Last active
October 27, 2024 15:54
-
-
Save AskAlice/e7cca0143b1e2493ba19559742c64b7e to your computer and use it in GitHub Desktop.
MSI Center Autorun on task scheduler named FixNorton.exe
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
// Decompiled with JetBrains decompiler | |
// Type: FixNorton.Program | |
// Assembly: FixNorton, Version=1.2022.1219.1, Culture=neutral, PublicKeyToken=null | |
// MVID: 7D841D22-1B30-498A-B772-DA82A5EEF8E7 | |
// Assembly location: C:\Program Files (x86)\MSI\MSI Center\PushCast\Push20221215131801\FixNorton.exe | |
using Microsoft.Win32; | |
using System; | |
using System.Collections.Generic; | |
using System.Diagnostics; | |
using System.IO; | |
using System.Linq; | |
using System.ServiceProcess; | |
using System.Threading; | |
namespace FixNorton | |
{ | |
internal class Program | |
{ | |
private static void Main(string[] args) | |
{ | |
string baseDirectory = AppDomain.CurrentDomain.BaseDirectory; | |
try | |
{ | |
C_Registry.DeleteKey("PushCast\\Push20221215131801", "Error"); | |
C_Registry.SetKeyValue("PushCast\\Push20221215131801", "Status", (object) 1001, RegistryValueKind.DWord); | |
string keyValue = C_Registry.GetKeyValue("Component\\SDK", "Version"); | |
if (!string.IsNullOrWhiteSpace(keyValue)) | |
{ | |
Version version = new Version(keyValue); | |
if (version.Major >= 3) | |
{ | |
if (version.Minor >= 2022) | |
{ | |
if (version.Build >= 914) | |
{ | |
if (File.Exists(baseDirectory + "MSI.TerminalServer.exe")) | |
{ | |
if (File.Exists(baseDirectory + "CS_CommonAPI.dll")) | |
{ | |
foreach (Process process in Process.GetProcessesByName("MSI.CentralServer")) | |
process.Kill(); | |
foreach (Process process in Process.GetProcessesByName("MSI.TerminalServer")) | |
process.Kill(); | |
Thread.Sleep(100); | |
File.Delete("C:\\Program Files (x86)\\MSI\\MSI Center\\MSI.TerminalServer.exe"); | |
File.Delete("C:\\Program Files (x86)\\MSI\\MSI Center\\CS_CommonAPI.dll"); | |
Thread.Sleep(50); | |
File.Copy(baseDirectory + "MSI.TerminalServer.exe", "C:\\Program Files (x86)\\MSI\\MSI Center\\MSI.TerminalServer.exe", true); | |
File.Copy(baseDirectory + "CS_CommonAPI.dll", "C:\\Program Files (x86)\\MSI\\MSI Center\\CS_CommonAPI.dll", true); | |
Thread.Sleep(50); | |
ServiceController serviceController = ((IEnumerable<ServiceController>) ServiceController.GetServices()).ToList<ServiceController>().Find((Predicate<ServiceController>) (x => x.ServiceName.Equals("MSI_Center_Service"))); | |
if (serviceController != null) | |
{ | |
C_Registry.SetKeyValue("Component\\SDK", "Quick Start", (object) 1, RegistryValueKind.DWord); | |
serviceController.Stop(); | |
SpinWait.SpinUntil((Func<bool>) (() => false), 500); | |
serviceController.Start(); | |
} | |
} | |
} | |
} | |
} | |
} | |
} | |
} | |
catch (Exception ex) | |
{ | |
C_Registry.SetKeyValue("PushCast\\Push20221215131801", "Error", (object) ex.Message, RegistryValueKind.String); | |
} | |
try | |
{ | |
File.Delete(baseDirectory + "MSI.TerminalServer.exe"); | |
} | |
catch (Exception ex) | |
{ | |
} | |
try | |
{ | |
File.Delete(baseDirectory + "CS_CommonAPI.dll"); | |
} | |
catch (Exception ex) | |
{ | |
} | |
try | |
{ | |
File.Delete(baseDirectory + "FixNorton.exe"); | |
} | |
catch (Exception ex) | |
{ | |
} | |
try | |
{ | |
File.Delete(baseDirectory + "PushInfo.txt"); | |
} | |
catch (Exception ex) | |
{ | |
} | |
} | |
} | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment