Trojan.Encoder.37466

Technical Information

To ensure autorun and distribution

Creates the following files on removable media

<Drive name for removable media>:\how_to_back_files.html

Malicious functions

To complicate detection of its presence in the operating system,

deletes volume shadow copies.

Executes the following

'<SYSTEM32>\taskkill.exe' -f -im sqlbrowser.exe
'<SYSTEM32>\net.exe' stop SQLBrowser
'<SYSTEM32>\net.exe' stop SQLAgent$MSFW
'<SYSTEM32>\net.exe' stop SQLAgent$ISARS
'<SYSTEM32>\net.exe' stop MSSQL$MSFW
'<SYSTEM32>\net.exe' stop MSSQL$ISARS
'<SYSTEM32>\net.exe' stop MSSQLServerADHelper100
'<SYSTEM32>\taskkill.exe' -f -impostgres.exe
'<SYSTEM32>\taskkill.exe' -f -im pg_ctl.exe
'<SYSTEM32>\taskkill.exe' -f -im msftesql.exe
'<SYSTEM32>\taskkill.exe' -f -im ReportingServicesService.exe
'<SYSTEM32>\taskkill.exe' -f -im fdhost.exe
'<SYSTEM32>\taskkill.exe' -f -im SQLAGENT.EXE
'<SYSTEM32>\taskkill.exe' -f -im Ssms.exe
'<SYSTEM32>\taskkill.exe' -f -im fdlauncher.exe
'<SYSTEM32>\taskkill.exe' -f -im sqlceip.exe
'<SYSTEM32>\taskkill.exe' -f -im MsDtsSrvr.exe
'<SYSTEM32>\taskkill.exe' -f -im msmdsrv.exe
'<SYSTEM32>\taskkill.exe' -f -im sqlserv.exe
'<SYSTEM32>\taskkill.exe' -f -im sql writer.exe
'<SYSTEM32>\net.exe' stop REportServer$ISARS
'<SYSTEM32>\net.exe' stop SQLWriter

Injects code into

the following system processes:

<SYSTEM32>\vssadmin.exe

Modifies file system

Creates the following files

b:\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\applications\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\config\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\gatherlogs\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\gatherlogs\systemindex\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\propmap\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\secstore\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\sqm\sessions\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\temp\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\vault\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\ait\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\caches\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\devicemetadatastore\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\devicemetadatastore\en-us\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\drm\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\drm\cache\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\gameexplorer\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\power efficiency diagnostics\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\ringtones\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\sqm\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\rac\statedata\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\rac\temp\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\user account pictures\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\sqm\manifest\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\rac\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\mf\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\msdn\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\msdn\7.0\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1028\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1031\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1033\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1036\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1040\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1041\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1042\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1046\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1049\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1050\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\msdn\7.0\2052\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\msdn\7.0\3082\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\msdn\8.0\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\netframework\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\netframework\breadcrumbstore\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\network\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\network\connections\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\network\downloader\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\office\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\office\uicaptions\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\cache\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\rac\outbound\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\ilscache\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\rac\publisheddata\how_to_back_files.html
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\sqm\upload\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\noncritical_x64_4a8ed64bf1962bf234c1a7153259451034e674_cab_0731c4f1\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\noncritical_x64_d473a376adfb18a7b165c5e3c26de43cd8bccb_cab_079d8596\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\backup\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\updates\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\localcopy\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\quarantine\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\scans\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\cachemanager\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\results\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\service\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\store\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows nt\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\activitylog\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\common coverpages\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\common coverpages\en-us\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\inbox\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\queue\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\sentitems\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\en-us\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows nt\msscan\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\wpd\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_cab_0841821b\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_099489dd\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\noncritical_x64_5d5d8b7c1982ab7c66cf747e7b18b39e2441a_cab_073d8027\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_088cc9f7\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\accessibility\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\tablet pc\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\windows powershell\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\games\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\google chrome\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\java\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\configuration\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\help\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\tools\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\identitycrl\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\uninstall\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\media player\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft .net framework sdk v1.1\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\mirc\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\qip 2012\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sharepoint\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\steam\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\tablet pc\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\winamp\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\winrar\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\templates\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\wer\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\wer\reportarchive\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\maintenance\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\event viewer\views\applicationviewsrootnode\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\event viewer\views\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\event viewer\how_to_back_files.html
C:\far2\addons\setup\how_to_back_files.html
C:\far2\addons\shell\how_to_back_files.html
C:\far2\addons\xlat\how_to_back_files.html
C:\far2\addons\xlat\russian\how_to_back_files.html
C:\far2\documentation\how_to_back_files.html
C:\far2\documentation\eng\how_to_back_files.html
C:\far2\documentation\rus\how_to_back_files.html
C:\far2\encyclopedia\how_to_back_files.html
C:\far2\encyclopedia\tap\how_to_back_files.html
C:\far2\fexcept\how_to_back_files.html
C:\far2\plugins\how_to_back_files.html
C:\far2\plugins\align\how_to_back_files.html
C:\far2\plugins\arclite\how_to_back_files.html
C:\far2\plugins\autowrap\how_to_back_files.html
C:\far2\plugins\brackets\how_to_back_files.html
C:\far2\plugins\compare\how_to_back_files.html
C:\far2\plugins\drawline\how_to_back_files.html
C:\far2\plugins\editcase\how_to_back_files.html
C:\far2\plugins\emenu\how_to_back_files.html
C:\far2\plugins\farcmds\how_to_back_files.html
C:\far2\plugins\filecase\how_to_back_files.html
C:\far2\plugins\ftp\how_to_back_files.html
C:\far2\plugins\ftp\lib\how_to_back_files.html
C:\far2\plugins\hlfviewer\how_to_back_files.html
C:\far2\plugins\macroview\how_to_back_files.html
C:\far2\plugins\network\how_to_back_files.html
C:\far2\plugins\proclist\how_to_back_files.html
b:\boot\zh-hk\how_to_back_files.html
b:\boot\tr-tr\how_to_back_files.html
C:\far2\addons\macros\how_to_back_files.html
b:\boot\zh-cn\how_to_back_files.html
b:\boot\sv-se\how_to_back_files.html
b:\boot\es-es\how_to_back_files.html
D:\how_to_back_files.html
C:\how_to_back_files.html
C:\far2\how_to_back_files.html
C:\far2\addons\how_to_back_files.html
C:\far2\addons\colors\how_to_back_files.html
C:\far2\addons\colors\custom_highlighting\how_to_back_files.html
b:\boot\bcd.log1
b:\boot\bcd.log2
b:\boot\bootstat.dat
b:\boot\cs-cz\how_to_back_files.html
b:\boot\da-dk\how_to_back_files.html
b:\boot\de-de\how_to_back_files.html
b:\boot\el-gr\how_to_back_files.html
C:\far2\plugins\tmppanel\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\wwansvc\how_to_back_files.html
b:\boot\en-us\how_to_back_files.html
b:\boot\fonts\how_to_back_files.html
b:\boot\fr-fr\how_to_back_files.html
b:\boot\hu-hu\how_to_back_files.html
b:\boot\it-it\how_to_back_files.html
b:\boot\ja-jp\how_to_back_files.html
b:\boot\ko-kr\how_to_back_files.html
b:\boot\nb-no\how_to_back_files.html
b:\boot\nl-nl\how_to_back_files.html
b:\boot\pl-pl\how_to_back_files.html
b:\boot\pt-br\how_to_back_files.html
b:\boot\pt-pt\how_to_back_files.html
C:\far2\addons\colors\default_highlighting\how_to_back_files.html
b:\boot\ru-ru\how_to_back_files.html
b:\boot\how_to_back_files.html
b:\boot\fi-fi\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\support\how_to_back_files.html
C:\far2\pluginsdk\how_to_back_files.html
C:\msocache\all users\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\assistance\client\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\crypto\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\crypto\dss\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\crypto\dss\machinekeys\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\crypto\keys\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\crypto\rsa\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\crypto\rsa\machinekeys\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\dbgclr\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\dbgclr\7.1\how_to_back_files.html
b:\boot\zh-tw\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\dbgclr\7.1\1033\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\device stage\device\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\device stage\task\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-us\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-us\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\devicesync\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\drm\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\drm\server\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\ehome\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\ehome\logs\how_to_back_files.html
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\device stage\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\assistance\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\how_to_back_files.html
%ALLUSERSPROFILE%\adobe\setup\how_to_back_files.html
%ALLUSERSPROFILE%\adobe\arm\{291aa914-a987-4ce9-bd63-ac0a92d435e5}\how_to_back_files.html
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\how_to_back_files.html
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\how_to_back_files.html
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\how_to_back_files.html
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\far2\pluginsdk\headers.c\how_to_back_files.html
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\far2\pluginsdk\headers.pas\how_to_back_files.html
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\how_to_back_files.html
<Current directory>\how_to_back_files.html
C:\totalcmd\how_to_back_files.html
C:\totalcmd\language\how_to_back_files.html
C:\users\how_to_back_files.html
%ALLUSERSPROFILE%\how_to_back_files.html
%ALLUSERSPROFILE%\adobe\how_to_back_files.html
%ALLUSERSPROFILE%\adobe\arm\how_to_back_files.html
%ALLUSERSPROFILE%\adobe\arm\reader_15.007.20033\how_to_back_files.html
%ALLUSERSPROFILE%\adobe\arm\reader_15.008.20082\how_to_back_files.html
%ALLUSERSPROFILE%\adobe\arm\s\how_to_back_files.html
C:\msocache\how_to_back_files.html
%ALLUSERSPROFILE%\adobe\arm\s\10428\how_to_back_files.html
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft help\how_to_back_files.html

Moves the following files

from b:\boot\bcd.log1 to b:\boot\bcd.log1.newware
from b:\boot\bcd.log2 to b:\boot\bcd.log2.newware
from b:\boot\bootstat.dat to b:\boot\bootstat.dat.newware

Modifies the following files

D:\install.log
C:\far2\addons\colors\default_highlighting\hell.reg
C:\far2\addons\colors\default_highlighting\greenmile.reg
C:\far2\addons\colors\default_highlighting\farcolors242.reg
C:\far2\addons\colors\default_highlighting\dn_like.reg
C:\far2\addons\colors\default_highlighting\descript.ion
C:\far2\addons\colors\default_highlighting\colors_from_sadovoj.reg
C:\far2\addons\colors\default_highlighting\colors_from_gernichenko.reg
C:\far2\addons\colors\default_highlighting\colors_from_admin_essp_ru.reg
C:\far2\addons\colors\default_highlighting\black_from_myodov.reg
C:\far2\addons\colors\default_highlighting\black_from_july.reg
C:\far2\addons\colors\default_highlighting\black_from_fonarev.reg
C:\far2\addons\colors\custom_highlighting\vaxcolors.reg
C:\far2\addons\colors\custom_highlighting\rodion_doroshkevich.reg
C:\far2\addons\colors\custom_highlighting\nc5pal2.reg
C:\far2\addons\colors\custom_highlighting\import_colors.bat
C:\far2\addons\colors\custom_highlighting\hell.reg
C:\far2\addons\colors\custom_highlighting\greenmile.reg
C:\far2\addons\colors\custom_highlighting\farcolors242.reg
C:\far2\addons\colors\custom_highlighting\dn_like.reg
C:\far2\addons\colors\custom_highlighting\descript.ion
C:\far2\addons\colors\custom_highlighting\colors_from_sadovoj.reg
C:\far2\addons\colors\custom_highlighting\colors_from_gernichenko.reg
C:\far2\addons\colors\custom_highlighting\colors_from_admin_essp_ru.reg
C:\far2\addons\colors\custom_highlighting\black_from_myodov.reg
C:\far2\addons\colors\custom_highlighting\black_from_july.reg
C:\far2\addons\colors\custom_highlighting\black_from_fonarev.reg
<Drive name for removable media>:\correct.avi
C:\far2\addons\colors\default_highlighting\import_colors.bat
C:\far2\addons\colors\default_highlighting\nc5pal2.reg

Modifies multiple files.

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''

Creates and executes the following

'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c rem Kill "SQL"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop SQLBrowser' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$MSFW' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$ISARS' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop MSSQL$MSFW' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop MSSQL$ISARS' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop MSSQLServerADHelper100' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -impostgres.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im msftesql.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop REportServer$ISARS' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im Ssms.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im sql writer.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdhost.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop SQLWriter' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c rem Kill "SQL"
'<SYSTEM32>\net1.exe' stop SQLWriter
'<SYSTEM32>\cmd.exe' /c net stop SQLWriter
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop SQLWriter
'<SYSTEM32>\net1.exe' stop REportServer$ISARS
'<SYSTEM32>\cmd.exe' /c net stop REportServer$ISARS
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop REportServer$ISARS
'<SYSTEM32>\net1.exe' stop SQLBrowser
'<SYSTEM32>\cmd.exe' /c net stop SQLBrowser
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop SQLBrowser
'<SYSTEM32>\net1.exe' stop SQLAgent$MSFW
'<SYSTEM32>\cmd.exe' /c net stop SQLAgent$MSFW
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$MSFW
'<SYSTEM32>\net1.exe' stop SQLAgent$ISARS
'<SYSTEM32>\cmd.exe' /c net stop SQLAgent$ISARS
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$ISARS
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP
'<SYSTEM32>\wbadmin.exe' DELETE SYSTEMSTATEBACKUP
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest
'<SYSTEM32>\bcdedit.exe' /set {default} bootstatuspolicy ignoreallfailures
'<SYSTEM32>\wbem\wmic.exe' SHADOWCOPY /nointeractive
'<SYSTEM32>\bcdedit.exe' /set {default} recoverynabled No
'<SYSTEM32>\cmd.exe' /c wmic.exe SHADOWCOPY /nointeractive
'<SYSTEM32>\wbadmin.exe' DELETE SYSTEMSTABACKUP -deleteOldest
'<SYSTEM32>\wbadmin.exe' delete backup -keepVersion:0 -quiet
'<SYSTEM32>\cmd.exe' /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
'<SYSTEM32>\cmd.exe' /c bcdedit.exe /set {default} recoverynabled No
'<SYSTEM32>\cmd.exe' /c wbadmin DELETE SYSTEMSTATEBACKUP
'<SYSTEM32>\cmd.exe' /c vssadmin.exe Delete Shadows /All /Quiet
'<SYSTEM32>\cmd.exe' /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest
'<SYSTEM32>\cmd.exe' /c wbadmin delete backup -keepVersion:0 -quiet
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No
'<SYSTEM32>\net1.exe' stop MSSQL$MSFW
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet
'<SYSTEM32>\cmd.exe' /c net stop MSSQL$MSFW
'<SYSTEM32>\cmd.exe' /c taskkill -f -im Ssms.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im fdlauncher.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im sqlceip.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im MsDtsSrvr.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im msmdsrv.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im sqlserv.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im sql writer.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im sql writer.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im sqlbrowser.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe
'<SYSTEM32>\cmd.exe' /c rem Kill "SQL"
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im Ssms.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE
'<SYSTEM32>\net1.exe' stop MSSQL$ISARS
'<SYSTEM32>\cmd.exe' /c taskkill -f -im SQLAGENT.EXE
'<SYSTEM32>\cmd.exe' /c net stop MSSQL$ISARS
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop MSSQL$ISARS
'<SYSTEM32>\net1.exe' stop MSSQLServerADHelper100
'<SYSTEM32>\cmd.exe' /c net stop MSSQLServerADHelper100
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop MSSQLServerADHelper100
'<SYSTEM32>\cmd.exe' /c taskkill -f -impostgres.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -impostgres.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im pg_ctl.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im msftesql.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im msftesql.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im ReportingServicesService.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im fdhost.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdhost.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop MSSQL$MSFW
'%WINDIR%\syswow64\cmd.exe' /c pause

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial