Техническая информация
Для обеспечения автозапуска и распространения:
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Invoker] 'ImagePath' = '<DRIVERS>\Invoker.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\FlexBios] 'ImagePath' = '<DRIVERS>\FlexBios.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\EBIOS32] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\EBIOS32] 'ImagePath' = 'System32\Drivers\EBIOS32.SYS'
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\ext2.tmp
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\EBIO8ae1.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\EBIO8b0f.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\ETKN8b4e.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\Flex8b7d.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\Flex8bcb.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\flex8bea.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\Flex8c09.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\Flex8c38.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\head8c96.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\Invo8cb5.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\Invo8ce4.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\invo8d03.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\Invo8d23.rra
- %TEMP%\pft3.tmp\variable.sys
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\iSMB8d52.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\iSmb8da0.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\left8dcf.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\left8e0d.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\READ8e2c.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\vssv8e4c.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\_IsU8e7a.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\valu8ef7.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\vssv8f17.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\isrt8f84.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\defa8fe2.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\_IsR904f.rra
- C:\EbuDllTmpDir\FlexEng.dll
- <DRIVERS>\Invoker.sys
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\EBIO8a83.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\EBIO8ab2.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\EBIO8a64.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\Dial8a44.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\back89f6.rra
- %TEMP%\pft3.tmp\pftw1.pkg
- %TEMP%\pft3.tmp\BiosUpdate.bio
- %TEMP%\pft3.tmp\data1.cab
- %TEMP%\pft3.tmp\data1.hdr
- %TEMP%\pft3.tmp\data2.cab
- %TEMP%\pft3.tmp\EfiVar.dll
- %TEMP%\pft3.tmp\ikernel.ex_
- %TEMP%\pft3.tmp\INTELEBU.PFW
- %TEMP%\pft3.tmp\layout.bin
- %TEMP%\pft3.tmp\Setup.exe
- %TEMP%\pft3.tmp\Setup.ini
- %TEMP%\pft3.tmp\setup.inx
- %TEMP%\pft3.tmp\setup.iss
- <DRIVERS>\FlexBios.sys
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\iSMB8d80.rra
- %TEMP%\pft3.tmp\UPDATE.cap
- %CommonProgramFiles%\InstallShield\engine\6\Intel 32\temp.000
- %CommonProgramFiles%\InstallShield\engine\6\Intel 32\ILog7c3b.rra
- %TEMP%\793d.rra
- %CommonProgramFiles%\InstallShield\engine\6\Intel 32\core7dd1.rra
- %CommonProgramFiles%\InstallShield\engine\6\Intel 32\ctor7e2f.rra
- %CommonProgramFiles%\InstallShield\engine\6\Intel 32\obje7fa6.rra
- %CommonProgramFiles%\InstallShield\engine\6\Intel 32\iuse8032.rra
- %CommonProgramFiles%\InstallShield\IScript\IScr8236.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\setu88ed.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\lice895a.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\vssv8979.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\back89a8.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\back89d7.rra
- %TEMP%\plf1.tmp
- %TEMP%\pft3.tmp\vssver2.scc
- <DRIVERS>\EBIOS32.SYS
Присваивает атрибут 'скрытый' для следующих файлов:
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\vssver2.scc
Удаляет следующие файлы:
- %TEMP%\ext2.tmp
- %TEMP%\pft3.tmp\pftw1.pkg
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\vssver2.scc
- <DRIVERS>\FlexBios.sys
- <DRIVERS>\Invoker.sys
Перемещает следующие файлы:
- %CommonProgramFiles%\InstallShield\engine\6\Intel 32\temp.000 в %CommonProgramFiles%\InstallShield\engine\6\Intel 32\IKernel.exe
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\flex8bea.rra в %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\flexbios64.sys
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\Flex8c09.rra в %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\FlexBiosDLL.dll
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\Flex8c38.rra в %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\FlexEng.dll
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\head8c96.rra в %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\header.bmp
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\Invo8cb5.rra в %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\Invoker.sys
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\Invo8ce4.rra в %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\Invoker.vxd
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\invo8d03.rra в %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\invoker64.sys
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\Invo8d23.rra в %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\InvokerDLL.dll
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\iSMB8d52.rra в %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\iSMBios.sys
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\iSMB8d80.rra в %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\iSMBios.VXD
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\iSmb8da0.rra в %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\iSmbiosDLL.dll
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\left8dcf.rra в %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\left_banner.bmp
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\left8e0d.rra в %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\left_sm.png
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\READ8e2c.rra в %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\README.TXT
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\_IsU8e7a.rra в %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\_IsUser.Dll
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\valu8ef7.rra в %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\value.shl
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\isrt8f84.rra в %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\isrt.dll
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\Flex8bcb.rra в %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\FlexBios.vxd
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\defa8fe2.rra в %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\default.pal
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\Flex8b7d.rra в %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\FlexBios.sys
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\EBIO8b0f.rra в %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\EBIOSSUP.dll
- %CommonProgramFiles%\InstallShield\engine\6\Intel 32\ILog7c3b.rra в %CommonProgramFiles%\InstallShield\engine\6\Intel 32\ILog.dll
- %CommonProgramFiles%\InstallShield\engine\6\Intel 32\core7dd1.rra в %CommonProgramFiles%\InstallShield\engine\6\Intel 32\corecomp.ini
- %CommonProgramFiles%\InstallShield\engine\6\Intel 32\ctor7e2f.rra в %CommonProgramFiles%\InstallShield\engine\6\Intel 32\ctor.dll
- %CommonProgramFiles%\InstallShield\engine\6\Intel 32\obje7fa6.rra в %CommonProgramFiles%\InstallShield\engine\6\Intel 32\objectps.dll
- %CommonProgramFiles%\InstallShield\engine\6\Intel 32\iuse8032.rra в %CommonProgramFiles%\InstallShield\engine\6\Intel 32\iuser.dll
- %CommonProgramFiles%\InstallShield\IScript\IScr8236.rra в %CommonProgramFiles%\InstallShield\IScript\IScript.dll
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\setu88ed.rra в %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\setup.inx
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\lice895a.rra в %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\license.txt
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\vssv8979.rra в %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\vssver2.scc
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\back89a8.rra в %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\background.bmp
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\back89d7.rra в %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\background.zip
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\back89f6.rra в %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\background_old.bmp
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\Dial8a44.rra в %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\DialogGraphic.bmp
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\EBIO8a64.rra в %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\EBIOS32.sys
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\EBIO8a83.rra в %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\EBIOS32.VXD
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\EBIO8ab2.rra в %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\EBIOSPost.exe
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\EBIO8ae1.rra в %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\EBIOSRes.dll
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\ETKN8b4e.rra в %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\ETKNVRam.dll
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\_IsR904f.rra в %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\_IsRes.dll
Подменяет следующие файлы:
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\vssver2.scc
Другое:
Создает и запускает на исполнение:
- '%TEMP%\pft3.tmp\Setup.exe' /SMS
- '%CommonProgramFiles%\InstallShield\engine\6\Intel 32\IKernel.exe' -RegServer
- '%CommonProgramFiles%\InstallShield\engine\6\Intel 32\IKernel.exe' 32\IKernel.exe -Embedding
- '%CommonProgramFiles%\InstallShield\engine\6\Intel 32\IKernel.exe' /REGSERVER
