Техническая информация
Для обеспечения автозапуска и распространения:
Подменяет следующие исполняемые системные файлы:
- <SYSTEM32>\msvcp71.dll файлом <SYSTEM32>\msvc2cd4.rra
- <SYSTEM32>\msvcr71.dll файлом <SYSTEM32>\msvc2dbe.rra
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\ext2.tmp
- %ProgramFiles%\InstallShield Installation Information\{98DAB161-EE7A-4433-BE10-BCD7292FF41A}\Setu231f.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- %ProgramFiles%\InstallShield Installation Information\{98DAB161-EE7A-4433-BE10-BCD7292FF41A}\Setu22f1.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- %ProgramFiles%\InstallShield Installation Information\{98DAB161-EE7A-4433-BE10-BCD7292FF41A}\data2283.rra
- %ProgramFiles%\InstallShield Installation Information\{98DAB161-EE7A-4433-BE10-BCD7292FF41A}\setu234e.rra
- %ProgramFiles%\InstallShield Installation Information\{98DAB161-EE7A-4433-BE10-BCD7292FF41A}\data2264.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- %ProgramFiles%\InstallShield Installation Information\{98DAB161-EE7A-4433-BE10-BCD7292FF41A}\layo2245.rra
- <SYSTEM32>\SETU26d9.rra
- <SYSTEM32>\msvc2dbe.rra
- %ProgramFiles%\InstallShield Installation Information\{98DAB161-EE7A-4433-BE10-BCD7292FF41A}\Setup.ini
- <SYSTEM32>\msvc2cd4.rra
- <SYSTEM32>\JRCO2c38.rra
- <SYSTEM32>\wxms2b7c.rra
- <SYSTEM32>\wxms291b.rra
- <SYSTEM32>\wxms289e.rra
- <SYSTEM32>\wxba27c3.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- <SYSTEM32>\Sign2727.rra
- <SYSTEM32>\ResF266b.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- <SYSTEM32>\LLF24e5.rra
- <SYSTEM32>\Lang24b6.rra
- <SYSTEM32>\Elit2487.rra
- %ProgramFiles%\ЅрИуµзЧУ±кК鹫№ІіМРт\DLL\Exce2439.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\obje9e4f.rra
- %TEMP%\8e32.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe
- %TEMP%\IEU5.tmp
- %TEMP%\IEC4.tmp
- %TEMP%\pft3~tmp\Disk1\setup.inx
- %TEMP%\pft3~tmp\Disk1\Setup.ini
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\core98b2.rra
- %TEMP%\pft3~tmp\Disk1\Setup.exe
- %TEMP%\pft3~tmp\Disk1\ikernel.ex_
- %TEMP%\pft3~tmp\Disk1\data2.cab
- %TEMP%\pft3~tmp\Disk1\data1.hdr
- %TEMP%\pft3~tmp\Disk1\data1.cab
- %TEMP%\pft3~tmp\pftw1.pkg
- %TEMP%\plf1.tmp
- %TEMP%\pft3~tmp\Disk1\layout.bin
- %TEMP%\{98DAB161-EE7A-4433-BE10-BCD7292FF41A}\defabe3b.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuse9f78.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- %TEMP%\{98DAB161-EE7A-4433-BE10-BCD7292FF41A}\_IsRbfd2.rra
- %TEMP%\{98DAB161-EE7A-4433-BE10-BCD7292FF41A}\isrtbd9f.rra
- %TEMP%\{98DAB161-EE7A-4433-BE10-BCD7292FF41A}\valubd12.rra
- %TEMP%\{98DAB161-EE7A-4433-BE10-BCD7292FF41A}\Jr_dbb0f.rra
- %TEMP%\{98DAB161-EE7A-4433-BE10-BCD7292FF41A}\licebad0.rra
- %TEMP%\{98DAB161-EE7A-4433-BE10-BCD7292FF41A}\setub7d3.rra
- %CommonProgramFiles%\InstallShield\IScript\iscra61f.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor993f.rra
- <SYSTEM32>\msvc2e5a.rra
Удаляет следующие файлы:
- %TEMP%\ext2.tmp
- %TEMP%\pft3~tmp\pftw1.pkg
- %TEMP%\IEC4.tmp
- %TEMP%\IEU5.tmp
- <SYSTEM32>\msvcp71.dll
- <SYSTEM32>\msvcr71.dll
- <SYSTEM32>\msvcrt.dll
Перемещает следующие файлы:
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\core98b2.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\corecomp.ini
- <SYSTEM32>\wxms291b.rra в <SYSTEM32>\wxmsw26_core_vc_custom.dll
- <SYSTEM32>\wxms289e.rra в <SYSTEM32>\wxmsw26_adv_vc_custom.dll
- <SYSTEM32>\wxba27c3.rra в <SYSTEM32>\wxbase26_vc_custom.dll
- <SYSTEM32>\Sign2727.rra в <SYSTEM32>\SignCore.DLL
- <SYSTEM32>\SETU26d9.rra в <SYSTEM32>\SETUP_DLL.dll
- <SYSTEM32>\ResF266b.rra в <SYSTEM32>\ResFAT.dll
- <SYSTEM32>\LLF24e5.rra в <SYSTEM32>\LLF.dll
- <SYSTEM32>\Lang24b6.rra в <SYSTEM32>\Language.dll
- <SYSTEM32>\Elit2487.rra в <SYSTEM32>\Elite4Flash.dll
- %ProgramFiles%\ЅрИуµзЧУ±кК鹫№ІіМРт\DLL\Exce2439.rra в %ProgramFiles%\ЅрИуµзЧУ±кК鹫№ІіМРт\DLL\ExcelName.dll
- %ProgramFiles%\InstallShield Installation Information\{98DAB161-EE7A-4433-BE10-BCD7292FF41A}\setu234e.rra в %ProgramFiles%\InstallShield Installation Information\{98DAB161-EE7A-4433-BE10-BCD7292FF41A}\setup.inx
- %ProgramFiles%\InstallShield Installation Information\{98DAB161-EE7A-4433-BE10-BCD7292FF41A}\Setu231f.rra в %ProgramFiles%\InstallShield Installation Information\{98DAB161-EE7A-4433-BE10-BCD7292FF41A}\Setup.ini
- %ProgramFiles%\InstallShield Installation Information\{98DAB161-EE7A-4433-BE10-BCD7292FF41A}\Setu22f1.rra в %ProgramFiles%\InstallShield Installation Information\{98DAB161-EE7A-4433-BE10-BCD7292FF41A}\Setup.exe
- %ProgramFiles%\InstallShield Installation Information\{98DAB161-EE7A-4433-BE10-BCD7292FF41A}\data2283.rra в %ProgramFiles%\InstallShield Installation Information\{98DAB161-EE7A-4433-BE10-BCD7292FF41A}\data1.cab
- %ProgramFiles%\InstallShield Installation Information\{98DAB161-EE7A-4433-BE10-BCD7292FF41A}\data2264.rra в %ProgramFiles%\InstallShield Installation Information\{98DAB161-EE7A-4433-BE10-BCD7292FF41A}\data1.hdr
- %ProgramFiles%\InstallShield Installation Information\{98DAB161-EE7A-4433-BE10-BCD7292FF41A}\layo2245.rra в %ProgramFiles%\InstallShield Installation Information\{98DAB161-EE7A-4433-BE10-BCD7292FF41A}\layout.bin
- %TEMP%\{98DAB161-EE7A-4433-BE10-BCD7292FF41A}\_IsRbfd2.rra в %TEMP%\{98DAB161-EE7A-4433-BE10-BCD7292FF41A}\_IsRes.dll
- %TEMP%\{98DAB161-EE7A-4433-BE10-BCD7292FF41A}\defabe3b.rra в %TEMP%\{98DAB161-EE7A-4433-BE10-BCD7292FF41A}\default.pal
- %TEMP%\{98DAB161-EE7A-4433-BE10-BCD7292FF41A}\isrtbd9f.rra в %TEMP%\{98DAB161-EE7A-4433-BE10-BCD7292FF41A}\isrt.dll
- %TEMP%\{98DAB161-EE7A-4433-BE10-BCD7292FF41A}\valubd12.rra в %TEMP%\{98DAB161-EE7A-4433-BE10-BCD7292FF41A}\value.shl
- %TEMP%\{98DAB161-EE7A-4433-BE10-BCD7292FF41A}\Jr_dbb0f.rra в %TEMP%\{98DAB161-EE7A-4433-BE10-BCD7292FF41A}\Jr_dll_utility.dll
- %TEMP%\{98DAB161-EE7A-4433-BE10-BCD7292FF41A}\licebad0.rra в %TEMP%\{98DAB161-EE7A-4433-BE10-BCD7292FF41A}\license.txt
- %TEMP%\{98DAB161-EE7A-4433-BE10-BCD7292FF41A}\setub7d3.rra в %TEMP%\{98DAB161-EE7A-4433-BE10-BCD7292FF41A}\setup.inx
- %CommonProgramFiles%\InstallShield\IScript\iscra61f.rra в %CommonProgramFiles%\InstallShield\IScript\iscript.dll
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuse9f78.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuser.dll
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\obje9e4f.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\objectps.dll
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor993f.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor.dll
- <SYSTEM32>\wxms2b7c.rra в <SYSTEM32>\wxmsw26_html_vc_custom.dll
- <SYSTEM32>\JRCO2c38.rra в <SYSTEM32>\JRCOMLib.dll
Другое:
Создает и запускает на исполнение:
- '%TEMP%\pft3~tmp\Disk1\Setup.exe'
- '%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' -RegServer
- '%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' 32\IKernel.exe -Embedding
- '%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' /REGSERVER
