Trojan.Encoder.39066

Техническая информация

Для обеспечения автозапуска и распространения

Создает следующие файлы на съемном носителе

<Имя диска съемного носителя>:\!!!read_me_medusa!!!.txt
<Имя диска съемного носителя>:\indogerman2010.pptx
<Имя диска съемного носителя>:\february_catalogue__2015.doc
<Имя диска съемного носителя>:\applicantform_en.doc
<Имя диска съемного носителя>:\split.avi
<Имя диска съемного носителя>:\fi51.doc
<Имя диска съемного носителя>:\correct.avi
<Имя диска съемного носителя>:\contosoroot_1.cer
<Имя диска съемного носителя>:\default.bmp
<Имя диска съемного носителя>:\testee.cer
<Имя диска съемного носителя>:\contoso_1.cer
<Имя диска съемного носителя>:\testcertificate.cer
<Имя диска съемного носителя>:\pmd.cer
<Имя диска съемного носителя>:\dashborder_192.bmp
<Имя диска съемного носителя>:\dialmap.bmp
<Имя диска съемного носителя>:\dial.bmp
<Имя диска съемного носителя>:\gruenspecht_02172016.pptx
<Имя диска съемного носителя>:\samieee_obiee_presentation.pptx

Вредоносные функции

Для затруднения выявления своего присутствия в системе

удаляет теневые копии разделов.

Запускает на исполнение

'<SYSTEM32>\net.exe' stop "Acronis VSS Provider" /y
'<SYSTEM32>\net.exe' stop "UI0Detect" /y
'<SYSTEM32>\net.exe' stop "VeeamBackupSvc" /y
'<SYSTEM32>\net.exe' stop "VeeamBrokerSvc" /y
'<SYSTEM32>\net.exe' stop "VeeamCatalogSvc" /y
'<SYSTEM32>\net.exe' stop "VeeamCloudSvc" /y
'<SYSTEM32>\net.exe' stop "VeeamDeploymentService" /y
'<SYSTEM32>\net.exe' stop "VeeamDeploySvc" /y
'<SYSTEM32>\net.exe' stop "VeeamEnterpriseManagerSvc" /y
'<SYSTEM32>\net.exe' stop "VeeamMountSvc" /y
'<SYSTEM32>\net.exe' stop "VeeamNFSSvc" /y
'<SYSTEM32>\net.exe' stop "VeeamRESTSvc" /y
'<SYSTEM32>\net.exe' stop "W3Svc" /y
'<SYSTEM32>\net.exe' stop "msftesql$PROD" /y
'<SYSTEM32>\net.exe' stop "wbengine" /y
'<SYSTEM32>\net.exe' stop "WRSVC" /y
'<SYSTEM32>\net.exe' stop "VeeamHvIntegrationSvc" /y
'<SYSTEM32>\net.exe' stop "swi_update" /y
'<SYSTEM32>\net.exe' stop "SQLAgent$CXDB" /y
'<SYSTEM32>\net.exe' stop "SQLAgent$CITRIX_METAFRAME" /y
'<SYSTEM32>\net.exe' stop "SQL Backups" /y
'<SYSTEM32>\net.exe' stop "MSSQL$PROD" /y
'<SYSTEM32>\net.exe' stop "Zoolz 2 Service" /y
'<SYSTEM32>\net.exe' stop "MSSQLServerADHelper" /y
'<SYSTEM32>\net.exe' stop "SQLAgent$PROD" /y
'<SYSTEM32>\net.exe' stop "TrueKeyServiceHelper" /y
'<SYSTEM32>\net.exe' stop "VeeamTransportSvc" /y
'<SYSTEM32>\net.exe' stop "TrueKeyScheduler" /y
'<SYSTEM32>\net.exe' stop "SQLAgent$VEEAMSQL2012" /y
'<SYSTEM32>\net.exe' stop "SQLAgent$ECWDB2" /y
'<SYSTEM32>\net.exe' stop "SQLAgent$PRACTTICEBGC" /y
'<SYSTEM32>\net.exe' stop "SQLAgent$PRACTTICEMGT" /y
'<SYSTEM32>\net.exe' stop "SQLAgent$PROFXENGAGEMENT" /y
'<SYSTEM32>\net.exe' stop "SQLAgent$SBSMONITORING" /y
'<SYSTEM32>\net.exe' stop "SQLAgent$SHAREPOINT" /y
'<SYSTEM32>\net.exe' stop "SQLAgent$SQL_2008" /y
'<SYSTEM32>\net.exe' stop "SQLAgent$SYSTEM_BGC" /y
'<SYSTEM32>\net.exe' stop "SQLAgent$TPS" /y
'<SYSTEM32>\net.exe' stop "SQLAgent$TPSAMA" /y
'<SYSTEM32>\net.exe' stop "SQLAgent$VEEAMSQL2008R2" /y
'<SYSTEM32>\net.exe' stop "SQLBrowser" /y
'<SYSTEM32>\net.exe' stop "tmlisten" /y
'<SYSTEM32>\net.exe' stop "SQLSafeOLRService" /y
'<SYSTEM32>\net.exe' stop "SQLSERVERAGENT" /y
'<SYSTEM32>\net.exe' stop "SQLTELEMETRY" /y
'<SYSTEM32>\net.exe' stop "SQLTELEMETRY$ECWDB2" /y
'<SYSTEM32>\net.exe' stop "SQLWriter" /y
'<SYSTEM32>\net.exe' stop "SstpSvc" /y
'<SYSTEM32>\net.exe' stop "svcGenericHost" /y
'<SYSTEM32>\net.exe' stop "swi_filter" /y
'<SYSTEM32>\net.exe' stop "swi_service" /y
'<SYSTEM32>\net.exe' stop "swi_update_64" /y
'<SYSTEM32>\net.exe' stop "TmCCSF" /y
'<SYSTEM32>\net.exe' stop "TrueKey" /y
'<SYSTEM32>\net.exe' stop "NetMsmqActivator" /y
'<SYSTEM32>\net.exe' stop "EhttpSrv" /y
'<SYSTEM32>\net.exe' stop "ekrn" /y
'<SYSTEM32>\taskkill.exe' /F /IM ocssd.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM onenote.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM oracle.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM outlook.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM powerpnt.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM sqbcoreservice.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM sqlagent.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM sqlbrowser.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM sqlservr.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM sqlwriter.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM ocautoupds.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM ocomm.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM steam.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM thebat.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM thebat64.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM thunderbird.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM visio.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM winword.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM wordpad.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM xfssvccon.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM tmlisten.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM PccNTMon.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM CNTAoSMgr.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM synctime.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM tbirdconfig.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM mysqld-opt.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM mysqld-nt.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM mysqld.exe /T
'<SYSTEM32>\net.exe' stop "MSSQL$SOPHOS" /y
'<SYSTEM32>\net.exe' stop "SQLAgent$SOPHOS" /y
'<SYSTEM32>\net.exe' stop "AVP" /y
'<SYSTEM32>\net.exe' stop "klnagent" /y
'<SYSTEM32>\net.exe' stop "MSSQL$SQLEXPRESS" /y
'<SYSTEM32>\net.exe' stop "SQLAgent$SQLEXPRESS" /y
'<SYSTEM32>\net.exe' stop "kavfsslp" /y
'<SYSTEM32>\net.exe' stop "KAVFSGT" /y
'<SYSTEM32>\net.exe' stop "KAVFS" /y
'<SYSTEM32>\net.exe' stop "mfefire" /y
'<SYSTEM32>\taskkill.exe' /F /IM zoolz.exe /T
'<SYSTEM32>\net.exe' stop "ESHASRV" /y
'<SYSTEM32>\taskkill.exe' /F /IM agntsvc.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM dbsnmp.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM encsvc.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM excel.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM firefoxconfig.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM infopath.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM isqlplussvc.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM msaccess.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM msftesql.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM mspub.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM mydesktopqos.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM mydesktopservice.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM dbeng50.exe /T
'<SYSTEM32>\net.exe' stop "SQLAgent$BKUPEXEC" /y
'<SYSTEM32>\taskkill.exe' /F /IM Ntrtscan.exe /T
'<SYSTEM32>\net.exe' stop "sophossps" /y
'<SYSTEM32>\net.exe' stop "SNAC" /y
'<SYSTEM32>\net.exe' stop "bedbg" /y
'<SYSTEM32>\net.exe' stop "DCAgent" /y
'<SYSTEM32>\net.exe' stop "EPSecurityService" /y
'<SYSTEM32>\net.exe' stop "EPUpdateService" /y
'<SYSTEM32>\net.exe' stop "EraserSvc11710" /y
'<SYSTEM32>\net.exe' stop "EsgShKernel" /y
'<SYSTEM32>\net.exe' stop "FA_Scheduler" /y
'<SYSTEM32>\net.exe' stop "IISAdmin" /y
'<SYSTEM32>\net.exe' stop "IMAP4Svc" /y
'<SYSTEM32>\net.exe' stop "macmnsvc" /y
'<SYSTEM32>\net.exe' stop "masvc" /y
'<SYSTEM32>\net.exe' stop "MBEndpointAgent" /y
'<SYSTEM32>\net.exe' stop "MsDtsServer110" /y
'<SYSTEM32>\net.exe' stop "McAfeeEngineService" /y
'<SYSTEM32>\net.exe' stop "McAfeeFramework" /y
'<SYSTEM32>\net.exe' stop "McAfeeFrameworkMcAfeeFramework" /y
'<SYSTEM32>\net.exe' stop "McShield" /y
'<SYSTEM32>\net.exe' stop "McTaskManager" /y
'<SYSTEM32>\net.exe' stop "mfemms" /y
'<SYSTEM32>\net.exe' stop "mfevtp" /y
'<SYSTEM32>\net.exe' stop "MMS" /y
'<SYSTEM32>\net.exe' stop "mozyprobackup" /y
'<SYSTEM32>\net.exe' stop "MsDtsServer" /y
'<SYSTEM32>\net.exe' stop "MsDtsServer100" /y
'<SYSTEM32>\net.exe' stop "BackupExecVSSProvider" /y
'<SYSTEM32>\net.exe' stop "MBAMService" /y
'<SYSTEM32>\net.exe' stop "BackupExecRPCService" /y
'<SYSTEM32>\net.exe' stop "Sophos System Protection Service" /y
'<SYSTEM32>\net.exe' stop "Enterprise Client Service" /y
'<SYSTEM32>\net.exe' stop "Sophos Agent" /y
'<SYSTEM32>\net.exe' stop "Sophos AutoUpdate Service" /y
'<SYSTEM32>\net.exe' stop "Sophos Clean Service" /y
'<SYSTEM32>\net.exe' stop "Sophos Device Control Service" /y
'<SYSTEM32>\net.exe' stop "Sophos File Scanner Service" /y
'<SYSTEM32>\net.exe' stop "Sophos Health Service" /y
'<SYSTEM32>\net.exe' stop "Sophos MCS Agent" /y
'<SYSTEM32>\net.exe' stop "Sophos MCS Client" /y
'<SYSTEM32>\net.exe' stop "Sophos Message Router" /y
'<SYSTEM32>\net.exe' stop "Sophos Safestore Service" /y
'<SYSTEM32>\net.exe' stop "Sophos Web Control Service" /y
'<SYSTEM32>\net.exe' stop "BackupExecJobEngine" /y
'<SYSTEM32>\net.exe' stop "SQLsafe Backup Service" /y
'<SYSTEM32>\net.exe' stop "SQLsafe Filter Service" /y
'<SYSTEM32>\net.exe' stop "Symantec System Recovery" /y
'<SYSTEM32>\net.exe' stop "Veeam Backup Catalog Data Service" /y
'<SYSTEM32>\net.exe' stop "AcronisAgent" /y
'<SYSTEM32>\net.exe' stop "AcrSch2Svc" /y
'<SYSTEM32>\net.exe' stop "Antivirus" /y
'<SYSTEM32>\net.exe' stop "ARSM" /y
'<SYSTEM32>\net.exe' stop "BackupExecAgentAccelerator" /y
'<SYSTEM32>\net.exe' stop "BackupExecAgentBrowser" /y
'<SYSTEM32>\net.exe' stop "BackupExecDeviceMediaService" /y
'<SYSTEM32>\net.exe' stop "BackupExecManagementService" /y
'<SYSTEM32>\net.exe' stop "MSExchangeES" /y
'<SYSTEM32>\net.exe' stop "MSExchangeIS" /y
'<SYSTEM32>\net.exe' stop "MSExchangeMGMT" /y
'<SYSTEM32>\net.exe' stop "MSSQLServerOLAPService" /y
'<SYSTEM32>\net.exe' stop "MySQL80" /y
'<SYSTEM32>\net.exe' stop "MySQL57" /y
'<SYSTEM32>\net.exe' stop "ntrtscan" /y
'<SYSTEM32>\net.exe' stop "OracleClientCache80" /y
'<SYSTEM32>\net.exe' stop "PDVFSService" /y
'<SYSTEM32>\net.exe' stop "POP3Svc" /y
'<SYSTEM32>\net.exe' stop "ReportServer" /y
'<SYSTEM32>\net.exe' stop "ReportServer$SQL_2008" /y
'<SYSTEM32>\net.exe' stop "ReportServer$SYSTEM_BGC" /y
'<SYSTEM32>\net.exe' stop "MSSQLSERVER" /y
'<SYSTEM32>\net.exe' stop "MSSQLServerADHelper100" /y
'<SYSTEM32>\net.exe' stop "ReportServer$TPS" /y
'<SYSTEM32>\net.exe' stop "sacsvr" /y
'<SYSTEM32>\net.exe' stop "SamSs" /y
'<SYSTEM32>\net.exe' stop "SAVAdminService" /y
'<SYSTEM32>\net.exe' stop "SAVService" /y
'<SYSTEM32>\net.exe' stop "SDRSVC" /y
'<SYSTEM32>\net.exe' stop "SepMasterService" /y
'<SYSTEM32>\net.exe' stop "ShMonitor" /y
'<SYSTEM32>\net.exe' stop "Smcinst" /y
'<SYSTEM32>\net.exe' stop "SmcService" /y
'<SYSTEM32>\net.exe' stop "SMTPSvc" /y
'<SYSTEM32>\net.exe' stop "ReportServer$TPSAMA" /y
'<SYSTEM32>\net.exe' stop "RESvc" /y
'<SYSTEM32>\net.exe' stop "MSSQLFDLauncher$TPSAMA" /y
'<SYSTEM32>\net.exe' stop "MSSQLFDLauncher$TPS" /y
'<SYSTEM32>\net.exe' stop "MSSQLFDLauncher$SYSTEM_BGC" /y
'<SYSTEM32>\net.exe' stop "MSExchangeSA" /y
'<SYSTEM32>\net.exe' stop "MSExchangeSRS" /y
'<SYSTEM32>\net.exe' stop "MSOLAP$SQL_2008" /y
'<SYSTEM32>\net.exe' stop "MSOLAP$SYSTEM_BGC" /y
'<SYSTEM32>\net.exe' stop "MSOLAP$TPS" /y
'<SYSTEM32>\net.exe' stop "MSOLAP$TPSAMA" /y
'<SYSTEM32>\net.exe' stop "MSSQL$BKUPEXEC" /y
'<SYSTEM32>\net.exe' stop "MSSQL$ECWDB2" /y
'<SYSTEM32>\net.exe' stop "MSSQL$PRACTICEMGT" /y
'<SYSTEM32>\net.exe' stop "MSSQL$PRACTTICEBGC" /y
'<SYSTEM32>\net.exe' stop "MSSQL$PROFXENGAGEMENT" /y
'<SYSTEM32>\net.exe' stop "MSExchangeMTA" /y
'<SYSTEM32>\net.exe' stop "MSSQL$SBSMONITORING" /y
'<SYSTEM32>\net.exe' stop "MSSQL$SQL_2008" /y
'<SYSTEM32>\net.exe' stop "MSSQL$SYSTEM_BGC" /y
'<SYSTEM32>\net.exe' stop "MSSQL$TPS" /y
'<SYSTEM32>\net.exe' stop "MSSQL$TPSAMA" /y
'<SYSTEM32>\net.exe' stop "MSSQL$VEEAMSQL2008R2" /y
'<SYSTEM32>\net.exe' stop "MSSQL$VEEAMSQL2012" /y
'<SYSTEM32>\net.exe' stop "MSSQLFDLauncher" /y
'<SYSTEM32>\net.exe' stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y
'<SYSTEM32>\net.exe' stop "MSSQLFDLauncher$SBSMONITORING" /y
'<SYSTEM32>\net.exe' stop "MSSQLFDLauncher$SHAREPOINT" /y
'<SYSTEM32>\net.exe' stop "MSSQLFDLauncher$SQL_2008" /y
'<SYSTEM32>\net.exe' stop "MSSQL$SHAREPOINT" /y
'<SYSTEM32>\net.exe' stop "SntpService" /y
'<SYSTEM32>\taskkill.exe' /F /IM mbamtray.exe /T

Запускает большое число процессов

Изменения в файловой системе

Создает следующие файлы

D:\$recycle.bin\!!!read_me_medusa!!!.txt
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins3d\prc\!!!read_me_medusa!!!.txt
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins3d\!!!read_me_medusa!!!.txt
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins\multimedia\mpp\!!!read_me_medusa!!!.txt
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins\multimedia\!!!read_me_medusa!!!.txt
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins\annotations\stamps\enu\!!!read_me_medusa!!!.txt
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins\annotations\stamps\!!!read_me_medusa!!!.txt
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins\annotations\!!!read_me_medusa!!!.txt
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins\acroform\pmp\!!!read_me_medusa!!!.txt
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins\acroform\!!!read_me_medusa!!!.txt
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins\!!!read_me_medusa!!!.txt
%ProgramFiles%\adobe\reader 11.0\reader\legal\enu\!!!read_me_medusa!!!.txt
%ProgramFiles%\adobe\reader 11.0\reader\legal\!!!read_me_medusa!!!.txt
%ProgramFiles%\adobe\reader 11.0\reader\javascripts\!!!read_me_medusa!!!.txt
%ProgramFiles%\adobe\reader 11.0\reader\services\!!!read_me_medusa!!!.txt
%ProgramFiles%\adobe\reader 11.0\reader\idtemplates\enu\!!!read_me_medusa!!!.txt
%ProgramFiles%\adobe\reader 11.0\reader\browser\!!!read_me_medusa!!!.txt
%ProgramFiles%\adobe\reader 11.0\reader\air\!!!read_me_medusa!!!.txt
%ProgramFiles%\adobe\reader 11.0\reader\!!!read_me_medusa!!!.txt
%ProgramFiles%\adobe\reader 11.0\esl\!!!read_me_medusa!!!.txt
%ProgramFiles%\adobe\reader 11.0\!!!read_me_medusa!!!.txt
%ProgramFiles%\adobe\!!!read_me_medusa!!!.txt
<Текущая директория>\!!!read_me_medusa!!!.txt
C:\kms\!!!read_me_medusa!!!.txt
C:\documents and settings\!!!read_me_medusa!!!.txt
C:\$recycle.bin\!!!read_me_medusa!!!.txt
C:\$recycle.bin\s-1-5-21-1864035604-3554178654-4081431624-1000\!!!read_me_medusa!!!.txt
D:\!!!read_me_medusa!!!.txt
D:\$recycle.bin\s-1-5-21-1864035604-3554178654-4081431624-1000\!!!read_me_medusa!!!.txt
%ProgramFiles%\adobe\reader 11.0\reader\idtemplates\!!!read_me_medusa!!!.txt
%ProgramFiles%\adobe\reader 11.0\reader\tracker\!!!read_me_medusa!!!.txt

Перемещает следующие файлы

%ProgramFiles%\adobe\reader 11.0\reader\agmgpuoptin.ini в %ProgramFiles%\adobe\reader 11.0\reader\agmgpuoptin.ini.medusa
%ProgramFiles%\adobe\reader 11.0\reader\tracker\reviewers.gif в %ProgramFiles%\adobe\reader 11.0\reader\tracker\reviewers.gif.medusa
%ProgramFiles%\adobe\reader 11.0\reader\tracker\pdf.gif в %ProgramFiles%\adobe\reader 11.0\reader\tracker\pdf.gif.medusa
%ProgramFiles%\adobe\reader 11.0\reader\tracker\open_original_form.gif в %ProgramFiles%\adobe\reader 11.0\reader\tracker\open_original_form.gif.medusa
%ProgramFiles%\adobe\reader 11.0\reader\tracker\main.css в %ProgramFiles%\adobe\reader 11.0\reader\tracker\main.css.medusa
%ProgramFiles%\adobe\reader 11.0\reader\tracker\info.gif в %ProgramFiles%\adobe\reader 11.0\reader\tracker\info.gif.medusa
%ProgramFiles%\adobe\reader 11.0\reader\tracker\form_responses.gif в %ProgramFiles%\adobe\reader 11.0\reader\tracker\form_responses.gif.medusa
%ProgramFiles%\adobe\reader 11.0\reader\tracker\forms_super.gif в %ProgramFiles%\adobe\reader 11.0\reader\tracker\forms_super.gif.medusa
%ProgramFiles%\adobe\reader 11.0\reader\tracker\forms_received.gif в %ProgramFiles%\adobe\reader 11.0\reader\tracker\forms_received.gif.medusa
%ProgramFiles%\adobe\reader 11.0\reader\tracker\forms_distributed.gif в %ProgramFiles%\adobe\reader 11.0\reader\tracker\forms_distributed.gif.medusa
%ProgramFiles%\adobe\reader 11.0\reader\tracker\end_review.gif в %ProgramFiles%\adobe\reader 11.0\reader\tracker\end_review.gif.medusa
%ProgramFiles%\adobe\reader 11.0\reader\tracker\ended_review_or_form.gif в %ProgramFiles%\adobe\reader 11.0\reader\tracker\ended_review_or_form.gif.medusa
%ProgramFiles%\adobe\reader 11.0\reader\tracker\email_initiator.gif в %ProgramFiles%\adobe\reader 11.0\reader\tracker\email_initiator.gif.medusa
%ProgramFiles%\adobe\reader 11.0\reader\tracker\email_all.gif в %ProgramFiles%\adobe\reader 11.0\reader\tracker\email_all.gif.medusa
%ProgramFiles%\adobe\reader 11.0\reader\tracker\distribute_form.gif в %ProgramFiles%\adobe\reader 11.0\reader\tracker\distribute_form.gif.medusa
%ProgramFiles%\adobe\reader 11.0\reader\tracker\create_form.gif в %ProgramFiles%\adobe\reader 11.0\reader\tracker\create_form.gif.medusa
%ProgramFiles%\adobe\reader 11.0\reader\tracker\br.gif в %ProgramFiles%\adobe\reader 11.0\reader\tracker\br.gif.medusa
%ProgramFiles%\adobe\reader 11.0\reader\tracker\bl.gif в %ProgramFiles%\adobe\reader 11.0\reader\tracker\bl.gif.medusa
%ProgramFiles%\adobe\reader 11.0\reader\tracker\reviews_joined.gif в %ProgramFiles%\adobe\reader 11.0\reader\tracker\reviews_joined.gif.medusa
%ProgramFiles%\adobe\reader 11.0\reader\tracker\reviews_super.gif в %ProgramFiles%\adobe\reader 11.0\reader\tracker\reviews_super.gif.medusa
%ProgramFiles%\adobe\reader 11.0\reader\tracker\turnonnotificationinacrobat.gif в %ProgramFiles%\adobe\reader 11.0\reader\tracker\turnonnotificationinacrobat.gif.medusa
%ProgramFiles%\adobe\reader 11.0\reader\tracker\review_browser.gif в %ProgramFiles%\adobe\reader 11.0\reader\tracker\review_browser.gif.medusa
%ProgramFiles%\adobe\reader 11.0\reader\tracker\warning.gif в %ProgramFiles%\adobe\reader 11.0\reader\tracker\warning.gif.medusa
%ProgramFiles%\adobe\reader 11.0\reader\tracker\turnoffnotificationintray.gif в %ProgramFiles%\adobe\reader 11.0\reader\tracker\turnoffnotificationintray.gif.medusa
%ProgramFiles%\adobe\reader 11.0\reader\tracker\turnoffnotificationinacrobat.gif в %ProgramFiles%\adobe\reader 11.0\reader\tracker\turnoffnotificationinacrobat.gif.medusa
%ProgramFiles%\adobe\reader 11.0\reader\tracker\trash.gif в %ProgramFiles%\adobe\reader 11.0\reader\tracker\trash.gif.medusa
%ProgramFiles%\adobe\reader 11.0\reader\tracker\stop_collection_data.gif в %ProgramFiles%\adobe\reader 11.0\reader\tracker\stop_collection_data.gif.medusa
%ProgramFiles%\adobe\reader 11.0\reader\tracker\submission_history.gif в %ProgramFiles%\adobe\reader 11.0\reader\tracker\submission_history.gif.medusa
%ProgramFiles%\adobe\reader 11.0\reader\tracker\tr.gif в %ProgramFiles%\adobe\reader 11.0\reader\tracker\tr.gif.medusa
%ProgramFiles%\adobe\reader 11.0\reader\tracker\tl.gif в %ProgramFiles%\adobe\reader 11.0\reader\tracker\tl.gif.medusa
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins3d\drvdx9.x3d в %ProgramFiles%\adobe\reader 11.0\reader\plug_ins3d\drvdx9.x3d.medusa
%ProgramFiles%\adobe\reader 11.0\reader\tracker\server_ok.gif в %ProgramFiles%\adobe\reader 11.0\reader\tracker\server_ok.gif.medusa
%ProgramFiles%\adobe\reader 11.0\reader\tracker\server_lg.gif в %ProgramFiles%\adobe\reader 11.0\reader\tracker\server_lg.gif.medusa
%ProgramFiles%\adobe\reader 11.0\reader\services\services.cfg в %ProgramFiles%\adobe\reader 11.0\reader\services\services.cfg.medusa
%ProgramFiles%\adobe\reader 11.0\reader\tracker\server_issue.gif в %ProgramFiles%\adobe\reader 11.0\reader\tracker\server_issue.gif.medusa
%ProgramFiles%\adobe\reader 11.0\reader\tracker\rss.gif в %ProgramFiles%\adobe\reader 11.0\reader\tracker\rss.gif.medusa
%ProgramFiles%\adobe\reader 11.0\reader\tracker\review_shared.gif в %ProgramFiles%\adobe\reader 11.0\reader\tracker\review_shared.gif.medusa
%ProgramFiles%\adobe\reader 11.0\reader\tracker\review_same_reviewers.gif в %ProgramFiles%\adobe\reader 11.0\reader\tracker\review_same_reviewers.gif.medusa
%ProgramFiles%\adobe\reader 11.0\reader\tracker\review_email.gif в %ProgramFiles%\adobe\reader 11.0\reader\tracker\review_email.gif.medusa
%ProgramFiles%\adobe\reader 11.0\reader\tracker\add_reviewer.gif в %ProgramFiles%\adobe\reader 11.0\reader\tracker\add_reviewer.gif.medusa
%ProgramFiles%\adobe\reader 11.0\reader\tracker\reviews_sent.gif в %ProgramFiles%\adobe\reader 11.0\reader\tracker\reviews_sent.gif.medusa
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins3d\2d.x3d в %ProgramFiles%\adobe\reader 11.0\reader\plug_ins3d\2d.x3d.medusa
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins\multimedia\mpp\flash.mpp в %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\multimedia\mpp\flash.mpp.medusa
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins\ia32.api в %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\ia32.api.medusa
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins\makeaccessible.api в %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\makeaccessible.api.medusa
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins\escript.api в %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\escript.api.medusa
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins\dva.api в %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\dva.api.medusa
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins\ebook.api в %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\ebook.api.medusa
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins\digsig.api в %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\digsig.api.medusa
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins\acroform\pmp\datamatrix.pmp в %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\acroform\pmp\datamatrix.pmp.medusa
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins\annots.api в %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\annots.api.medusa
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins\acroform.api в %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\acroform.api.medusa
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins\acroform\pmp\qrcode.pmp в %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\acroform\pmp\qrcode.pmp.medusa
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins\acroform\pmp\adobepdf417.pmp в %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\acroform\pmp\adobepdf417.pmp.medusa
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins\accessibility.api в %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\accessibility.api.medusa
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins\acroform\adobepdf.xdc в %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\acroform\adobepdf.xdc.medusa
%ProgramFiles%\adobe\reader 11.0\reader\legal\enu\eula.ini в %ProgramFiles%\adobe\reader 11.0\reader\legal\enu\eula.ini.medusa
%ProgramFiles%\adobe\reader 11.0\reader\javascripts\jsbytecodewin.bin в %ProgramFiles%\adobe\reader 11.0\reader\javascripts\jsbytecodewin.bin.medusa
%ProgramFiles%\adobe\reader 11.0\reader\adobe.reader.dependencies.manifest в %ProgramFiles%\adobe\reader 11.0\reader\adobe.reader.dependencies.manifest.medusa
%ProgramFiles%\adobe\reader 11.0\reader\cryptocme.sig в %ProgramFiles%\adobe\reader 11.0\reader\cryptocme.sig.medusa
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins\multimedia\mpp\mcimpp.mpp в %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\multimedia\mpp\mcimpp.mpp.medusa
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins\checkers.api в %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\checkers.api.medusa
%ProgramFiles%\adobe\reader 11.0\reader\rtc.der в %ProgramFiles%\adobe\reader 11.0\reader\rtc.der.medusa
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins\multimedia\mpp\windowsmedia.mpp в %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\multimedia\mpp\windowsmedia.mpp.medusa
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins3d\tesselate.x3d в %ProgramFiles%\adobe\reader 11.0\reader\plug_ins3d\tesselate.x3d.medusa
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins3d\prcr.x3d в %ProgramFiles%\adobe\reader 11.0\reader\plug_ins3d\prcr.x3d.medusa
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins3d\drvsoft.x3d в %ProgramFiles%\adobe\reader 11.0\reader\plug_ins3d\drvsoft.x3d.medusa
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins3d\prc\myriadcad.otf в %ProgramFiles%\adobe\reader 11.0\reader\plug_ins3d\prc\myriadcad.otf.medusa
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins3d\3difr.x3d в %ProgramFiles%\adobe\reader 11.0\reader\plug_ins3d\3difr.x3d.medusa
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins\weblink.api в %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\weblink.api.medusa
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins\spelling.api в %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\spelling.api.medusa
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins\saveasrtf.api в %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\saveasrtf.api.medusa
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins\search.api в %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\search.api.medusa
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins\updater.api в %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\updater.api.medusa
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins\reflow.api в %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\reflow.api.medusa
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins\sendmail.api в %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\sendmail.api.medusa
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins\pddom.api в %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\pddom.api.medusa
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins\readoutloud.api в %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\readoutloud.api.medusa
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins\ppklite.api в %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\ppklite.api.medusa
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins\multimedia\mpp\quicktime.mpp в %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\multimedia\mpp\quicktime.mpp.medusa
%ProgramFiles%\adobe\reader 11.0\reader\plug_ins\multimedia.api в %ProgramFiles%\adobe\reader 11.0\reader\plug_ins\multimedia.api.medusa
%ProgramFiles%\adobe\reader 11.0\reader\services\dexshare.spi в %ProgramFiles%\adobe\reader 11.0\reader\services\dexshare.spi.medusa
%ProgramFiles%\adobe\reader 11.0\reader\tracker\turnonnotificationintray.gif в %ProgramFiles%\adobe\reader 11.0\reader\tracker\turnonnotificationintray.gif.medusa

Изменяет следующие файлы

D:\$recycle.bin\s-1-5-21-1864035604-3554178654-4081431624-1000\desktop.ini
<Имя диска съемного носителя>:\fi51.doc
<Имя диска съемного носителя>:\february_catalogue__2015.doc
<Имя диска съемного носителя>:\applicantform_en.doc
<Имя диска съемного носителя>:\contosoroot_1.cer
<Имя диска съемного носителя>:\testee.cer
<Имя диска съемного носителя>:\contoso_1.cer
<Имя диска съемного носителя>:\testcertificate.cer
<Имя диска съемного носителя>:\pmd.cer
<Имя диска съемного носителя>:\dashborder_192.bmp
<Имя диска съемного носителя>:\dialmap.bmp
<Имя диска съемного носителя>:\default.bmp
<Имя диска съемного носителя>:\split.avi
<Имя диска съемного носителя>:\dial.bmp
<Имя диска съемного носителя>:\correct.avi
D:\install.log
<Имя диска съемного носителя>:\cveuropeo.doc
<Имя диска съемного носителя>:\lisp_success.doc

Изменяет множество файлов пользовательских данных (Trojan.Encoder).

Изменяет расширения файлов пользовательских данных (Trojan.Encoder).

Другое

Ищет следующие окна

ClassName: '' WindowName: ''

Запускает на исполнение

'<SYSTEM32>\net1.exe' stop "Acronis VSS Provider" /y
'<SYSTEM32>\net1.exe' stop "SQLAgent$SQL_2008" /y
'<SYSTEM32>\net1.exe' stop "SQLAgent$SYSTEM_BGC" /y
'<SYSTEM32>\net1.exe' stop "SQLAgent$TPS" /y
'<SYSTEM32>\net1.exe' stop "SQLAgent$TPSAMA" /y
'<SYSTEM32>\net1.exe' stop "SQLAgent$VEEAMSQL2008R2" /y
'<SYSTEM32>\net1.exe' stop "SQLAgent$VEEAMSQL2012" /y
'<SYSTEM32>\net1.exe' stop "SQLBrowser" /y
'<SYSTEM32>\net1.exe' stop "SQLSafeOLRService" /y
'<SYSTEM32>\net1.exe' stop "SepMasterService" /y
'<SYSTEM32>\net1.exe' stop "SQLSERVERAGENT" /y
'<SYSTEM32>\net1.exe' stop "SQLTELEMETRY$ECWDB2" /y
'<SYSTEM32>\net1.exe' stop "SQLWriter" /y
'<SYSTEM32>\net1.exe' stop "SstpSvc" /y
'<SYSTEM32>\net1.exe' stop "svcGenericHost" /y
'<SYSTEM32>\net1.exe' stop "swi_filter" /y
'<SYSTEM32>\net1.exe' stop "swi_service" /y
'<SYSTEM32>\net1.exe' stop "swi_update_64" /y
'<SYSTEM32>\net1.exe' stop "TmCCSF" /y
'<SYSTEM32>\net1.exe' stop "SQLAgent$SBSMONITORING" /y
'<SYSTEM32>\net1.exe' stop "SQLAgent$SHAREPOINT" /y
'<SYSTEM32>\net1.exe' stop "SQLAgent$PROFXENGAGEMENT" /y
'<SYSTEM32>\net1.exe' stop "SQLAgent$PRACTTICEMGT" /y
'<SYSTEM32>\net1.exe' stop "SQLAgent$PRACTTICEBGC" /y
'<SYSTEM32>\net1.exe' stop "ReportServer$SYSTEM_BGC" /y
'<SYSTEM32>\net1.exe' stop "ReportServer$TPS" /y
'<SYSTEM32>\net1.exe' stop "ReportServer$TPSAMA" /y
'<SYSTEM32>\net1.exe' stop "RESvc" /y
'<SYSTEM32>\net1.exe' stop "sacsvr" /y
'<SYSTEM32>\net1.exe' stop "SamSs" /y
'<SYSTEM32>\net1.exe' stop "SAVAdminService" /y
'<SYSTEM32>\net1.exe' stop "SAVService" /y
'<SYSTEM32>\net1.exe' stop "tmlisten" /y
'<SYSTEM32>\net1.exe' stop "SQLTELEMETRY" /y
'<SYSTEM32>\net1.exe' stop "SDRSVC" /y
'<SYSTEM32>\net1.exe' stop "Smcinst" /y
'<SYSTEM32>\net1.exe' stop "SmcService" /y
'<SYSTEM32>\net1.exe' stop "SMTPSvc" /y
'<SYSTEM32>\net1.exe' stop "SNAC" /y
'<SYSTEM32>\net1.exe' stop "SntpService" /y
'<SYSTEM32>\net1.exe' stop "sophossps" /y
'<SYSTEM32>\net1.exe' stop "SQLAgent$BKUPEXEC" /y
'<SYSTEM32>\net1.exe' stop "SQLAgent$ECWDB2" /y
'<SYSTEM32>\net1.exe' stop "ReportServer$SQL_2008" /y
'<SYSTEM32>\net1.exe' stop "ShMonitor" /y
'<SYSTEM32>\net1.exe' stop "VeeamRESTSvc" /y
'<SYSTEM32>\vssadmin.exe' resize shadowstorage /for=F: /on=F: /maxsize=401MB
'<SYSTEM32>\net1.exe' stop "TrueKeyServiceHelper" /y
'<SYSTEM32>\net1.exe' stop "NetMsmqActivator" /y
'<SYSTEM32>\net1.exe' stop "EhttpSrv" /y
'<SYSTEM32>\net1.exe' stop "ekrn" /y
'<SYSTEM32>\net1.exe' stop "ESHASRV" /y
'<SYSTEM32>\net1.exe' stop "MSSQL$SOPHOS" /y
'<SYSTEM32>\net1.exe' stop "SQLAgent$SOPHOS" /y
'<SYSTEM32>\net1.exe' stop "AVP" /y
'<SYSTEM32>\net1.exe' stop "klnagent" /y
'<SYSTEM32>\net1.exe' stop "TrueKey" /y
'<SYSTEM32>\net1.exe' stop "MSSQL$SQLEXPRESS" /y
'<SYSTEM32>\net1.exe' stop "kavfsslp" /y
'<SYSTEM32>\net1.exe' stop "KAVFSGT" /y
'<SYSTEM32>\net1.exe' stop "KAVFS" /y
'<SYSTEM32>\net1.exe' stop "mfefire" /y
'<SYSTEM32>\vssadmin.exe' resize shadowstorage /for=C: /on=C: /maxsize=401MB
'<SYSTEM32>\vssadmin.exe' resize shadowstorage /for=C: /on=C: /maxsize=unbounded
'<SYSTEM32>\vssadmin.exe' resize shadowstorage /for=D: /on=D: /maxsize=401MB
'<SYSTEM32>\vssadmin.exe' resize shadowstorage /for=D: /on=D: /maxsize=unbounded
'<SYSTEM32>\net1.exe' stop "SQLAgent$PROD" /y
'<SYSTEM32>\net1.exe' stop "msftesql$PROD" /y
'<SYSTEM32>\net1.exe' stop "MSSQLServerADHelper" /y
'<SYSTEM32>\net1.exe' stop "Zoolz 2 Service" /y
'<SYSTEM32>\net1.exe' stop "MSSQL$PROD" /y
'<SYSTEM32>\net1.exe' stop "VeeamBackupSvc" /y
'<SYSTEM32>\net1.exe' stop "VeeamBrokerSvc" /y
'<SYSTEM32>\net1.exe' stop "VeeamCatalogSvc" /y
'<SYSTEM32>\net1.exe' stop "VeeamCloudSvc" /y
'<SYSTEM32>\net1.exe' stop "VeeamDeploymentService" /y
'<SYSTEM32>\net1.exe' stop "VeeamDeploySvc" /y
'<SYSTEM32>\net1.exe' stop "VeeamEnterpriseManagerSvc" /y
'<SYSTEM32>\net1.exe' stop "VeeamMountSvc" /y
'<SYSTEM32>\net1.exe' stop "TrueKeyScheduler" /y
'<SYSTEM32>\net1.exe' stop "ReportServer" /y
'<SYSTEM32>\net1.exe' stop "VeeamNFSSvc" /y
'<SYSTEM32>\net1.exe' stop "W3Svc" /y
'<SYSTEM32>\net1.exe' stop "wbengine" /y
'<SYSTEM32>\net1.exe' stop "WRSVC" /y
'<SYSTEM32>\net1.exe' stop "VeeamHvIntegrationSvc" /y
'<SYSTEM32>\net1.exe' stop "swi_update" /y
'<SYSTEM32>\net1.exe' stop "SQLAgent$CXDB" /y
'<SYSTEM32>\net1.exe' stop "SQLAgent$CITRIX_METAFRAME" /y
'<SYSTEM32>\net1.exe' stop "SQL Backups" /y
'<SYSTEM32>\net1.exe' stop "UI0Detect" /y
'<SYSTEM32>\net1.exe' stop "VeeamTransportSvc" /y
'<SYSTEM32>\net1.exe' stop "SQLAgent$SQLEXPRESS" /y
'<SYSTEM32>\net1.exe' stop "POP3Svc" /y
'<SYSTEM32>\net1.exe' stop "MSSQLFDLauncher$SYSTEM_BGC" /y
'<SYSTEM32>\net1.exe' stop "BackupExecManagementService" /y
'<SYSTEM32>\net1.exe' stop "BackupExecRPCService" /y
'<SYSTEM32>\net1.exe' stop "BackupExecVSSProvider" /y
'<SYSTEM32>\net1.exe' stop "bedbg" /y
'<SYSTEM32>\net1.exe' stop "DCAgent" /y
'<SYSTEM32>\net1.exe' stop "EPSecurityService" /y
'<SYSTEM32>\net1.exe' stop "EPUpdateService" /y
'<SYSTEM32>\net1.exe' stop "EraserSvc11710" /y
'<SYSTEM32>\net1.exe' stop "Sophos Safestore Service" /y
'<SYSTEM32>\net1.exe' stop "EsgShKernel" /y
'<SYSTEM32>\net1.exe' stop "IISAdmin" /y
'<SYSTEM32>\net1.exe' stop "IMAP4Svc" /y
'<SYSTEM32>\net1.exe' stop "macmnsvc" /y
'<SYSTEM32>\net1.exe' stop "masvc" /y
'<SYSTEM32>\net1.exe' stop "MBAMService" /y
'<SYSTEM32>\net1.exe' stop "MBEndpointAgent" /y
'<SYSTEM32>\net1.exe' stop "McAfeeEngineService" /y
'<SYSTEM32>\net1.exe' stop "McAfeeFramework" /y
'<SYSTEM32>\net1.exe' stop "BackupExecDeviceMediaService" /y
'<SYSTEM32>\net1.exe' stop "BackupExecJobEngine" /y
'<SYSTEM32>\net1.exe' stop "BackupExecAgentBrowser" /y
'<SYSTEM32>\net1.exe' stop "BackupExecAgentAccelerator" /y
'<SYSTEM32>\net1.exe' stop "ARSM" /y
'<SYSTEM32>\net1.exe' stop "Sophos Agent" /y
'<SYSTEM32>\net1.exe' stop "Sophos AutoUpdate Service" /y
'<SYSTEM32>\net1.exe' stop "Sophos Clean Service" /y
'<SYSTEM32>\net1.exe' stop "Sophos Device Control Service" /y
'<SYSTEM32>\net1.exe' stop "Sophos File Scanner Service" /y
'<SYSTEM32>\net1.exe' stop "Sophos Health Service" /y
'<SYSTEM32>\net1.exe' stop "Sophos MCS Agent" /y
'<SYSTEM32>\net1.exe' stop "Sophos MCS Client" /y
'<SYSTEM32>\net1.exe' stop "McAfeeFrameworkMcAfeeFramework" /y
'<SYSTEM32>\net1.exe' stop "FA_Scheduler" /y
'<SYSTEM32>\net1.exe' stop "Sophos Message Router" /y
'<SYSTEM32>\net1.exe' stop "Sophos Web Control Service" /y
'<SYSTEM32>\net1.exe' stop "SQLsafe Backup Service" /y
'<SYSTEM32>\net1.exe' stop "SQLsafe Filter Service" /y
'<SYSTEM32>\net1.exe' stop "Symantec System Recovery" /y
'<SYSTEM32>\net1.exe' stop "Veeam Backup Catalog Data Service" /y
'<SYSTEM32>\net1.exe' stop "AcronisAgent" /y
'<SYSTEM32>\net1.exe' stop "AcrSch2Svc" /y
'<SYSTEM32>\net1.exe' stop "Antivirus" /y
'<SYSTEM32>\net1.exe' stop "Enterprise Client Service" /y
'<SYSTEM32>\net1.exe' stop "Sophos System Protection Service" /y
'<SYSTEM32>\net1.exe' stop "MSExchangeSA" /y
'<SYSTEM32>\net1.exe' stop "OracleClientCache80" /y
'<SYSTEM32>\net1.exe' stop "mfemms" /y
'<SYSTEM32>\net1.exe' stop "MSSQL$TPS" /y
'<SYSTEM32>\net1.exe' stop "MSSQL$TPSAMA" /y
'<SYSTEM32>\net1.exe' stop "MSSQL$VEEAMSQL2008R2" /y
'<SYSTEM32>\net1.exe' stop "MSSQL$VEEAMSQL2012" /y
'<SYSTEM32>\net1.exe' stop "MSSQLFDLauncher" /y
'<SYSTEM32>\net1.exe' stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y
'<SYSTEM32>\net1.exe' stop "MSSQLFDLauncher$SBSMONITORING" /y
'<SYSTEM32>\net1.exe' stop "MSSQLFDLauncher$SHAREPOINT" /y
'<SYSTEM32>\net1.exe' stop "McShield" /y
'<SYSTEM32>\net1.exe' stop "MSSQLFDLauncher$SQL_2008" /y
'<SYSTEM32>\net1.exe' stop "MSSQLFDLauncher$TPS" /y
'<SYSTEM32>\net1.exe' stop "MSSQLFDLauncher$TPSAMA" /y
'<SYSTEM32>\net1.exe' stop "MSSQLSERVER" /y
'<SYSTEM32>\net1.exe' stop "MSSQLServerADHelper100" /y
'<SYSTEM32>\net1.exe' stop "MSSQLServerOLAPService" /y
'<SYSTEM32>\net1.exe' stop "MySQL80" /y
'<SYSTEM32>\net1.exe' stop "MySQL57" /y
'<SYSTEM32>\net1.exe' stop "ntrtscan" /y
'<SYSTEM32>\net1.exe' stop "MSSQL$SQL_2008" /y
'<SYSTEM32>\net1.exe' stop "MSSQL$SYSTEM_BGC" /y
'<SYSTEM32>\net1.exe' stop "MSSQL$SHAREPOINT" /y
'<SYSTEM32>\net1.exe' stop "MSSQL$SBSMONITORING" /y
'<SYSTEM32>\net1.exe' stop "MSSQL$PROFXENGAGEMENT" /y
'<SYSTEM32>\net1.exe' stop "MMS" /y
'<SYSTEM32>\net1.exe' stop "mozyprobackup" /y
'<SYSTEM32>\net1.exe' stop "MsDtsServer" /y
'<SYSTEM32>\net1.exe' stop "MsDtsServer100" /y
'<SYSTEM32>\net1.exe' stop "MsDtsServer110" /y
'<SYSTEM32>\net1.exe' stop "MSExchangeES" /y
'<SYSTEM32>\net1.exe' stop "MSExchangeIS" /y
'<SYSTEM32>\net1.exe' stop "MSExchangeMGMT" /y
'<SYSTEM32>\net1.exe' stop "McTaskManager" /y
'<SYSTEM32>\net1.exe' stop "PDVFSService" /y
'<SYSTEM32>\net1.exe' stop "MSExchangeMTA" /y
'<SYSTEM32>\net1.exe' stop "MSOLAP$SQL_2008" /y
'<SYSTEM32>\net1.exe' stop "MSOLAP$SYSTEM_BGC" /y
'<SYSTEM32>\net1.exe' stop "MSOLAP$TPS" /y
'<SYSTEM32>\net1.exe' stop "MSOLAP$TPSAMA" /y
'<SYSTEM32>\net1.exe' stop "MSSQL$BKUPEXEC" /y
'<SYSTEM32>\net1.exe' stop "MSSQL$ECWDB2" /y
'<SYSTEM32>\net1.exe' stop "MSSQL$PRACTICEMGT" /y
'<SYSTEM32>\net1.exe' stop "MSSQL$PRACTTICEBGC" /y
'<SYSTEM32>\net1.exe' stop "mfevtp" /y
'<SYSTEM32>\net1.exe' stop "MSExchangeSRS" /y
'<SYSTEM32>\vssadmin.exe' resize shadowstorage /for=F: /on=F: /maxsize=unbounded

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней