Trojan.Encoder.38828

Техническая информация

Для обеспечения автозапуска и распространения

Создает или изменяет следующие файлы

%ProgramFiles%\microsoft office\office14\startup\how to back files.txt
%ProgramFiles%\microsoft office\office14\xlstart\how to back files.txt

Создает следующие файлы на съемном носителе

<Имя диска съемного носителя>:\how to back files.txt

Вредоносные функции

Для затруднения выявления своего присутствия в системе

блокирует:

Компонент восстановления системы (SR)

Запускает на исполнение

'<SYSTEM32>\net.exe' stop "SQLSERVERAGENT"
'<SYSTEM32>\net.exe' stop "VMware NAT Service"
'<SYSTEM32>\net.exe' stop JWRinfoClientService
'<SYSTEM32>\net.exe' stop "MSSQLFDLauncher$OPTIMA"
'<SYSTEM32>\net.exe' stop MSExchangeDelivery
'<SYSTEM32>\net.exe' stop VMnetDHCP
'<SYSTEM32>\net.exe' stop JWEM3DBAUTORun
'<SYSTEM32>\taskkill.exe' /IM BackupExec.exe /F
'<SYSTEM32>\taskkill.exe' /IM pg_ctl.exe /F
'<SYSTEM32>\net.exe' stop "SQLAgent$WOLTERSKLUWER"
'<SYSTEM32>\net.exe' stop MSExchangeDagMgmt
'<SYSTEM32>\net.exe' stop "MSSQLSERVER"
'<SYSTEM32>\net.exe' stop mysqltransport
'<SYSTEM32>\taskkill.exe' /IM ThunderPlatform.exe /F
'<SYSTEM32>\taskkill.exe' /IM VBoxSDS.exe /F
'<SYSTEM32>\net.exe' stop JWService
'<SYSTEM32>\net.exe' stop "SQLAgent$PROGID"
'<SYSTEM32>\net.exe' stop MSExchangeCompliance
'<SYSTEM32>\net.exe' stop "MSSQLFDLauncher"
'<SYSTEM32>\net.exe' stop WebAttendServer
'<SYSTEM32>\net.exe' stop DellDRLogSvc
'<SYSTEM32>\net.exe' stop wanxiao-monitor
'<SYSTEM32>\net.exe' stop VMAuthdService
'<SYSTEM32>\net.exe' stop "MSSQL$WOLTERSKLUWER"
'<SYSTEM32>\net.exe' stop MSExchangeAntispamUpdate
'<SYSTEM32>\net.exe' stop "Synology Drive VSS Service x64"
'<SYSTEM32>\net.exe' stop VMUSBArbService
'<SYSTEM32>\net.exe' stop Apache2.2
'<SYSTEM32>\net.exe' stop FirebirdGuardianDeafaultInstance
'<SYSTEM32>\net.exe' stop "memcached Server"
'<SYSTEM32>\taskkill.exe' /IM Launchpad.exe /F
'<SYSTEM32>\taskkill.exe' /F /IM Veeam.Backup.Manager.exe
'<SYSTEM32>\net.exe' stop CASWebServer
'<SYSTEM32>\taskkill.exe' /IM mpdwsvc.exe /F
'<SYSTEM32>\net.exe' stop CASLicenceServer
'<SYSTEM32>\net.exe' stop "ReportServer$OPTIMA"
'<SYSTEM32>\net.exe' stop MSExchangeFrontEndTransport
'<SYSTEM32>\taskkill.exe' /IM java.exe /F
'<SYSTEM32>\net.exe' stop VeeanBackupSvc
'<SYSTEM32>\net.exe' stop QPCore
'<SYSTEM32>\net.exe' stop MSExchangeFastSearch
'<SYSTEM32>\net.exe' stop "SQLAgent$OPTIMA"
'<SYSTEM32>\net.exe' stop TeamViewer
'<SYSTEM32>\net.exe' stop VeeamCatalogSvc
'<SYSTEM32>\net.exe' stop TeamViewer8
'<SYSTEM32>\net.exe' stop MSExchangeDiagnostics
'<SYSTEM32>\taskkill.exe' /IM iexplore.exe /F
'<SYSTEM32>\net.exe' stop AdobeARMservice
'<SYSTEM32>\net.exe' stop Tomcat8
'<SYSTEM32>\taskkill.exe' /IM U8CEServer.exe /F
'<SYSTEM32>\taskkill.exe' /IM NFVPrint.exe /F
'<SYSTEM32>\taskkill.exe' /IM tomcat9.exe /F
'<SYSTEM32>\taskkill.exe' /IM Att.exe /F
'<SYSTEM32>\net.exe' stop FirebirdServerDefaultInstance
'<SYSTEM32>\net.exe' stop RapidRecoveryAgent
'<SYSTEM32>\taskkill.exe' /IM rcrelay.exe /F
'<SYSTEM32>\taskkill.exe' /IM mysqld.exe /F
'<SYSTEM32>\net.exe' stop Service2
'<SYSTEM32>\taskkill.exe' /F /IM Veeam.Backup.CloudService.exe
'<SYSTEM32>\net.exe' stop "MSSQL$OPTIMA"
'<SYSTEM32>\taskkill.exe' /IM httpd.exe /F
'<SYSTEM32>\taskkill.exe' /IM sqlservr.exe /F
'<SYSTEM32>\net.exe' stop "MSSQL$PROGID"
'<SYSTEM32>\net.exe' stop XenSvc
'<SYSTEM32>\net.exe' stop "MSSQLFDLauncher$SHOPCONTROL9"
'<SYSTEM32>\net.exe' stop "SQLAgent"
'<SYSTEM32>\net.exe' stop "NetBackup Legacy Client Service"
'<SYSTEM32>\net.exe' stop "MSSQL"
'<SYSTEM32>\net.exe' stop "NetBackup Discovery Framework"
'<SYSTEM32>\net.exe' stop vss
'<SYSTEM32>\net.exe' stop "NetBackup Client Service"
'<SYSTEM32>\taskkill.exe' /IM "UFSoft.U8.OC.QuartzScheduler.exe" /F
'<SYSTEM32>\net.exe' stop "SQLAgent$SHOPCONTROL9"
'<SYSTEM32>\taskkill.exe' /F /IM Veeam.Backup.BrokerService.exe
'<SYSTEM32>\net.exe' stop "SQLAgent$VEEAMSQL2012"
'<SYSTEM32>\taskkill.exe' /IM U8SmartClient.exe /F
'<SYSTEM32>\net.exe' stop "ReportServer$SHOPCONTROL9"
'<SYSTEM32>\net.exe' stop MSExchangeHM
'<SYSTEM32>\net.exe' stop "NetBackup Legacy Network Service"
'<SYSTEM32>\net.exe' stop SQLBrowser
'<SYSTEM32>\net.exe' stop "SQLWrite"
'<SYSTEM32>\net.exe' stop "MSSQL$SHOPCONTROL9"
'<SYSTEM32>\taskkill.exe' /IM DDSoftPwsTomcat9.exe /F
'<SYSTEM32>\net.exe' stop SQLSERVERAGENT
'<SYSTEM32>\net.exe' stop "MSOLAP$SHOPCONTROL9"
'<SYSTEM32>\net.exe' stop "SSISTELEMETRY130"
'<SYSTEM32>\taskkill.exe' /IM Tomcat7w.exe /F
'<SYSTEM32>\net.exe' stop "MsDtsServer130"
'<SYSTEM32>\net.exe' stop "SQLTELEMETRY"
'<SYSTEM32>\taskkill.exe' /F /IM Veeam.Backup.Agent.ConfigurationService.exe
'<SYSTEM32>\net.exe' stop "SQLBrowser"
'<SYSTEM32>\net.exe' stop MSSQL$
'<SYSTEM32>\net.exe' stop "MSSQL$VEEAMSQL2012"
'<SYSTEM32>\net.exe' stop MSExchangeEdgeSync
'<SYSTEM32>\net.exe' stop "MSSQLServerADHelper100"
'<SYSTEM32>\net.exe' stop "NetBackup SAN Client Fibre Transport Service"
'<SYSTEM32>\net.exe' stop "NetBackup Proxy Service"
'<SYSTEM32>\net.exe' stop MSSQL$VIM_SQLEXP
'<SYSTEM32>\net.exe' stop MSExchangeADTopology
'<SYSTEM32>\net.exe' stop VMwareHostd
'<SYSTEM32>\net.exe' stop xenlite
'<SYSTEM32>\net.exe' stop MSComplianceAudit
'<SYSTEM32>\net.exe' stop UIODetect
'<SYSTEM32>\net.exe' stop Realtek11nSU
'<SYSTEM32>\net.exe' stop UFIDAWebService
'<SYSTEM32>\net.exe' stop "TMBMServer"
'<SYSTEM32>\taskkill.exe' /IM ReportingServicesService.exe /F
'<SYSTEM32>\net.exe' stop "igfxCUIService2.0.0.0"
'<SYSTEM32>\net.exe' stop Apache2.4
'<SYSTEM32>\net.exe' stop vmvss
'<SYSTEM32>\net.exe' stop HaoZipSvc
'<SYSTEM32>\net.exe' stop SQLWriter
'<SYSTEM32>\taskkill.exe' /IM U8SmartClientMonitor.exe /F
'<SYSTEM32>\taskkill.exe' /F /IM Veeam.Backup.CatalogDataService.exe
'<SYSTEM32>\net.exe' stop MSSQL$FE_EXPRESS
'<SYSTEM32>\net.exe' stop "SQLTELEMETRY$HL"
'<SYSTEM32>\net.exe' stop U8WorkerService2
'<SYSTEM32>\net.exe' stop SQLANYs_Sage_FAS_Fixed_Assets
'<SYSTEM32>\net.exe' stop U8WorkerService1
'<SYSTEM32>\net.exe' stop "ReportServer"
'<SYSTEM32>\net.exe' stop MSSQL$RE_EXPRESS
'<SYSTEM32>\net.exe' stop "MsDtsServer100"
'<SYSTEM32>\taskkill.exe' /IM mysqld-nt.exe /F
'<SYSTEM32>\net.exe' stop "MSSQLServerOLAPService"
'<SYSTEM32>\taskkill.exe' /IM UFSoft.U8.OC.QuartzScheduler.exe /F
'<SYSTEM32>\net.exe' stop "msftesql$SQLEXPRESS"

Запускает большое число процессов

Изменения в файловой системе

Создает следующие файлы

%TEMP%\killerr.bat
%ProgramFiles%\microsoft office\document themes 14\how to back files.txt
%ProgramFiles%\microsoft office\media\cagcat10\1033\how to back files.txt
%ProgramFiles%\microsoft office\media\cagcat10\how to back files.txt
%ProgramFiles%\microsoft office\media\office14\1033\how to back files.txt
%ProgramFiles%\microsoft office\media\office14\autoshap\how to back files.txt
%ProgramFiles%\microsoft office\document themes 14\theme effects\how to back files.txt
%ProgramFiles%\microsoft office\document themes 14\theme fonts\how to back files.txt
%ProgramFiles%\microsoft office\media\office14\bullets\how to back files.txt
%ProgramFiles%\microsoft office\media\how to back files.txt
%ProgramFiles%\microsoft office\office14\1033\bibliography\how to back files.txt
%ProgramFiles%\microsoft office\office14\1033\dataservices\how to back files.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\americana\how to back files.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\babyblue\how to back files.txt
%ProgramFiles%\microsoft office\media\office14\lines\how to back files.txt
%ProgramFiles%\microsoft office\media\office14\how to back files.txt
%ProgramFiles%\microsoft office\document themes 14\theme colors\how to back files.txt
%ProgramFiles%\microsoft office\clipart\publisher\how to back files.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\brightorange\how to back files.txt
%ProgramFiles%\java\jre1.8.0_45\lib\deploy\how to back files.txt
%ProgramFiles%\java\jre1.8.0_45\lib\ext\how to back files.txt
%ProgramFiles%\java\jre1.8.0_45\lib\fonts\how to back files.txt
%ProgramFiles%\java\jre1.8.0_45\lib\images\cursors\how to back files.txt
%ProgramFiles%\java\jre1.8.0_45\lib\images\how to back files.txt
%ProgramFiles%\java\jre1.8.0_45\lib\jfr\how to back files.txt
%ProgramFiles%\java\jre1.8.0_45\lib\management\how to back files.txt
%ProgramFiles%\java\jre1.8.0_45\lib\security\how to back files.txt
%ProgramFiles%\java\jre1.8.0_45\lib\how to back files.txt
%ProgramFiles%\java\jre1.8.0_45\how to back files.txt
%ProgramFiles%\java\how to back files.txt
%ProgramFiles%\microsoft office\clipart\pub60cor\how to back files.txt
%ProgramFiles%\microsoft office\clipart\publisher\backgrounds\how to back files.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\biscay\how to back files.txt
%ProgramFiles%\java\jre1.8.0_45\lib\applet\how to back files.txt
%ProgramFiles%\microsoft office\clipart\how to back files.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\memories\how to back files.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\brightyellow\how to back files.txt
%ProgramFiles%\microsoft office\office14\addins\how to back files.txt
%ProgramFiles%\microsoft office\office14\bibliography\sort\how to back files.txt
%ProgramFiles%\microsoft office\office14\bibliography\style\how to back files.txt
%ProgramFiles%\microsoft office\office14\bibliography\how to back files.txt
%ProgramFiles%\microsoft office\office14\borders\how to back files.txt
%ProgramFiles%\microsoft office\office14\convert\1033\how to back files.txt
%ProgramFiles%\microsoft office\office14\convert\how to back files.txt
%ProgramFiles%\microsoft office\office14\document parts\1033\14\how to back files.txt
%ProgramFiles%\microsoft office\office14\document parts\1033\how to back files.txt
%ProgramFiles%\microsoft office\office14\document parts\how to back files.txt
%ProgramFiles%\microsoft office\office14\en\how to back files.txt
%ProgramFiles%\microsoft office\office14\forms\1033\how to back files.txt
%ProgramFiles%\microsoft office\office14\forms\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\certificates\groove.net\components\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\certificates\groove.net\managedobjects\how to back files.txt
%ProgramFiles%\microsoft office\office14\accwiz\how to back files.txt
%ProgramFiles%\java\jre1.8.0_45\lib\amd64\how to back files.txt
%ProgramFiles%\java\jre1.8.0_45\lib\cmm\how to back files.txt
%ProgramFiles%\microsoft office\office14\1036\how to back files.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\graycheck\how to back files.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\lime\how to back files.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\oasis\how to back files.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\slate\how to back files.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\softblue\how to back files.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\solutions\how to back files.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\springgreen\how to back files.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\sts2\how to back files.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\swirl\how to back files.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\how to back files.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\how to back files.txt
%ProgramFiles%\microsoft office\office14\1033\pubftscm\how to back files.txt
%ProgramFiles%\microsoft office\office14\1033\pubspapr\how to back files.txt
%ProgramFiles%\microsoft office\office14\1033\quickstyles\how to back files.txt
%ProgramFiles%\microsoft office\office14\1033\how to back files.txt
%ProgramFiles%\microsoft office\office14\3082\how to back files.txt
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\desert\how to back files.txt
%ProgramFiles%\java\jre1.8.0_45\bin\how to back files.txt
%ProgramFiles%\java\jre1.8.0_45\bin\server\how to back files.txt
%ProgramFiles%\java\jre1.8.0_45\bin\plugin2\how to back files.txt
C:\documents and settings\user\nethood\how to back files.txt
C:\documents and settings\user\pictures\how to back files.txt
C:\documents and settings\user\printhood\how to back files.txt
C:\documents and settings\user\recent\automaticdestinations\how to back files.txt
C:\documents and settings\user\recent\customdestinations\how to back files.txt
C:\documents and settings\user\recent\how to back files.txt
C:\documents and settings\user\saved games\how to back files.txt
C:\documents and settings\user\searches\how to back files.txt
C:\documents and settings\user\sendto\how to back files.txt
C:\documents and settings\user\start menu\programs\accessories\accessibility\how to back files.txt
C:\documents and settings\user\start menu\programs\accessories\system tools\how to back files.txt
C:\documents and settings\user\start menu\programs\accessories\how to back files.txt
C:\documents and settings\user\start menu\programs\administrative tools\how to back files.txt
C:\documents and settings\user\my documents\my pictures\how to back files.txt
C:\documents and settings\user\music\how to back files.txt
C:\documents and settings\user\my documents\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\certificates\groove.net\servers\how to back files.txt
C:\documents and settings\user\start menu\programs\google chrome\how to back files.txt
C:\documents and settings\user\local settings\how to back files.txt
C:\documents and settings\user\local settings\<INETFILES>\content.ie5\how to back files.txt
C:\documents and settings\user\local settings\<INETFILES>\low\how to back files.txt
C:\documents and settings\user\local settings\<INETFILES>\virtualized\how to back files.txt
C:\documents and settings\user\local settings\<INETFILES>\how to back files.txt
C:\documents and settings\user\local settings\thunderbird\profiles\chdgbv82.default-release\cache2\doomed\how to back files.txt
C:\documents and settings\user\local settings\thunderbird\profiles\chdgbv82.default-release\cache2\entries\how to back files.txt
C:\documents and settings\user\local settings\<INETFILES>\content.ie5\zmuktniv\how to back files.txt
C:\documents and settings\user\local settings\thunderbird\profiles\chdgbv82.default-release\cache2\how to back files.txt
C:\documents and settings\user\local settings\thunderbird\profiles\chdgbv82.default-release\safebrowsing\how to back files.txt
C:\documents and settings\user\local settings\thunderbird\profiles\chdgbv82.default-release\startupcache\how to back files.txt
C:\documents and settings\user\local settings\thunderbird\profiles\chdgbv82.default-release\how to back files.txt
C:\documents and settings\user\local settings\thunderbird\profiles\hmz1jddi.default\how to back files.txt
C:\documents and settings\user\local settings\thunderbird\profiles\how to back files.txt
C:\documents and settings\user\local settings\thunderbird\how to back files.txt
C:\documents and settings\user\local settings\thunderbird\profiles\chdgbv82.default-release\safebrowsing\google4\how to back files.txt
C:\documents and settings\user\my documents\my music\how to back files.txt
%ProgramFiles%\microsoft office\office14\accessweb\how to back files.txt
C:\documents and settings\user\start menu\programs\maintenance\how to back files.txt
C:\documents and settings\user\start menu\programs\winrar\how to back files.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\push\how to back files.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\rectangles\how to back files.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\resizingpanels\how to back files.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\shatter\how to back files.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\specialoccasion\how to back files.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\sports\how to back files.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\stacking\how to back files.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\travel\how to back files.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\videowall\how to back files.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\vignette\how to back files.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\how to back files.txt
%ProgramFiles%\dvd maker\shared\how to back files.txt
%ProgramFiles%\dvd maker\how to back files.txt
%ProgramFiles%\java\jre1.8.0_45\bin\dtplugin\how to back files.txt
C:\documents and settings\user\start menu\programs\startup\how to back files.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\pets\how to back files.txt
C:\documents and settings\user\start menu\programs\telegram desktop\how to back files.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\performance\how to back files.txt
C:\documents and settings\user\my documents\my videos\how to back files.txt
C:\documents and settings\user\start menu\programs\how to back files.txt
C:\documents and settings\user\start menu\how to back files.txt
C:\documents and settings\user\templates\how to back files.txt
C:\documents and settings\user\videos\how to back files.txt
C:\documents and settings\user\how to back files.txt
C:\documents and settings\how to back files.txt
<Текущая директория>\how to back files.txt
C:\kms\how to back files.txt
%ProgramFiles%\dvd maker\en-us\how to back files.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\babyboy\how to back files.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\babygirl\how to back files.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\flippage\how to back files.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\full\how to back files.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\huecycle\how to back files.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\layeredtitles\how to back files.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\oldage\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\how to back files.txt
%ProgramFiles%\windows journal\templates\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\certificates\verisign\how to back files.txt
%ProgramFiles%\microsoft sql server compact edition\v3.5\how to back files.txt
%ProgramFiles%\microsoft sql server compact edition\how to back files.txt
%ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\license agreements\how to back files.txt
%ProgramFiles%\microsoft sync framework\v1.0\documentation\1033\how to back files.txt
%ProgramFiles%\microsoft sync framework\v1.0\documentation\how to back files.txt
%ProgramFiles%\microsoft office\how to back files.txt
%ProgramFiles%\microsoft sql server compact edition\v3.5\desktop\how to back files.txt
%ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\resources\1033\how to back files.txt
%ProgramFiles%\microsoft sync framework\v1.0\runtime\how to back files.txt
%ProgramFiles%\microsoft sync framework\v1.0\how to back files.txt
%ProgramFiles%\microsoft sync framework\how to back files.txt
%ProgramFiles%\microsoft synchronization services\ado.net\v1.0\how to back files.txt
%ProgramFiles%\microsoft synchronization services\ado.net\how to back files.txt
%ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\resources\how to back files.txt
%ProgramFiles%\microsoft sync framework\v1.0\runtime\x64\how to back files.txt
%ProgramFiles%\microsoft office\templates\how to back files.txt
%ProgramFiles%\microsoft office\templates\1033\how to back files.txt
%ProgramFiles%\mozilla firefox\browser\features\how to back files.txt
%ProgramFiles%\microsoft office\office14\samples\how to back files.txt
%ProgramFiles%\microsoft office\office14\how to back files.txt
%ProgramFiles%\microsoft office\stationery\1033\how to back files.txt
%ProgramFiles%\microsoft office\stationery\how to back files.txt
%ProgramFiles%\microsoft office\templates\1033\access\datatype\how to back files.txt
%ProgramFiles%\microsoft office\templates\1033\access\part\how to back files.txt
%ProgramFiles%\microsoft office\templates\1033\access\wss\how to back files.txt
%ProgramFiles%\microsoft office\templates\1033\access\how to back files.txt
%ProgramFiles%\microsoft office\templates\1033\fax\how to back files.txt
%ProgramFiles%\microsoft office\templates\1033\onenote\14\notebook templates\how to back files.txt
%ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\how to back files.txt
%ProgramFiles%\microsoft office\templates\1033\onenote\14\how to back files.txt
%ProgramFiles%\microsoft office\templates\1033\onenote\how to back files.txt
%ProgramFiles%\microsoft synchronization services\how to back files.txt
%ProgramFiles%\microsoft office\office14\pubwiz\how to back files.txt
%ProgramFiles%\microsoft office\templates\presentation designs\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\certificates\groove.net\how to back files.txt
%ProgramFiles%\mozilla firefox\browser\visualelements\how to back files.txt
%ProgramFiles%\mozilla thunderbird\how to back files.txt
%ProgramFiles%\msbuild\microsoft\windows workflow foundation\v3.0\how to back files.txt
%ProgramFiles%\msbuild\microsoft\windows workflow foundation\v3.5\how to back files.txt
%ProgramFiles%\msbuild\microsoft\windows workflow foundation\how to back files.txt
%ProgramFiles%\msbuild\microsoft\how to back files.txt
%ProgramFiles%\msbuild\how to back files.txt
%ProgramFiles%\reference assemblies\microsoft\framework\v3.0\redistlist\how to back files.txt
%ProgramFiles%\reference assemblies\microsoft\framework\v3.0\how to back files.txt
%ProgramFiles%\reference assemblies\microsoft\framework\v3.5\redistlist\how to back files.txt
%ProgramFiles%\reference assemblies\microsoft\framework\v3.5\how to back files.txt
%ProgramFiles%\reference assemblies\microsoft\framework\how to back files.txt
%ProgramFiles%\reference assemblies\microsoft\how to back files.txt
%ProgramFiles%\reference assemblies\how to back files.txt
%ProgramFiles%\uninstall information\how to back files.txt
%ProgramFiles%\windows journal\en-us\how to back files.txt
%ProgramFiles%\mozilla thunderbird\visualelements\how to back files.txt
%ProgramFiles%\microsoft office\office14\pubba\how to back files.txt
%ProgramFiles%\microsoft office\office14\queries\how to back files.txt
%ProgramFiles%\mozilla thunderbird\fonts\how to back files.txt
%ProgramFiles%\mozilla firefox\defaults\pref\how to back files.txt
%ProgramFiles%\mozilla firefox\defaults\how to back files.txt
%ProgramFiles%\mozilla firefox\distibution\how to back files.txt
%ProgramFiles%\mozilla firefox\fonts\how to back files.txt
%ProgramFiles%\mozilla firefox\gmp-clearkey\0.1\how to back files.txt
%ProgramFiles%\mozilla firefox\gmp-clearkey\how to back files.txt
%ProgramFiles%\mozilla firefox\uninstall\how to back files.txt
%ProgramFiles%\mozilla firefox\how to back files.txt
%ProgramFiles%\mozilla thunderbird\chrome\icons\default\how to back files.txt
%ProgramFiles%\mozilla thunderbird\chrome\icons\how to back files.txt
%ProgramFiles%\mozilla thunderbird\chrome\how to back files.txt
%ProgramFiles%\mozilla thunderbird\defaults\messenger\how to back files.txt
%ProgramFiles%\mozilla thunderbird\defaults\pref\how to back files.txt
%ProgramFiles%\mozilla thunderbird\defaults\how to back files.txt
%ProgramFiles%\mozilla thunderbird\features\how to back files.txt
%ProgramFiles%\mozilla thunderbird\isp\how to back files.txt
%ProgramFiles%\mozilla firefox\browser\how to back files.txt
%ProgramFiles%\microsoft office\office14\proof\how to back files.txt
%ProgramFiles%\microsoft office\office14\proof\3082\how to back files.txt
%ProgramFiles%\microsoft office\office14\proof\1036\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\graycheck\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\lime\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\oasis\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\slate\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\softblue\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\springgreen\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\sts2\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\swirl\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\americana\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\babyblue\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\biscay\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\brightorange\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\babyblue\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\desert\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\certificates\verisign\components\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\brightorange\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\americana\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\sounds\people\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\sounds\places\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\sounds\things\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\sounds\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\toolbmps\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\calendar\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\certificates\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\discussion\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\documentshare\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\groovedocumentreview\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formstemplates\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\computers\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\biscay\how to back files.txt
C:\documents and settings\user\local settings\<INETFILES>\content.ie5\i3nmat9z\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\brightyellow\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\lime\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\xml files\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\how to back files.txt
%ProgramFiles%\microsoft office\office14\infopathom\infopathomformservices\infopathomformservicesv12\how to back files.txt
%ProgramFiles%\microsoft office\office14\infopathom\infopathomformservices\how to back files.txt
%ProgramFiles%\microsoft office\office14\infopathom\infopathomv12\how to back files.txt
%ProgramFiles%\microsoft office\office14\infopathom\how to back files.txt
%ProgramFiles%\microsoft office\office14\library\analysis\how to back files.txt
%ProgramFiles%\microsoft office\office14\library\solver\how to back files.txt
%ProgramFiles%\microsoft office\office14\library\how to back files.txt
%ProgramFiles%\microsoft office\office14\media\how to back files.txt
%ProgramFiles%\microsoft office\office14\onenote\how to back files.txt
%ProgramFiles%\microsoft office\office14\outlookautodiscover\how to back files.txt
%ProgramFiles%\microsoft office\office14\pagesize\how to back files.txt
%ProgramFiles%\microsoft office\office14\proof\1033\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\desert\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\xml files\space templates\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\graycheck\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\toolicons\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\brightyellow\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\oasis\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\slate\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\softblue\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\springgreen\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\sts2\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\swirl\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttool\project report type\basic\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttool\project report type\fancy\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttool\project report type\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttool\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\welcome tool\how to back files.txt
%ProgramFiles%\microsoft office\office14\groove\tooldata\how to back files.txt
%ProgramFiles%\mozilla thunderbird\uninstall\how to back files.txt
C:\documents and settings\user\local settings\<INETFILES>\content.ie5\ea09503g\how to back files.txt
C:\documents and settings\user\local settings\microsoft\office\groove\system\how to back files.txt
C:\documents and settings\all users\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\packages\how to back files.txt
C:\documents and settings\all users\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\how to back files.txt
C:\documents and settings\all users\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\packages\vcruntimeminimum_amd64\how to back files.txt
C:\documents and settings\all users\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\packages\how to back files.txt
C:\documents and settings\all users\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\how to back files.txt
C:\documents and settings\all users\package cache\{38b2c744-ad08-4d5b-91a2-3fb6f739ff3e}\how to back files.txt
C:\documents and settings\all users\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\packages\vcruntimeadditional_x86\how to back files.txt
C:\documents and settings\all users\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\packages\vcruntimeadditional_amd64\how to back files.txt
C:\documents and settings\all users\package cache\{9d29fc96-9eee-4253-943f-96b3bbfdd0b6}v14.16.27024\packages\vcruntimeadditional_amd64\how to back files.txt
C:\documents and settings\all users\package cache\{9d29fc96-9eee-4253-943f-96b3bbfdd0b6}v14.16.27024\packages\how to back files.txt
C:\documents and settings\all users\package cache\{9d29fc96-9eee-4253-943f-96b3bbfdd0b6}v14.16.27024\how to back files.txt
C:\documents and settings\all users\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\packages\vcruntimeminimum_amd64\how to back files.txt
C:\documents and settings\all users\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\packages\how to back files.txt
C:\documents and settings\all users\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\packages\how to back files.txt
C:\documents and settings\all users\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\how to back files.txt
C:\documents and settings\all users\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\how to back files.txt
C:\documents and settings\all users\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\packages\vcruntimeadditional_amd64\how to back files.txt
C:\documents and settings\all users\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\packages\vcruntimeadditional_x86\how to back files.txt
C:\documents and settings\all users\oracle\java\javapath\how to back files.txt
C:\documents and settings\all users\oracle\java\how to back files.txt
C:\documents and settings\all users\oracle\how to back files.txt
C:\documents and settings\all users\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\x64\how to back files.txt
C:\documents and settings\all users\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\how to back files.txt
C:\documents and settings\all users\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\how to back files.txt
C:\documents and settings\all users\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\how to back files.txt
C:\documents and settings\all users\package cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\how to back files.txt
C:\documents and settings\all users\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\packages\vcruntimeminimum_x86\how to back files.txt
C:\documents and settings\all users\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\packages\how to back files.txt
C:\documents and settings\all users\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\how to back files.txt
C:\documents and settings\all users\package cache\{295d1583-fdb9-414b-a4c8-da539362a26b}\how to back files.txt
C:\documents and settings\all users\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\how to back files.txt
C:\documents and settings\all users\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\how to back files.txt
C:\documents and settings\all users\microsoft help\how to back files.txt
C:\documents and settings\all users\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\packages\how to back files.txt
C:\documents and settings\all users\microsoft\network\how to back files.txt
C:\documents and settings\all users\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\packages\how to back files.txt
C:\documents and settings\all users\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\how to back files.txt
C:\documents and settings\all users\package cache\{fd9b6070-d13e-45dc-819b-41806bf45b6b}\how to back files.txt
C:\documents and settings\all users\package cache\how to back files.txt
C:\documents and settings\all users\start menu\programs\accessories\accessibility\how to back files.txt
C:\documents and settings\all users\start menu\programs\accessories\system tools\how to back files.txt
C:\documents and settings\all users\start menu\programs\accessories\tablet pc\how to back files.txt
C:\documents and settings\all users\start menu\programs\accessories\windows powershell\how to back files.txt
C:\documents and settings\all users\start menu\programs\accessories\how to back files.txt
C:\documents and settings\all users\start menu\programs\administrative tools\how to back files.txt
C:\documents and settings\all users\start menu\programs\games\how to back files.txt
C:\documents and settings\all users\start menu\programs\java\how to back files.txt
C:\documents and settings\all users\start menu\programs\maintenance\how to back files.txt
C:\documents and settings\all users\start menu\programs\microsoft office\microsoft office 2010 tools\how to back files.txt
C:\documents and settings\all users\start menu\programs\microsoft office\how to back files.txt
C:\documents and settings\all users\start menu\programs\sharepoint\how to back files.txt
C:\documents and settings\all users\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\packages\how to back files.txt
C:\documents and settings\all users\microsoft\how to back files.txt
C:\documents and settings\all users\oracle\java\installcache_x64\how to back files.txt
C:\documents and settings\all users\package cache\{f1b0fb3a-e0ea-47a6-9383-3650655403b0}v14.16.27024\how to back files.txt
C:\documents and settings\all users\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\packages\vcruntimeminimum_x86\how to back files.txt
C:\documents and settings\all users\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\packages\how to back files.txt
C:\documents and settings\all users\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\how to back files.txt
C:\documents and settings\all users\package cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\how to back files.txt
C:\documents and settings\all users\package cache\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\packages\vcruntimeminimum_amd64\how to back files.txt
C:\documents and settings\all users\package cache\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\packages\how to back files.txt
C:\documents and settings\all users\package cache\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\how to back files.txt
C:\documents and settings\all users\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\packages\vcruntimeadditional_amd64\how to back files.txt
C:\documents and settings\all users\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\packages\how to back files.txt
C:\documents and settings\all users\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\how to back files.txt
C:\documents and settings\all users\package cache\{ec9807de-b577-47b1-a024-0251805acf24}v14.29.30133\packages\vcruntimeminimum_x86\how to back files.txt
C:\documents and settings\all users\package cache\{ec9807de-b577-47b1-a024-0251805acf24}v14.29.30133\packages\how to back files.txt
C:\documents and settings\all users\package cache\{ec9807de-b577-47b1-a024-0251805acf24}v14.29.30133\how to back files.txt
C:\documents and settings\all users\package cache\{f1b0fb3a-e0ea-47a6-9383-3650655403b0}v14.16.27024\packages\vcruntimeminimum_amd64\how to back files.txt
C:\documents and settings\all users\package cache\{f1b0fb3a-e0ea-47a6-9383-3650655403b0}v14.16.27024\packages\how to back files.txt
C:\documents and settings\all users\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\how to back files.txt
C:\documents and settings\all users\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\how to back files.txt
C:\documents and settings\all users\microsoft\wwansvc\how to back files.txt
C:\documents and settings\all users\microsoft\wpd\how to back files.txt
C:\documents and settings\all users\microsoft\vault\how to back files.txt
C:\documents and settings\all users\favorites\how to back files.txt
C:\documents and settings\all users\microsoft\assistance\client\1.0\en-us\how to back files.txt
C:\documents and settings\all users\microsoft\assistance\client\1.0\how to back files.txt
C:\documents and settings\all users\microsoft\assistance\client\how to back files.txt
C:\documents and settings\all users\microsoft\assistance\how to back files.txt
C:\documents and settings\all users\microsoft\crypto\dss\machinekeys\how to back files.txt
C:\documents and settings\all users\microsoft\crypto\dss\how to back files.txt
C:\documents and settings\all users\microsoft\crypto\keys\how to back files.txt
C:\documents and settings\all users\microsoft\crypto\rsa\machinekeys\how to back files.txt
C:\documents and settings\all users\microsoft\crypto\rsa\s-1-5-18\how to back files.txt
C:\documents and settings\all users\microsoft\crypto\rsa\how to back files.txt
C:\documents and settings\all users\microsoft\crypto\how to back files.txt
C:\documents and settings\all users\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\how to back files.txt
C:\documents and settings\all users\documents\my videos\sample videos\how to back files.txt
C:\documents and settings\all users\documents\my pictures\sample pictures\how to back files.txt
C:\documents and settings\all users\documents\how to back files.txt
C:\documents and settings\all users\start menu\programs\startup\how to back files.txt
C:\documents and settings\all users\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\how to back files.txt
C:\documents and settings\all users\documents\my music\how to back files.txt
D:\$recycle.bin\s-1-5-21-3150914307-1777937420-491476919-1000\how to back files.txt
D:\$recycle.bin\how to back files.txt
g:\how to back files.txt
C:\how to back files.txt
C:\$recycle.bin\s-1-5-21-3150914307-1777937420-491476919-1000\how to back files.txt
C:\$recycle.bin\how to back files.txt
D:\how to back files.txt
C:\documents and settings\all users\adobe\arm\s\how to back files.txt
C:\documents and settings\all users\adobe\arm\how to back files.txt
C:\documents and settings\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\how to back files.txt
C:\documents and settings\all users\adobe\setup\how to back files.txt
C:\documents and settings\all users\adobe\how to back files.txt
C:\documents and settings\all users\desktop\how to back files.txt
C:\documents and settings\all users\documents\my music\sample music\how to back files.txt
C:\documents and settings\all users\adobe\arm\{291aa914-a987-4ce9-bd63-ac0a92d435e5}\how to back files.txt
C:\documents and settings\all users\documents\my pictures\how to back files.txt
C:\documents and settings\all users\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\packages\vcruntimeadditional_x86\how to back files.txt
C:\documents and settings\all users\microsoft\device stage\device\how to back files.txt
C:\documents and settings\all users\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-us\how to back files.txt
C:\documents and settings\all users\microsoft\office\how to back files.txt
C:\documents and settings\all users\microsoft\officesoftwareprotectionplatform\cache\how to back files.txt
C:\documents and settings\all users\microsoft\officesoftwareprotectionplatform\how to back files.txt
C:\documents and settings\all users\microsoft\rac\outbound\how to back files.txt
C:\documents and settings\all users\microsoft\rac\publisheddata\how to back files.txt
C:\documents and settings\all users\microsoft\rac\statedata\how to back files.txt
C:\documents and settings\all users\microsoft\rac\temp\how to back files.txt
C:\documents and settings\all users\microsoft\rac\how to back files.txt
C:\documents and settings\all users\microsoft\search\data\applications\how to back files.txt
C:\documents and settings\all users\microsoft\search\data\temp\how to back files.txt
C:\documents and settings\all users\microsoft\search\data\how to back files.txt
C:\documents and settings\all users\microsoft\search\how to back files.txt
C:\documents and settings\all users\microsoft\user account pictures\default pictures\how to back files.txt
C:\documents and settings\all users\microsoft\user account pictures\how to back files.txt
C:\documents and settings\all users\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-us\how to back files.txt
C:\documents and settings\all users\microsoft\office\uicaptions\how to back files.txt
C:\documents and settings\all users\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\how to back files.txt
C:\documents and settings\all users\microsoft\office\uicaptions\3082\how to back files.txt
C:\documents and settings\all users\documents\my videos\how to back files.txt
C:\documents and settings\all users\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\how to back files.txt
C:\documents and settings\all users\microsoft\device stage\task\how to back files.txt
C:\documents and settings\all users\microsoft\device stage\how to back files.txt
C:\documents and settings\all users\microsoft\devicesync\how to back files.txt
C:\documents and settings\all users\microsoft\drm\server\how to back files.txt
C:\documents and settings\all users\microsoft\drm\how to back files.txt
C:\documents and settings\all users\microsoft\ehome\logs\how to back files.txt
C:\documents and settings\all users\microsoft\ehome\how to back files.txt
C:\documents and settings\all users\microsoft\identitycrl\how to back files.txt
C:\documents and settings\all users\microsoft\media player\how to back files.txt
C:\documents and settings\all users\microsoft\mf\how to back files.txt
C:\documents and settings\all users\microsoft\msdn\8.0\how to back files.txt
C:\documents and settings\all users\microsoft\msdn\how to back files.txt
C:\documents and settings\all users\microsoft\network\connections\how to back files.txt
C:\documents and settings\all users\microsoft\network\downloader\how to back files.txt
C:\documents and settings\all users\microsoft\office\uicaptions\1036\how to back files.txt
C:\documents and settings\default user\local settings\<INETFILES>\how to back files.txt
C:\documents and settings\user\local settings\temp\how to back files.txt
C:\documents and settings\all users\start menu\programs\winrar\how to back files.txt
C:\documents and settings\user\contacts\how to back files.txt
C:\documents and settings\user\cookies\low\how to back files.txt
C:\documents and settings\user\cookies\how to back files.txt
C:\documents and settings\user\desktop\how to back files.txt
C:\documents and settings\user\documents\my music\how to back files.txt
C:\documents and settings\public\videos\how to back files.txt
C:\documents and settings\public\how to back files.txt
C:\documents and settings\user\documents\my pictures\how to back files.txt
C:\documents and settings\user\downloads\how to back files.txt
C:\documents and settings\user\favorites\links\how to back files.txt
C:\documents and settings\user\favorites\links for united states\how to back files.txt
C:\documents and settings\user\favorites\microsoft websites\how to back files.txt
C:\documents and settings\user\favorites\msn websites\how to back files.txt
C:\documents and settings\user\documents\my videos\how to back files.txt
C:\documents and settings\user\documents\how to back files.txt
C:\documents and settings\public\videos\sample videos\how to back files.txt
C:\documents and settings\public\recorded tv\sample media\how to back files.txt
C:\documents and settings\user\favorites\how to back files.txt
C:\documents and settings\public\documents\my music\how to back files.txt
C:\documents and settings\public\documents\my pictures\sample pictures\how to back files.txt
C:\documents and settings\public\documents\my pictures\how to back files.txt
C:\documents and settings\public\documents\my videos\sample videos\how to back files.txt
C:\documents and settings\public\documents\my videos\how to back files.txt
C:\documents and settings\public\documents\how to back files.txt
C:\documents and settings\public\downloads\how to back files.txt
C:\documents and settings\public\favorites\how to back files.txt
C:\documents and settings\public\libraries\how to back files.txt
C:\documents and settings\public\music\sample music\how to back files.txt
C:\documents and settings\public\music\how to back files.txt
C:\documents and settings\public\pictures\sample pictures\how to back files.txt
C:\documents and settings\public\pictures\how to back files.txt
C:\documents and settings\user\favorites\windows live\how to back files.txt
C:\documents and settings\public\desktop\how to back files.txt
C:\documents and settings\public\recorded tv\how to back files.txt
C:\documents and settings\all users\start menu\programs\steam\how to back files.txt
C:\documents and settings\user\links\how to back files.txt
C:\documents and settings\user\local settings\microsoft\office\groove\how to back files.txt
C:\documents and settings\user\local settings\microsoft\office\how to back files.txt
C:\documents and settings\user\local settings\microsoft\windows media\12.0\how to back files.txt
C:\documents and settings\user\local settings\microsoft\windows media\how to back files.txt
C:\documents and settings\user\local settings\microsoft\how to back files.txt
C:\documents and settings\user\local settings\microsoft help\how to back files.txt
C:\documents and settings\user\local settings\programs\common\how to back files.txt
C:\documents and settings\user\local settings\programs\how to back files.txt
C:\documents and settings\user\local settings\temp\hsperfdata_user\how to back files.txt
C:\documents and settings\user\local settings\temp\low\how to back files.txt
C:\documents and settings\user\local settings\temp\microsoft .net framework 4 setup_4.0.30319\how to back files.txt
C:\documents and settings\user\local settings\temp\microsoft visual c++ 2010 x64 redistributable setup_10.0.30319\how to back files.txt
C:\documents and settings\user\local settings\temp\microsoft visual c++ 2010 x86 redistributable setup_10.0.30319\how to back files.txt
C:\documents and settings\user\local settings\temp\opera installer\how to back files.txt
C:\documents and settings\user\local settings\temp\wpdnse\how to back files.txt
C:\documents and settings\user\local settings\microsoft\office\groove\user\how to back files.txt
C:\documents and settings\default user\how to back files.txt
C:\documents and settings\public\documents\my music\sample music\how to back files.txt
C:\documents and settings\user\local settings\microsoft\media player\sync playlists\how to back files.txt
C:\documents and settings\user\local settings\history\low\how to back files.txt
C:\documents and settings\user\local settings\history\how to back files.txt
C:\documents and settings\user\local settings\microsoft\credentials\how to back files.txt
C:\documents and settings\user\local settings\microsoft\feeds\feeds for united states~\how to back files.txt
C:\documents and settings\user\local settings\microsoft\feeds\microsoft feeds~\how to back files.txt
C:\documents and settings\user\local settings\microsoft\feeds\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\webslices~\how to back files.txt
C:\documents and settings\user\local settings\microsoft\feeds\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\how to back files.txt
C:\documents and settings\user\local settings\microsoft\feeds\how to back files.txt
C:\documents and settings\user\local settings\microsoft\feeds cache\15ivkcr3\how to back files.txt
C:\documents and settings\user\local settings\microsoft\feeds cache\6fwa5ftw\how to back files.txt
C:\documents and settings\user\local settings\microsoft\feeds cache\bbs9hw0e\how to back files.txt
C:\documents and settings\user\local settings\microsoft\feeds cache\xwtafhng\how to back files.txt
C:\documents and settings\user\local settings\microsoft\feeds cache\how to back files.txt
C:\documents and settings\user\local settings\microsoft\media player\sync playlists\en-us\0000b025\how to back files.txt
C:\documents and settings\user\local settings\microsoft\media player\sync playlists\en-us\how to back files.txt
C:\documents and settings\user\local settings\microsoft\media player\how to back files.txt
C:\documents and settings\user\local settings\history\history.ie5\how to back files.txt
C:\documents and settings\default user\videos\how to back files.txt
C:\documents and settings\default user\templates\how to back files.txt
C:\documents and settings\default user\start menu\how to back files.txt
C:\documents and settings\default\local settings\how to back files.txt
C:\documents and settings\default\music\how to back files.txt
C:\documents and settings\default\my documents\my music\how to back files.txt
C:\documents and settings\default\my documents\my pictures\how to back files.txt
C:\documents and settings\default\my documents\my videos\how to back files.txt
C:\documents and settings\default\my documents\how to back files.txt
C:\documents and settings\default\nethood\how to back files.txt
C:\documents and settings\default\pictures\how to back files.txt
C:\documents and settings\default\printhood\how to back files.txt
C:\documents and settings\default\recent\how to back files.txt
C:\documents and settings\default\saved games\how to back files.txt
C:\documents and settings\default\sendto\how to back files.txt
C:\documents and settings\default\start menu\programs\accessories\accessibility\how to back files.txt
C:\documents and settings\default\local settings\microsoft\how to back files.txt
C:\documents and settings\default\links\how to back files.txt
C:\documents and settings\default\local settings\<INETFILES>\how to back files.txt
C:\documents and settings\all users\start menu\programs\tablet pc\how to back files.txt
C:\documents and settings\default\start menu\programs\accessories\system tools\how to back files.txt
C:\documents and settings\default\favorites\how to back files.txt
C:\documents and settings\all users\start menu\how to back files.txt
C:\documents and settings\all users\sun\java\java update\how to back files.txt
C:\documents and settings\all users\sun\java\how to back files.txt
C:\documents and settings\all users\sun\how to back files.txt
C:\documents and settings\all users\templates\how to back files.txt
C:\documents and settings\all users\how to back files.txt
C:\documents and settings\all users\start menu\programs\how to back files.txt
<Текущая директория>\targetinfo.txt
C:\documents and settings\default\desktop\how to back files.txt
C:\documents and settings\default\documents\my music\how to back files.txt
C:\documents and settings\default\documents\my pictures\how to back files.txt
C:\documents and settings\default\documents\my videos\how to back files.txt
C:\documents and settings\default\documents\how to back files.txt
C:\documents and settings\default\downloads\how to back files.txt
C:\documents and settings\default\cookies\how to back files.txt
C:\documents and settings\default\local settings\history\how to back files.txt
C:\documents and settings\user\local settings\<INETFILES>\content.ie5\dyps348i\how to back files.txt
C:\documents and settings\default\start menu\programs\accessories\how to back files.txt
C:\documents and settings\default\start menu\how to back files.txt
C:\documents and settings\default user\my documents\my pictures\how to back files.txt
C:\documents and settings\default user\my documents\my videos\how to back files.txt
C:\documents and settings\default user\my documents\how to back files.txt
C:\documents and settings\default user\nethood\how to back files.txt
C:\documents and settings\default user\pictures\how to back files.txt
C:\documents and settings\default user\printhood\how to back files.txt
C:\documents and settings\default user\recent\how to back files.txt
C:\documents and settings\default user\saved games\how to back files.txt
C:\documents and settings\default user\sendto\how to back files.txt
C:\documents and settings\default user\start menu\programs\accessories\accessibility\how to back files.txt
C:\documents and settings\default user\start menu\programs\accessories\system tools\how to back files.txt
C:\documents and settings\default user\start menu\programs\accessories\how to back files.txt
C:\documents and settings\default user\start menu\programs\maintenance\how to back files.txt
C:\documents and settings\default user\start menu\programs\how to back files.txt
C:\documents and settings\default\start menu\programs\maintenance\how to back files.txt
C:\documents and settings\default user\my documents\my music\how to back files.txt
C:\documents and settings\default\start menu\programs\how to back files.txt
C:\documents and settings\default user\music\how to back files.txt
C:\documents and settings\default\local settings\temp\how to back files.txt
C:\documents and settings\default\templates\how to back files.txt
C:\documents and settings\default\videos\how to back files.txt
C:\documents and settings\default\how to back files.txt
C:\documents and settings\default user\cookies\how to back files.txt
C:\documents and settings\default user\desktop\how to back files.txt
C:\documents and settings\default user\documents\my music\how to back files.txt
C:\documents and settings\default user\documents\my pictures\how to back files.txt
C:\documents and settings\default user\documents\my videos\how to back files.txt
C:\documents and settings\default user\documents\how to back files.txt
C:\documents and settings\default user\downloads\how to back files.txt
C:\documents and settings\default user\favorites\how to back files.txt
C:\documents and settings\default user\links\how to back files.txt
C:\documents and settings\default user\local settings\history\how to back files.txt
C:\documents and settings\default user\local settings\microsoft\how to back files.txt
C:\documents and settings\default user\local settings\temp\how to back files.txt
C:\documents and settings\default user\local settings\how to back files.txt
%ProgramFiles%\windows journal\how to back files.txt

Изменяет следующие файлы

D:\install.log

Сетевая активность

Подключается к

'22#.0.0.22':445
'ap#.#pify.org':80
'91.##5.85.142':80
'22#.0.0.22':135

TCP

Запросы HTTP GET

http://ap#.#pify.org/

Запросы HTTP POST

http://91.##5.85.142/QWEwqdsvsf/ap.php

UDP

DNS ASK ap#.#pify.org

Другое

Ищет следующие окна

ClassName: '' WindowName: ''

Создает и запускает на исполнение

'<Полный путь к файлу>' ' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c bcdedit /set {current} bootstatuspolicy ignoreallfailures' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c bcdedit /set {current} recoveryenabled no' (со скрытым окном)

Перезапускает анализируемый образец

Запускает на исполнение

'<SYSTEM32>\cmd.exe' /c ""%TEMP%\killerr.bat" "
'<SYSTEM32>\net1.exe' stop "Synology Drive VSS Service x64"
'<SYSTEM32>\sc.exe' config MSSQL$VIM_SQLEXP start=disabled
'<SYSTEM32>\sc.exe' delete secbizsrv
'<SYSTEM32>\sc.exe' delete AlibabaProtect
'<SYSTEM32>\net1.exe' stop MSExchangeAntispamUpdate
'<SYSTEM32>\net1.exe' stop "MSSQL$WOLTERSKLUWER"
'<SYSTEM32>\net1.exe' stop VMAuthdService
'<SYSTEM32>\sc.exe' delete TPlusStdTaskService1300
'<SYSTEM32>\net1.exe' stop wanxiao-monitor
'<SYSTEM32>\sc.exe' delete SPTimerV4
'<SYSTEM32>\net1.exe' stop DellDRLogSvc
'<SYSTEM32>\sc.exe' delete SQLTELEMETRY
'<SYSTEM32>\sc.exe' delete SPSearchHostController
'<SYSTEM32>\net1.exe' stop VMUSBArbService
'<SYSTEM32>\sc.exe' delete ZTEVdservice
'<SYSTEM32>\net1.exe' stop MSExchangeCompliance
'<SYSTEM32>\net1.exe' stop "SQLAgent$PROGID"
'<SYSTEM32>\sc.exe' delete TPlusStdUpgradeService1300
'<SYSTEM32>\sc.exe' delete SPTraceV4
'<SYSTEM32>\sc.exe' delete MSMQ
'<SYSTEM32>\sc.exe' delete kbasesrv
'<SYSTEM32>\net1.exe' stop FirebirdGuardianDeafaultInstance
'<SYSTEM32>\net1.exe' stop mysqltransport
'<SYSTEM32>\net1.exe' stop "MSSQLSERVER"
'<SYSTEM32>\net1.exe' stop MSExchangeDagMgmt
'<SYSTEM32>\net1.exe' stop "SQLAgent$WOLTERSKLUWER"
'<SYSTEM32>\sc.exe' delete VirboxWebServer
'<SYSTEM32>\net1.exe' stop WebAttendServer
'<SYSTEM32>\net1.exe' stop "MSSQLFDLauncher"
'<SYSTEM32>\sc.exe' delete SQLAgent$SQL2008
'<SYSTEM32>\net1.exe' stop TeamViewer8
'<SYSTEM32>\sc.exe' delete smtpsvrJT
'<SYSTEM32>\net1.exe' stop MSSQL$FE_EXPRESS
'<SYSTEM32>\sc.exe' delete eSightService
'<SYSTEM32>\sc.exe' delete "ZTE FileTranS"
'<SYSTEM32>\net1.exe' stop HaoZipSvc
'<SYSTEM32>\net1.exe' stop "memcached Server"
'<SYSTEM32>\sc.exe' delete TPlusStdAppService1300
'<SYSTEM32>\net1.exe' stop Apache2.4
'<SYSTEM32>\sc.exe' delete ProjectQueueService16
'<SYSTEM32>\net1.exe' stop "igfxCUIService2.0.0.0"
'<SYSTEM32>\sc.exe' config SQLANYs_Sage_FAS_Fixed_Assets start=disabled
'<SYSTEM32>\net1.exe' stop "TMBMServer"
'<SYSTEM32>\net1.exe' stop UFIDAWebService
'<SYSTEM32>\sc.exe' delete apachezt
'<SYSTEM32>\sc.exe' delete wwbizsrv
'<SYSTEM32>\net1.exe' stop Realtek11nSU
'<SYSTEM32>\net1.exe' stop UIODetect
'<SYSTEM32>\net1.exe' stop MSComplianceAudit
'<SYSTEM32>\net1.exe' stop xenlite
'<SYSTEM32>\sc.exe' delete MSSQL$SQL2008
'<SYSTEM32>\sc.exe' delete SPAdminV4
'<SYSTEM32>\net1.exe' stop VMwareHostd
'<SYSTEM32>\net1.exe' stop MSExchangeADTopology
'<SYSTEM32>\net1.exe' stop MSSQL$VIM_SQLEXP
'<SYSTEM32>\net1.exe' stop XenSvc
'<SYSTEM32>\sc.exe' delete Jenkins
'<SYSTEM32>\sc.exe' delete qemu-ga
'<SYSTEM32>\net1.exe' stop "MSSQL$PROGID"
'<SYSTEM32>\sc.exe' delete OSearch16
'<SYSTEM32>\net1.exe' stop U8WorkerService2
'<SYSTEM32>\net1.exe' stop Apache2.2
'<SYSTEM32>\sc.exe' delete RTCATS
'<SYSTEM32>\sc.exe' delete MMRHookService
'<SYSTEM32>\sc.exe' delete vmware-converter-agent
'<SYSTEM32>\sc.exe' delete "OSP Service"
'<SYSTEM32>\sc.exe' delete c2wts
'<SYSTEM32>\net1.exe' stop Tomcat8
'<SYSTEM32>\net1.exe' stop AdobeARMservice
'<SYSTEM32>\sc.exe' delete OracleMTSRecoveryService
'<SYSTEM32>\sc.exe' delete vmware-converter-server
'<SYSTEM32>\net1.exe' stop "MSSQL$OPTIMA"
'<SYSTEM32>\net1.exe' stop MSExchangeEdgeSync
'<SYSTEM32>\sc.exe' delete AppFabricCachingService
'<SYSTEM32>\net1.exe' stop TeamViewer
'<SYSTEM32>\sc.exe' delete vmware-converter-worker
'<SYSTEM32>\net1.exe' stop VeeamCatalogSvc
'<SYSTEM32>\sc.exe' delete ADWS
'<SYSTEM32>\net1.exe' stop "SQLAgent$OPTIMA"
'<SYSTEM32>\net1.exe' stop MSExchangeFastSearch
'<SYSTEM32>\net1.exe' stop QPCore
'<SYSTEM32>\sc.exe' delete MotionBoard57
'<SYSTEM32>\sc.exe' delete QQCertificateService
'<SYSTEM32>\net1.exe' stop VeeanBackupSvc
'<SYSTEM32>\net1.exe' stop MSExchangeFrontEndTransport
'<SYSTEM32>\sc.exe' delete MotionBoardRCService57
'<SYSTEM32>\net1.exe' stop "ReportServer$OPTIMA"
'<SYSTEM32>\net1.exe' stop CASLicenceServer
'<SYSTEM32>\sc.exe' delete vsvnjobsvc
'<SYSTEM32>\sc.exe' delete OracleRemExecService
'<SYSTEM32>\sc.exe' delete VisualSVNServer
'<SYSTEM32>\net1.exe' stop CASWebServer
'<SYSTEM32>\net1.exe' stop MSExchangeHM
'<SYSTEM32>\sc.exe' delete "SQL Server Reporting Services"
'<SYSTEM32>\net1.exe' stop SQLANYs_Sage_FAS_Fixed_Assets
'<SYSTEM32>\net1.exe' stop "SQLTELEMETRY$HL"
'<SYSTEM32>\sc.exe' delete 2345PicSvc
'<SYSTEM32>\net1.exe' stop VMnetDHCP
'<SYSTEM32>\net1.exe' stop MSExchangeDelivery
'<SYSTEM32>\sc.exe' delete jhi_service
'<SYSTEM32>\sc.exe' delete ProjectCalcService16
'<SYSTEM32>\net1.exe' stop "MSSQLFDLauncher$OPTIMA"
'<SYSTEM32>\sc.exe' delete zyb_sync
'<SYSTEM32>\sc.exe' delete OracleJobSchedulerORCL
'<SYSTEM32>\sc.exe' delete LMS
'<SYSTEM32>\sc.exe' delete 360EntHttpServer
'<SYSTEM32>\net1.exe' stop JWRinfoClientService
'<SYSTEM32>\net1.exe' stop "VMware NAT Service"
'<SYSTEM32>\sc.exe' delete 360EntSvc
'<SYSTEM32>\net1.exe' stop JWService
'<SYSTEM32>\sc.exe' delete IpOverUsbSvc
'<SYSTEM32>\sc.exe' delete 360EntClientSvc
'<SYSTEM32>\sc.exe' delete NFWebServer
'<SYSTEM32>\sc.exe' delete MsDtsServer100
'<SYSTEM32>\sc.exe' delete wampapache
'<SYSTEM32>\sc.exe' delete KuaiYunTools
'<SYSTEM32>\net1.exe' stop Service2
'<SYSTEM32>\sc.exe' delete MSSEARCH
'<SYSTEM32>\sc.exe' delete KMSELDI
'<SYSTEM32>\net1.exe' stop RapidRecoveryAgent
'<SYSTEM32>\sc.exe' delete msftesql
'<SYSTEM32>\sc.exe' delete btPanel
'<SYSTEM32>\sc.exe' delete "SyncBASE Service"
'<SYSTEM32>\sc.exe' delete Protect_2345Explorer
'<SYSTEM32>\net1.exe' stop FirebirdServerDefaultInstance
'<SYSTEM32>\sc.exe' delete OracleDBConcoleorcl
'<SYSTEM32>\sc.exe' delete "FontCache3.0.0.0"
'<SYSTEM32>\net1.exe' stop JWEM3DBAUTORun
'<SYSTEM32>\sc.exe' delete ProjectEventService16
'<SYSTEM32>\sc.exe' delete SSSyncService
'<SYSTEM32>\net1.exe' stop U8WorkerService1
'<SYSTEM32>\net1.exe' stop SQLBrowser
'<SYSTEM32>\sc.exe' delete MSSQLFDLauncher
'<SYSTEM32>\cmd.exe' /c "color b & @taskkill /IM ReportingServicesService.exe /F & @sc delete "SQL Server Reporting Services" & @sc delete MSSQLFDLauncher & @taskkill /IM U8CEServer.exe /F & @taskkill /IM ServerNT....
'<SYSTEM32>\net1.exe' stop "MSSQL$VEEAMSQL2012"
'<SYSTEM32>\sc.exe' delete eCardMPService
'<SYSTEM32>\cmd.exe' /c "color a & @net stop U8WorkerService1 & @net stop U8WorkerService2 & @net stop "memcached Server" & @net stop Apache2.4 & @net stop UFIDAWebService & @net stop MSComplianceAudit & @net stop ...
'<SYSTEM32>\sc.exe' delete OracleOraDb11g_home1ClrAgent
'<SYSTEM32>\sc.exe' delete MSSQLSERVER
'<SYSTEM32>\sc.exe' config SQLBrowser start=disabled
'<SYSTEM32>\sc.exe' delete EnergyDataService
'<SYSTEM32>\sc.exe' delete OracleOraDb11g_home1TNSListener
'<SYSTEM32>\cmd.exe' /c "color a & @net stop HaoZipSvc & @net stop "igfxCUIService2.0.0.0" & @net stop Realtek11nSU & @net stop xenlite & @net stop XenSvc & @net stop Apache2.2 & @net stop "Synology Drive VSS Servi...
'<SYSTEM32>\sc.exe' delete QcSoftService
'<SYSTEM32>\net1.exe' stop "ReportServer$SHOPCONTROL9"
'<SYSTEM32>\sc.exe' delete UI0Detect
'<SYSTEM32>\sc.exe' delete OracleVssWriterORCL
'<SYSTEM32>\net1.exe' stop "SQLAgent$VEEAMSQL2012"
'<SYSTEM32>\sc.exe' delete MSSQLServerOLAPService
'<SYSTEM32>\sc.exe' delete K3MobileService
'<SYSTEM32>\net1.exe' stop "SQLAgent$SHOPCONTROL9"
'<SYSTEM32>\sc.exe' delete OracleServiceORCL
'<SYSTEM32>\sc.exe' delete TCPIDDAService
'<SYSTEM32>\sc.exe' delete aspnet_state @sc delete Redis
'<SYSTEM32>\sc.exe' delete VMTools
'<SYSTEM32>\net1.exe' stop "NetBackup Client Service"
'<SYSTEM32>\net1.exe' stop vss
'<SYSTEM32>\cmd.exe' /c "color a & @net stop UIODetect & @net stop VMwareHostd & @net stop TeamViewer8 & @net stop VMUSBArbService & @net stop VMAuthdService & @net stop wanxiao-monitor & @net stop WebAttendServer ...
'<SYSTEM32>\sc.exe' delete "eCard-TTransServer"
'<SYSTEM32>\net1.exe' stop "SQLWrite"
'<SYSTEM32>\net1.exe' stop "MSSQLFDLauncher$SHOPCONTROL9"
'<SYSTEM32>\net1.exe' stop "msftesql$SQLEXPRESS"
'<SYSTEM32>\sc.exe' delete WebAttendServer
'<SYSTEM32>\sc.exe' delete "DAService_TCP"
'<SYSTEM32>\cmd.exe' /c "color b & sc config MSSQLSERVER start=disabled & sc config "SQL Server (MSSQLSERVER)" start=disabled & net stop MSSQL$ & sc config MSSQL$ start=disabled & net stop SQLSERVERAGENT & sc confi...
'<SYSTEM32>\cmd.exe' /c "color b & taskkill /F /IM Veeam.Backup.Agent.ConfigurationService.exe & taskkill /F /IM Veeam.Backup.BrokerService.exe & taskkill /F /IM Veeam.Backup.CatalogDataService.exe & taskkill /F /I...
'<SYSTEM32>\cmd.exe' /c "color b & net stop "MSOLAP$SHOPCONTROL9" & net stop "MSSQL$SHOPCONTROL9" & net stop "MSSQLFDLauncher$SHOPCONTROL9" & net stop "ReportServer$SHOPCONTROL9" & net stop "SQLAgent$SHOPCONTROL9" ...
'<SYSTEM32>\cmd.exe' /c "color b & @taskkill /IM Tomcat7w.exe /F & @taskkill /IM "UFSoft.U8.OC.QuartzScheduler.exe" /F & @taskkill /IM UFSoft.U8.OC.QuartzScheduler.exe /F & @taskkill /IM Launchpad.exe /F & @taskkil...
'<SYSTEM32>\sc.exe' config MSSQLSERVER start=disabled
'<SYSTEM32>\sc.exe' config "SQL Server (MSSQLSERVER)" start=disabled
'<SYSTEM32>\cmd.exe' /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
'<SYSTEM32>\cmd.exe' /c "color b & @taskkill /IM DDSoftPwsTomcat9.exe /F & @taskkill /IM U8SmartClient.exe /F & @taskkill /IM U8SmartClientMonitor.exe /F & @taskkill /IM tomcat9.exe /F & @taskkill /IM SqlManagement...
'<SYSTEM32>\cmd.exe' /c bcdedit /set {current} recoveryenabled no
'<SYSTEM32>\net1.exe' stop "SQLSERVERAGENT"
'<SYSTEM32>\cmd.exe' /c "color b & @sc delete "XT800Service_Personal" & @sc delete SQLSERVERAGENT & @sc delete SQLWriter & @sc delete SQLBrowser & @sc delete MSSQLFDLauncher & @sc delete MSSQLSERVER & @sc delete Qc...
'<SYSTEM32>\net1.exe' stop MSSQL$
'<SYSTEM32>\net1.exe' stop "SQLBrowser"
'<SYSTEM32>\cmd.exe' /c "color b & net stop "SQLSERVERAGENT" & net stop "SQLBrowser" & net stop "SQLTELEMETRY" & net stop "MsDtsServer130" & net stop "SSISTELEMETRY130" & net stop "SQLWrite" & net stop "MSSQL$VEEAM...
'<SYSTEM32>\net1.exe' stop "SQLTELEMETRY"
'<SYSTEM32>\sc.exe' config MSSQL$ start=disabled
'<SYSTEM32>\net1.exe' stop "MsDtsServer130"
'<SYSTEM32>\net1.exe' stop "SSISTELEMETRY130"
'<SYSTEM32>\net1.exe' stop "MSOLAP$SHOPCONTROL9"
'<SYSTEM32>\net1.exe' stop SQLSERVERAGENT
'<SYSTEM32>\bcdedit.exe' /set {current} bootstatuspolicy ignoreallfailures
'<SYSTEM32>\cmd.exe' /c "color b & @sc delete OracleOraDb11g_home1ClrAgent & @sc delete OracleOraDb11g_home1TNSListener & @sc delete OracleVssWriterORCL & @sc delete OracleServiceORCL & @sc delete aspnet_state @sc ...
'<SYSTEM32>\sc.exe' delete "XT800Service_Personal"
'<SYSTEM32>\sc.exe' delete SQLSERVERAGENT
'<SYSTEM32>\net1.exe' stop "MSSQL$SHOPCONTROL9"
'<SYSTEM32>\sc.exe' delete SQLWriter
'<SYSTEM32>\cmd.exe' /c "color b & @sc delete "UWS LoPriv Services" & @sc delete ftnlsv3 & @sc delete ftnlses3 & @sc delete FxService & @sc delete "UtilDev Web Server Pro" & @sc delete ftusbrdwks & @sc delete ftusb...
'<SYSTEM32>\sc.exe' config SQLSERVERAGENT start=disabled
'<SYSTEM32>\cmd.exe' /c "color b & @sc delete "DAService_TCP" & @sc delete "eCard-TTransServer" & @sc delete eCardMPService & @sc delete EnergyDataService & @sc delete UI0Detect & @sc delete K3MobileService & @sc d...
'<SYSTEM32>\sc.exe' delete SQLBrowser
'<SYSTEM32>\net1.exe' stop MSExchangeDiagnostics
'<SYSTEM32>\sc.exe' delete JhTask
'<SYSTEM32>\cmd.exe' /c "color e & @taskkill /IM sqlservr.exe /F & @taskkill /IM httpd.exe /F & @taskkill /IM java.exe /F & @taskkill /IM fdhost.exe /F & @taskkill /IM fdlauncher.exe /F & @taskkill /IM Veeam.Backup...
'<SYSTEM32>\sc.exe' delete VMwareHostd
'<SYSTEM32>\sc.exe' delete ftnlses3
'<SYSTEM32>\sc.exe' delete RtcQms
'<SYSTEM32>\net1.exe' stop "MSSQLServerOLAPService"
'<SYSTEM32>\sc.exe' delete FxService
'<SYSTEM32>\sc.exe' config vmvss start=disabled
'<SYSTEM32>\sc.exe' delete RTCMEETINGMCU
'<SYSTEM32>\sc.exe' delete "AHS SERVICE"
'<SYSTEM32>\sc.exe' delete "UtilDev Web Server Pro"
'<SYSTEM32>\sc.exe' delete RTCIMMCU
'<SYSTEM32>\sc.exe' delete "Flash Helper Service"
'<SYSTEM32>\sc.exe' delete ftusbrdwks
'<SYSTEM32>\sc.exe' delete ftusbrdsrv
'<SYSTEM32>\sc.exe' delete "vm-agent"
'<SYSTEM32>\sc.exe' config MSSQL$FE_EXPRESS start= disabled
'<SYSTEM32>\net1.exe' stop "MsDtsServer100"
'<SYSTEM32>\sc.exe' delete "Sense Shield Service"
'<SYSTEM32>\sc.exe' delete RTCDATAMCU
'<SYSTEM32>\sc.exe' delete "Kiwi Syslog Server"
'<SYSTEM32>\sc.exe' delete VmAgentDaemon
'<SYSTEM32>\sc.exe' delete "ZTE USBIP Client Guard"
'<SYSTEM32>\sc.exe' delete SSMonitorService
'<SYSTEM32>\net1.exe' stop MSSQL$RE_EXPRESS
'<SYSTEM32>\net1.exe' stop "ReportServer"
'<SYSTEM32>\sc.exe' delete RTCCDR
'<SYSTEM32>\sc.exe' delete "UWS HiPriv Services"
'<SYSTEM32>\sc.exe' delete OpenSSHd
'<SYSTEM32>\sc.exe' delete "ZTE USBIP Client"
'<SYSTEM32>\net1.exe' stop "NetBackup Discovery Framework"
'<SYSTEM32>\net1.exe' stop "NetBackup SAN Client Fibre Transport Service"
'<SYSTEM32>\sc.exe' delete VGAuthService
'<SYSTEM32>\sc.exe' delete RTCAVMCU
'<SYSTEM32>\cmd.exe' /c "@color b & sc delete MSCRMAsyncService & @sc delete REPLICA & @sc delete RTCATS & @sc delete RTCAVMCU & @sc delete RtcQms & @sc delete RTCMEETINGMCU & @sc delete RTCIMMCU & @sc delete RTCDA...
'<SYSTEM32>\net1.exe' stop "MSSQL"
'<SYSTEM32>\sc.exe' config vss start=disabled
'<SYSTEM32>\sc.exe' delete UIODetect
'<SYSTEM32>\sc.exe' delete ImeDictUpdateService
'<SYSTEM32>\net1.exe' stop "NetBackup Legacy Client Service"
'<SYSTEM32>\sc.exe' delete MSDTC
'<SYSTEM32>\sc.exe' delete "wanxiao-monitor"
'<SYSTEM32>\sc.exe' delete XT800Service_Personal
'<SYSTEM32>\net1.exe' stop "SQLAgent"
'<SYSTEM32>\net1.exe' stop SQLWriter
'<SYSTEM32>\net1.exe' stop "NetBackup Legacy Network Service"
'<SYSTEM32>\sc.exe' delete TeamViewer
'<SYSTEM32>\sc.exe' delete MCService
'<SYSTEM32>\sc.exe' delete VMAuthdService
'<SYSTEM32>\sc.exe' config SQLWriter start=disabled
'<SYSTEM32>\net1.exe' stop "MSSQLServerADHelper100"
'<SYSTEM32>\cmd.exe' /c "color e & @taskkill /IM ThunderPlatform.exe /F & @taskkill /IM iexplore.exe /F & @taskkill /IM vm-agent.exe /F & @taskkill /IM vm-agent-daemon.exe /F & @taskkill /IM eSightService.exe /F & ...
'<SYSTEM32>\net1.exe' stop "NetBackup Proxy Service"
'<SYSTEM32>\sc.exe' delete ReportServer
'<SYSTEM32>\cmd.exe' /c "color e & @taskkill /IM pg_ctl.exe /F & @taskkill /IM rcrelay.exe /F & @taskkill /IM SogouImeBroker.exe /F & @taskkill /IM CCenter.exe /F & @taskkill /IM ScanFrm.exe /F & @taskkill /IM d_ma...
'<SYSTEM32>\cmd.exe' /c "color e & @taskkill /IM BackupExec.exe /F & @taskkill /IM Att.exe /F & @taskkill /IM mdm.exe /F & @taskkill /IM BackupExecManagementService.exe /F & @taskkill /IM bengine.exe /F & @taskkill...
'<SYSTEM32>\sc.exe' delete VMUSBArbService
'<SYSTEM32>\cmd.exe' /c "color e & @taskkill /IM VBoxSDS.exe /F & @taskkill /IM mysqld.exe /F & @taskkill /IM TeamViewer_Service.exe /F & @taskkill /IM TeamViewer.exe /F & @taskkill /IM CasLicenceServer.exe /F & @t...
'<SYSTEM32>\sc.exe' delete MSCRMAsyncService
'<SYSTEM32>\net1.exe' stop vmvss
'<SYSTEM32>\sc.exe' delete "UWS LoPriv Services"
'<SYSTEM32>\sc.exe' delete REPLICA
'<SYSTEM32>\sc.exe' delete RabbitMQ
'<SYSTEM32>\sc.exe' delete allpass_redisservice_port21160
'<SYSTEM32>\sc.exe' delete ftnlsv3
'<SYSTEM32>\sc.exe' delete "FlexNet Licensing Service 64"

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней