Trojan.Encoder.37339

Technical Information

To ensure autorun and distribution

Creates the following files on removable media

<Drive name for removable media>:\how_to_back_files.html

Malicious functions

To complicate detection of its presence in the operating system,

deletes volume shadow copies.

Executes the following

'<SYSTEM32>\taskkill.exe' -f -im sqlbrowser.exe
'<SYSTEM32>\net.exe' stop SQLBrowser
'<SYSTEM32>\net.exe' stop SQLAgent$MSFW
'<SYSTEM32>\net.exe' stop SQLAgent$ISARS
'<SYSTEM32>\net.exe' stop MSSQL$MSFW
'<SYSTEM32>\net.exe' stop MSSQL$ISARS
'<SYSTEM32>\net.exe' stop MSSQLServerADHelper100
'<SYSTEM32>\taskkill.exe' -f -impostgres.exe
'<SYSTEM32>\taskkill.exe' -f -im pg_ctl.exe
'<SYSTEM32>\taskkill.exe' -f -im msftesql.exe
'<SYSTEM32>\taskkill.exe' -f -im ReportingServicesService.exe
'<SYSTEM32>\taskkill.exe' -f -im fdhost.exe
'<SYSTEM32>\taskkill.exe' -f -im SQLAGENT.EXE
'<SYSTEM32>\taskkill.exe' -f -im Ssms.exe
'<SYSTEM32>\taskkill.exe' -f -im fdlauncher.exe
'<SYSTEM32>\taskkill.exe' -f -im sqlceip.exe
'<SYSTEM32>\taskkill.exe' -f -im MsDtsSrvr.exe
'<SYSTEM32>\taskkill.exe' -f -im msmdsrv.exe
'<SYSTEM32>\taskkill.exe' -f -im sqlserv.exe
'<SYSTEM32>\taskkill.exe' -f -im sql writer.exe
'<SYSTEM32>\net.exe' stop REportServer$ISARS
'<SYSTEM32>\net.exe' stop SQLWriter

Injects code into

the following system processes:

<SYSTEM32>\wbadmin.exe

Reads files which store third party applications passwords

%HOMEPATH%\desktop\about.htm
%HOMEPATH%\desktop\about.html
%HOMEPATH%\desktop\alert.html
%HOMEPATH%\desktop\api-hashmap.html
%HOMEPATH%\desktop\contoso.cer
%HOMEPATH%\desktop\contoso_1.cer
%HOMEPATH%\desktop\cveuropeo.doc
%HOMEPATH%\desktop\delete.avi
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
%HOMEPATH%\desktop\howto-index.html
%HOMEPATH%\desktop\ituneshelpunavailable.htm
%HOMEPATH%\desktop\pmd.cer
%HOMEPATH%\desktop\sdksampleunprivdeveloper.cer
%HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
%HOMEPATH%\desktop\tree_view.html
%HOMEPATH%\desktop\trivial-merge.htm

