ユーザー向け情報

閉じる

マイライブラリ
マイライブラリ

+ マイライブラリに追加

検索
検索

電話
テクニカルサポート利用方法

問い合わせ

新規お問い合わせ

電話（英語）

+7 (495) 789-45-86

フォーラム（英語）

お問い合わせ履歴

新規お問い合わせ

電話（英語）

+7 (495) 789-45-86

Profile

JP

RU CN DE EN ES FR IT JP KZ UZ PL BY
閉じる
サービス
スキャナー
Dr.Web vxCube
トライアル
ウイルスライブラリ
ナレッジベース

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

ニュース

Trojan.Siggen8.54695

Added to the Dr.Web virus database: 2019-11-10

Virus description added:

Technical Information

Malicious functions
Executes the following
  • '%WINDIR%\syswow64\taskkill.exe' /IM zoolz.exe /F
  • '%WINDIR%\syswow64\net.exe' stop MSSQLServerADHelper100 /y
  • '%WINDIR%\syswow64\net.exe' stop MSSQLServerOLAPService /y
  • '%WINDIR%\syswow64\net.exe' stop MySQL80 /y
  • '%WINDIR%\syswow64\net.exe' stop MySQL57 /y
  • '%WINDIR%\syswow64\net.exe' stop ntrtscan /y
  • '%WINDIR%\syswow64\net.exe' stop OracleClientCache80 /y
  • '%WINDIR%\syswow64\net.exe' stop PDVFSService /y
  • '%WINDIR%\syswow64\net.exe' stop POP3Svc /y
  • '%WINDIR%\syswow64\net.exe' stop ReportServer /y
  • '%WINDIR%\syswow64\net.exe' stop MSSQL$SHAREPOINT /y
  • '%WINDIR%\syswow64\net.exe' stop ReportServer$SQL_2008 /y
  • '%WINDIR%\syswow64\net.exe' stop ReportServer$TPS /y
  • '%WINDIR%\syswow64\net.exe' stop ReportServer$TPSAMA /y
  • '%WINDIR%\syswow64\net.exe' stop RESvc /y
  • '%WINDIR%\syswow64\net.exe' stop sacsvr /y
  • '%WINDIR%\syswow64\net.exe' stop SamSs /y
  • '%WINDIR%\syswow64\net.exe' stop SAVAdminService /y
  • '%WINDIR%\syswow64\net.exe' stop SAVService /y
  • '%WINDIR%\syswow64\net.exe' stop SDRSVC /y
  • '%WINDIR%\syswow64\net.exe' stop SepMasterService /y
  • '%WINDIR%\syswow64\net.exe' stop MSSQLFDLauncher$TPSAMA /y
  • '%WINDIR%\syswow64\net.exe' stop MSSQLSERVER /y
  • '%WINDIR%\syswow64\net.exe' stop MSSQLFDLauncher$TPS /y
  • '%WINDIR%\syswow64\net.exe' stop MSSQLFDLauncher$SYSTEM_BGC /y
  • '%WINDIR%\syswow64\net.exe' stop MSSQLFDLauncher$SQL_2008 /y
  • '%WINDIR%\syswow64\net.exe' stop MSOLAP$SQL_2008 /y
  • '%WINDIR%\syswow64\net.exe' stop MSOLAP$SYSTEM_BGC /y
  • '%WINDIR%\syswow64\net.exe' stop MSOLAP$TPS /y
  • '%WINDIR%\syswow64\net.exe' stop MSOLAP$TPSAMA /y
  • '%WINDIR%\syswow64\net.exe' stop MSSQL$BKUPEXEC /y
  • '%WINDIR%\syswow64\net.exe' stop MSSQL$ECWDB2 /y
  • '%WINDIR%\syswow64\net.exe' stop MSSQL$PRACTICEMGT /y
  • '%WINDIR%\syswow64\net.exe' stop MSSQL$PRACTTICEBGC /y
  • '%WINDIR%\syswow64\net.exe' stop MSSQL$PROFXENGAGEMENT /y
  • '%WINDIR%\syswow64\net.exe' stop ShMonitor /y
  • '%WINDIR%\syswow64\net.exe' stop ReportServer$SYSTEM_BGC /y
  • '%WINDIR%\syswow64\net.exe' stop MSSQL$SBSMONITORING /y
  • '%WINDIR%\syswow64\net.exe' stop MSSQL$SYSTEM_BGC /y
  • '%WINDIR%\syswow64\net.exe' stop MSSQL$TPS /y
  • '%WINDIR%\syswow64\net.exe' stop MSSQL$TPSAMA /y
  • '%WINDIR%\syswow64\net.exe' stop MSSQL$VEEAMSQL2008R2 /y
  • '%WINDIR%\syswow64\net.exe' stop MSSQL$VEEAMSQL2012 /y
  • '%WINDIR%\syswow64\net.exe' stop MSSQLFDLauncher /y
  • '%WINDIR%\syswow64\net.exe' stop MSSQLFDLauncher$PROFXENGAGEMENT /y
  • '%WINDIR%\syswow64\net.exe' stop MSSQLFDLauncher$SBSMONITORING /y
  • '%WINDIR%\syswow64\net.exe' stop MSSQLFDLauncher$SHAREPOINT /y
  • '%WINDIR%\syswow64\net.exe' stop MSExchangeSRS /y
  • '%WINDIR%\syswow64\net.exe' stop MSSQL$SQL_2008 /y
  • '%WINDIR%\syswow64\net.exe' stop SQLAgent$SYSTEM_BGC /y
  • '%WINDIR%\syswow64\net.exe' stop VeeamHvIntegrationSvc /y
  • '%WINDIR%\syswow64\net.exe' stop SMTPSvc /y
  • '%WINDIR%\syswow64\net.exe' stop TmCCSF /y
  • '%WINDIR%\syswow64\net.exe' stop tmlisten /y
  • '%WINDIR%\syswow64\net.exe' stop TrueKey /y
  • '%WINDIR%\syswow64\net.exe' stop TrueKeyScheduler /y
  • '%WINDIR%\syswow64\net.exe' stop TrueKeyServiceHelper /y
  • '%WINDIR%\syswow64\net.exe' stop UI0Detect /y
  • '%WINDIR%\syswow64\net.exe' stop VeeamBackupSvc /y
  • '%WINDIR%\syswow64\net.exe' stop VeeamBrokerSvc /y
  • '%WINDIR%\syswow64\net.exe' stop VeeamCatalogSvc /y
  • '%WINDIR%\syswow64\net.exe' stop Smcinst /y
  • '%WINDIR%\syswow64\net.exe' stop VeeamCloudSvc /y
  • '%WINDIR%\syswow64\net.exe' stop VeeamDeploySvc /y
  • '%WINDIR%\syswow64\net.exe' stop VeeamEnterpriseManagerSvc /y
  • '%WINDIR%\syswow64\net.exe' stop VeeamMountSvc /y
  • '%WINDIR%\syswow64\net.exe' stop VeeamNFSSvc /y
  • '%WINDIR%\syswow64\net.exe' stop VeeamRESTSvc /y
  • '%WINDIR%\syswow64\net.exe' stop VeeamTransportSvc /y
  • '%WINDIR%\syswow64\net.exe' stop W3Svc /y
  • '%WINDIR%\syswow64\net.exe' stop wbengine /y
  • '%WINDIR%\syswow64\net.exe' stop WRSVC /y
  • '%WINDIR%\syswow64\net.exe' stop swi_service /y
  • '%WINDIR%\syswow64\net.exe' stop swi_update_64 /y
  • '%WINDIR%\syswow64\net.exe' stop swi_filter /y
  • '%WINDIR%\syswow64\net.exe' stop svcGenericHost /y
  • '%WINDIR%\syswow64\net.exe' stop SstpSvc /y
  • '%WINDIR%\syswow64\net.exe' stop SntpService /y
  • '%WINDIR%\syswow64\net.exe' stop sophossps /y
  • '%WINDIR%\syswow64\net.exe' stop SQLAgent$BKUPEXEC /y
  • '%WINDIR%\syswow64\net.exe' stop SQLAgent$ECWDB2 /y
  • '%WINDIR%\syswow64\net.exe' stop SQLAgent$PRACTTICEBGC /y
  • '%WINDIR%\syswow64\net.exe' stop SQLAgent$PRACTTICEMGT /y
  • '%WINDIR%\syswow64\net.exe' stop SQLAgent$PROFXENGAGEMENT /y
  • '%WINDIR%\syswow64\net.exe' stop SQLAgent$SBSMONITORING /y
  • '%WINDIR%\syswow64\net.exe' stop SQLAgent$SHAREPOINT /y
  • '%WINDIR%\syswow64\net.exe' stop SmcService /y
  • '%WINDIR%\syswow64\net.exe' stop MSExchangeSA /y
  • '%WINDIR%\syswow64\net.exe' stop SQLAgent$SQL_2008 /y
  • '%WINDIR%\syswow64\net.exe' stop SQLAgent$TPSAMA /y
  • '%WINDIR%\syswow64\net.exe' stop SQLAgent$VEEAMSQL2008R2 /y
  • '%WINDIR%\syswow64\net.exe' stop SQLAgent$VEEAMSQL2012 /y
  • '%WINDIR%\syswow64\net.exe' stop SQLBrowser /y
  • '%WINDIR%\syswow64\net.exe' stop SQLSafeOLRService /y
  • '%WINDIR%\syswow64\net.exe' stop SQLSERVERAGENT /y
  • '%WINDIR%\syswow64\net.exe' stop SQLTELEMETRY /y
  • '%WINDIR%\syswow64\net.exe' stop SQLTELEMETRY$ECWDB2 /y
  • '%WINDIR%\syswow64\net.exe' stop SQLWriter /y
  • '%WINDIR%\syswow64\net.exe' stop SNAC /y
  • '%WINDIR%\syswow64\net.exe' stop SQLAgent$TPS /y
  • '%WINDIR%\syswow64\net.exe' stop VeeamDeploymentService /y
  • '%WINDIR%\syswow64\net.exe' stop MSExchangeMTA /y
  • '%WINDIR%\syswow64\net.exe' stop McShield /y
  • '%WINDIR%\syswow64\taskkill.exe' /IM sqlwriter.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM steam.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM synctime.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM tbirdconfig.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM thebat.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM thebat64.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM thunderbird.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM visio.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM winword.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM mydesktopqos.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM wordpad.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM tmlisten.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM PccNTMon.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM CNTAoSMgr.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM Ntrtscan.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM mbamtray.exe /F
  • '%WINDIR%\syswow64\net.exe' stop "Acronis VSS Provider" /y
  • '%WINDIR%\syswow64\net.exe' stop "Enterprise Client Service" /y
  • '%WINDIR%\syswow64\net.exe' stop "Sophos Agent" /y
  • '%WINDIR%\syswow64\net.exe' stop "Sophos AutoUpdate Service" /y
  • '%WINDIR%\syswow64\taskkill.exe' /IM sqlbrowser.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM sqlservr.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM sqlagent.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM sqbcoreservice.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM powerpnt.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM dbeng50.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM dbsnmp.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM encsvc.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM excel.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM firefoxconfig.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM infopath.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM isqlplussvc.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM msaccess.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM msftesql.exe /F
  • '%WINDIR%\syswow64\net.exe' stop "Sophos Clean Service" /y
  • '%WINDIR%\syswow64\taskkill.exe' /IM xfssvccon.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM mspub.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM mysqld.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM mysqld-nt.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM mysqld-opt.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM ocautoupds.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM ocomm.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM ocssd.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM onenote.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM oracle.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM outlook.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM agntsvc.exe /F
  • '%WINDIR%\syswow64\taskkill.exe' /IM mydesktopservice.exe /F
  • '%WINDIR%\syswow64\net.exe' stop AcrSch2Svc /y
  • '%WINDIR%\syswow64\net.exe' stop MSExchangeIS /y
  • '%WINDIR%\syswow64\net.exe' stop "Sophos Health Service" /y
  • '%WINDIR%\syswow64\net.exe' stop FA_Scheduler /y
  • '%WINDIR%\syswow64\net.exe' stop IISAdmin /y
  • '%WINDIR%\syswow64\net.exe' stop IMAP4Svc /y
  • '%WINDIR%\syswow64\net.exe' stop macmnsvc /y
  • '%WINDIR%\syswow64\net.exe' stop masvc /y
  • '%WINDIR%\syswow64\net.exe' stop MBAMService /y
  • '%WINDIR%\syswow64\net.exe' stop MBEndpointAgent /y
  • '%WINDIR%\syswow64\net.exe' stop McAfeeEngineService /y
  • '%WINDIR%\syswow64\net.exe' stop McAfeeFramework /y
  • '%WINDIR%\syswow64\net.exe' stop "Sophos Device Control Service" /y
  • '%WINDIR%\syswow64\net.exe' stop McAfeeFrameworkMcAfeeFramework /y
  • '%WINDIR%\syswow64\net.exe' stop McTaskManager /y
  • '%WINDIR%\syswow64\net.exe' stop mfemms /y
  • '%WINDIR%\syswow64\net.exe' stop mfevtp /y
  • '%WINDIR%\syswow64\net.exe' stop MMS /y
  • '%WINDIR%\syswow64\net.exe' stop mozyprobackup /y
  • '%WINDIR%\syswow64\net.exe' stop MsDtsServer /y
  • '%WINDIR%\syswow64\net.exe' stop MsDtsServer100 /y
  • '%WINDIR%\syswow64\net.exe' stop MsDtsServer110 /y
  • '%WINDIR%\syswow64\net.exe' stop MSExchangeES /y
  • '%WINDIR%\syswow64\net.exe' stop EraserSvc11710 /y
  • '%WINDIR%\syswow64\net.exe' stop EsgShKernel /y
  • '%WINDIR%\syswow64\net.exe' stop EPUpdateService /y
  • '%WINDIR%\syswow64\net.exe' stop EPSecurityService /y
  • '%WINDIR%\syswow64\net.exe' stop DCAgent /y
  • '%WINDIR%\syswow64\net.exe' stop "Sophos MCS Client" /y
  • '%WINDIR%\syswow64\net.exe' stop "Sophos Message Router" /y
  • '%WINDIR%\syswow64\net.exe' stop "Sophos Safestore Service" /y
  • '%WINDIR%\syswow64\net.exe' stop "Sophos System Protection Service" /y
  • '%WINDIR%\syswow64\net.exe' stop "Sophos Web Control Service" /y
  • '%WINDIR%\syswow64\net.exe' stop "SQLsafe Backup Service" /y
  • '%WINDIR%\syswow64\net.exe' stop "SQLsafe Filter Service" /y
  • '%WINDIR%\syswow64\net.exe' stop "Symantec System Recovery" /y
  • '%WINDIR%\syswow64\net.exe' stop "Veeam Backup Catalog Data Service" /y
  • '%WINDIR%\syswow64\net.exe' stop "Sophos File Scanner Service" /y
  • '%WINDIR%\syswow64\net.exe' stop MSExchangeMGMT /y
  • '%WINDIR%\syswow64\net.exe' stop AcronisAgent /y
  • '%WINDIR%\syswow64\net.exe' stop ARSM /y
  • '%WINDIR%\syswow64\net.exe' stop BackupExecAgentAccelerator /y
  • '%WINDIR%\syswow64\net.exe' stop BackupExecAgentBrowser /y
  • '%WINDIR%\syswow64\net.exe' stop BackupExecDeviceMediaService /y
  • '%WINDIR%\syswow64\net.exe' stop BackupExecJobEngine /y
  • '%WINDIR%\syswow64\net.exe' stop BackupExecManagementService /y
  • '%WINDIR%\syswow64\net.exe' stop BackupExecRPCService /y
  • '%WINDIR%\syswow64\net.exe' stop BackupExecVSSProvider /y
  • '%WINDIR%\syswow64\net.exe' stop bedbg /y
  • '%WINDIR%\syswow64\net.exe' stop "Sophos MCS Agent" /y
  • '%WINDIR%\syswow64\net.exe' stop Antivirus /y
  • '%WINDIR%\syswow64\net.exe' stop swi_update /y
Miscellaneous
Searches for the following windows
  • ClassName: '' WindowName: ''
Creates and executes the following
  • '%WINDIR%\syswow64\taskkill.exe' /IM zoolz.exe /F' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop MSSQLServerADHelper100 /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop MSSQLServerOLAPService /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop MySQL80 /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop MySQL57 /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop ntrtscan /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop OracleClientCache80 /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop PDVFSService /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop POP3Svc /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop ReportServer /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop MSSQL$SHAREPOINT /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop ReportServer$SQL_2008 /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop ReportServer$TPS /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop ReportServer$TPSAMA /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop RESvc /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop sacsvr /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop SamSs /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop SAVAdminService /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop SAVService /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop SDRSVC /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop SepMasterService /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop MSSQLFDLauncher$TPSAMA /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop MSSQLSERVER /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop MSSQLFDLauncher$TPS /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop MSSQLFDLauncher$SYSTEM_BGC /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop MSSQLFDLauncher$SQL_2008 /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop MSOLAP$SQL_2008 /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop MSOLAP$SYSTEM_BGC /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop MSOLAP$TPS /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop MSOLAP$TPSAMA /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop MSSQL$BKUPEXEC /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop MSSQL$ECWDB2 /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop MSSQL$PRACTICEMGT /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop MSSQL$PRACTTICEBGC /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop MSSQL$PROFXENGAGEMENT /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop ShMonitor /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop ReportServer$SYSTEM_BGC /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop MSSQL$SBSMONITORING /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop MSSQL$SYSTEM_BGC /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop MSSQL$TPS /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop MSSQL$TPSAMA /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop MSSQL$VEEAMSQL2008R2 /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop MSSQL$VEEAMSQL2012 /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop MSSQLFDLauncher /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop MSSQLFDLauncher$PROFXENGAGEMENT /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop MSSQLFDLauncher$SBSMONITORING /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop MSSQLFDLauncher$SHAREPOINT /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop MSExchangeSRS /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop MSSQL$SQL_2008 /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop SQLAgent$SYSTEM_BGC /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop VeeamHvIntegrationSvc /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop SMTPSvc /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop TmCCSF /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop tmlisten /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop TrueKey /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop TrueKeyScheduler /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop TrueKeyServiceHelper /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop UI0Detect /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop VeeamBackupSvc /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop VeeamBrokerSvc /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop VeeamCatalogSvc /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop Smcinst /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop VeeamCloudSvc /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop VeeamDeploySvc /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop VeeamEnterpriseManagerSvc /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop VeeamMountSvc /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop VeeamNFSSvc /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop VeeamRESTSvc /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop VeeamTransportSvc /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop W3Svc /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop wbengine /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop WRSVC /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop swi_service /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop swi_update_64 /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop swi_filter /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop svcGenericHost /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop SstpSvc /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop SntpService /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop sophossps /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop SQLAgent$BKUPEXEC /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop SQLAgent$ECWDB2 /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop SQLAgent$PRACTTICEBGC /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop SQLAgent$PRACTTICEMGT /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop SQLAgent$PROFXENGAGEMENT /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop SQLAgent$SBSMONITORING /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop SQLAgent$SHAREPOINT /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop SmcService /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop MSExchangeSA /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop SQLAgent$SQL_2008 /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop SQLAgent$TPSAMA /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop SQLAgent$VEEAMSQL2008R2 /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop SQLAgent$VEEAMSQL2012 /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop SQLBrowser /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop SQLSafeOLRService /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop SQLSERVERAGENT /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop SQLTELEMETRY /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop SQLTELEMETRY$ECWDB2 /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop SQLWriter /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop SNAC /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop SQLAgent$TPS /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop VeeamDeploymentService /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop MSExchangeMTA /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop McShield /y' (with hidden window)
  • '%WINDIR%\syswow64\taskkill.exe' /IM sqlwriter.exe /F' (with hidden window)
  • '%WINDIR%\syswow64\taskkill.exe' /IM steam.exe /F' (with hidden window)
  • '%WINDIR%\syswow64\taskkill.exe' /IM synctime.exe /F' (with hidden window)
  • '%WINDIR%\syswow64\taskkill.exe' /IM tbirdconfig.exe /F' (with hidden window)
  • '%WINDIR%\syswow64\taskkill.exe' /IM thebat.exe /F' (with hidden window)
  • '%WINDIR%\syswow64\taskkill.exe' /IM thebat64.exe /F' (with hidden window)
  • '%WINDIR%\syswow64\taskkill.exe' /IM thunderbird.exe /F' (with hidden window)
  • '%WINDIR%\syswow64\taskkill.exe' /IM visio.exe /F' (with hidden window)
  • '%WINDIR%\syswow64\taskkill.exe' /IM winword.exe /F' (with hidden window)
  • '%WINDIR%\syswow64\taskkill.exe' /IM mydesktopqos.exe /F' (with hidden window)
  • '%WINDIR%\syswow64\taskkill.exe' /IM wordpad.exe /F' (with hidden window)
  • '%WINDIR%\syswow64\taskkill.exe' /IM tmlisten.exe /F' (with hidden window)
  • '%WINDIR%\syswow64\taskkill.exe' /IM PccNTMon.exe /F' (with hidden window)
  • '%WINDIR%\syswow64\taskkill.exe' /IM CNTAoSMgr.exe /F' (with hidden window)
  • '%WINDIR%\syswow64\taskkill.exe' /IM Ntrtscan.exe /F' (with hidden window)
  • '%WINDIR%\syswow64\taskkill.exe' /IM mbamtray.exe /F' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop "Acronis VSS Provider" /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop "Enterprise Client Service" /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop "Sophos Agent" /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop "Sophos AutoUpdate Service" /y' (with hidden window)
  • '%WINDIR%\syswow64\taskkill.exe' /IM sqlbrowser.exe /F' (with hidden window)
  • '%WINDIR%\syswow64\taskkill.exe' /IM sqlservr.exe /F' (with hidden window)
  • '%WINDIR%\syswow64\taskkill.exe' /IM sqlagent.exe /F' (with hidden window)
  • '%WINDIR%\syswow64\taskkill.exe' /IM sqbcoreservice.exe /F' (with hidden window)
  • '%WINDIR%\syswow64\taskkill.exe' /IM powerpnt.exe /F' (with hidden window)
  • '%WINDIR%\syswow64\taskkill.exe' /IM dbeng50.exe /F' (with hidden window)
  • '%WINDIR%\syswow64\taskkill.exe' /IM dbsnmp.exe /F' (with hidden window)
  • '%WINDIR%\syswow64\taskkill.exe' /IM encsvc.exe /F' (with hidden window)
  • '%WINDIR%\syswow64\taskkill.exe' /IM excel.exe /F' (with hidden window)
  • '%WINDIR%\syswow64\taskkill.exe' /IM firefoxconfig.exe /F' (with hidden window)
  • '%WINDIR%\syswow64\taskkill.exe' /IM infopath.exe /F' (with hidden window)
  • '%WINDIR%\syswow64\taskkill.exe' /IM isqlplussvc.exe /F' (with hidden window)
  • '%WINDIR%\syswow64\taskkill.exe' /IM msaccess.exe /F' (with hidden window)
  • '%WINDIR%\syswow64\taskkill.exe' /IM msftesql.exe /F' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop "Sophos Clean Service" /y' (with hidden window)
  • '%WINDIR%\syswow64\taskkill.exe' /IM xfssvccon.exe /F' (with hidden window)
  • '%WINDIR%\syswow64\taskkill.exe' /IM mspub.exe /F' (with hidden window)
  • '%WINDIR%\syswow64\taskkill.exe' /IM mysqld.exe /F' (with hidden window)
  • '%WINDIR%\syswow64\taskkill.exe' /IM mysqld-nt.exe /F' (with hidden window)
  • '%WINDIR%\syswow64\taskkill.exe' /IM mysqld-opt.exe /F' (with hidden window)
  • '%WINDIR%\syswow64\taskkill.exe' /IM ocautoupds.exe /F' (with hidden window)
  • '%WINDIR%\syswow64\taskkill.exe' /IM ocomm.exe /F' (with hidden window)
  • '%WINDIR%\syswow64\taskkill.exe' /IM ocssd.exe /F' (with hidden window)
  • '%WINDIR%\syswow64\taskkill.exe' /IM onenote.exe /F' (with hidden window)
  • '%WINDIR%\syswow64\taskkill.exe' /IM oracle.exe /F' (with hidden window)
  • '%WINDIR%\syswow64\taskkill.exe' /IM outlook.exe /F' (with hidden window)
  • '%WINDIR%\syswow64\taskkill.exe' /IM agntsvc.exe /F' (with hidden window)
  • '%WINDIR%\syswow64\taskkill.exe' /IM mydesktopservice.exe /F' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop AcrSch2Svc /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop MSExchangeIS /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop "Sophos Health Service" /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop FA_Scheduler /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop IISAdmin /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop IMAP4Svc /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop macmnsvc /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop masvc /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop MBAMService /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop MBEndpointAgent /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop McAfeeEngineService /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop McAfeeFramework /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop "Sophos Device Control Service" /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop McAfeeFrameworkMcAfeeFramework /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop McTaskManager /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop mfemms /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop mfevtp /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop MMS /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop mozyprobackup /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop MsDtsServer /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop MsDtsServer100 /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop MsDtsServer110 /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop MSExchangeES /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop EraserSvc11710 /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop EsgShKernel /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop EPUpdateService /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop EPSecurityService /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop DCAgent /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop "Sophos MCS Client" /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop "Sophos Message Router" /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop "Sophos Safestore Service" /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop "Sophos System Protection Service" /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop "Sophos Web Control Service" /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop "SQLsafe Backup Service" /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop "SQLsafe Filter Service" /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop "Symantec System Recovery" /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop "Veeam Backup Catalog Data Service" /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop "Sophos File Scanner Service" /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop MSExchangeMGMT /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop AcronisAgent /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop ARSM /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop BackupExecAgentAccelerator /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop BackupExecAgentBrowser /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop BackupExecDeviceMediaService /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop BackupExecJobEngine /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop BackupExecManagementService /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop BackupExecRPCService /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop BackupExecVSSProvider /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop bedbg /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop "Sophos MCS Agent" /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop Antivirus /y' (with hidden window)
  • '%WINDIR%\syswow64\net.exe' stop swi_update /y' (with hidden window)
Executes the following
  • '%WINDIR%\syswow64\net1.exe' stop "Acronis VSS Provider" /y
  • '%WINDIR%\syswow64\net1.exe' stop sacsvr /y
  • '%WINDIR%\syswow64\net1.exe' stop SamSs /y
  • '%WINDIR%\syswow64\net1.exe' stop SAVAdminService /y
  • '%WINDIR%\syswow64\net1.exe' stop SAVService /y
  • '%WINDIR%\syswow64\net1.exe' stop SDRSVC /y
  • '%WINDIR%\syswow64\net1.exe' stop ShMonitor /y
  • '%WINDIR%\syswow64\net1.exe' stop MySQL80 /y
  • '%WINDIR%\syswow64\net1.exe' stop SepMasterService /y
  • '%WINDIR%\syswow64\net1.exe' stop SmcService /y
  • '%WINDIR%\syswow64\net1.exe' stop SMTPSvc /y
  • '%WINDIR%\syswow64\net1.exe' stop SNAC /y
  • '%WINDIR%\syswow64\net1.exe' stop SntpService /y
  • '%WINDIR%\syswow64\net1.exe' stop sophossps /y
  • '%WINDIR%\syswow64\net1.exe' stop SQLAgent$BKUPEXEC /y
  • '%WINDIR%\syswow64\net1.exe' stop ReportServer$TPSAMA /y
  • '%WINDIR%\syswow64\net1.exe' stop RESvc /y
  • '%WINDIR%\syswow64\net1.exe' stop ReportServer$SYSTEM_BGC /y
  • '%WINDIR%\syswow64\net1.exe' stop ReportServer$SQL_2008 /y
  • '%WINDIR%\syswow64\net1.exe' stop ReportServer$TPS /y
  • '%WINDIR%\syswow64\net1.exe' stop MSSQLFDLauncher$SHAREPOINT /y
  • '%WINDIR%\syswow64\net1.exe' stop MSSQLFDLauncher$SQL_2008 /y
  • '%WINDIR%\syswow64\net1.exe' stop MSSQLFDLauncher$TPS /y
  • '%WINDIR%\syswow64\net1.exe' stop MSSQLFDLauncher$SYSTEM_BGC /y
  • '%WINDIR%\syswow64\net1.exe' stop MSSQLFDLauncher$TPSAMA /y
  • '%WINDIR%\syswow64\net1.exe' stop MSSQLSERVER /y
  • '%WINDIR%\syswow64\net1.exe' stop SQLAgent$ECWDB2 /y
  • '%WINDIR%\syswow64\net1.exe' stop Smcinst /y
  • '%WINDIR%\syswow64\net1.exe' stop MSSQLServerOLAPService /y
  • '%WINDIR%\syswow64\net1.exe' stop ntrtscan /y
  • '%WINDIR%\syswow64\net1.exe' stop MySQL57 /y
  • '%WINDIR%\syswow64\net1.exe' stop POP3Svc /y
  • '%WINDIR%\syswow64\net1.exe' stop OracleClientCache80 /y
  • '%WINDIR%\syswow64\net1.exe' stop PDVFSService /y
  • '%WINDIR%\syswow64\net1.exe' stop ReportServer /y
  • '%WINDIR%\syswow64\net1.exe' stop MSSQLFDLauncher$SBSMONITORING /y
  • '%WINDIR%\syswow64\net1.exe' stop MSSQLServerADHelper100 /y
  • '%WINDIR%\syswow64\net1.exe' stop SQLSafeOLRService /y
  • '%WINDIR%\syswow64\net1.exe' stop VeeamTransportSvc /y
  • '%WINDIR%\syswow64\net1.exe' stop SQLAgent$PROFXENGAGEMENT /y
  • '%WINDIR%\syswow64\net1.exe' stop TrueKeyServiceHelper /y
  • '%WINDIR%\syswow64\net1.exe' stop TrueKeyScheduler /y
  • '%WINDIR%\syswow64\net1.exe' stop UI0Detect /y
  • '%WINDIR%\syswow64\net1.exe' stop VeeamBackupSvc /y
  • '%WINDIR%\syswow64\net1.exe' stop VeeamBrokerSvc /y
  • '%WINDIR%\syswow64\net1.exe' stop VeeamCloudSvc /y
  • '%WINDIR%\syswow64\net1.exe' stop SQLAgent$PRACTTICEMGT /y
  • '%WINDIR%\syswow64\net1.exe' stop VeeamCatalogSvc /y
  • '%WINDIR%\syswow64\net1.exe' stop VeeamDeploySvc /y
  • '%WINDIR%\syswow64\net1.exe' stop VeeamEnterpriseManagerSvc /y
  • '%WINDIR%\syswow64\net1.exe' stop VeeamMountSvc /y
  • '%WINDIR%\syswow64\net1.exe' stop VeeamNFSSvc /y
  • '%WINDIR%\syswow64\net1.exe' stop VeeamRESTSvc /y
  • '%WINDIR%\syswow64\net1.exe' stop wbengine /y
  • '%WINDIR%\syswow64\net1.exe' stop swi_update_64 /y
  • '%WINDIR%\syswow64\net1.exe' stop TmCCSF /y
  • '%WINDIR%\syswow64\net1.exe' stop tmlisten /y
  • '%WINDIR%\syswow64\net1.exe' stop svcGenericHost /y
  • '%WINDIR%\syswow64\net1.exe' stop SstpSvc /y
  • '%WINDIR%\syswow64\net1.exe' stop SQLAgent$SHAREPOINT /y
  • '%WINDIR%\syswow64\net1.exe' stop SQLAgent$SQL_2008 /y
  • '%WINDIR%\syswow64\net1.exe' stop SQLAgent$SYSTEM_BGC /y
  • '%WINDIR%\syswow64\net1.exe' stop SQLAgent$TPS /y
  • '%WINDIR%\syswow64\net1.exe' stop SQLAgent$TPSAMA /y
  • '%WINDIR%\syswow64\net1.exe' stop SQLAgent$VEEAMSQL2012 /y
  • '%WINDIR%\syswow64\net1.exe' stop SQLAgent$PRACTTICEBGC /y
  • '%WINDIR%\syswow64\net1.exe' stop MSSQLFDLauncher$PROFXENGAGEMENT /y
  • '%WINDIR%\syswow64\net1.exe' stop SQLBrowser /y
  • '%WINDIR%\syswow64\net1.exe' stop SQLSERVERAGENT /y
  • '%WINDIR%\syswow64\net1.exe' stop SQLTELEMETRY /y
  • '%WINDIR%\syswow64\net1.exe' stop SQLTELEMETRY$ECWDB2 /y
  • '%WINDIR%\syswow64\net1.exe' stop SQLWriter /y
  • '%WINDIR%\syswow64\net1.exe' stop swi_service /y
  • '%WINDIR%\syswow64\net1.exe' stop swi_filter /y
  • '%WINDIR%\syswow64\net1.exe' stop SQLAgent$SBSMONITORING /y
  • '%WINDIR%\syswow64\net1.exe' stop SQLAgent$VEEAMSQL2008R2 /y
  • '%WINDIR%\syswow64\net1.exe' stop VeeamDeploymentService /y
  • '%WINDIR%\syswow64\net1.exe' stop MSSQL$VEEAMSQL2012 /y
  • '%WINDIR%\syswow64\net1.exe' stop MSSQL$PRACTTICEBGC /y
  • '%WINDIR%\syswow64\net1.exe' stop BackupExecAgentAccelerator /y
  • '%WINDIR%\syswow64\net1.exe' stop BackupExecAgentBrowser /y
  • '%WINDIR%\syswow64\net1.exe' stop BackupExecDeviceMediaService /y
  • '%WINDIR%\syswow64\net1.exe' stop BackupExecJobEngine /y
  • '%WINDIR%\syswow64\net1.exe' stop BackupExecRPCService /y
  • '%WINDIR%\syswow64\net1.exe' stop BackupExecManagementService /y
  • '%WINDIR%\syswow64\net1.exe' stop "Sophos MCS Client" /y
  • '%WINDIR%\syswow64\net1.exe' stop bedbg /y
  • '%WINDIR%\syswow64\net1.exe' stop DCAgent /y
  • '%WINDIR%\syswow64\net1.exe' stop EPSecurityService /y
  • '%WINDIR%\syswow64\net1.exe' stop EPUpdateService /y
  • '%WINDIR%\syswow64\net1.exe' stop EraserSvc11710 /y
  • '%WINDIR%\syswow64\net1.exe' stop EsgShKernel /y
  • '%WINDIR%\syswow64\net1.exe' stop FA_Scheduler /y
  • '%WINDIR%\syswow64\net1.exe' stop ARSM /y
  • '%WINDIR%\syswow64\net1.exe' stop Antivirus /y
  • '%WINDIR%\syswow64\net1.exe' stop AcronisAgent /y
  • '%WINDIR%\syswow64\net1.exe' stop AcrSch2Svc /y
  • '%WINDIR%\syswow64\net1.exe' stop "Veeam Backup Catalog Data Service" /y
  • '%WINDIR%\syswow64\net1.exe' stop "Enterprise Client Service" /y
  • '%WINDIR%\syswow64\net1.exe' stop "Sophos Clean Service" /y
  • '%WINDIR%\syswow64\net1.exe' stop "Sophos AutoUpdate Service" /y
  • '%WINDIR%\syswow64\net1.exe' stop "Sophos Device Control Service" /y
  • '%WINDIR%\syswow64\net1.exe' stop "Sophos File Scanner Service" /y
  • '%WINDIR%\syswow64\net1.exe' stop "Sophos Health Service" /y
  • '%WINDIR%\syswow64\net1.exe' stop IMAP4Svc /y
  • '%WINDIR%\syswow64\net1.exe' stop BackupExecVSSProvider /y
  • '%WINDIR%\syswow64\net1.exe' stop "Sophos MCS Agent" /y
  • '%WINDIR%\syswow64\net1.exe' stop "Sophos Safestore Service" /y
  • '%WINDIR%\syswow64\net1.exe' stop "Sophos System Protection Service" /y
  • '%WINDIR%\syswow64\net1.exe' stop "Sophos Web Control Service" /y
  • '%WINDIR%\syswow64\net1.exe' stop "SQLsafe Backup Service" /y
  • '%WINDIR%\syswow64\net1.exe' stop "SQLsafe Filter Service" /y
  • '%WINDIR%\syswow64\net1.exe' stop "Symantec System Recovery" /y
  • '%WINDIR%\syswow64\net1.exe' stop "Sophos Agent" /y
  • '%WINDIR%\syswow64\net1.exe' stop "Sophos Message Router" /y
  • '%WINDIR%\syswow64\net1.exe' stop mfevtp /y
  • '%WINDIR%\syswow64\net1.exe' stop MSSQL$TPSAMA /y
  • '%WINDIR%\syswow64\net1.exe' stop MBAMService /y
  • '%WINDIR%\syswow64\net1.exe' stop MSOLAP$TPS /y
  • '%WINDIR%\syswow64\net1.exe' stop MSOLAP$SYSTEM_BGC /y
  • '%WINDIR%\syswow64\net1.exe' stop MSOLAP$TPSAMA /y
  • '%WINDIR%\syswow64\net1.exe' stop MSSQL$ECWDB2 /y
  • '%WINDIR%\syswow64\net1.exe' stop MSSQL$BKUPEXEC /y
  • '%WINDIR%\syswow64\net1.exe' stop MSSQL$PRACTICEMGT /y
  • '%WINDIR%\syswow64\net1.exe' stop IISAdmin /y
  • '%WINDIR%\syswow64\net1.exe' stop MSSQL$PROFXENGAGEMENT /y
  • '%WINDIR%\syswow64\net1.exe' stop MSSQL$SQL_2008 /y
  • '%WINDIR%\syswow64\net1.exe' stop MSSQL$SBSMONITORING /y
  • '%WINDIR%\syswow64\net1.exe' stop MSSQL$SHAREPOINT /y
  • '%WINDIR%\syswow64\net1.exe' stop MSSQL$SYSTEM_BGC /y
  • '%WINDIR%\syswow64\net1.exe' stop MSSQL$TPS /y
  • '%WINDIR%\syswow64\net1.exe' stop MSSQL$VEEAMSQL2008R2 /y
  • '%WINDIR%\syswow64\net1.exe' stop MSExchangeMGMT /y
  • '%WINDIR%\syswow64\net1.exe' stop MSExchangeSRS /y
  • '%WINDIR%\syswow64\net1.exe' stop MSOLAP$SQL_2008 /y
  • '%WINDIR%\syswow64\net1.exe' stop MSExchangeSA /y
  • '%WINDIR%\syswow64\net1.exe' stop MSExchangeMTA /y
  • '%WINDIR%\syswow64\net1.exe' stop MBEndpointAgent /y
  • '%WINDIR%\syswow64\net1.exe' stop McAfeeEngineService /y
  • '%WINDIR%\syswow64\net1.exe' stop McAfeeFramework /y
  • '%WINDIR%\syswow64\net1.exe' stop McAfeeFrameworkMcAfeeFramework /y
  • '%WINDIR%\syswow64\net1.exe' stop McShield /y
  • '%WINDIR%\syswow64\net1.exe' stop mfemms /y
  • '%WINDIR%\syswow64\net1.exe' stop macmnsvc /y
  • '%WINDIR%\syswow64\net1.exe' stop MSSQLFDLauncher /y
  • '%WINDIR%\syswow64\net1.exe' stop McTaskManager /y
  • '%WINDIR%\syswow64\net1.exe' stop MMS /y
  • '%WINDIR%\syswow64\net1.exe' stop MsDtsServer /y
  • '%WINDIR%\syswow64\net1.exe' stop MsDtsServer110 /y
  • '%WINDIR%\syswow64\net1.exe' stop MsDtsServer100 /y
  • '%WINDIR%\syswow64\net1.exe' stop MSExchangeIS /y
  • '%WINDIR%\syswow64\net1.exe' stop MSExchangeES /y
  • '%WINDIR%\syswow64\net1.exe' stop masvc /y
  • '%WINDIR%\syswow64\net1.exe' stop mozyprobackup /y
  • '%WINDIR%\syswow64\net1.exe' stop W3Svc /y

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Free trial

 

Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

Free trial

 

Download Dr.Web

Download by serial number

Download on App Store

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

 

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android

Free trial

14 days

Download now
Get it on Google Play