Trojan.Encoder.33795

Technical Information

Malicious functions

To complicate detection of its presence in the operating system,

deletes volume shadow copies.

Executes the following

'%WINDIR%\syswow64\taskkill.exe' /f /im avgidsagenta.exe
'%WINDIR%\syswow64\net.exe' stop SQLAgent$PRACTTICEMGT /y
'%WINDIR%\syswow64\net.exe' stop BackupExecJobEngine /y
'%WINDIR%\syswow64\net.exe' stop BackupExecAgentBrowser /y
'%WINDIR%\syswow64\net.exe' stop VeeamHvIntegrationSvc /y
'%WINDIR%\syswow64\net.exe' stop masvc /y
'%WINDIR%\syswow64\net.exe' stop W3Svc /y
'%WINDIR%\syswow64\net.exe' stop ΓГ‡ВЈSQLsafe Backup ServiceΓГ‡ВҐ /y
'%WINDIR%\syswow64\net.exe' stop SQLAgent$CXDB /y
'%WINDIR%\syswow64\net.exe' stop SQLBrowser /y
'%WINDIR%\syswow64\net.exe' stop MSSQLFDLauncher$SYSTEM_BGC /y
'%WINDIR%\syswow64\net.exe' stop MSSQLFDLauncher$SQL_2008 /y
'%WINDIR%\syswow64\net.exe' stop ΓГ‡ВЈSophos Safestore ServiceΓГ‡ВҐ /y
'%WINDIR%\syswow64\net.exe' stop svcGenericHost /y
'%WINDIR%\syswow64\net.exe' stop ntrtscan /y
'%WINDIR%\syswow64\net.exe' stop SQLAgent$VEEAMSQL2012 /y
'%WINDIR%\syswow64\net.exe' stop MSExchangeMGMT /y
'%WINDIR%\syswow64\net.exe' stop SamSs /y
'%WINDIR%\syswow64\net.exe' stop MSExchangeES /y
'%WINDIR%\syswow64\net.exe' stop MBAMService /y
'%WINDIR%\syswow64\net.exe' stop EsgShKernel /y
'%WINDIR%\syswow64\net.exe' stop ESHASRV /y
'%WINDIR%\syswow64\net.exe' stop SQLAgent$SQL_2008 /y
'%WINDIR%\syswow64\net.exe' stop VeeamBackupSvc /y
'%WINDIR%\syswow64\net.exe' stop IISAdmin /y
'%WINDIR%\syswow64\net.exe' stop SDRSVC /y
'%WINDIR%\syswow64\net.exe' stop MsDtsServer /y
'%WINDIR%\syswow64\net.exe' stop ShMonitor /y
'%WINDIR%\syswow64\net.exe' stop BackupExecDeviceMediaService /y
'%WINDIR%\syswow64\net.exe' stop MySQL57 /y
'%WINDIR%\syswow64\net.exe' stop McAfeeFrameworkMcAfeeFramework /y
'%WINDIR%\syswow64\net.exe' stop TrueKey /y
'%WINDIR%\syswow64\net.exe' stop VeeamMountSvc /y
'%WINDIR%\syswow64\net.exe' stop MsDtsServer110 /y
'%WINDIR%\syswow64\net.exe' stop SQLAgent$BKUPEXEC /y
'%WINDIR%\syswow64\net.exe' stop UI0Detect /y
'%WINDIR%\syswow64\net.exe' stop ReportServer /y
'%WINDIR%\syswow64\net.exe' stop MSSQL$TPSAMA /y
'%WINDIR%\syswow64\net.exe' stop SQLTELEMETRY$ECWDB2 /y
'%WINDIR%\syswow64\net.exe' stop ReportServer$SYSTEM_BGC /y
'%WINDIR%\syswow64\net.exe' stop MSSQL$BKUPEXEC /y
'%WINDIR%\syswow64\net.exe' stop MSExchangeSRS /y
'%WINDIR%\syswow64\net.exe' stop SQLAgent$VEEAMSQL2008R2 /y
'%WINDIR%\syswow64\net.exe' stop McShield /y
'%WINDIR%\syswow64\net.exe' stop SepMasterService /y
'%WINDIR%\syswow64\net.exe' stop ΓГ‡ВЈSophos MCS ClientΓГ‡ВҐ /y
'%WINDIR%\syswow64\net.exe' stop VeeamCatalogSvc /y
'%WINDIR%\syswow64\net.exe' stop SQLAgent$SHAREPOINT /y
'%WINDIR%\syswow64\net.exe' stop NetMsmqActivator /y
'%WINDIR%\syswow64\net.exe' stop kavfsslp /y
'%WINDIR%\syswow64\net.exe' stop AcronisAgent /y
'%WINDIR%\syswow64\net.exe' stop tmlisten /y
'%WINDIR%\syswow64\net.exe' stop SQLAgent$PRACTTICEBGC /y
'%WINDIR%\syswow64\net.exe' stop KAVFSGT /y
'%WINDIR%\syswow64\net.exe' stop SQLAgent$CITRIX_METAFRAME /y
'%WINDIR%\syswow64\net.exe' stop MBEndpointAgent /y
'%WINDIR%\syswow64\net.exe' stop WRSVC /y
'%WINDIR%\syswow64\net.exe' stop mfevtp /y
'%WINDIR%\syswow64\net.exe' stop msftesql$PROD /y
'%WINDIR%\syswow64\net.exe' stop mozyprobackup /y
'%WINDIR%\syswow64\net.exe' stop MSSQL$SQL_2008 /y
'%WINDIR%\syswow64\net.exe' stop SNAC /y
'%WINDIR%\syswow64\net.exe' stop ReportServer$SQL_2008 /y
'%WINDIR%\syswow64\net.exe' stop BackupExecAgentAccelerator /y
'%WINDIR%\syswow64\net.exe' stop MSSQL$SQLEXPRESS /y
'%WINDIR%\syswow64\net.exe' stop MSSQL$PRACTTICEBGC /y
'%WINDIR%\syswow64\net.exe' stop MSSQL$TPS /y
'%WINDIR%\syswow64\net.exe' stop VeeamRESTSvc /y
'%WINDIR%\syswow64\net.exe' stop ekrn /y
'%WINDIR%\syswow64\net.exe' stop MMS /y
'%WINDIR%\syswow64\net.exe' stop ΓГ‡ВЈSophos MCS AgentΓГ‡ВҐ /y
'%WINDIR%\syswow64\net.exe' stop RESvc /y
'%WINDIR%\syswow64\net.exe' stop ΓГ‡ВЈAcronis VSS ProviderΓГ‡ВҐ /y
'%WINDIR%\syswow64\net.exe' stop MSSQLFDLauncher$SHAREPOINT /y
'%WINDIR%\syswow64\net.exe' stop ΓГ‡ВЈSQLsafe Filter ServiceΓГ‡ВҐ /y
'%WINDIR%\syswow64\net.exe' stop MSSQL$PROD /y
'%WINDIR%\syswow64\net.exe' stop SQLAgent$PROD /y
'%WINDIR%\syswow64\net.exe' stop MSOLAP$TPS /y
'%WINDIR%\syswow64\net.exe' stop MsDtsServer100 /y
'%WINDIR%\syswow64\net.exe' stop MSSQL$SHAREPOINT /y
'%WINDIR%\syswow64\net.exe' stop mfemms /y
'%WINDIR%\syswow64\net.exe' stop ΓГ‡ВЈSQL BackupsΓГ‡ВҐ /y
'%WINDIR%\syswow64\net.exe' stop KAVFS /y
'%WINDIR%\syswow64\net.exe' stop swi_service /y
'%WINDIR%\syswow64\net.exe' stop MSSQL$PRACTICEMGT /y
'%WINDIR%\syswow64\net.exe' stop SQLAgent$TPSAMA /y
'%WINDIR%\syswow64\net.exe' stop McAfeeFramework /y
'%WINDIR%\syswow64\net.exe' stop ΓГ‡ВЈEnterprise Client ServiceΓГ‡ВҐ /y
'%WINDIR%\syswow64\net.exe' stop SQLAgent$SBSMONITORING /y
'%WINDIR%\syswow64\net.exe' stop MSSQL$VEEAMSQL2012 /y
'%WINDIR%\syswow64\net.exe' stop swi_filter /y
'%WINDIR%\syswow64\net.exe' stop SQLSafeOLRService /y
'%WINDIR%\syswow64\net.exe' stop VeeamCloudSvc /y
'%WINDIR%\syswow64\net.exe' stop ΓГ‡ВЈSophos AgentΓГ‡ВҐ /y
'%WINDIR%\syswow64\net.exe' stop ΓГ‡ВЈSophos File Scanner ServiceΓГ‡ВҐ /y
'%WINDIR%\syswow64\net.exe' stop BackupExecVSSProvider /y
'%WINDIR%\syswow64\net.exe' stop MSSQL$PROFXENGAGEMENT /y
'%WINDIR%\syswow64\net.exe' stop IMAP4Svc /y
'%WINDIR%\syswow64\net.exe' stop ARSM /y
'%WINDIR%\syswow64\net.exe' stop MSExchangeIS /y
'%WINDIR%\syswow64\net.exe' stop AVP /y
'%WINDIR%\syswow64\net.exe' stop MSSQLFDLauncher /y
'%WINDIR%\syswow64\net.exe' stop MSExchangeMTA /y
'%WINDIR%\syswow64\net.exe' stop TrueKeyScheduler /y
'%WINDIR%\syswow64\net.exe' stop MSSQL$SOPHOS /y
'%WINDIR%\syswow64\net.exe' stop VeeamEnterpriseManagerSvc /y
'%WINDIR%\syswow64\net.exe' stop SQLAgent$SQLEXPRESS /y
'%WINDIR%\syswow64\net.exe' stop OracleClientCache80 /y
'%WINDIR%\syswow64\net.exe' stop MSSQL$SBSMONITORING /y
'%WINDIR%\syswow64\net.exe' stop ΓГ‡ВЈVeeam Backup Catalog Data ServiceΓГ‡ВҐ /
'%WINDIR%\syswow64\net.exe' stop McAfeeEngineService /y
'%WINDIR%\syswow64\taskkill.exe' /f /im steam.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im thebat.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im thebat64.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im thunderbird.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im visio.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im winword.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im wordpad.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im notepad.exe
'%WINDIR%\syswow64\net.exe' stop SQLAgent$SYSTEM_BGC /y
'%WINDIR%\syswow64\net.exe' stop ΓГ‡ВЈSophos Device Control ServiceΓГ‡ВҐ /y
'%WINDIR%\syswow64\net.exe' stop SQLAgent$SOPHOS /y
'%WINDIR%\syswow64\net.exe' stop macmnsvc /y
'%WINDIR%\syswow64\net.exe' stop ΓГ‡ВЈZoolz 2 ServiceΓГ‡ВҐ /y
'%WINDIR%\syswow64\net.exe' stop McTaskManager /y
'%WINDIR%\syswow64\net.exe' stop ΓГ‡ВЈSophos AutoUpdate ServiceΓГ‡ВҐ /y
'%WINDIR%\syswow64\net.exe' stop ΓГ‡ВЈSophos System Protection ServiceΓГ‡ВҐ /y
'%WINDIR%\syswow64\net.exe' stop EraserSvc11710 /y
'%WINDIR%\syswow64\net.exe' stop PDVFSService /y
'%WINDIR%\syswow64\net.exe' stop SQLAgent$PROFXENGAGEMENT /y
'%WINDIR%\syswow64\net.exe' stop SAVService /y
'%WINDIR%\syswow64\net.exe' stop MSSQLFDLauncher$TPSAMA /y
'%WINDIR%\syswow64\taskkill.exe' /f /im onenote.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im ocautoupds.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im powerpnt.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im mydesktopservice.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im xfssvccon.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im avgcsrva.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im avgnsa.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im avgemca.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im avgrsa.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im egui.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im avpui.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im NS.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im ctfmon.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im processhacker.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im postgres.exe
'%WINDIR%\syswow64\net.exe' stop EPSecurityService /y
'%WINDIR%\syswow64\taskkill.exe' /f /im slqserver.exe
'%WINDIR%\syswow64\net.exe' stop SQLAgent$ECWDB2 /y
'%WINDIR%\syswow64\taskkill.exe' /f /im msftesql.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im sqlbrowser.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im sqlservr.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im oracle.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im ocssd.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im dbsnmp.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im synctime.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im mydesktopqos.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im agntsvc.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im isqlplussvc.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im sqlwriter.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im avgwdsvca.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im sqlagent.exe
'%WINDIR%\syswow64\taskkill.exe' /f /im outlook.exe
'%WINDIR%\syswow64\net.exe' stop ΓГ‡ВЈSymantec System RecoveryΓГ‡ВҐ /y
'%WINDIR%\syswow64\net.exe' stop DCAgent /y
'%WINDIR%\syswow64\net.exe' stop MSSQLFDLauncher$SBSMONITORING /y
'%WINDIR%\syswow64\net.exe' stop MySQL80 /y
'%WINDIR%\syswow64\net.exe' stop MSOLAP$SYSTEM_BGC /y
'%WINDIR%\syswow64\net.exe' stop ReportServer$TPS /y
'%WINDIR%\syswow64\net.exe' stop MSSQL$ECWDB2 /y
'%WINDIR%\syswow64\net.exe' stop SntpService /y
'%WINDIR%\syswow64\net.exe' stop SQLSERVERAGENT /y
'%WINDIR%\syswow64\net.exe' stop BackupExecManagementService /y
'%WINDIR%\syswow64\net.exe' stop SMTPSvc /y
'%WINDIR%\syswow64\net.exe' stop SQLAgent$TPS /y
'%WINDIR%\syswow64\net.exe' stop Antivirus /y
'%WINDIR%\syswow64\net.exe' stop ΓГ‡ВЈSophos Message RouterΓГ‡ВҐ /y
'%WINDIR%\syswow64\net.exe' stop mfefire /y
'%WINDIR%\syswow64\net.exe' stop MSExchangeSA /y
'%WINDIR%\syswow64\net.exe' stop MSSQLServerADHelper /y
'%WINDIR%\syswow64\net.exe' stop SQLTELEMETRY /y
'%WINDIR%\syswow64\net.exe' stop ΓГ‡ВЈSophos Clean ServiceΓГ‡ВҐ /y
'%WINDIR%\syswow64\net.exe' stop swi_update_64 /y
'%WINDIR%\syswow64\net.exe' stop ΓГ‡ВЈSophos Web Control ServiceΓГ‡ВҐ /y
'%WINDIR%\syswow64\net.exe' stop EhttpSrv /y
'%WINDIR%\syswow64\net.exe' stop POP3Svc /y
'%WINDIR%\syswow64\net.exe' stop MSOLAP$TPSAMA /y
'%WINDIR%\syswow64\net.exe' stop BackupExecRPCService /y
'%WINDIR%\syswow64\net.exe' stop MSSQL$VEEAMSQL2008R2 /y
'%WINDIR%\syswow64\net.exe' stop klnagent /y
'%WINDIR%\syswow64\net.exe' stop sophossps /y
'%WINDIR%\syswow64\net.exe' stop VeeamDeploySvc /y
'%WINDIR%\syswow64\net.exe' stop VeeamBrokerSvc /y
'%WINDIR%\syswow64\net.exe' stop MSOLAP$SQL_2008 /y
'%WINDIR%\syswow64\net.exe' stop TrueKeyServiceHelper /y
'%WINDIR%\syswow64\net.exe' stop sacsvr /y
'%WINDIR%\syswow64\net.exe' stop VeeamNFSSvc /y
'%WINDIR%\syswow64\net.exe' stop FA_Scheduler /y
'%WINDIR%\syswow64\net.exe' stop SAVAdminService /y
'%WINDIR%\syswow64\net.exe' stop EPUpdateService /y
'%WINDIR%\syswow64\net.exe' stop VeeamTransportSvc /y
'%WINDIR%\syswow64\net.exe' stop ΓГ‡ВЈSophos Health ServiceΓГ‡ВҐ /y
'%WINDIR%\syswow64\net.exe' stop bedbg /y
'%WINDIR%\syswow64\net.exe' stop MSSQLFDLauncher$PROFXENGAGEMENT /y
'%WINDIR%\syswow64\net.exe' stop VeeamDeploymentService /y
'%WINDIR%\syswow64\net.exe' stop MSSQLSERVER /y
'%WINDIR%\syswow64\net.exe' stop MSSQLServerADHelper100 /y
'%WINDIR%\syswow64\net.exe' stop TmCCSF /y
'%WINDIR%\syswow64\net.exe' stop wbengine /y
'%WINDIR%\syswow64\net.exe' stop SQLWriter /y
'%WINDIR%\syswow64\net.exe' stop MSSQLFDLauncher$TPS /y
'%WINDIR%\syswow64\net.exe' stop SmcService /y
'%WINDIR%\syswow64\net.exe' stop ReportServer$TPSAMA /y
'%WINDIR%\syswow64\net.exe' stop swi_update /y
'%WINDIR%\syswow64\net.exe' stop AcrSch2Svc /y
'%WINDIR%\syswow64\net.exe' stop MSSQL$SYSTEM_BGC /y
'%WINDIR%\syswow64\net.exe' stop SstpSvc /y
'%WINDIR%\syswow64\net.exe' stop Smcinst /y
'%WINDIR%\syswow64\net.exe' stop MSSQLServerOLAPService /y

Reads files which store third party applications passwords

%HOMEPATH%\desktop\000814251_video_01.avi
%HOMEPATH%\desktop\508softwareandos.doc
%HOMEPATH%\desktop\dashborder_144.bmp
%HOMEPATH%\desktop\dashborder_120.bmp
%HOMEPATH%\desktop\dashborder_96.bmp
%HOMEPATH%\desktop\dial.bmp
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
%HOMEPATH%\desktop\join.avi
%HOMEPATH%\desktop\toolbar.bmp

Modifies file system

Creates the following files

<Current directory>\qwxidiwq73823.bat
%TEMP%\dashborder_96.bmp
%TEMP%\dashborder_120.bmp
%TEMP%\dashborder_144.bmp
%TEMP%\total commander 64 bit.lnk
%TEMP%\telegram.lnk
%TEMP%\qip 2012.lnk
%TEMP%\mail.ru agent.lnk
%TEMP%\icq.lnk
%TEMP%\508softwareandos.doc
%TEMP%\000814251_video_01.avi
%TEMP%\albumart_{5fa05d35-a682-4af6-96f7-0773e42d4d16}_small.jpg
%TEMP%\wildlife.wmv
%TEMP%\penguins.jpg
%TEMP%\lighthouse.jpg
%TEMP%\koala.jpg
%TEMP%\jellyfish.jpg
%TEMP%\hydrangeas.jpg
%TEMP%\desert.jpg
%TEMP%\chrysanthemum.jpg
%TEMP%\sleep away.mp3
%TEMP%\maid with the flaxen hair.mp3
%TEMP%\kalimba.mp3
%TEMP%\tulips.jpg
%TEMP%\folder.jpg
%TEMP%\dial.bmp
%TEMP%\install.log
%TEMP%\4f0bf7ff71f28.jpeg
%TEMP%\3.jpg
%TEMP%\210252809.jpg
%TEMP%\2015-02-patients-topic-work-related-asthma-jobs.pdf
%TEMP%\2013_smccc_competition_points_jul2013.xlsx
%TEMP%\2013_finalsummaryforweb.xlsx
%TEMP%\2.jpeg
%TEMP%\13.jpg
%TEMP%\13.jpeg
%TEMP%\10thingscondoms.pdf
%TEMP%\join.avi
%TEMP%\hadac_newsletter_july_2010_final.docx
%TEMP%\size!.txt
%TEMP%\register.rtf
%TEMP%\keyboard.txt
%TEMP%\history.txt
%TEMP%\qwxidiwq73823.bat
%TEMP%\ntuser.ini
%TEMP%\recentplaces.lnk
%TEMP%\downloads.lnk
%TEMP%\desktop.lnk
%TEMP%\toolbar.bmp
%TEMP%\1189.jpeg
%TEMP%\albumart_{5fa05d35-a682-4af6-96f7-0773e42d4d16}_large.jpg
%TEMP%\albumartsmall.jpg
%TEMP%\mirc.lnk
%TEMP%\savesettings.cmd
%TEMP%\restoresettings.cmd
%TEMP%\notes_rus.txt
%TEMP%\notes.txt
%TEMP%\ftpcmds_rus.txt
%TEMP%\ftpcmds.txt
%TEMP%\pluginw.pas
%TEMP%\farkeysw.pas
%TEMP%\farcolorw.pas
%TEMP%\proplusww.xml
%TEMP%\code.bin
%TEMP%\plugins_review.txt
%TEMP%\plugins_install.txt
%TEMP%\far_faq.txt
%TEMP%\bug_report.txt
%TEMP%\arc_support.txt
%TEMP%\clearpluginscache.cmd
%TEMP%\readme.txt
%TEMP%\export_colors.bat
%TEMP%\import_colors.bat
nul
%TEMP%\techinfo.txt
%TEMP%\setup.xml
%TEMP%\office32ww.xml
%TEMP%\excelmui.xml
%TEMP%\desktop.ini
%TEMP%\branding.xml
%TEMP%\winamp.lnk
%TEMP%\steam.lnk
%TEMP%\opera.lnk
%TEMP%\mozilla thunderbird.lnk
%TEMP%\mozilla firefox.lnk
%TEMP%\google chrome.lnk
%TEMP%\acrobat reader dc.lnk
%TEMP%\ntuser.dat.log
%TEMP%\accessmuiset.xml
%TEMP%\accessmui.xml
%TEMP%\officemuiset.xml
%TEMP%\powerpointmui.xml
%TEMP%\officemui.xml
%TEMP%\groovemui.xml
%TEMP%\onenotemui.xml
%TEMP%\infopathmui.xml
%TEMP%\office32mui.xml
%TEMP%\proofing.xml
%TEMP%\proof.xml
%TEMP%\wordmui.xml
%TEMP%\outlookmui.xml
%TEMP%\publishermui.xml
%TEMP%\7790_preview.pdf
%TEMP%\babyboymaintonotesbackground_pal.wmv

Modifies the following files

C:\far2\addons\colors\custom_highlighting\import_colors.bat
C:\far2\savesettings.cmd
C:\far2\restoresettings.cmd
C:\far2\plugins\ftp\notes_rus.txt
C:\far2\plugins\ftp\notes.txt
C:\far2\plugins\ftp\ftpcmds_rus.txt
C:\far2\plugins\ftp\ftpcmds.txt
C:\far2\pluginsdk\headers.pas\pluginw.pas
C:\far2\pluginsdk\headers.pas\farkeysw.pas
C:\far2\pluginsdk\headers.pas\farcolorw.pas
C:\far2\encyclopedia\tap\code.bin
C:\far2\documentation\rus\techinfo.txt
C:\far2\documentation\rus\plugins_review.txt
C:\far2\documentation\rus\plugins_install.txt
C:\far2\documentation\rus\far_faq.txt
C:\far2\documentation\rus\bug_report.txt
C:\far2\documentation\rus\arc_support.txt
C:\far2\documentation\eng\techinfo.txt
C:\far2\documentation\eng\plugins_review.txt
C:\far2\documentation\eng\plugins_install.txt
C:\far2\documentation\eng\far_faq.txt
C:\far2\documentation\eng\bug_report.txt
C:\far2\documentation\eng\arc_support.txt
C:\far2\clearpluginscache.cmd
C:\far2\addons\readme.txt
C:\far2\addons\colors\import_colors.bat
C:\far2\addons\colors\export_colors.bat
C:\far2\addons\colors\default_highlighting\import_colors.bat
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.xml
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.xml

Modifies multiple files.

Modifies user data files (Trojan.Encoder).

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''

Creates and executes the following

'%WINDIR%\syswow64\cmd.exe' /C "icacls . /grant Everyone:F /T /C /Q"' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /C QWxIDiWQ73823.bat
'%WINDIR%\syswow64\net1.exe' stop MSSQL$TPSAMA /y
'%WINDIR%\syswow64\net1.exe' stop SQLAgent$CITRIX_METAFRAME /y
'%WINDIR%\syswow64\net1.exe' stop VeeamCloudSvc /y
'%WINDIR%\syswow64\net1.exe' stop ΓГ‡ВЈSophos File Scanner ServiceΓГ‡ВҐ /y
'%WINDIR%\syswow64\net1.exe' stop ΓГ‡ВЈSophos AgentΓГ‡ВҐ /y
'%WINDIR%\syswow64\net1.exe' stop MBEndpointAgent /y
'%WINDIR%\syswow64\net1.exe' stop swi_service /y
'%WINDIR%\syswow64\net1.exe' stop MBAMService /y
'%WINDIR%\syswow64\net1.exe' stop MSSQL$PRACTICEMGT /y
'%WINDIR%\syswow64\net1.exe' stop ESHASRV /y
'%WINDIR%\syswow64\net1.exe' stop McAfeeFramework /y
'%WINDIR%\syswow64\net1.exe' stop SQLAgent$SBSMONITORING /y
'%WINDIR%\syswow64\net1.exe' stop MSSQL$VEEAMSQL2012 /y
'%WINDIR%\syswow64\net1.exe' stop swi_filter /y
'%WINDIR%\syswow64\net1.exe' stop SQLSafeOLRService /y
'%WINDIR%\syswow64\net1.exe' stop BackupExecVSSProvider /y
'%WINDIR%\syswow64\net1.exe' stop VeeamEnterpriseManagerSvc /y
'%WINDIR%\syswow64\net1.exe' stop SQLAgent$SQLEXPRESS /y
'%WINDIR%\syswow64\net1.exe' stop SQLAgent$TPSAMA /y
'%WINDIR%\syswow64\net1.exe' stop OracleClientCache80 /y
'%WINDIR%\syswow64\net1.exe' stop ΓГ‡ВЈEnterprise Client ServiceΓГ‡ВҐ /y
'%WINDIR%\syswow64\net1.exe' stop EsgShKernel /y
'%WINDIR%\syswow64\net1.exe' stop MSExchangeES /y
'%WINDIR%\syswow64\net1.exe' stop SamSs /y
'%WINDIR%\syswow64\net1.exe' stop MsDtsServer /y
'%WINDIR%\syswow64\net1.exe' stop SQLAgent$SQL_2008 /y
'%WINDIR%\syswow64\net1.exe' stop SDRSVC /y
'%WINDIR%\syswow64\net1.exe' stop IISAdmin /y
'%WINDIR%\syswow64\net1.exe' stop SQLAgent$PRACTTICEMGT /y
'%WINDIR%\syswow64\net1.exe' stop BackupExecJobEngine /y
'%WINDIR%\syswow64\net1.exe' stop BackupExecAgentBrowser /y
'%WINDIR%\syswow64\net1.exe' stop VeeamHvIntegrationSvc /y
'%WINDIR%\syswow64\net1.exe' stop tmlisten /y
'%WINDIR%\syswow64\net1.exe' stop masvc /y
'%WINDIR%\syswow64\net1.exe' stop ΓГ‡ВЈSQLsafe Backup ServiceΓГ‡ВҐ /y
'%WINDIR%\syswow64\net1.exe' stop SQLAgent$CXDB /y
'%WINDIR%\syswow64\net1.exe' stop SQLBrowser /y
'%WINDIR%\syswow64\net1.exe' stop MSSQLFDLauncher$SQL_2008 /y
'%WINDIR%\syswow64\net1.exe' stop VeeamBackupSvc /y
'%WINDIR%\syswow64\net1.exe' stop ΓГ‡ВЈSophos Safestore ServiceΓГ‡ВҐ /y
'%WINDIR%\syswow64\net1.exe' stop svcGenericHost /y
'%WINDIR%\syswow64\net1.exe' stop ntrtscan /y
'%WINDIR%\syswow64\net1.exe' stop SQLAgent$VEEAMSQL2012 /y
'%WINDIR%\syswow64\net1.exe' stop W3Svc /y
'%WINDIR%\syswow64\net1.exe' stop MSExchangeMGMT /y
'%WINDIR%\syswow64\net1.exe' stop kavfsslp /y
'%WINDIR%\syswow64\net1.exe' stop ShMonitor /y
'%WINDIR%\syswow64\net1.exe' stop MSSQL$PROFXENGAGEMENT /y
'%WINDIR%\syswow64\net1.exe' stop AVP /y
'%WINDIR%\syswow64\net1.exe' stop RESvc /y
'%WINDIR%\syswow64\net1.exe' stop ΓГ‡ВЈAcronis VSS ProviderΓГ‡ВҐ /y
'%WINDIR%\syswow64\net1.exe' stop MSSQLFDLauncher$SHAREPOINT /y
'%WINDIR%\syswow64\net1.exe' stop ΓГ‡ВЈSQLsafe Filter ServiceΓГ‡ВҐ /y
'%WINDIR%\syswow64\net1.exe' stop MSSQL$PROD /y
'%WINDIR%\syswow64\net1.exe' stop SQLAgent$PROD /y
'%WINDIR%\syswow64\net1.exe' stop MSOLAP$TPS /y
'%WINDIR%\syswow64\net1.exe' stop VeeamDeploySvc /y
'%WINDIR%\syswow64\net1.exe' stop MMS /y
'%WINDIR%\syswow64\net1.exe' stop ΓГ‡ВЈSophos MCS AgentΓГ‡ВҐ /y
'%WINDIR%\syswow64\net1.exe' stop MSSQLServerOLAPService /y
'%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=d: /on=d: /maxsize=401MB
'%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=d: /on=d: /maxsize=unbounded
'%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=e: /on=e: /maxsize=401MB
'%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=e: /on=e: /maxsize=unbounded
'%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=f: /on=f: /maxsize=401MB
'%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=f: /on=f: /maxsize=unbounded
'%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=g: /on=g: /maxsize=401MB
'%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=g: /on=g: /maxsize=unbounded
'%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=c: /on=c: /maxsize=401MB
'%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=c: /on=c: /maxsize=unbounded
'%WINDIR%\syswow64\net1.exe' stop ekrn /y
'%WINDIR%\syswow64\net1.exe' stop VeeamRESTSvc /y
'%WINDIR%\syswow64\net1.exe' stop McAfeeEngineService /y
'%WINDIR%\syswow64\net1.exe' stop MSSQLFDLauncher /y
'%WINDIR%\syswow64\net1.exe' stop MSExchangeMTA /y
'%WINDIR%\syswow64\net1.exe' stop TrueKeyScheduler /y
'%WINDIR%\syswow64\net1.exe' stop MSSQL$SOPHOS /y
'%WINDIR%\syswow64\net1.exe' stop ΓГ‡ВЈSQL BackupsΓГ‡ВҐ /y
'%WINDIR%\syswow64\net1.exe' stop MSSQL$TPS /y
'%WINDIR%\syswow64\net1.exe' stop mfemms /y
'%WINDIR%\syswow64\net1.exe' stop MsDtsServer100 /y
'%WINDIR%\syswow64\net1.exe' stop MSSQL$SHAREPOINT /y
'%WINDIR%\syswow64\net1.exe' stop WRSVC /y
'%WINDIR%\syswow64\net1.exe' stop mfevtp /y
'%WINDIR%\syswow64\net1.exe' stop msftesql$PROD /y
'%WINDIR%\syswow64\net1.exe' stop mozyprobackup /y
'%WINDIR%\syswow64\net1.exe' stop MSSQL$SQL_2008 /y
'%WINDIR%\syswow64\net1.exe' stop SNAC /y
'%WINDIR%\syswow64\net1.exe' stop ReportServer$SQL_2008 /y
'%WINDIR%\syswow64\net1.exe' stop BackupExecAgentAccelerator /y
'%WINDIR%\syswow64\net1.exe' stop MSSQL$SQLEXPRESS /y
'%WINDIR%\syswow64\net1.exe' stop MSSQL$PRACTTICEBGC /y
'%WINDIR%\syswow64\net1.exe' stop IMAP4Svc /y
'%WINDIR%\syswow64\net1.exe' stop MSExchangeIS /y
'%WINDIR%\syswow64\net1.exe' stop ARSM /y
'%WINDIR%\syswow64\net1.exe' stop NetMsmqActivator /y
'%WINDIR%\syswow64\net1.exe' stop SQLAgent$SHAREPOINT /y
'%WINDIR%\syswow64\net1.exe' stop VeeamCatalogSvc /y
'%WINDIR%\syswow64\net1.exe' stop VeeamTransportSvc /y
'%WINDIR%\syswow64\net1.exe' stop ΓГ‡ВЈSophos Health ServiceΓГ‡ВҐ /y
'%WINDIR%\syswow64\net1.exe' stop bedbg /y
'%WINDIR%\syswow64\net1.exe' stop MSSQLSERVER /y
'%WINDIR%\syswow64\net1.exe' stop KAVFS /y
'%WINDIR%\syswow64\net1.exe' stop Smcinst /y
'%WINDIR%\syswow64\net1.exe' stop MSSQLServerADHelper100 /y
'%WINDIR%\syswow64\net1.exe' stop FA_Scheduler /y
'%WINDIR%\syswow64\net1.exe' stop TmCCSF /y
'%WINDIR%\syswow64\net1.exe' stop EPUpdateService /y
'%WINDIR%\syswow64\net1.exe' stop SQLWriter /y
'%WINDIR%\syswow64\net1.exe' stop SmcService /y
'%WINDIR%\syswow64\net1.exe' stop ReportServer$TPSAMA /y
'%WINDIR%\syswow64\net1.exe' stop swi_update /y
'%WINDIR%\syswow64\net1.exe' stop AcrSch2Svc /y
'%WINDIR%\syswow64\net1.exe' stop MSSQL$SYSTEM_BGC /y
'%WINDIR%\syswow64\net1.exe' stop VeeamBrokerSvc /y
'%WINDIR%\syswow64\net1.exe' stop MSSQLFDLauncher$PROFXENGAGEMENT /y
'%WINDIR%\syswow64\net1.exe' stop wbengine /y
'%WINDIR%\syswow64\net1.exe' stop VeeamNFSSvc /y
'%WINDIR%\syswow64\net1.exe' stop MSSQLFDLauncher$TPS /y
'%WINDIR%\syswow64\net1.exe' stop sacsvr /y
'%WINDIR%\syswow64\net1.exe' stop TrueKeyServiceHelper /y
'%WINDIR%\syswow64\cmd.exe' /C "icacls . /grant Everyone:F /T /C /Q"
'%WINDIR%\syswow64\net1.exe' stop SQLAgent$SYSTEM_BGC /y
'%WINDIR%\syswow64\net1.exe' stop ΓГ‡ВЈSophos Device Control ServiceΓГ‡ВҐ /y
'%WINDIR%\syswow64\net1.exe' stop macmnsvc /y
'%WINDIR%\syswow64\net1.exe' stop SQLAgent$ECWDB2 /y
'%WINDIR%\syswow64\net1.exe' stop ΓГ‡ВЈZoolz 2 ServiceΓГ‡ВҐ /y
'%WINDIR%\syswow64\net1.exe' stop McTaskManager /y
'%WINDIR%\syswow64\net1.exe' stop ΓГ‡ВЈSophos AutoUpdate ServiceΓГ‡ВҐ /y
'%WINDIR%\syswow64\net1.exe' stop ΓГ‡ВЈSophos System Protection ServiceΓГ‡ВҐ /y
'%WINDIR%\syswow64\net1.exe' stop EraserSvc11710 /y
'%WINDIR%\syswow64\icacls.exe' . /grant Everyone:F /T /C /Q
'%WINDIR%\syswow64\net1.exe' stop PDVFSService /y
'%WINDIR%\syswow64\net1.exe' stop SAVService /y
'%WINDIR%\syswow64\net1.exe' stop MSSQLFDLauncher$TPSAMA /y
'%WINDIR%\syswow64\net1.exe' stop EPSecurityService /y
'%WINDIR%\syswow64\net1.exe' stop SQLAgent$SOPHOS /y
'%WINDIR%\syswow64\net1.exe' stop ΓГ‡ВЈSymantec System RecoveryΓГ‡ВҐ /y
'%WINDIR%\syswow64\net1.exe' stop Antivirus /y
'%WINDIR%\syswow64\net1.exe' stop SstpSvc /y
'%WINDIR%\syswow64\net1.exe' stop MSOLAP$SQL_2008 /y
'%WINDIR%\syswow64\net1.exe' stop VeeamDeploymentService /y
'%WINDIR%\syswow64\net1.exe' stop SQLAgent$PROFXENGAGEMENT /y
'%WINDIR%\syswow64\net1.exe' stop SQLAgent$TPS /y
'%WINDIR%\syswow64\net1.exe' stop SAVAdminService /y
'%WINDIR%\syswow64\net1.exe' stop DCAgent /y
'%WINDIR%\syswow64\net1.exe' stop ReportServer$SYSTEM_BGC /y
'%WINDIR%\syswow64\net1.exe' stop KAVFSGT /y
'%WINDIR%\syswow64\net1.exe' stop BackupExecDeviceMediaService /y
'%WINDIR%\syswow64\net1.exe' stop MySQL57 /y
'%WINDIR%\syswow64\net1.exe' stop McAfeeFrameworkMcAfeeFramework /y
'%WINDIR%\syswow64\net1.exe' stop TrueKey /y
'%WINDIR%\syswow64\net1.exe' stop VeeamMountSvc /y
'%WINDIR%\syswow64\net1.exe' stop MsDtsServer110 /y
'%WINDIR%\syswow64\net1.exe' stop SQLAgent$BKUPEXEC /y
'%WINDIR%\syswow64\net1.exe' stop UI0Detect /y
'%WINDIR%\syswow64\net1.exe' stop ReportServer /y
'%WINDIR%\syswow64\net1.exe' stop SQLTELEMETRY$ECWDB2 /y
'%WINDIR%\syswow64\net1.exe' stop MSSQLFDLauncher$SYSTEM_BGC /y
'%WINDIR%\syswow64\net1.exe' stop MSSQL$BKUPEXEC /y
'%WINDIR%\syswow64\net1.exe' stop SQLAgent$PRACTTICEBGC /y
'%WINDIR%\syswow64\net1.exe' stop MSExchangeSRS /y
'%WINDIR%\syswow64\net1.exe' stop SQLAgent$VEEAMSQL2008R2 /y
'%WINDIR%\syswow64\net1.exe' stop McShield /y
'%WINDIR%\syswow64\net1.exe' stop SepMasterService /y
'%WINDIR%\syswow64\net1.exe' stop ΓГ‡ВЈSophos MCS ClientΓГ‡ВҐ /y
'%WINDIR%\syswow64\net1.exe' stop MSSQL$SBSMONITORING /y
'%WINDIR%\syswow64\net1.exe' stop ΓГ‡ВЈSophos Message RouterΓГ‡ВҐ /y
'%WINDIR%\syswow64\net1.exe' stop AcronisAgent /y
'%WINDIR%\syswow64\net1.exe' stop sophossps /y
'%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=h: /on=h: /maxsize=401MB
'%WINDIR%\syswow64\net1.exe' stop MSOLAP$TPSAMA /y
'%WINDIR%\syswow64\net1.exe' stop MySQL80 /y
'%WINDIR%\syswow64\net1.exe' stop MSOLAP$SYSTEM_BGC /y
'%WINDIR%\syswow64\net1.exe' stop ReportServer$TPS /y
'%WINDIR%\syswow64\net1.exe' stop MSSQL$ECWDB2 /y
'%WINDIR%\syswow64\net1.exe' stop SntpService /y
'%WINDIR%\syswow64\net1.exe' stop SQLSERVERAGENT /y
'%WINDIR%\syswow64\net1.exe' stop BackupExecManagementService /y
'%WINDIR%\syswow64\net1.exe' stop SMTPSvc /y
'%WINDIR%\syswow64\net1.exe' stop mfefire /y
'%WINDIR%\syswow64\net1.exe' stop MSSQLFDLauncher$SBSMONITORING /y
'%WINDIR%\syswow64\net1.exe' stop BackupExecRPCService /y
'%WINDIR%\syswow64\net1.exe' stop klnagent /y
'%WINDIR%\syswow64\net1.exe' stop MSExchangeSA /y
'%WINDIR%\syswow64\net1.exe' stop MSSQLServerADHelper /y
'%WINDIR%\syswow64\net1.exe' stop SQLTELEMETRY /y
'%WINDIR%\syswow64\net1.exe' stop ΓГ‡ВЈSophos Clean ServiceΓГ‡ВҐ /y
'%WINDIR%\syswow64\net1.exe' stop swi_update_64 /y
'%WINDIR%\syswow64\net1.exe' stop ΓГ‡ВЈSophos Web Control ServiceΓГ‡ВҐ /y
'%WINDIR%\syswow64\net1.exe' stop EhttpSrv /y
'%WINDIR%\syswow64\net1.exe' stop POP3Svc /y
'%WINDIR%\syswow64\net1.exe' stop MSSQL$VEEAMSQL2008R2 /y
'%WINDIR%\syswow64\net1.exe' stop ΓГ‡ВЈVeeam Backup Catalog Data ServiceΓГ‡ВҐ /
'%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=h: /on=h: /maxsize=unbounded

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial