Skip to content

Instantly share code, notes, and snippets.

@AskAlice
Last active January 28, 2023 05:29
Show Gist options
  • Save AskAlice/e7cca0143b1e2493ba19559742c64b7e to your computer and use it in GitHub Desktop.
Save AskAlice/e7cca0143b1e2493ba19559742c64b7e to your computer and use it in GitHub Desktop.
MSI Center Autorun on task scheduler named FixNorton.exe
// Decompiled with JetBrains decompiler
// Type: FixNorton.Program
// Assembly: FixNorton, Version=1.2022.1219.1, Culture=neutral, PublicKeyToken=null
// MVID: 7D841D22-1B30-498A-B772-DA82A5EEF8E7
// Assembly location: C:\Program Files (x86)\MSI\MSI Center\PushCast\Push20221215131801\FixNorton.exe
using Microsoft.Win32;
using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.IO;
using System.Linq;
using System.ServiceProcess;
using System.Threading;
namespace FixNorton
{
internal class Program
{
private static void Main(string[] args)
{
string baseDirectory = AppDomain.CurrentDomain.BaseDirectory;
try
{
C_Registry.DeleteKey("PushCast\\Push20221215131801", "Error");
C_Registry.SetKeyValue("PushCast\\Push20221215131801", "Status", (object) 1001, RegistryValueKind.DWord);
string keyValue = C_Registry.GetKeyValue("Component\\SDK", "Version");
if (!string.IsNullOrWhiteSpace(keyValue))
{
Version version = new Version(keyValue);
if (version.Major >= 3)
{
if (version.Minor >= 2022)
{
if (version.Build >= 914)
{
if (File.Exists(baseDirectory + "MSI.TerminalServer.exe"))
{
if (File.Exists(baseDirectory + "CS_CommonAPI.dll"))
{
foreach (Process process in Process.GetProcessesByName("MSI.CentralServer"))
process.Kill();
foreach (Process process in Process.GetProcessesByName("MSI.TerminalServer"))
process.Kill();
Thread.Sleep(100);
File.Delete("C:\\Program Files (x86)\\MSI\\MSI Center\\MSI.TerminalServer.exe");
File.Delete("C:\\Program Files (x86)\\MSI\\MSI Center\\CS_CommonAPI.dll");
Thread.Sleep(50);
File.Copy(baseDirectory + "MSI.TerminalServer.exe", "C:\\Program Files (x86)\\MSI\\MSI Center\\MSI.TerminalServer.exe", true);
File.Copy(baseDirectory + "CS_CommonAPI.dll", "C:\\Program Files (x86)\\MSI\\MSI Center\\CS_CommonAPI.dll", true);
Thread.Sleep(50);
ServiceController serviceController = ((IEnumerable<ServiceController>) ServiceController.GetServices()).ToList<ServiceController>().Find((Predicate<ServiceController>) (x => x.ServiceName.Equals("MSI_Center_Service")));
if (serviceController != null)
{
C_Registry.SetKeyValue("Component\\SDK", "Quick Start", (object) 1, RegistryValueKind.DWord);
serviceController.Stop();
SpinWait.SpinUntil((Func<bool>) (() => false), 500);
serviceController.Start();
}
}
}
}
}
}
}
}
catch (Exception ex)
{
C_Registry.SetKeyValue("PushCast\\Push20221215131801", "Error", (object) ex.Message, RegistryValueKind.String);
}
try
{
File.Delete(baseDirectory + "MSI.TerminalServer.exe");
}
catch (Exception ex)
{
}
try
{
File.Delete(baseDirectory + "CS_CommonAPI.dll");
}
catch (Exception ex)
{
}
try
{
File.Delete(baseDirectory + "FixNorton.exe");
}
catch (Exception ex)
{
}
try
{
File.Delete(baseDirectory + "PushInfo.txt");
}
catch (Exception ex)
{
}
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment