REAgentC.exe |
can be used to disable Windows Recovery Environment (WinRE) repair/recovery options of an infected system |
---|---|
vssadmin.exe delete shadows /all /quiet |
can be used to delete all volume shadow copies on a system |
wmic shadowcopy delete |
can be used to delete volume shadow copies |
wbadmin.exe delete catalog -quiet |
can be used to delete the Windows Backup Catalog |
bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no |
can be used to disable automatic Windows recovery features by modifying boot configuration data |