Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'wextract_cleanup0' = 'rundll32.exe <SYSTEM32>\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"'
Создает или изменяет следующие файлы:
- %HOMEPATH%\Start Menu\Programs\Startup\ST5UNST Uninstaller.LNK
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\IXP000.TMP\SelfComV3.ex_
- %TEMP%\IXP000.TMP\SelfComReset.rt_
- %TEMP%\IXP000.TMP\SelfComNotReset.rt_
- %TEMP%\IXP000.TMP\SelfComV3.DE_
- %TEMP%\IXP000.TMP\SETUP.LST
- %TEMP%\IXP000.TMP\SETUP.EXE
- %TEMP%\IXP000.TMP\Settings.rt_
- %TEMP%\IXP000.TMP\SelfCom6.rt_
- %TEMP%\IXP000.TMP\SelfCom5.rt_
- %TEMP%\IXP000.TMP\SelfCom4.rt_
- %TEMP%\IXP000.TMP\SelfCom7.rt_
- %TEMP%\IXP000.TMP\SelfCom.rt_
- %TEMP%\IXP000.TMP\SelfCom.ic_
- %TEMP%\IXP000.TMP\SelfCom Agenda.rt_
- %TEMP%\IXP000.TMP\StdOle2.tl_
- %TEMP%\IXP000.TMP\status.rt_
- %TEMP%\IXP000.TMP\status.nd_
- %TEMP%\IXP000.TMP\structure.jp_
- %TEMP%\IXP000.TMP\Stuffout.wa_
- %TEMP%\IXP000.TMP\Stuffin.wa_
- %TEMP%\IXP000.TMP\Structure.rt_
- %TEMP%\IXP000.TMP\Skill.rt_
- %TEMP%\IXP000.TMP\Similarities.rt_
- %TEMP%\IXP000.TMP\setup1.ex_
- %TEMP%\IXP000.TMP\Skilling.rt_
- %TEMP%\IXP000.TMP\ST5UNST.EX_
- %TEMP%\IXP000.TMP\SPEAK.WA_
- %TEMP%\IXP000.TMP\Source.rt_
- %TEMP%\IXP000.TMP\ResetMsg.rt_
- %TEMP%\IXP000.TMP\Reconciliation.rt_
- %TEMP%\IXP000.TMP\Reason.rt_
- %TEMP%\IXP000.TMP\resetn.wa_
- %TEMP%\IXP000.TMP\RichEd32.dl_
- %TEMP%\IXP000.TMP\resetyn.wa_
- %TEMP%\IXP000.TMP\resety.wa_
- %TEMP%\IXP000.TMP\Questioning.rt_
- %TEMP%\IXP000.TMP\Pretending.rt_
- %TEMP%\IXP000.TMP\Power.rt_
- %TEMP%\IXP000.TMP\rankupdate.rt_
- %TEMP%\IXP000.TMP\Realization.rt_
- %TEMP%\IXP000.TMP\Reality.rt_
- %TEMP%\IXP000.TMP\Reading.rt_
- %TEMP%\IXP000.TMP\Self Concept.rt_
- %TEMP%\IXP000.TMP\scroll-on.wa_
- %TEMP%\IXP000.TMP\scroll-off.wa_
- %TEMP%\IXP000.TMP\SelfCom0.rt_
- %TEMP%\IXP000.TMP\SelfCom3.rt_
- %TEMP%\IXP000.TMP\SelfCom2.rt_
- %TEMP%\IXP000.TMP\SelfCom1.rt_
- %TEMP%\IXP000.TMP\RUN.WA_
- %TEMP%\IXP000.TMP\River.rt_
- %TEMP%\IXP000.TMP\RICHTX32.OC_
- %TEMP%\IXP000.TMP\SCCLO.WA_
- %TEMP%\IXP000.TMP\scrollintro.rt_
- %TEMP%\IXP000.TMP\SCOPN.WA_
- %TEMP%\IXP000.TMP\Science.rt_
- %TEMP%\IXP000.TMP\wood3-reset-up.jp_
- %TEMP%\IXP000.TMP\wood3-reset-dn.jp_
- %TEMP%\IXP000.TMP\wood3-jrnl-opn-up.jp_
- %TEMP%\IXP000.TMP\wood3-tinytorch.jp_
- %TEMP%\IXP000.TMP\wood3-torch-a-l7.JP_
- %TEMP%\IXP000.TMP\wood3-torch-a.jp_
- %TEMP%\IXP000.TMP\wood3-torch.jp_
- %TEMP%\IXP000.TMP\wood3-fr1.jp_
- %TEMP%\IXP000.TMP\wood3-btn-xit-l7a.JP_
- %TEMP%\IXP000.TMP\wood3-btn-xit.JP_
- %TEMP%\IXP000.TMP\wood3-fr1-l7.JP_
- %TEMP%\IXP000.TMP\wood3-jrnl-opn-dn.jp_
- %TEMP%\IXP000.TMP\wood3-jrnl-clos-up.jp_
- %TEMP%\IXP000.TMP\wood3-jrnl-clos-dn.jp_
- %TEMP%\IXP000.TMP\work.nd_
- %TEMP%\IXP000.TMP\wood3-torch-l7.JP_
- %TEMP%\IXP000.TMP\wood3-torch-d-l7.JP_
- %WINDIR%\ST5UNST.000
- <SYSTEM32>\temp.000
- %WINDIR%\SETUP.LST
- %WINDIR%\temp.000
- %TEMP%\IXP000.TMP\wood3-torch-btn-dn.jp_
- %TEMP%\IXP000.TMP\wood3-torch-b-l7.jp_
- %TEMP%\IXP000.TMP\wood3-torch-b.jp_
- %TEMP%\IXP000.TMP\wood3-torch-btn-up.jp_
- %TEMP%\IXP000.TMP\wood3-torch-d.jp_
- %TEMP%\IXP000.TMP\wood3-torch-c-l7.JP_
- %TEMP%\IXP000.TMP\wood3-torch-c.jp_
- %TEMP%\IXP000.TMP\VB5StKit.dl_
- %TEMP%\IXP000.TMP\Value.rt_
- %TEMP%\IXP000.TMP\tweet3.wa_
- %TEMP%\IXP000.TMP\view.rt_
- %TEMP%\IXP000.TMP\Waters-1.rt_
- %TEMP%\IXP000.TMP\ViewPoint.rt_
- %TEMP%\IXP000.TMP\VIEWJNL.WA_
- %TEMP%\IXP000.TMP\Thoughts.rt_
- %TEMP%\IXP000.TMP\Thought.rt_
- %TEMP%\IXP000.TMP\subjectref.rt_
- %TEMP%\IXP000.TMP\Time.rt_
- %TEMP%\IXP000.TMP\Tweaking.rt_
- %TEMP%\IXP000.TMP\torch-on.wa_
- %TEMP%\IXP000.TMP\torch-off.wa_
- %TEMP%\IXP000.TMP\wood3-btn-about.JP_
- %TEMP%\IXP000.TMP\wood3-book-opn-up.jp_
- %TEMP%\IXP000.TMP\wood3-book-opn-dn.jp_
- %TEMP%\IXP000.TMP\wood3-btn-dn.jp_
- %TEMP%\IXP000.TMP\wood3-btn-up-p.jp_
- %TEMP%\IXP000.TMP\wood3-btn-up.jp_
- %TEMP%\IXP000.TMP\wood3-btn-dn-p.jp_
- %TEMP%\IXP000.TMP\wood3-bkg.jp_
- %TEMP%\IXP000.TMP\wood3-bkg3.jp_
- %TEMP%\IXP000.TMP\Waters-2.rt_
- %TEMP%\IXP000.TMP\wood3-bkg-l7.jp_
- %TEMP%\IXP000.TMP\wood3-book-clos-up.jp_
- %TEMP%\IXP000.TMP\wood3-book-clos-dn.jp_
- %TEMP%\IXP000.TMP\wood3-bkg-l7O.jp_
- %TEMP%\IXP000.TMP\cbicon6.jp_
- %TEMP%\IXP000.TMP\cbicon5.jp_
- %TEMP%\IXP000.TMP\cbicon4.jp_
- %TEMP%\IXP000.TMP\cbicon7.jp_
- %TEMP%\IXP000.TMP\Closejnl.rt_
- %TEMP%\IXP000.TMP\Chunks.rt_
- %TEMP%\IXP000.TMP\Chunks-1.rt_
- %TEMP%\IXP000.TMP\Caution.rt_
- %TEMP%\IXP000.TMP\Cause-Effect.rt_
- %TEMP%\IXP000.TMP\Cause-Effect-2.rt_
- %TEMP%\IXP000.TMP\cbicon0.jp_
- %TEMP%\IXP000.TMP\cbicon3.jp_
- %TEMP%\IXP000.TMP\cbicon2.jp_
- %TEMP%\IXP000.TMP\cbicon1.jp_
- %TEMP%\IXP000.TMP\Discernment.rt_
- %TEMP%\IXP000.TMP\Ctl3d32.dl_
- %TEMP%\IXP000.TMP\Creativity.rt_
- %TEMP%\IXP000.TMP\Er-1.rt_
- %TEMP%\IXP000.TMP\Exploration.rt_
- %TEMP%\IXP000.TMP\EXIT.WA_
- %TEMP%\IXP000.TMP\Ethics.rt_
- %TEMP%\IXP000.TMP\ComCat.dl_
- %TEMP%\IXP000.TMP\CLOSJNL.WA_
- %TEMP%\IXP000.TMP\Closeman.rt_
- %TEMP%\IXP000.TMP\commander.wa_
- %TEMP%\IXP000.TMP\Cosmic Map.rt_
- %TEMP%\IXP000.TMP\Controversy.rt_
- %TEMP%\IXP000.TMP\Continuum.rt_
- %TEMP%\IXP000.TMP\award0.rt_
- %TEMP%\IXP000.TMP\Awake.rt_
- %TEMP%\IXP000.TMP\autorun.in_
- %TEMP%\IXP000.TMP\award1.rt_
- %TEMP%\IXP000.TMP\award2.wa_
- %TEMP%\IXP000.TMP\award2.rt_
- %TEMP%\IXP000.TMP\award1.wa_
- %TEMP%\IXP000.TMP\ADDREC.WA_
- %TEMP%\IXP000.TMP\About.rt_
- %TEMP%\IXP000.TMP\XITJNL.WA_
- %TEMP%\IXP000.TMP\allone.rt_
- %TEMP%\IXP000.TMP\Automatic Living.rt_
- %TEMP%\IXP000.TMP\AsycFilt.dl_
- %TEMP%\IXP000.TMP\ambition.rt_
- %TEMP%\IXP000.TMP\award12.rt_
- %TEMP%\IXP000.TMP\award11.rt_
- %TEMP%\IXP000.TMP\award10.rt_
- %TEMP%\IXP000.TMP\award13.rt_
- %TEMP%\IXP000.TMP\Awareness.rt_
- %TEMP%\IXP000.TMP\award-1.rt_
- %TEMP%\IXP000.TMP\award14.rt_
- %TEMP%\IXP000.TMP\award5.rt_
- %TEMP%\IXP000.TMP\award4.rt_
- %TEMP%\IXP000.TMP\award3.rt_
- %TEMP%\IXP000.TMP\award6.rt_
- %TEMP%\IXP000.TMP\award9.rt_
- %TEMP%\IXP000.TMP\award8.rt_
- %TEMP%\IXP000.TMP\award7.rt_
- %TEMP%\IXP000.TMP\MSVBVM50.dl_
- %TEMP%\IXP000.TMP\mission.nd_
- %TEMP%\IXP000.TMP\Mechanism.rt_
- %TEMP%\IXP000.TMP\Needs.rt_
- %TEMP%\IXP000.TMP\NotDoneYet.rt_
- %TEMP%\IXP000.TMP\newsubject.rt_
- %TEMP%\IXP000.TMP\New Skill.rt_
- %TEMP%\IXP000.TMP\key-agenda.rt_
- %TEMP%\IXP000.TMP\Journal Report.rt_
- %TEMP%\IXP000.TMP\Journal Entry.rt_
- %TEMP%\IXP000.TMP\lab-1.rt_
- %TEMP%\IXP000.TMP\MCI32.OC_
- %TEMP%\IXP000.TMP\Manifestation.rt_
- %TEMP%\IXP000.TMP\Level One Goal.rt_
- %TEMP%\IXP000.TMP\OPNJNL.WA_
- %TEMP%\IXP000.TMP\operative.wa_
- %TEMP%\IXP000.TMP\openness.rt_
- %TEMP%\IXP000.TMP\Parameters.rt_
- %TEMP%\IXP000.TMP\plugin.rt_
- %TEMP%\IXP000.TMP\Perspective.rt_
- %TEMP%\IXP000.TMP\Perception.rt_
- %TEMP%\IXP000.TMP\OleAut32.dl_
- %TEMP%\IXP000.TMP\Observation.rt_
- %TEMP%\IXP000.TMP\NotDoneYet-o.rt_
- %TEMP%\IXP000.TMP\OlePro32.dl_
- %TEMP%\IXP000.TMP\open1.wa_
- %TEMP%\IXP000.TMP\open0.wa_
- %TEMP%\IXP000.TMP\Oneness.rt_
- %TEMP%\IXP000.TMP\gbicon2.jp_
- %TEMP%\IXP000.TMP\gbicon1.jp_
- %TEMP%\IXP000.TMP\gbicon0.jp_
- %TEMP%\IXP000.TMP\gbicon3.jp_
- %TEMP%\IXP000.TMP\gbicon6.jp_
- %TEMP%\IXP000.TMP\gbicon5.jp_
- %TEMP%\IXP000.TMP\gbicon4.jp_
- %TEMP%\IXP000.TMP\Feelings.rt_
- %TEMP%\IXP000.TMP\Feeling.rt_
- %TEMP%\IXP000.TMP\Feel.rt_
- %TEMP%\IXP000.TMP\feelnow.rt_
- %TEMP%\IXP000.TMP\Gauge.rt_
- %TEMP%\IXP000.TMP\galaxy.rt_
- %TEMP%\IXP000.TMP\finish.wa_
- %TEMP%\IXP000.TMP\Interface-2.rt_
- %TEMP%\IXP000.TMP\Interaction.rt_
- %TEMP%\IXP000.TMP\Inner Feeling.rt_
- %TEMP%\IXP000.TMP\Interface.rt_
- %TEMP%\IXP000.TMP\JE-1.rt_
- %TEMP%\IXP000.TMP\introduction.rt_
- %TEMP%\IXP000.TMP\intro.wa_
- %TEMP%\IXP000.TMP\Greetings.rt_
- %TEMP%\IXP000.TMP\Getting Things.rt_
- %TEMP%\IXP000.TMP\gbicon7.jp_
- %TEMP%\IXP000.TMP\Holding Up.rt_
- %TEMP%\IXP000.TMP\Inner Awareness.rt_
- %TEMP%\IXP000.TMP\info.nd_
- %TEMP%\IXP000.TMP\icons.rt_
Перемещает следующие файлы:
- <SYSTEM32>\temp.000 в <SYSTEM32>\VB5StKit.dll
- %WINDIR%\temp.000 в %WINDIR%\setup1.exe
- %WINDIR%\temp.000 в %WINDIR%\ST5UNST.EXE
Подменяет следующие файлы:
- %WINDIR%\temp.000
Другое:
Ищет следующие окна:
- ClassName: 'GVBSetupInit' WindowName: ''
Создает и запускает на исполнение:
- '%TEMP%\IXP000.TMP\SETUP.EXE'
