar.exe
- %WINDIR%\Help\vvt.part03.rar
- %WINDIR%\Help\2.bat
- %WINDIR%\Help\csrs.exe
- %WINDIR%\Help\vvt.part01.rar
- %WINDIR%\Help\apps.chm.new
- %WINDIR%\Help\vvt.part02.rar
- <SYSTEM32>\dllcache\apps.chm.new
- %WINDIR%\Help\supp_ed.chm
- %WINDIR%\Help\suptools.chm
- %WINDIR%\Help\sysdm.chm
- %WINDIR%\Help\spolsconcepts.chm
- %WINDIR%\Help\drwtsn32.hlp
- %WINDIR%\Help\sr_ui.chm
- %WINDIR%\Help\dskquoui.hlp
- %WINDIR%\Help\sysrestore.chm
- %WINDIR%\Help\system.chm
- %WINDIR%\Help\sysmon.chm
- %WINDIR%\Help\dsclient.hlp
- %WINDIR%\Help\sysprop.chm
- %WINDIR%\Help\soundrec.chm
- %WINDIR%\Help\sounds.chm
- %WINDIR%\Help\diskmgmt.hlp
- %WINDIR%\Help\snmpconcepts.chm
- %WINDIR%\Help\sol.chm
- %WINDIR%\Help\dijoy.hlp
- %WINDIR%\Help\speech.chm
- %WINDIR%\Help\spider.chm
- %WINDIR%\Help\splash.chm
- %WINDIR%\Help\spad.chm
- %WINDIR%\Help\spconcepts.chm
- %WINDIR%\Help\display.hlp
- %WINDIR%\Help\wab.chm
- %WINDIR%\Help\wbemtest.chm
- %WINDIR%\Help\webpub.chm
- %WINDIR%\Help\update1.chm
- %WINDIR%\Help\usercpl.chm
- %WINDIR%\Help\utilmgr.chm
- %WINDIR%\Help\wininstl.chm
- %WINDIR%\Help\winmine.chm
- %WINDIR%\Help\win_dos.chm
- %WINDIR%\Help\whatsnew.chm
- %WINDIR%\Help\winchat.chm
- %WINDIR%\Help\windows.chm
- %WINDIR%\Help\els.hlp
- %WINDIR%\Help\taskmgr.chm
- %WINDIR%\Help\tcpip.chm
- %WINDIR%\Help\sys_srv.chm
- %WINDIR%\Help\tapi.chm
- %WINDIR%\Help\taskbar.chm
- %WINDIR%\Help\tshoot.chm
- %WINDIR%\Help\evntwin.hlp
- %WINDIR%\Help\twclient.chm
- %WINDIR%\Help\telnet.chm
- %WINDIR%\Help\timesrv.chm
- %WINDIR%\Help\eudcedit.hlp
- %WINDIR%\Help\regedit.chm
- %WINDIR%\Help\regopt.chm
- %WINDIR%\Help\conf.hlp
- %WINDIR%\Help\reader.chm
- %WINDIR%\Help\compstui.hlp
- %WINDIR%\Help\recycle.chm
- %WINDIR%\Help\connect.hlp
- %WINDIR%\Help\rrc.chm
- %WINDIR%\Help\cscui.hlp
- %WINDIR%\Help\remasst.chm
- %WINDIR%\Help\reskit.chm
- %WINDIR%\Help\rktools.chm
- %WINDIR%\Help\clipbrd.hlp
- %WINDIR%\Help\plyr_err.chm
- %WINDIR%\Help\printfnd.chm
- %WINDIR%\Help\password.chm
- %WINDIR%\Help\phowto.chm
- %WINDIR%\Help\pinball.chm
- %WINDIR%\Help\qosconcepts.chm
- %WINDIR%\Help\ratings.chm
- %WINDIR%\Help\rdesktop.chm
- %WINDIR%\Help\printing.chm
- %WINDIR%\Help\comexp.hlp
- %WINDIR%\Help\pwrmn.chm
- %WINDIR%\Help\secedit.chm
- %WINDIR%\Help\dfs.hlp
- %WINDIR%\Help\secsetconcepts.chm
- %WINDIR%\Help\sceconcepts.chm
- %WINDIR%\Help\scm.chm
- %WINDIR%\Help\scmconcepts.chm
- %WINDIR%\Help\shvl.chm
- %WINDIR%\Help\smlogcfg.chm
- %WINDIR%\Help\sndvol32.chm
- %WINDIR%\Help\secsettings.chm
- %WINDIR%\Help\dialer.hlp
- %WINDIR%\Help\sendcmsg.chm
- %WINDIR%\Help\rsmconcepts.chm
- %WINDIR%\Help\rsop.chm
- %WINDIR%\Help\rsopsnp.chm
- %WINDIR%\Help\rsm.chm
- %WINDIR%\Help\ddeshare.hlp
- %WINDIR%\Help\defrag.hlp
- %WINDIR%\Help\saferconcepts.chm
- %WINDIR%\Help\sc.chm
- %WINDIR%\Help\sce.chm
- %WINDIR%\Help\rvse.chm
- %WINDIR%\Help\safer.chm
- %WINDIR%\Help\devmgr.hlp
- %WINDIR%\Help\sapicpl.hlp
- %WINDIR%\Help\scarddlg.hlp
- %WINDIR%\Help\secauth.hlp
- %WINDIR%\Help\reader.hlp
- %WINDIR%\Help\regedit.hlp
- %WINDIR%\Help\rsm.hlp
- %WINDIR%\Help\signin.hlp
- %WINDIR%\Help\sigverif.hlp
- %WINDIR%\Help\sndvol32.hlp
- %WINDIR%\Help\sendcmsg.hlp
- %WINDIR%\Help\sfmmgr.hlp
- %WINDIR%\Help\shell.hlp
- %WINDIR%\Help\ntbackup.hlp
- %WINDIR%\Help\ntshrui.hlp
- %WINDIR%\Help\nwdoc.hlp
- %WINDIR%\Help\newfeat4.hlp
- %WINDIR%\Help\newfeat5.hlp
- %WINDIR%\Help\notepad.hlp
- %WINDIR%\Help\progman.hlp
- %WINDIR%\Help\pwrmn.hlp
- %WINDIR%\Help\ratings.hlp
- %WINDIR%\Help\objsel.hlp
- %WINDIR%\Help\osk.hlp
- %WINDIR%\Help\pinball.hlp
- %WINDIR%\Help\wab.hlp
- %WINDIR%\Help\winchat.hlp
- %WINDIR%\Help\windows.hlp
- %WINDIR%\Help\users.hlp
- %WINDIR%\Help\utilmgr.hlp
- %WINDIR%\Help\verifier.hlp
- %WINDIR%\Help\wscript.hlp
- %WINDIR%\Help\wsecedit.hlp
- %WINDIR%\Help\2.bat
- %WINDIR%\Help\winhlp32.hlp
- %WINDIR%\Help\winmine.hlp
- %WINDIR%\Help\wordpad.hlp
- %WINDIR%\Help\spider.hlp
- %WINDIR%\Help\sysdm.hlp
- %WINDIR%\Help\sysmon.hlp
- %WINDIR%\Help\snmpsnap.hlp
- %WINDIR%\Help\sol.hlp
- %WINDIR%\Help\soundrec.hlp
- %WINDIR%\Help\tcpmon.hlp
- %WINDIR%\Help\telnet.hlp
- %WINDIR%\Help\twclient.hlp
- %WINDIR%\Help\sysrestore.hlp
- %WINDIR%\Help\tapi.hlp
- %WINDIR%\Help\taskmgr.hlp
- %WINDIR%\Help\freecell.hlp
- %WINDIR%\Help\fxsclnt.hlp
- %WINDIR%\Help\gpedit.hlp
- %WINDIR%\Help\filemgmt.hlp
- %WINDIR%\Help\wuauhelp.chm
- %WINDIR%\Help\fonts.hlp
- %WINDIR%\Help\hypertrm.hlp
- %WINDIR%\Help\ident.hlp
- %WINDIR%\Help\iexplore.hlp
- %WINDIR%\Help\gptext.hlp
- %WINDIR%\Help\halftone.hlp
- %WINDIR%\Help\hardware.hlp
- %WINDIR%\Help\wmplay.chm
- %WINDIR%\Help\wmplayer.chm
- %WINDIR%\Help\wordpad.chm
- %WINDIR%\Help\fde.hlp
- %WINDIR%\Help\wmic.chm
- %WINDIR%\Help\wmifltr.chm
- %WINDIR%\Help\wscript.chm
- %WINDIR%\Help\wshconcepts.chm
- %WINDIR%\Help\wuau.chm
- %WINDIR%\Help\filefold.hlp
- %WINDIR%\Help\wpa.chm
- %WINDIR%\Help\wschelp.chm
- %WINDIR%\Help\msnauth.hlp
- %WINDIR%\Help\msoe.hlp
- %WINDIR%\Help\msoeacct.hlp
- %WINDIR%\Help\mpnetwrk.hlp
- %WINDIR%\Help\mqsnap.hlp
- %WINDIR%\Help\mshearts.hlp
- %WINDIR%\Help\newfeat1.hlp
- %WINDIR%\Help\newfeat2.hlp
- %WINDIR%\Help\newfeat3.hlp
- %WINDIR%\Help\mspaint.hlp
- %WINDIR%\Help\mstask.hlp
- %WINDIR%\Help\netcfg.hlp
- %WINDIR%\Help\ixhelp.hlp
- %WINDIR%\Help\localsec.hlp
- %WINDIR%\Help\magnify.hlp
- %WINDIR%\Help\infrared.hlp
- %WINDIR%\Help\input.hlp
- %WINDIR%\Help\ipsecsnp.hlp
- %WINDIR%\Help\modem.hlp
- %WINDIR%\Help\mouse.hlp
- %WINDIR%\Help\mplayer2.hlp
- %WINDIR%\Help\mfcuix.hlp
- %WINDIR%\Help\mmc_dlg.hlp
- %WINDIR%\Help\mobsync.hlp
- %WINDIR%\Help\chooser.hlp
- %WINDIR%\Help\drwtsn32.chm
- %WINDIR%\Help\dskquoui.chm
- %WINDIR%\Help\ade.hlp
- %WINDIR%\Help\display.chm
- %WINDIR%\Help\dkconcepts.chm
- %WINDIR%\Help\drvvfp.chm
- %WINDIR%\Help\encrypt.chm
- %WINDIR%\Help\agt0405.hlp
- %WINDIR%\Help\eudcedit.chm
- %WINDIR%\Help\dxdiag.chm
- %WINDIR%\Help\adprop.hlp
- %WINDIR%\Help\els.chm
- %WINDIR%\Help\ddeshare.chm
- %WINDIR%\Help\defrag.chm
- %WINDIR%\Help\devmgr.chm
- %WINDIR%\Help\migwiz.htm
- %WINDIR%\Help\migwiz2.htm
- %WINDIR%\Help\datetime.chm
- %WINDIR%\Help\digiras.chm
- %WINDIR%\Help\aclui.hlp
- %WINDIR%\Help\diskmgmt.chm
- %WINDIR%\Help\diagboot.chm
- %WINDIR%\Help\dialer.chm
- %WINDIR%\Help\access.hlp
- %WINDIR%\Help\gpedit.chm
- %WINDIR%\Help\hardware.chm
- %WINDIR%\Help\agt0409.hlp
- %WINDIR%\Help\fxsshare.chm
- %WINDIR%\Help\gen.chm
- %WINDIR%\Help\Glossary.chm
- %WINDIR%\Help\hschelp.chm
- %WINDIR%\Help\hypertrm.chm
- %WINDIR%\Help\icwdial.chm
- %WINDIR%\Help\howto.chm
- %WINDIR%\Help\hrtz.chm
- %WINDIR%\Help\hs.chm
- %WINDIR%\Help\file_srv.chm
- %WINDIR%\Help\agt0407.hlp
- %WINDIR%\Help\find.chm
- %WINDIR%\Help\evconcepts.chm
- %WINDIR%\Help\agt0406.hlp
- %WINDIR%\Help\filefold.chm
- %WINDIR%\Help\agt0408.hlp
- %WINDIR%\Help\fxsclnt.chm
- %WINDIR%\Help\fxscover.chm
- %WINDIR%\Help\folderop.chm
- %WINDIR%\Help\fonts.chm
- %WINDIR%\Help\freecell.chm
- %WINDIR%\Help\addremov.chm
- %WINDIR%\Help\admtools.chm
- %WINDIR%\Help\apps.chm
- %WINDIR%\Help\accessib.chm
- %WINDIR%\Help\acc_dis.chm
- %WINDIR%\Help\aclui.chm
- %WINDIR%\Help\audit.chm
- %WINDIR%\Help\bckg.chm
- %WINDIR%\Help\blurbs.chm
- %WINDIR%\Help\apps_sp.chm
- %WINDIR%\Help\article.chm
- %WINDIR%\Help\atm.chm
- %WINDIR%\Help\mshearts.cnt
- %WINDIR%\Help\msnauth.cnt
- %WINDIR%\Help\nocontnt.cnt
- %WINDIR%\Help\conf.cnt
- %WINDIR%\Help\connect.cnt
- %WINDIR%\Help\mplayer2.cnt
- %WINDIR%\Help\windows.cnt
- %WINDIR%\Help\winhlp32.cnt
- %WINDIR%\Help\access.chm
- %WINDIR%\Help\progman.cnt
- %WINDIR%\Help\ratings.cnt
- %WINDIR%\Help\update.cnt
- %WINDIR%\Help\compmgmt.chm
- %WINDIR%\Help\conf.chm
- %WINDIR%\Help\conf1.chm
- %WINDIR%\Help\comexp.chm
- %WINDIR%\Help\common.chm
- %WINDIR%\Help\compfldr.chm
- %WINDIR%\Help\cyzcoins.chm
- %WINDIR%\Help\ciquery.htm
- %WINDIR%\Help\ixqlang.htm
- %WINDIR%\Help\cpanel.chm
- %WINDIR%\Help\ciadmin.htm
- %WINDIR%\Help\cyycoins.chm
- %WINDIR%\Help\calc.chm
- %WINDIR%\Help\camera.chm
- %WINDIR%\Help\cdmedia.chm
- %WINDIR%\Help\blutooth.chm
- %WINDIR%\Help\bootcons.chm
- %WINDIR%\Help\brief.chm
- %WINDIR%\Help\clipbrd.chm
- %WINDIR%\Help\cmconcepts.chm
- %WINDIR%\Help\colormgt.chm
- %WINDIR%\Help\certmgr.chm
- %WINDIR%\Help\charmap.chm
- %WINDIR%\Help\chkr.chm
- %WINDIR%\Help\newfeat1.chm
- %WINDIR%\Help\agt0c0a.hlp
- %WINDIR%\Help\newfeat2.chm
- %WINDIR%\Help\netcfg.chm
- %WINDIR%\Help\network.chm
- %WINDIR%\Help\agt0816.hlp
- %WINDIR%\Help\newfeat5.chm
- %WINDIR%\Help\nmchat.chm
- %WINDIR%\Help\calc.hlp
- %WINDIR%\Help\newfeat3.chm
- %WINDIR%\Help\audiocdc.hlp
- %WINDIR%\Help\newfeat4.chm
- %WINDIR%\Help\msmq.chm
- %WINDIR%\Help\msmqconcepts.chm
- %WINDIR%\Help\msoe.chm
- %WINDIR%\Help\agt0419.hlp
- %WINDIR%\Help\mshearts.chm
- %WINDIR%\Help\msinfo32.chm
- %WINDIR%\Help\agt041f.hlp
- %WINDIR%\Help\mstask.chm
- %WINDIR%\Help\mstsc.chm
- %WINDIR%\Help\agt041d.hlp
- %WINDIR%\Help\msorcl32.chm
- %WINDIR%\Help\mspaint.chm
- %WINDIR%\Help\nusrmgr.chm
- %WINDIR%\Help\nwdoc.chm
- %WINDIR%\Help\odbcinst.chm
- %WINDIR%\Help\chnscsvr.hlp
- %WINDIR%\Help\nthelp.chm
- %WINDIR%\Help\ntshared.chm
- %WINDIR%\Help\omc.chm
- %WINDIR%\Help\osk.chm
- %WINDIR%\Help\packager.chm
- %WINDIR%\Help\odbcjet.chm
- %WINDIR%\Help\oe_msgr.chm
- %WINDIR%\Help\offlinefolders.chm
- %WINDIR%\Help\notepad.chm
- %WINDIR%\Help\ntart.chm
- %WINDIR%\Help\cdmedia.hlp
- %WINDIR%\Help\camera.hlp
- %WINDIR%\Help\nmwhiteb.chm
- %WINDIR%\Help\nofts.chm
- %WINDIR%\Help\ntcmds.chm
- %WINDIR%\Help\charmap.hlp
- %WINDIR%\Help\ntdef.chm
- %WINDIR%\Help\ntbackup.chm
- %WINDIR%\Help\certmgr.hlp
- %WINDIR%\Help\ntchowto.chm
- %WINDIR%\Help\intellimirror.chm
- %WINDIR%\Help\agt040e.hlp
- %WINDIR%\Help\agt0410.hlp
- %WINDIR%\Help\agt040c.hlp
- %WINDIR%\Help\infrared.chm
- %WINDIR%\Help\input.chm
- %WINDIR%\Help\is.chm
- %WINDIR%\Help\isconcepts.chm
- %WINDIR%\Help\joy.chm
- %WINDIR%\Help\ipsecconcepts.chm
- %WINDIR%\Help\ipsecsnp.chm
- %WINDIR%\Help\Ipv6.chm
- %WINDIR%\Help\ieshared.chm
- %WINDIR%\Help\iesupp.chm
- %WINDIR%\Help\iewebhlp.chm
- %WINDIR%\Help\ieakmmc.chm
- %WINDIR%\Help\ieeula.chm
- %WINDIR%\Help\ieos.chm
- %WINDIR%\Help\agt040b.hlp
- %WINDIR%\Help\imgprev.chm
- %WINDIR%\Help\inetres.chm
- %WINDIR%\Help\iexplore.chm
- %WINDIR%\Help\iis.chm
- %WINDIR%\Help\iismmc.chm
- %WINDIR%\Help\agt0415.hlp
- %WINDIR%\Help\mmc.chm
- %WINDIR%\Help\agt0416.hlp
- %WINDIR%\Help\mail.chm
- %WINDIR%\Help\misc.chm
- %WINDIR%\Help\mls_trb.chm
- %WINDIR%\Help\mpconcepts.chm
- %WINDIR%\Help\msconfig.chm
- %WINDIR%\Help\msdasc.chm
- %WINDIR%\Help\mobsync.chm
- %WINDIR%\Help\mode.chm
- %WINDIR%\Help\mouse.chm
- %WINDIR%\Help\keyshort.chm
- %WINDIR%\Help\agt0414.hlp
- %WINDIR%\Help\lang.chm
- %WINDIR%\Help\agt0413.hlp
- %WINDIR%\Help\key.chm
- %WINDIR%\Help\keyb.chm
- %WINDIR%\Help\lpe.chm
- %WINDIR%\Help\lpeconcepts.chm
- %WINDIR%\Help\magnify.chm
- %WINDIR%\Help\langbar.chm
- %WINDIR%\Help\license.chm
- %WINDIR%\Help\localsec.chm
- 'www.lc##t.net':80
- 'localhost':1035
- http://www.lc##t.net/ewebedit/UploadFile/Rar.exe
- http://www.lc##t.net/ewebedit/UploadFile/csrs.exe
- http://www.lc##t.net/ewebedit/UploadFile/vvt.part03.rar
- http://www.lc##t.net/ewebedit/UploadFile/vvt.part01.rar
- http://www.lc##t.net/ewebedit/UploadFile/vvt.part02.rar
- DNS ASK www.lc##t.net
- ClassName: '' WindowName: ''