(((Image:\\schtasks.exe (CommandLine:\ \-create\ * OR CommandLine:\ \/create\ * OR CommandLine:\ –create\ * OR CommandLine:\ —create\ * OR CommandLine:\ ―create\ *)) (CommandLine:\:\\Perflogs* OR CommandLine:\:\\Users\\All\ Users\\* OR CommandLine:\:\\Users\\Default\\* OR CommandLine:\:\\Users\\Public* OR CommandLine:\:\\Windows\\Temp* OR CommandLine:\\AppData\\Local\\* OR CommandLine:\\AppData\\Roaming\\* OR CommandLine:%AppData%* OR CommandLine:%Public%*)) OR (ParentCommandLine:\\svchost.exe\ \-k\ netsvcs\ \-p\ \-s\ Schedule (CommandLine:\:\\Perflogs* OR CommandLine:\:\\Windows\\Temp* OR CommandLine:\\Users\\Public* OR CommandLine:%Public%*))) (-((ParentCommandLine:unattended.ini* OR CommandLine:update_task.xml*) OR CommandLine:\/Create\ \/TN\ TVInstallRestore\ \/TR* OR (CommandLine:\/Create\ \/Xml\ * CommandLine:\\Temp\\.CR.* CommandLine:\\Avira_Security_Installation.xml*) OR ((CommandLine:\/Create\ \/F\ \/TN* CommandLine:\/Xml\ * CommandLine:\\Temp\\* CommandLine:Avira_*) (CommandLine:.tmp\\UpdateFallbackTask.xml* OR CommandLine:.tmp\\WatchdogServiceControlManagerTimeout.xml* OR CommandLine:.tmp\\SystrayAutostart.xml* OR CommandLine:.tmp\\MaintenanceTask.xml*)) OR (CommandLine:\\Temp\\* CommandLine:\/Create\ \/TN\ \"klcp_update\"\ \/XML\ * CommandLine:\\klcp_update_task.xml*)))