Trojan.Encoder.33212

Technical Information

To ensure autorun and distribution

Creates the following files on removable media

<Drive name for removable media>:\[how to recover files].txt
<Drive name for removable media>:\indogerman2010.pptx
<Drive name for removable media>:\samieee_obiee_presentation.pptx
<Drive name for removable media>:\middaugh_keynote.pptx
<Drive name for removable media>:\waterresourcesag.pptx
<Drive name for removable media>:\trivial-merge.htm
<Drive name for removable media>:\508softwareandos.doc
<Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
<Drive name for removable media>:\roozenedowebinar.pptx
<Drive name for removable media>:\cveuropeo.doc
<Drive name for removable media>:\ovp25012015.doc
<Drive name for removable media>:\tileimage.bmp
<Drive name for removable media>:\default.bmp
<Drive name for removable media>:\archer.avi
<Drive name for removable media>:\split.avi
<Drive name for removable media>:\join.avi
<Drive name for removable media>:\correct.avi
<Drive name for removable media>:\applicantform_en.doc
<Drive name for removable media>:\gruenspecht_02172016.pptx

Malicious functions

Executes the following

'%WINDIR%\syswow64\taskkill.exe' /IM firefox.exe /F
'%WINDIR%\syswow64\net.exe' stop "YTBackup" /y
'%WINDIR%\syswow64\net.exe' stop "vhdsvc" /y
'%WINDIR%\syswow64\net.exe' stop "TeamViewer" /y
'%WINDIR%\syswow64\net.exe' stop "MSOLAP$SQL_2008" /y
'%WINDIR%\syswow64\net.exe' stop "MSOLAP$SYSTEM_BGC" /y
'%WINDIR%\syswow64\net.exe' stop "MSOLAP$TPS" /y
'%WINDIR%\syswow64\net.exe' stop "tmccsf" /y
'%WINDIR%\syswow64\net.exe' stop "MSOLAP$TPSAMA" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQL$ECWDB2" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQL$PRACTICEMGT" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQL$PRACTTICEBGC" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQL$PROD" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQL$PROFXENGAGEMENT" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQL$SBSMONITORING" /y
'%WINDIR%\syswow64\net.exe' stop "EqlReqService" /y
'%WINDIR%\syswow64\net.exe' stop "RapidRecoveryAgent" /y
'%WINDIR%\syswow64\net.exe' stop "EqlVss" /y
'%WINDIR%\syswow64\net.exe' stop "hasplms" /y
'%WINDIR%\syswow64\net.exe' stop "BASupportExpressSrvcUpdater_N_Central" /y
'%WINDIR%\syswow64\net.exe' stop "mfemms" /y
'%WINDIR%\syswow64\net.exe' stop "McAfeeDLPAgentService" /y
'%WINDIR%\syswow64\net.exe' stop "psqlWGE" /y
'%WINDIR%\syswow64\net.exe' stop "swprv" /y
'%WINDIR%\syswow64\net.exe' stop "wsbexchange" /y
'%WINDIR%\syswow64\net.exe' stop "WinVNC4" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQL$SHAREPOINT" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQL$BKUPEXEC" /y
'%WINDIR%\syswow64\net.exe' stop "TMBMServer" /y
'%WINDIR%\syswow64\net.exe' stop "VSNAPVSS" /y
'%WINDIR%\syswow64\net.exe' stop "stc_endpt_svc" /y
'%WINDIR%\syswow64\net.exe' stop "wbengine" /y
'%WINDIR%\syswow64\net.exe' stop "bbagent" /y
'%WINDIR%\syswow64\net.exe' stop "NasPmService" /y
'%WINDIR%\syswow64\net.exe' stop "BASupportExpressStandaloneService_N_Central" /y
'%WINDIR%\syswow64\net.exe' stop "macmnsvc" /y
'%WINDIR%\syswow64\net.exe' stop "tmlisten" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQL$SOPHOS" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQL$SQL_2008" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQL$SQLEXPRESS" /y
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$PRACTTICEBGC" /y
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$PRACTTICEMGT" /y
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$PROD" /y
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$PROFXENGAGEMENT" /y
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$SBSMONITORING" /y
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$SHAREPOINT" /y
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$SOPHOS" /y
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$SQLEXPRESS" /y
'%WINDIR%\syswow64\net.exe' stop "masvc" /y
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$SYSTEM_BGC" /y
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$TPS" /y
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$TPSAMA" /y
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$VEEAMSQL2008R2" /y
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$VEEAMSQL2012" /y
'%WINDIR%\syswow64\net.exe' stop "ReportServer$SQL_2008" /y
'%WINDIR%\syswow64\net.exe' stop "ReportServer$SYSTEM_BGC" /y
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$ECWDB2" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQLFDLauncher$SHAREPOINT" /y
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$CXDB" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQLFDLauncher$SBSMONITORING" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQL$SYSTEM_BGC" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQL$TPS" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQL$TPSAMA" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQL$VEEAMSQL2008R2" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQL$VEEAMSQL2012" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQLFDLauncher" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y
'%WINDIR%\syswow64\net.exe' stop "ReportServer$TPS" /y
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$BKUPEXEC" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQLFDLauncher$SQL_2008" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQLFDLauncher$SYSTEM_BGC" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQLFDLauncher$TPS" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQLFDLauncher$TPSAMA" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQLServerADHelper" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQLServerADHelper100" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQLServerOLAPService" /y
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$CITRIX_METAFRAME" /y
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$SQL_2008" /y
'%WINDIR%\syswow64\net.exe' stop "mozyprobackup" /y
'%WINDIR%\syswow64\net.exe' stop "VeeamCatalogSvc" /y
'%WINDIR%\syswow64\net.exe' stop "MSExchangeMTA" /y
'%WINDIR%\syswow64\net.exe' stop "MSExchangeSA" /y
'%WINDIR%\syswow64\net.exe' stop "MSExchangeSRS" /y
'%WINDIR%\syswow64\net.exe' stop "MSExchangeADTopology" /y
'%WINDIR%\syswow64\net.exe' stop "MSExchangeDelivery" /y
'%WINDIR%\syswow64\net.exe' stop "MSExchangeDiagnostics" /y
'%WINDIR%\syswow64\net.exe' stop "BackupExecManagementService" /y
'%WINDIR%\syswow64\net.exe' stop "MSExchangeEdgeSync" /y
'%WINDIR%\syswow64\net.exe' stop "MSExchangeHMRecovery" /y
'%WINDIR%\syswow64\net.exe' stop "MSExchangeIS" /y
'%WINDIR%\syswow64\net.exe' stop "MSExchangeMailboxReplication" /y
'%WINDIR%\syswow64\net.exe' stop "MSExchangeRPC" /y
'%WINDIR%\syswow64\net.exe' stop "MSExchangeRepl" /y
'%WINDIR%\syswow64\net.exe' stop "MSExchangeServiceHost" /y
'%WINDIR%\syswow64\net.exe' stop "MSExchangeES" /y
'%WINDIR%\syswow64\net.exe' stop "MSExchangeMGMT" /y
'%WINDIR%\syswow64\net.exe' stop "MBEndpointAgent" /y
'%WINDIR%\syswow64\net.exe' stop "MBAMService" /y
'%WINDIR%\syswow64\net.exe' stop "MB3Service" /y
'%WINDIR%\syswow64\net.exe' stop "McAfeeFramework" /y
'%WINDIR%\syswow64\net.exe' stop "Alerter" /y
'%WINDIR%\syswow64\net.exe' stop "AcronisAgent" /y
'%WINDIR%\syswow64\net.exe' stop "Acronis VSS Provider" /y
'%WINDIR%\syswow64\net.exe' stop "BackupExecAgentAccelerator" /y
'%WINDIR%\syswow64\net.exe' stop "BackupExecDeviceMediaService" /y
'%WINDIR%\syswow64\net.exe' stop "MSExchangeTransport" /y
'%WINDIR%\syswow64\net.exe' stop "MSExchangeHM" /y
'%WINDIR%\syswow64\net.exe' stop "BackupExecJobEngine" /y
'%WINDIR%\syswow64\net.exe' stop "BackupExecVSSProvider" /y
'%WINDIR%\syswow64\net.exe' stop "DFSR" /y
'%WINDIR%\syswow64\net.exe' stop "EPIntegrationService" /y
'%WINDIR%\syswow64\net.exe' stop "EPProtectedService" /y
'%WINDIR%\syswow64\net.exe' stop "EPSecurityService" /y
'%WINDIR%\syswow64\net.exe' stop "EPUpdateService" /y
'%WINDIR%\syswow64\net.exe' stop "CSFalconService" /y
'%WINDIR%\syswow64\net.exe' stop "BackupExecRPCService" /y
'%WINDIR%\syswow64\net.exe' stop "MSExchangeUM" /y
'%WINDIR%\syswow64\net.exe' stop "MSExchangeUMCR" /y
'%WINDIR%\syswow64\net.exe' stop "MSOLAP$*" /y
'%WINDIR%\syswow64\net.exe' stop "ReportServer" /y
'%WINDIR%\syswow64\net.exe' stop "ReportServer$*" /y
'%WINDIR%\syswow64\net.exe' stop "SQLWriter" /y
'%WINDIR%\syswow64\net.exe' stop "SQLBackupAgent" /y
'%WINDIR%\syswow64\net.exe' stop "Symantec System Recovery" /y
'%WINDIR%\syswow64\net.exe' stop "SyncoveryVSSService" /y
'%WINDIR%\syswow64\net.exe' stop "VeeamBackupSvc" /y
'%WINDIR%\syswow64\net.exe' stop "VeeamCloudSvc" /y
'%WINDIR%\syswow64\net.exe' stop "epredline" /y
'%WINDIR%\syswow64\net.exe' stop "VeeamEndpointBackupSvc" /y
'%WINDIR%\syswow64\net.exe' stop "VeeamEnterpriseManagerSvc" /y
'%WINDIR%\syswow64\net.exe' stop "VeeamMountSvc" /y
'%WINDIR%\syswow64\net.exe' stop "VeeamNFSSvc" /y
'%WINDIR%\syswow64\net.exe' stop "VeeamRESTSvc" /y
'%WINDIR%\syswow64\net.exe' stop "VeeamTransportSvc /y
'%WINDIR%\syswow64\net.exe' stop "Veeam Backup Catalog Data Service" /y
'%WINDIR%\syswow64\net.exe' stop "MSMQ" /y
'%WINDIR%\syswow64\net.exe' stop "SPTraceV4" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQL$*" /y
'%WINDIR%\syswow64\net.exe' stop "SPSearchHostController" /y
'%WINDIR%\syswow64\net.exe' stop "MSSQLSERVER" /y
'%WINDIR%\syswow64\net.exe' stop "MsDtsServer" /y
'%WINDIR%\syswow64\net.exe' stop "MySQL57" /y
'%WINDIR%\syswow64\net.exe' stop "OSearch15" /y
'%WINDIR%\syswow64\net.exe' stop "OracleClientCache80" /y
'%WINDIR%\syswow64\net.exe' stop "QuickBooksDB25" /y
'%WINDIR%\syswow64\net.exe' stop "SPAdminV4" /y
'%WINDIR%\syswow64\net.exe' stop "epag" /y
'%WINDIR%\syswow64\net.exe' stop "SQLBackups" /y
'%WINDIR%\syswow64\net.exe' stop "SPUserCodeV4" /y
'%WINDIR%\syswow64\net.exe' stop "SPWriterV4" /y
'%WINDIR%\syswow64\net.exe' stop "SQLBrowser" /y
'%WINDIR%\syswow64\net.exe' stop "SQLSafeOLRService" /y
'%WINDIR%\syswow64\net.exe' stop "SQLsafe Backup Service" /y
'%WINDIR%\syswow64\net.exe' stop "SQLSERVERAGENT" /y
'%WINDIR%\syswow64\net.exe' stop "SQLTELEMETRY" /y
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$*" /y
'%WINDIR%\syswow64\net.exe' stop "ReportServer$TPSAMA" /y

Terminates or attempts to terminate

the following user processes:

firefox.exe

Modifies file system

Creates the following files

D:\[how to recover files].txt

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''

Creates and executes the following

'%WINDIR%\syswow64\taskkill.exe' /IM firefox.exe /F' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "YTBackup" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "vhdsvc" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "TeamViewer" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSOLAP$SQL_2008" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSOLAP$SYSTEM_BGC" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSOLAP$TPS" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "tmccsf" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSOLAP$TPSAMA" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSSQL$ECWDB2" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSSQL$PRACTICEMGT" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSSQL$PRACTTICEBGC" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSSQL$PROD" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSSQL$PROFXENGAGEMENT" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSSQL$SBSMONITORING" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "EqlReqService" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "RapidRecoveryAgent" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "EqlVss" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "hasplms" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "BASupportExpressSrvcUpdater_N_Central" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "mfemms" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "McAfeeDLPAgentService" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "psqlWGE" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "swprv" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "wsbexchange" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "WinVNC4" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSSQL$SHAREPOINT" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSSQL$BKUPEXEC" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "TMBMServer" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "VSNAPVSS" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "stc_endpt_svc" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "wbengine" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "bbagent" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "NasPmService" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "BASupportExpressStandaloneService_N_Central" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "macmnsvc" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "tmlisten" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSSQL$SOPHOS" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSSQL$SQL_2008" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSSQL$SQLEXPRESS" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$PRACTTICEBGC" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$PRACTTICEMGT" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$PROD" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$PROFXENGAGEMENT" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$SBSMONITORING" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$SHAREPOINT" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$SOPHOS" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$SQLEXPRESS" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "masvc" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$SYSTEM_BGC" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$TPS" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$TPSAMA" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$VEEAMSQL2008R2" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$VEEAMSQL2012" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "ReportServer$SQL_2008" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "ReportServer$SYSTEM_BGC" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$ECWDB2" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSSQLFDLauncher$SHAREPOINT" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$CXDB" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSSQLFDLauncher$SBSMONITORING" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSSQL$SYSTEM_BGC" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSSQL$TPS" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSSQL$TPSAMA" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSSQL$VEEAMSQL2008R2" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSSQL$VEEAMSQL2012" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSSQLFDLauncher" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "ReportServer$TPS" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$BKUPEXEC" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSSQLFDLauncher$SQL_2008" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSSQLFDLauncher$SYSTEM_BGC" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSSQLFDLauncher$TPS" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSSQLFDLauncher$TPSAMA" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSSQLServerADHelper" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSSQLServerADHelper100" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSSQLServerOLAPService" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$CITRIX_METAFRAME" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$SQL_2008" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "mozyprobackup" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "VeeamCatalogSvc" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSExchangeMTA" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSExchangeSA" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSExchangeSRS" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSExchangeADTopology" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSExchangeDelivery" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSExchangeDiagnostics" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "BackupExecManagementService" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSExchangeEdgeSync" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSExchangeHMRecovery" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSExchangeIS" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSExchangeMailboxReplication" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSExchangeRPC" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSExchangeRepl" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSExchangeServiceHost" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSExchangeES" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSExchangeMGMT" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MBEndpointAgent" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MBAMService" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MB3Service" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "McAfeeFramework" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "Alerter" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "AcronisAgent" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "Acronis VSS Provider" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "BackupExecAgentAccelerator" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "BackupExecDeviceMediaService" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSExchangeTransport" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSExchangeHM" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "BackupExecJobEngine" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "BackupExecVSSProvider" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "DFSR" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "EPIntegrationService" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "EPProtectedService" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "EPSecurityService" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "EPUpdateService" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "CSFalconService" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "BackupExecRPCService" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSExchangeUM" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSExchangeUMCR" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSOLAP$*" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "ReportServer" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "ReportServer$*" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "SQLWriter" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "SQLBackupAgent" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "Symantec System Recovery" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "SyncoveryVSSService" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "VeeamBackupSvc" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "VeeamCloudSvc" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "epredline" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "VeeamEndpointBackupSvc" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "VeeamEnterpriseManagerSvc" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "VeeamMountSvc" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "VeeamNFSSvc" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "VeeamRESTSvc" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "VeeamTransportSvc /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "Veeam Backup Catalog Data Service" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSMQ" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "SPTraceV4" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSSQL$*" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "SPSearchHostController" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MSSQLSERVER" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MsDtsServer" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "MySQL57" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "OSearch15" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "OracleClientCache80" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "QuickBooksDB25" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "SPAdminV4" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "epag" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "SQLBackups" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "SPUserCodeV4" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "SPWriterV4" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "SQLBrowser" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "SQLSafeOLRService" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "SQLsafe Backup Service" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "SQLSERVERAGENT" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "SQLTELEMETRY" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "SQLAgent$*" /y' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop "ReportServer$TPSAMA" /y' (with hidden window)

Executes the following

'%WINDIR%\syswow64\net1.exe' stop "CSFalconService" /y
'%WINDIR%\syswow64\net1.exe' stop "TeamViewer" /y
'%WINDIR%\syswow64\net1.exe' stop "MSOLAP$SQL_2008" /y
'%WINDIR%\syswow64\net1.exe' stop "MSOLAP$SYSTEM_BGC" /y
'%WINDIR%\syswow64\net1.exe' stop "MSOLAP$TPSAMA" /y
'%WINDIR%\syswow64\net1.exe' stop "MSOLAP$TPS" /y
'%WINDIR%\syswow64\net1.exe' stop "VSNAPVSS" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQL$BKUPEXEC" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQL$PRACTTICEBGC" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQL$PROD" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQL$PRACTICEMGT" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQL$PROFXENGAGEMENT" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQL$SBSMONITORING" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQL$SHAREPOINT" /y
'%WINDIR%\syswow64\net1.exe' stop "YTBackup" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQL$ECWDB2" /y
'%WINDIR%\syswow64\net1.exe' stop "vhdsvc" /y
'%WINDIR%\syswow64\net1.exe' stop "RapidRecoveryAgent" /y
'%WINDIR%\syswow64\net1.exe' stop "EqlReqService" /y
'%WINDIR%\syswow64\net1.exe' stop "EqlVss" /y
'%WINDIR%\syswow64\net1.exe' stop "psqlWGE" /y
'%WINDIR%\syswow64\net1.exe' stop "swprv" /y
'%WINDIR%\syswow64\net1.exe' stop "WinVNC4" /y
'%WINDIR%\syswow64\net1.exe' stop "wsbexchange" /y
'%WINDIR%\syswow64\net1.exe' stop "tmccsf" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQL$SQL_2008" /y
'%WINDIR%\syswow64\net1.exe' stop "TMBMServer" /y
'%WINDIR%\syswow64\net1.exe' stop "macmnsvc" /y
'%WINDIR%\syswow64\net1.exe' stop "tmlisten" /y
'%WINDIR%\syswow64\net1.exe' stop "stc_endpt_svc" /y
'%WINDIR%\syswow64\net1.exe' stop "bbagent" /y
'%WINDIR%\syswow64\net1.exe' stop "NasPmService" /y
'%WINDIR%\syswow64\net1.exe' stop "BASupportExpressStandaloneService_N_Central" /y
'%WINDIR%\syswow64\net1.exe' stop "hasplms" /y
'%WINDIR%\syswow64\net1.exe' stop "mfemms" /y
'%WINDIR%\syswow64\net1.exe' stop "BASupportExpressSrvcUpdater_N_Central" /y
'%WINDIR%\syswow64\net1.exe' stop "wbengine" /y
'%WINDIR%\syswow64\net1.exe' stop "McAfeeDLPAgentService" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQL$SOPHOS" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQL$TPSAMA" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLAgent$PROD" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLAgent$PROFXENGAGEMENT" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLAgent$SBSMONITORING" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLAgent$SHAREPOINT" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLAgent$SOPHOS" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLAgent$SQL_2008" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLAgent$CXDB" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLAgent$SQLEXPRESS" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLAgent$TPS" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLAgent$TPSAMA" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLAgent$VEEAMSQL2012" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLAgent$VEEAMSQL2008R2" /y
'%WINDIR%\syswow64\net1.exe' stop "ReportServer$TPS" /y
'%WINDIR%\syswow64\net1.exe' stop "ReportServer$SYSTEM_BGC" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLAgent$PRACTTICEBGC" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLAgent$PRACTTICEMGT" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLAgent$ECWDB2" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLAgent$CITRIX_METAFRAME" /y
'%WINDIR%\syswow64\net1.exe' stop "SPTraceV4" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQL$VEEAMSQL2012" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQL$VEEAMSQL2008R2" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQLFDLauncher" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQLFDLauncher$SBSMONITORING" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQL$TPS" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQL$SQLEXPRESS" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQL$SYSTEM_BGC" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQLFDLauncher$SHAREPOINT" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQLFDLauncher$TPSAMA" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQLServerADHelper" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQLServerADHelper100" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQLServerOLAPService" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLAgent$BKUPEXEC" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQLFDLauncher$SQL_2008" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQLFDLauncher$SYSTEM_BGC" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQLFDLauncher$TPS" /y
'%WINDIR%\syswow64\net1.exe' stop "mozyprobackup" /y
'%WINDIR%\syswow64\net1.exe' stop "masvc" /y
'%WINDIR%\syswow64\net1.exe' stop "epredline" /y
'%WINDIR%\syswow64\net1.exe' stop "MSExchangeSA" /y
'%WINDIR%\syswow64\net1.exe' stop "MSExchangeSRS" /y
'%WINDIR%\syswow64\net1.exe' stop "MSExchangeDelivery" /y
'%WINDIR%\syswow64\net1.exe' stop "MSExchangeEdgeSync" /y
'%WINDIR%\syswow64\net1.exe' stop "MSExchangeDiagnostics" /y
'%WINDIR%\syswow64\net1.exe' stop "MSExchangeHMRecovery" /y
'%WINDIR%\syswow64\net1.exe' stop "MSExchangeUMCR" /y
'%WINDIR%\syswow64\net1.exe' stop "MSExchangeHM" /y
'%WINDIR%\syswow64\net1.exe' stop "MSExchangeIS" /y
'%WINDIR%\syswow64\net1.exe' stop "MSExchangeRepl" /y
'%WINDIR%\syswow64\net1.exe' stop "MSExchangeRPC" /y
'%WINDIR%\syswow64\net1.exe' stop "MSExchangeUM" /y
'%WINDIR%\syswow64\net1.exe' stop "MSExchangeTransport" /y
'%WINDIR%\syswow64\net1.exe' stop "MSExchangeMTA" /y
'%WINDIR%\syswow64\net1.exe' stop "MSExchangeES" /y
'%WINDIR%\syswow64\net1.exe' stop "MSExchangeADTopology" /y
'%WINDIR%\syswow64\net1.exe' stop "MBEndpointAgent" /y
'%WINDIR%\syswow64\net1.exe' stop "MBAMService" /y
'%WINDIR%\syswow64\net1.exe' stop "McAfeeFramework" /y
'%WINDIR%\syswow64\net1.exe' stop "AcronisAgent" /y
'%WINDIR%\syswow64\net1.exe' stop "BackupExecAgentAccelerator" /y
'%WINDIR%\syswow64\net1.exe' stop "Acronis VSS Provider" /y
'%WINDIR%\syswow64\net1.exe' stop "BackupExecRPCService" /y
'%WINDIR%\syswow64\net1.exe' stop "BackupExecDeviceMediaService" /y
'%WINDIR%\syswow64\net1.exe' stop "MSExchangeServiceHost" /y
'%WINDIR%\syswow64\net1.exe' stop "DFSR" /y
'%WINDIR%\syswow64\net1.exe' stop "MSExchangeMailboxReplication" /y
'%WINDIR%\syswow64\net1.exe' stop "BackupExecVSSProvider" /y
'%WINDIR%\syswow64\net1.exe' stop "EPIntegrationService" /y
'%WINDIR%\syswow64\net1.exe' stop "EPSecurityService" /y
'%WINDIR%\syswow64\net1.exe' stop "EPUpdateService" /y
'%WINDIR%\syswow64\net1.exe' stop "EPProtectedService" /y
'%WINDIR%\syswow64\net1.exe' stop "MB3Service" /y
'%WINDIR%\syswow64\net1.exe' stop "BackupExecManagementService" /y
'%WINDIR%\syswow64\net1.exe' stop "Alerter" /y
'%WINDIR%\syswow64\net1.exe' stop "BackupExecJobEngine" /y
'%WINDIR%\syswow64\net1.exe' stop "MSExchangeMGMT" /y
'%WINDIR%\syswow64\net1.exe' stop "MsDtsServer" /y
'%WINDIR%\syswow64\net1.exe' stop "ReportServer$*" /y
'%WINDIR%\syswow64\net1.exe' stop "Symantec System Recovery" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLBackupAgent" /y
'%WINDIR%\syswow64\net1.exe' stop "SyncoveryVSSService" /y
'%WINDIR%\syswow64\net1.exe' stop "VeeamBackupSvc" /y
'%WINDIR%\syswow64\net1.exe' stop "VeeamCatalogSvc" /y
'%WINDIR%\syswow64\net1.exe' stop "ReportServer" /y
'%WINDIR%\syswow64\net1.exe' stop "MSOLAP$*" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLWriter" /y
'%WINDIR%\syswow64\net1.exe' stop "VeeamCloudSvc" /y
'%WINDIR%\syswow64\net1.exe' stop "VeeamMountSvc" /y
'%WINDIR%\syswow64\net1.exe' stop "VeeamRESTSvc" /y
'%WINDIR%\syswow64\net1.exe' stop "VeeamTransportSvc /y
'%WINDIR%\syswow64\net1.exe' stop "Veeam Backup Catalog Data Service" /y
'%WINDIR%\syswow64\net1.exe' stop "epag" /y
'%WINDIR%\syswow64\net1.exe' stop "VeeamEndpointBackupSvc" /y
'%WINDIR%\syswow64\net1.exe' stop "VeeamEnterpriseManagerSvc" /y
'%WINDIR%\syswow64\net1.exe' stop "VeeamNFSSvc" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLAgent$SYSTEM_BGC" /y
'%WINDIR%\syswow64\net1.exe' stop "ReportServer$SQL_2008" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLAgent$*" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQLSERVER" /y
'%WINDIR%\syswow64\net1.exe' stop "OSearch15" /y
'%WINDIR%\syswow64\net1.exe' stop "QuickBooksDB25" /y
'%WINDIR%\syswow64\net1.exe' stop "OracleClientCache80" /y
'%WINDIR%\syswow64\net1.exe' stop "SPAdminV4" /y
'%WINDIR%\syswow64\net1.exe' stop "SPSearchHostController" /y
'%WINDIR%\syswow64\net1.exe' stop "MSSQL$*" /y
'%WINDIR%\syswow64\net1.exe' stop "MSMQ" /y
'%WINDIR%\syswow64\net1.exe' stop "SPUserCodeV4" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLBrowser" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLSafeOLRService" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLsafe Backup Service" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLSERVERAGENT" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLTELEMETRY" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLBackups" /y
'%WINDIR%\syswow64\net1.exe' stop "MySQL57" /y
'%WINDIR%\syswow64\net1.exe' stop "SPWriterV4" /y
'%WINDIR%\syswow64\net1.exe' stop "ReportServer$TPSAMA" /y

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial