Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Shuttle2000auto' = '%ProgramFiles%\EnterSafe\ePass2000Auto\certd2ka.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\eBankService] 'ImagePath' = '<SYSTEM32>\rundll32.exe <SYSTEM32>\e2acsp11.dll,eb_service'
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\ext2.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- %ProgramFiles%\InstallShield Installation Information\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\Setup.ini
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- %ProgramFiles%\InstallShield Installation Information\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\setu7092.rra
- %ProgramFiles%\InstallShield Installation Information\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\Setu7073.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- %ProgramFiles%\InstallShield Installation Information\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\Setu7044.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- %ProgramFiles%\InstallShield Installation Information\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\data6f1b.rra
- %ProgramFiles%\InstallShield Installation Information\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\data6f0c.rra
- %ProgramFiles%\InstallShield Installation Information\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\layo6eec.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- %TEMP%\nsx7.tmp
- %ProgramFiles%\EnterSafe\ePass2000Auto\lang\escsp_2052.lng
- %TEMP%\nscD.tmp\ioSpecial.ini
- %TEMP%\nscD.tmp\UserInfo.dll
- %TEMP%\nscD.tmp\System.dll
- %ALLUSERSPROFILE%\Start Menu\Programs\EnterSafe\ePass2000Auto\Uninstall ePass2000Auto.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\EnterSafe\ePass2000Auto\ePass2000AutoCertificate Manager.lnk
- <SYSTEM32>\e2acsp11.dll
- <SYSTEM32>\e2acsp11_s.dll
- %TEMP%\nsc8.tmp\UserInfo.dll
- %TEMP%\nsc8.tmp\System.dll
- %ProgramFiles%\EnterSafe\ePass2000Auto\lang\escsp_1033.lng
- %ProgramFiles%\EnterSafe\ePass2000Auto\lang\escertd_2052.lng
- %ProgramFiles%\EnterSafe\ePass2000Auto\lang\escertd_1033.lng
- %ProgramFiles%\EnterSafe\ePass2000Auto\lang\esmgr_2052.lng
- %ProgramFiles%\EnterSafe\ePass2000Auto\lang\esmgr_1033.lng
- %ProgramFiles%\EnterSafe\ePass2000Auto\certd2ka.exe
- %ProgramFiles%\EnterSafe\ePass2000Auto\uninst.exe
- <SYSTEM32>\e2acsp11.sig
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- %TEMP%\3406.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe
- %TEMP%\IEU5.tmp
- %TEMP%\IEC4.tmp
- %TEMP%\pft3~tmp\Disk1\setup.inx
- %TEMP%\pft3~tmp\Disk1\Setup.ini
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor3742.rra
- %TEMP%\pft3~tmp\Disk1\Setup.exe
- %TEMP%\pft3~tmp\Disk1\layout.bin
- %TEMP%\pft3~tmp\Disk1\ikernel.ex_
- %TEMP%\pft3~tmp\Disk1\data2.cab
- %TEMP%\pft3~tmp\Disk1\data1.hdr
- %TEMP%\pft3~tmp\Disk1\data1.cab
- %TEMP%\pft3~tmp\pftw1.pkg
- %TEMP%\plf1.tmp
- %TEMP%\pft3~tmp\Disk1\Setup.bmp
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\obje383c.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\core36f4.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuse388a.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- %TEMP%\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\_IsR42ac.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- %TEMP%\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\defa425e.rra
- %CommonProgramFiles%\InstallShield\IScript\iscr39e2.rra
- %TEMP%\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\isrt4210.rra
- %TEMP%\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\valu41c2.rra
- %TEMP%\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\load4164.rra
- %TEMP%\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\iTru4089.rra
- %TEMP%\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\eP2K3fed.rra
- %TEMP%\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\auto3fce.rra
- %TEMP%\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\setu3f60.rra
- %TEMP%\nscD.tmp\modern-wizard.bmp
- %TEMP%\nscD.tmp\InstallOptions.dll
Удаляет следующие файлы:
- %TEMP%\ext2.tmp
- %TEMP%\pft3~tmp\pftw1.pkg
- %TEMP%\IEC4.tmp
- %TEMP%\IEU5.tmp
- %TEMP%\nsc8.tmp\System.dll
- %TEMP%\nsc8.tmp\UserInfo.dll
Перемещает следующие файлы:
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\core36f4.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\corecomp.ini
- %ProgramFiles%\InstallShield Installation Information\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\Setu7044.rra в %ProgramFiles%\InstallShield Installation Information\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\Setup.exe
- %ProgramFiles%\InstallShield Installation Information\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\data6f1b.rra в %ProgramFiles%\InstallShield Installation Information\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\data1.cab
- %ProgramFiles%\InstallShield Installation Information\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\data6f0c.rra в %ProgramFiles%\InstallShield Installation Information\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\data1.hdr
- %ProgramFiles%\InstallShield Installation Information\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\layo6eec.rra в %ProgramFiles%\InstallShield Installation Information\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\layout.bin
- %TEMP%\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\_IsR42ac.rra в %TEMP%\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\_IsRes.dll
- %TEMP%\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\defa425e.rra в %TEMP%\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\default.pal
- %TEMP%\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\isrt4210.rra в %TEMP%\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\isrt.dll
- %TEMP%\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\valu41c2.rra в %TEMP%\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\value.shl
- %TEMP%\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\load4164.rra в %TEMP%\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\loader.exe
- %TEMP%\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\iTru4089.rra в %TEMP%\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\iTrusPTA.exe
- %TEMP%\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\eP2K3fed.rra в %TEMP%\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\eP2Kauto.exe
- %TEMP%\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\auto3fce.rra в %TEMP%\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\autorun.inf
- %TEMP%\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\setu3f60.rra в %TEMP%\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\setup.inx
- %CommonProgramFiles%\InstallShield\IScript\iscr39e2.rra в %CommonProgramFiles%\InstallShield\IScript\iscript.dll
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuse388a.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuser.dll
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\obje383c.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\objectps.dll
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor3742.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor.dll
- %ProgramFiles%\InstallShield Installation Information\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\Setu7073.rra в %ProgramFiles%\InstallShield Installation Information\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\Setup.ini
- %ProgramFiles%\InstallShield Installation Information\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\setu7092.rra в %ProgramFiles%\InstallShield Installation Information\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\setup.inx
Другое:
Создает и запускает на исполнение:
- '%TEMP%\pft3~tmp\Disk1\Setup.exe'
- '%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' -RegServer
- '%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' 32\IKernel.exe -Embedding
- '%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' /REGSERVER
- '%TEMP%\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\eP2Kauto.exe' /s
- '%ProgramFiles%\EnterSafe\ePass2000Auto\certd2ka.exe'
- '%TEMP%\{63C0CF6A-3949-4362-9FFE-2774453A8AA3}\iTrusPTA.exe' /s
Запускает на исполнение:
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\e2acsp11.dll,eb_service