Modifies file system

Creates the following files

D:\how_to_back_files.html
C:\users\default\appdata\roaming\microsoft\windows\how_to_back_files.html
C:\users\default\appdata\roaming\microsoft\internet explorer\quick launch\how_to_back_files.html
C:\users\default\appdata\roaming\microsoft\internet explorer\how_to_back_files.html
C:\users\default\appdata\roaming\microsoft\how_to_back_files.html
C:\users\default\appdata\roaming\media center programs\how_to_back_files.html
C:\users\default\appdata\roaming\how_to_back_files.html
C:\users\default\appdata\local\temp\how_to_back_files.html
C:\users\default\appdata\local\microsoft\windows\<INETFILES>\how_to_back_files.html
C:\users\default\appdata\local\microsoft\windows\history\how_to_back_files.html
C:\users\default\appdata\local\microsoft\windows\gameexplorer\how_to_back_files.html
C:\users\default\appdata\local\microsoft\windows\how_to_back_files.html
C:\users\default\appdata\local\microsoft\how_to_back_files.html
C:\users\default\appdata\how_to_back_files.html
C:\users\default\appdata\roaming\microsoft\windows\network shortcuts\how_to_back_files.html
C:\users\default\how_to_back_files.html
%ALLUSERSPROFILE%\sun\java\java update\how_to_back_files.html
%ALLUSERSPROFILE%\sun\java\how_to_back_files.html
%ALLUSERSPROFILE%\sun\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{e46eca4f-393b-40df-9f49-076faf788d83}\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{dde2682b-961a-41ea-8d44-6005991b7947}\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{ce085a78-074e-4823-8dc1-8a721b94b76d}\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\vcruntimeadditional_x86\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\how_to_back_files.html
C:\users\default\appdata\local\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{0d3e9e15-de7a-300b-96f1-b4af12b96488}v14.0.23026\packages\vcruntimeminimum_amd64\how_to_back_files.html
C:\users\default\appdata\roaming\microsoft\windows\printer shortcuts\how_to_back_files.html
C:\users\public\pictures\how_to_back_files.html
C:\users\public\music\sample music\how_to_back_files.html
C:\users\public\music\how_to_back_files.html
C:\users\public\libraries\how_to_back_files.html
C:\users\public\favorites\how_to_back_files.html
C:\users\public\downloads\how_to_back_files.html
C:\users\public\documents\how_to_back_files.html
C:\users\public\desktop\how_to_back_files.html
C:\users\public\how_to_back_files.html
C:\users\default\videos\how_to_back_files.html
C:\users\default\saved games\how_to_back_files.html
C:\users\default\pictures\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\how_to_back_files.html
C:\users\default\appdata\roaming\microsoft\windows\cookies\how_to_back_files.html
C:\users\default\favorites\how_to_back_files.html
C:\users\default\downloads\how_to_back_files.html
C:\users\default\documents\how_to_back_files.html
C:\users\default\desktop\how_to_back_files.html
C:\users\default\appdata\roaming\microsoft\windows\templates\how_to_back_files.html
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\maintenance\how_to_back_files.html
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools\how_to_back_files.html
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility\how_to_back_files.html
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\how_to_back_files.html
C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\how_to_back_files.html
C:\users\default\appdata\roaming\microsoft\windows\start menu\how_to_back_files.html
C:\users\default\appdata\roaming\microsoft\windows\sendto\how_to_back_files.html
C:\users\default\links\how_to_back_files.html
C:\users\default\appdata\roaming\microsoft\windows\recent\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{bc958bd2-5dac-3862-bb1a-c1be0790438d}v14.0.23026\packages\vcruntimeadditional_amd64\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{bc958bd2-5dac-3862-bb1a-c1be0790438d}v14.0.23026\packages\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{bc958bd2-5dac-3862-bb1a-c1be0790438d}v14.0.23026\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\support\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\wpd\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows nt\msscan\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\en-us\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\sentitems\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\queue\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\inbox\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\common coverpages\en-us\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\common coverpages\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\activitylog\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\how_to_back_files.html
C:\users\public\pictures\sample pictures\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft help\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\store\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\service\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\results\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\cachemanager\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\scans\history\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\scans\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\quarantine\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\localcopy\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\updates\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\backup\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\definition updates\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows nt\how_to_back_files.html
C:\users\default\music\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft toolkit\how_to_back_files.html
%ALLUSERSPROFILE%\oracle\how_to_back_files.html
%ALLUSERSPROFILE%\mozilla\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{b55f7208-e02b-4828-ac78-59c73ddf5bc7}\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\packages\vcruntimeminimum_x86\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\packages\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{a2199617-3609-410f-a8e8-e8806c73545b}\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{615bc16d-60f5-482e-91b3-b51d8130963b}\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{51adbf11-493f-431c-a862-967a0fae2944}\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{35459b22-19a6-44ec-8d34-27eb3131acac}\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\how_to_back_files.html
%ALLUSERSPROFILE%\mozilla\logs\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\wwansvc\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{0d3e9e15-de7a-300b-96f1-b4af12b96488}v14.0.23026\packages\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{0d3e9e15-de7a-300b-96f1-b4af12b96488}v14.0.23026\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\x64\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\how_to_back_files.html
%ALLUSERSPROFILE%\oracle\java\javapath\how_to_back_files.html
%ALLUSERSPROFILE%\oracle\java\installcache_x64\how_to_back_files.html
%ALLUSERSPROFILE%\oracle\java\how_to_back_files.html
%ALLUSERSPROFILE%\package cache\{0f12c81f-93ef-46ec-bc94-d952c1a775d4}\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\2\how_to_back_files.html
%HOMEPATH%\videos\how_to_back_files.html
C:\users\public\videos\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\58\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\57\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\56\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\55\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\54\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\53\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\52\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\51\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\50\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\5\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\49\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\48\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\46\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\6\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\45\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\44\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\43\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\42\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\41\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\40\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\4\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\39\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\38\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\37\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\36\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\47\how_to_back_files.html
C:\users\public\recorded tv\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\60\how_to_back_files.html
%HOMEPATH%\searches\how_to_back_files.html
%HOMEPATH%\saved games\how_to_back_files.html
%HOMEPATH%\pictures\how_to_back_files.html
%HOMEPATH%\music\how_to_back_files.html
%HOMEPATH%\links\how_to_back_files.html
%HOMEPATH%\favorites\windows live\how_to_back_files.html
%HOMEPATH%\favorites\msn websites\how_to_back_files.html
%HOMEPATH%\favorites\microsoft websites\how_to_back_files.html
%HOMEPATH%\favorites\links for united states\how_to_back_files.html
%HOMEPATH%\favorites\links\how_to_back_files.html
%HOMEPATH%\favorites\how_to_back_files.html
%HOMEPATH%\downloads\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\35\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\59\how_to_back_files.html
%HOMEPATH%\contacts\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\jre1.8.0_45_x64\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\tmp\si\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\tmp\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\security\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\muffin\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\host\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\9\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\8\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\7\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\63\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\62\how_to_back_files.html
%HOMEPATH%\desktop\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\61\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\34\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\33\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\32\how_to_back_files.html
%LOCALAPPDATA%low\adobe\linguistics\userdictionaries\adobe custom dictionary\all\how_to_back_files.html
%LOCALAPPDATA%low\oracle\java\au\how_to_back_files.html
%LOCALAPPDATA%low\oracle\java\how_to_back_files.html
%LOCALAPPDATA%low\oracle\how_to_back_files.html
%LOCALAPPDATA%low\microsoft\internet explorer\services\how_to_back_files.html
%LOCALAPPDATA%low\microsoft\internet explorer\how_to_back_files.html
%LOCALAPPDATA%low\microsoft\how_to_back_files.html
%LOCALAPPDATA%low\adobe\linguistics\userdictionaries\adobe custom dictionary\nl_nl\how_to_back_files.html
%LOCALAPPDATA%low\adobe\linguistics\userdictionaries\adobe custom dictionary\en_us\how_to_back_files.html
%LOCALAPPDATA%low\adobe\linguistics\userdictionaries\adobe custom dictionary\en_gb\how_to_back_files.html
%LOCALAPPDATA%low\adobe\linguistics\userdictionaries\adobe custom dictionary\en_ca\how_to_back_files.html
%LOCALAPPDATA%low\adobe\linguistics\userdictionaries\adobe custom dictionary\de_de\how_to_back_files.html
C:\users\public\recorded tv\sample media\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\how_to_back_files.html
%LOCALAPPDATA%low\adobe\linguistics\userdictionaries\adobe custom dictionary\how_to_back_files.html
%LOCALAPPDATA%low\adobe\linguistics\userdictionaries\how_to_back_files.html
%LOCALAPPDATA%low\adobe\linguistics\how_to_back_files.html
%LOCALAPPDATA%low\adobe\acrobat\dc\search\how_to_back_files.html
%LOCALAPPDATA%low\adobe\acrobat\dc\assets\how_to_back_files.html
%LOCALAPPDATA%low\adobe\acrobat\dc\how_to_back_files.html
%LOCALAPPDATA%low\adobe\acrobat\how_to_back_files.html
%LOCALAPPDATA%low\adobe\how_to_back_files.html
%LOCALAPPDATA%low\how_to_back_files.html
%HOMEPATH%\appdata\how_to_back_files.html
%HOMEPATH%\how_to_back_files.html
C:\users\public\videos\sample videos\how_to_back_files.html
%LOCALAPPDATA%low\adobe\linguistics\userdictionaries\adobe custom dictionary\de_ch\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows defender\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\0\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\31\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\30\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\3\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\29\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\28\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\27\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\26\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\25\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\24\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\23\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\22\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\21\how_to_back_files.html
%LOCALAPPDATA%low\sun\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\19\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\18\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\17\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\16\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\15\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\14\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\13\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\12\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\11\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\10\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\1\how_to_back_files.html
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\20\how_to_back_files.html
%HOMEPATH%\documents\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\noncritical_x64_d473a376adfb18a7b165c5e3c26de43cd8bccb_cab_079d8596\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sharepoint\how_to_back_files.html
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\how_to_back_files.html
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\how_to_back_files.html
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\how_to_back_files.html
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\how_to_back_files.html
C:\msocache\all users\how_to_back_files.html
C:\msocache\how_to_back_files.html
C:\far2\pluginsdk\headers.pas\how_to_back_files.html
C:\far2\pluginsdk\headers.c\how_to_back_files.html
C:\far2\pluginsdk\how_to_back_files.html
C:\far2\plugins\tmppanel\how_to_back_files.html
C:\far2\plugins\proclist\how_to_back_files.html
C:\far2\plugins\network\how_to_back_files.html
C:\far2\plugins\macroview\how_to_back_files.html
C:\far2\plugins\hlfviewer\how_to_back_files.html
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\how_to_back_files.html
C:\far2\documentation\eng\how_to_back_files.html
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\dbgclr\7.1\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\dbgclr\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\crypto\rsa\machinekeys\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\crypto\rsa\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\crypto\keys\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\crypto\dss\machinekeys\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\crypto\dss\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\crypto\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\assistance\client\how_to_back_files.html
C:\far2\plugins\ftp\lib\how_to_back_files.html
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\how_to_back_files.html
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\how_to_back_files.html
%ALLUSERSPROFILE%\adobe\setup\how_to_back_files.html
%ALLUSERSPROFILE%\adobe\arm\{291aa914-a987-4ce9-bd63-ac0a92d435e5}\how_to_back_files.html
%ALLUSERSPROFILE%\adobe\arm\s\10428\how_to_back_files.html
%ALLUSERSPROFILE%\adobe\arm\s\how_to_back_files.html
%ALLUSERSPROFILE%\adobe\arm\reader_15.008.20082\how_to_back_files.html
%ALLUSERSPROFILE%\adobe\arm\reader_15.007.20033\how_to_back_files.html
%ALLUSERSPROFILE%\adobe\arm\how_to_back_files.html
%ALLUSERSPROFILE%\adobe\how_to_back_files.html
%ALLUSERSPROFILE%\how_to_back_files.html
C:\users\how_to_back_files.html
C:\totalcmd\language\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\how_to_back_files.html
C:\totalcmd\how_to_back_files.html
C:\far2\plugins\ftp\how_to_back_files.html
C:\far2\plugins\filecase\how_to_back_files.html
C:\far2\plugins\farcmds\how_to_back_files.html
b:\boot\da-dk\how_to_back_files.html
b:\boot\ko-kr\how_to_back_files.html
b:\boot\ja-jp\how_to_back_files.html
b:\boot\it-it\how_to_back_files.html
b:\boot\hu-hu\how_to_back_files.html
b:\boot\fr-fr\how_to_back_files.html
b:\boot\fonts\how_to_back_files.html
C:\far2\addons\colors\default_highlighting\how_to_back_files.html
b:\boot\fi-fi\how_to_back_files.html
b:\boot\es-es\how_to_back_files.html
b:\boot\en-us\how_to_back_files.html
b:\boot\el-gr\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\dbgclr\7.1\1033\how_to_back_files.html
b:\boot\nl-nl\how_to_back_files.html
b:\boot\cs-cz\how_to_back_files.html
b:\boot\bootstat.dat
b:\boot\bcd.log2
b:\boot\bcd.log1
C:\far2\addons\colors\custom_highlighting\how_to_back_files.html
C:\far2\addons\colors\how_to_back_files.html
C:\far2\addons\how_to_back_files.html
C:\far2\how_to_back_files.html
b:\boot\how_to_back_files.html
<Current directory>\how_to_back_files.html
C:\how_to_back_files.html
b:\how_to_back_files.html
b:\boot\de-de\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\assistance\how_to_back_files.html
b:\boot\pl-pl\how_to_back_files.html
b:\boot\pt-pt\how_to_back_files.html
C:\far2\addons\macros\how_to_back_files.html
C:\far2\plugins\emenu\how_to_back_files.html
C:\far2\plugins\editcase\how_to_back_files.html
C:\far2\plugins\drawline\how_to_back_files.html
C:\far2\plugins\compare\how_to_back_files.html
C:\far2\plugins\brackets\how_to_back_files.html
C:\far2\plugins\autowrap\how_to_back_files.html
C:\far2\plugins\arclite\how_to_back_files.html
C:\far2\plugins\align\how_to_back_files.html
C:\far2\plugins\how_to_back_files.html
C:\far2\fexcept\how_to_back_files.html
C:\far2\encyclopedia\tap\how_to_back_files.html
b:\boot\pt-br\how_to_back_files.html
C:\far2\encyclopedia\how_to_back_files.html
b:\boot\nb-no\how_to_back_files.html
C:\far2\documentation\how_to_back_files.html
C:\far2\addons\xlat\russian\how_to_back_files.html
C:\far2\addons\xlat\how_to_back_files.html
C:\far2\addons\shell\how_to_back_files.html
C:\far2\addons\setup\how_to_back_files.html
b:\boot\zh-tw\how_to_back_files.html
b:\boot\zh-hk\how_to_back_files.html
b:\boot\zh-cn\how_to_back_files.html
b:\boot\tr-tr\how_to_back_files.html
b:\boot\sv-se\how_to_back_files.html
b:\boot\ru-ru\how_to_back_files.html
C:\far2\documentation\rus\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\noncritical_x64_4a8ed64bf1962bf234c1a7153259451034e674_cab_0731c4f1\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\accessibility\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\sqm\upload\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\sqm\sessions\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\sqm\manifest\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\sqm\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\ringtones\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\power efficiency diagnostics\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\gameexplorer\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\drm\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\windows powershell\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\devicemetadatastore\en-us\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\devicemetadatastore\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\caches\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\ait\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\vault\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\user account pictures\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\temp\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\secstore\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\propmap\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\drm\cache\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\device stage\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_cab_0841821b\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_099489dd\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_088cc9f7\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\wer\reportarchive\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\wer\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\templates\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\winrar\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\winamp\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\tablet pc\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\steam\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\tablet pc\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\mirc\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft .net framework sdk v1.1\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\maintenance\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\uninstall\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\tools\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\help\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\configuration\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\java\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\google chrome\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\qip 2012\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\games\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\indexer\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\event viewer\views\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1040\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1036\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1033\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1031\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1028\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\msdn\7.0\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\msdn\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\mf\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\media player\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\ilscache\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\identitycrl\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\device stage\device\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1042\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\event viewer\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\ehome\logs\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\ehome\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\drm\server\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\drm\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\devicesync\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-us\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-us\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\device stage\task\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\event viewer\views\applicationviewsrootnode\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\noncritical_x64_5d5d8b7c1982ab7c66cf747e7b18b39e2441a_cab_073d8027\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1046\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\msdn\7.0\2052\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1049\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\gatherlogs\systemindex\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\gatherlogs\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\config\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\applications\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\data\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\search\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\rac\temp\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\rac\statedata\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\rac\publisheddata\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\rac\outbound\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1050\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\rac\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1041\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\office\uicaptions\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\office\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\network\downloader\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\network\connections\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\network\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\netframework\breadcrumbstore\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\netframework\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\msdn\8.0\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\msdn\7.0\3082\how_to_back_files.html
%ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\cache\how_to_back_files.html
%HOMEPATH%\voip\how_to_back_files.html

Moves the following files

from b:\boot\bcd.log1 to b:\boot\bcd.log1.acessd
from b:\boot\bcd.log2 to b:\boot\bcd.log2.acessd
from b:\boot\bootstat.dat to b:\boot\bootstat.dat.acessd

Modifies the following files

D:\install.log
C:\far2\addons\colors\default_highlighting\hell.reg
C:\far2\addons\colors\default_highlighting\greenmile.reg
C:\far2\addons\colors\default_highlighting\farcolors242.reg
C:\far2\addons\colors\default_highlighting\dn_like.reg
C:\far2\addons\colors\default_highlighting\descript.ion
C:\far2\addons\colors\default_highlighting\colors_from_sadovoj.reg
C:\far2\addons\colors\default_highlighting\colors_from_gernichenko.reg
C:\far2\addons\colors\default_highlighting\colors_from_admin_essp_ru.reg
C:\far2\addons\colors\default_highlighting\black_from_myodov.reg
C:\far2\addons\colors\default_highlighting\black_from_july.reg
C:\far2\addons\colors\default_highlighting\black_from_fonarev.reg
C:\far2\addons\colors\custom_highlighting\vaxcolors.reg
C:\far2\addons\colors\custom_highlighting\rodion_doroshkevich.reg
C:\far2\addons\colors\custom_highlighting\nc5pal2.reg
C:\far2\addons\colors\custom_highlighting\import_colors.bat
C:\far2\addons\colors\custom_highlighting\hell.reg
C:\far2\addons\colors\custom_highlighting\greenmile.reg
C:\far2\addons\colors\custom_highlighting\farcolors242.reg
C:\far2\addons\colors\custom_highlighting\dn_like.reg
C:\far2\addons\colors\custom_highlighting\descript.ion
C:\far2\addons\colors\custom_highlighting\colors_from_sadovoj.reg
C:\far2\addons\colors\custom_highlighting\colors_from_gernichenko.reg
C:\far2\addons\colors\custom_highlighting\colors_from_admin_essp_ru.reg
C:\far2\addons\colors\custom_highlighting\black_from_myodov.reg
C:\far2\addons\colors\custom_highlighting\black_from_july.reg
C:\far2\addons\colors\custom_highlighting\black_from_fonarev.reg
<Drive name for removable media>:\join.avi
C:\far2\addons\colors\default_highlighting\import_colors.bat
C:\far2\addons\colors\default_highlighting\nc5pal2.reg

Modifies multiple files.

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''

Creates and executes the following

'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c rem Kill "SQL"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop SQLBrowser' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$MSFW' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$ISARS' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop MSSQL$MSFW' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop MSSQL$ISARS' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop MSSQLServerADHelper100' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -impostgres.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im msftesql.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop REportServer$ISARS' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im Ssms.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im sql writer.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdhost.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop SQLWriter' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c rem Kill "SQL"
'<SYSTEM32>\net1.exe' stop SQLWriter
'<SYSTEM32>\cmd.exe' /c net stop SQLWriter
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop SQLWriter
'<SYSTEM32>\net1.exe' stop REportServer$ISARS
'<SYSTEM32>\cmd.exe' /c net stop REportServer$ISARS
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop REportServer$ISARS
'<SYSTEM32>\net1.exe' stop SQLBrowser
'<SYSTEM32>\cmd.exe' /c net stop SQLBrowser
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop SQLBrowser
'<SYSTEM32>\net1.exe' stop SQLAgent$MSFW
'<SYSTEM32>\cmd.exe' /c net stop SQLAgent$MSFW
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$MSFW
'<SYSTEM32>\net1.exe' stop SQLAgent$ISARS
'<SYSTEM32>\cmd.exe' /c net stop SQLAgent$ISARS
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$ISARS
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP
'<SYSTEM32>\bcdedit.exe' /set {default} bootstatuspolicy ignoreallfailures
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest
'<SYSTEM32>\wbem\wmic.exe' SHADOWCOPY /nointeractive
'<SYSTEM32>\wbadmin.exe' DELETE SYSTEMSTABACKUP -deleteOldest
'<SYSTEM32>\wbadmin.exe' delete backup -keepVersion:0 -quiet
'<SYSTEM32>\bcdedit.exe' /set {default} recoverynabled No
'<SYSTEM32>\cmd.exe' /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
'<SYSTEM32>\cmd.exe' /c wmic.exe SHADOWCOPY /nointeractive
'<SYSTEM32>\wbadmin.exe' DELETE SYSTEMSTATEBACKUP
'<SYSTEM32>\cmd.exe' /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest
'<SYSTEM32>\cmd.exe' /c bcdedit.exe /set {default} recoverynabled No
'<SYSTEM32>\cmd.exe' /c vssadmin.exe Delete Shadows /All /Quiet
'<SYSTEM32>\cmd.exe' /c wbadmin delete backup -keepVersion:0 -quiet
'<SYSTEM32>\cmd.exe' /c wbadmin DELETE SYSTEMSTATEBACKUP
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive
'<SYSTEM32>\net1.exe' stop MSSQL$MSFW
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet
'<SYSTEM32>\cmd.exe' /c net stop MSSQL$MSFW
'<SYSTEM32>\cmd.exe' /c taskkill -f -im Ssms.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im fdlauncher.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im sqlceip.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im MsDtsSrvr.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im msmdsrv.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im sqlserv.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im sql writer.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im sql writer.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im sqlbrowser.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe
'<SYSTEM32>\cmd.exe' /c rem Kill "SQL"
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im Ssms.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE
'<SYSTEM32>\net1.exe' stop MSSQL$ISARS
'<SYSTEM32>\cmd.exe' /c taskkill -f -im SQLAGENT.EXE
'<SYSTEM32>\cmd.exe' /c net stop MSSQL$ISARS
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop MSSQL$ISARS
'<SYSTEM32>\net1.exe' stop MSSQLServerADHelper100
'<SYSTEM32>\cmd.exe' /c net stop MSSQLServerADHelper100
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop MSSQLServerADHelper100
'<SYSTEM32>\cmd.exe' /c taskkill -f -impostgres.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -impostgres.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im pg_ctl.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im msftesql.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im msftesql.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im ReportingServicesService.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe
'<SYSTEM32>\cmd.exe' /c taskkill -f -im fdhost.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdhost.exe
'%WINDIR%\syswow64\cmd.exe' /c %windir%\sysnative\cmd.exe /c net stop MSSQL$MSFW
'%WINDIR%\syswow64\cmd.exe' /c pause

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial