Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Classes\ExtremeCopy\shell\open\command] '' = '%ProgramFiles%\Easersoft\ExtremeCopy\ExtremeCopy.exe -task_dlg %1'
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\aut1.tmp
- %ProgramFiles%\Easersoft\ExtremeCopy\Done.wav
- %ProgramFiles%\Easersoft\ExtremeCopy\XCShellExt64.dll
- %ProgramFiles%\Easersoft\ExtremeCopy\Language\XCRes_FRA.dll
- %ProgramFiles%\Easersoft\ExtremeCopy\Language\XCRes_DEU.dll
- %ProgramFiles%\Easersoft\ExtremeCopy\XCBugReport.exe
- %ProgramFiles%\Easersoft\ExtremeCopy\Language\XCRes_IDN.dll
- %ProgramFiles%\Easersoft\ExtremeCopy\Language\XCRes_ITA.dll
- %ProgramFiles%\Easersoft\ExtremeCopy\Language\XCRes_THA.dll
- %ProgramFiles%\Easersoft\ExtremeCopy\Language\XCRes_PRT.dll
- %ProgramFiles%\Easersoft\ExtremeCopy\Language\XCRes_CHN.dll
- %ProgramFiles%\Easersoft\ExtremeCopy\Config.ini
- %ProgramFiles%\Easersoft\ExtremeCopy\XCUpdate.exe
- %ProgramFiles%\Easersoft\ExtremeCopy\Language\XCRes_KOR.dll
- %ProgramFiles%\Easersoft\ExtremeCopy\Language\XCRes_CHT.dll
- %ProgramFiles%\Easersoft\ExtremeCopy\ExtremeCopy.exe
- %ProgramFiles%\Easersoft\ExtremeCopy\Language\XCRes_ENU.dll
- %ProgramFiles%\Easersoft\ExtremeCopy\XCShellExt.dll
- %ProgramFiles%\Easersoft\ExtremeCopy\XCopyVISTA.exe
- %WINDIR%\Installer\MSI14.tmp
- C:\Config.Msi\21af3.rbs
- %TEMP%\{0CACBDED-E1ED-4F85-917C-413B824ACF9F}\String1033.txt
- %TEMP%\_is12.tmp
- %ProgramFiles%\Easersoft\ExtremeCopy\ExtremeCopy Help.chm
- %ALLUSERSPROFILE%\Start Menu\Programs\ExtremeCopy\About.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\ExtremeCopy\Configuration.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\ExtremeCopy\Register.lnk
- %TEMP%\{F7224F53-F89D-4E9F-834F-D469E8879DA8}\_isres_0x0409.dll
- %TEMP%\_is1C.tmp
- %TEMP%\{F7224F53-F89D-4E9F-834F-D469E8879DA8}\ISRT.dll
- %TEMP%\_is1B.tmp
- %TEMP%\{F7224F53-F89D-4E9F-834F-D469E8879DA8}\setup.inx
- %TEMP%\_is1A.tmp
- %TEMP%\{F7224F53-F89D-4E9F-834F-D469E8879DA8}\IsConfig.ini
- %TEMP%\_is19.tmp
- %WINDIR%\Installer\MSI18.tmp
- %WINDIR%\Installer\MSI17.tmp
- %WINDIR%\Installer\{9B4091A4-9556-402F-B703-31C203BDE889}\NewShortcut132_48DD1F2C4EB64A3FA78A3FBE72B51F39.exe
- %WINDIR%\Installer\{9B4091A4-9556-402F-B703-31C203BDE889}\NewShortcut2_8098936C11564F959FFD61445616E5FE.exe
- %WINDIR%\Installer\{9B4091A4-9556-402F-B703-31C203BDE889}\NewShortcut13_853B80A3411445EB99F38F1C8104D8C0.exe
- %WINDIR%\Installer\{9B4091A4-9556-402F-B703-31C203BDE889}\NewShortcut12_54D96325A3B04299AEB36F564E9A30FB.exe
- %WINDIR%\Installer\{9B4091A4-9556-402F-B703-31C203BDE889}\NewShortcut6_F8E9D956D78F45708E48F09A21024F62.exe
- %WINDIR%\Installer\{9B4091A4-9556-402F-B703-31C203BDE889}\NewShortcut10_3BE03658867C4AC7ADB229F3F12FA90A.exe
- %WINDIR%\Installer\{9B4091A4-9556-402F-B703-31C203BDE889}\ARPPRODUCTICON.exe
- %WINDIR%\Installer\21af4.msi
- %WINDIR%\Installer\MSI15.tmp
- %ALLUSERSPROFILE%\Desktop\ExtremeCopy Pro.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\ExtremeCopy\ExtremeCopy Pro.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\ExtremeCopy\Uninstall.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\ExtremeCopy\Bug Report.lnk
- %TEMP%\{0CACBDED-E1ED-4F85-917C-413B824ACF9F}\_isres_0x0409.dll
- %TEMP%\_is1D.tmp
- %TEMP%\_is11.tmp
- %TEMP%\_is10.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- %WINDIR%\Installer\21af2.ipi
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- %WINDIR%\Installer\MSI3.tmp
- %WINDIR%\Installer\21af0.msi
- %APPDATA%\ExtremeCopy\genflpui.$$A
- %APPDATA%\ExtremeCopy\ec32.$$A
- %TEMP%\ExtremeCopy 2.3.4 Pro\filex64.exe
- %TEMP%\aut2.tmp
- %TEMP%\ExtremeCopy 2.3.4 Pro\filex86.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- %TEMP%\{0CACBDED-E1ED-4F85-917C-413B824ACF9F}\setup.inx
- %TEMP%\_isF.tmp
- %TEMP%\{0CACBDED-E1ED-4F85-917C-413B824ACF9F}\IsConfig.ini
- %TEMP%\_isE.tmp
- %WINDIR%\Installer\MSID.tmp
- %TEMP%\{C22AC0C4-3878-48E6-88A5-1A75A48960E5}\String1033.txt
- %TEMP%\_isC.tmp
- %TEMP%\{C22AC0C4-3878-48E6-88A5-1A75A48960E5}\_isres_0x0409.dll
- %TEMP%\_isB.tmp
- %TEMP%\{C22AC0C4-3878-48E6-88A5-1A75A48960E5}\ISRT.dll
- %TEMP%\_isA.tmp
- %TEMP%\{C22AC0C4-3878-48E6-88A5-1A75A48960E5}\setup.inx
- %TEMP%\_is9.tmp
- %TEMP%\{C22AC0C4-3878-48E6-88A5-1A75A48960E5}\IsConfig.ini
- %TEMP%\_is8.tmp
- %WINDIR%\Installer\MSI7.tmp
- %TEMP%\~6.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- %WINDIR%\Installer\MSI5.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- %WINDIR%\Installer\MSI4.tmp
- %TEMP%\{0CACBDED-E1ED-4F85-917C-413B824ACF9F}\ISRT.dll
- %TEMP%\{F7224F53-F89D-4E9F-834F-D469E8879DA8}\String1033.txt
Присваивает атрибут 'скрытый' для следующих файлов:
- %APPDATA%\ExtremeCopy\ec32.msi
Удаляет следующие файлы:
- %TEMP%\aut1.tmp
- %WINDIR%\Installer\MSI15.tmp
- %WINDIR%\Installer\MSI4.tmp
- C:\Config.Msi\21af3.rbs
- %TEMP%\~6.tmp
- %WINDIR%\Installer\MSI17.tmp
- %TEMP%\_is19.tmp
- %TEMP%\_is1A.tmp
- %TEMP%\_is1B.tmp
- %WINDIR%\Installer\MSID.tmp
- %WINDIR%\Installer\MSI14.tmp
- %TEMP%\_is1C.tmp
- %TEMP%\{F7224F53-F89D-4E9F-834F-D469E8879DA8}\IsConfig.ini
- %TEMP%\{F7224F53-F89D-4E9F-834F-D469E8879DA8}\String1033.txt
- %TEMP%\{F7224F53-F89D-4E9F-834F-D469E8879DA8}\_isres_0x0409.dll
- %TEMP%\{F7224F53-F89D-4E9F-834F-D469E8879DA8}\setup.inx
- %WINDIR%\Installer\MSI18.tmp
- %WINDIR%\Installer\21af0.msi
- %WINDIR%\Installer\21af2.ipi
- %APPDATA%\ExtremeCopy\ec32.msi
- %TEMP%\_is1D.tmp
- %TEMP%\{F7224F53-F89D-4E9F-834F-D469E8879DA8}\ISRT.dll
- %TEMP%\{0CACBDED-E1ED-4F85-917C-413B824ACF9F}\setup.inx
- %TEMP%\{0CACBDED-E1ED-4F85-917C-413B824ACF9F}\_isres_0x0409.dll
- %TEMP%\{0CACBDED-E1ED-4F85-917C-413B824ACF9F}\String1033.txt
- %WINDIR%\Installer\MSI3.tmp
- %WINDIR%\Installer\MSI5.tmp
- %TEMP%\_is8.tmp
- %TEMP%\_is9.tmp
- %TEMP%\_isA.tmp
- %TEMP%\_isB.tmp
- %TEMP%\_isC.tmp
- %TEMP%\{C22AC0C4-3878-48E6-88A5-1A75A48960E5}\ISRT.dll
- %TEMP%\{C22AC0C4-3878-48E6-88A5-1A75A48960E5}\IsConfig.ini
- %TEMP%\aut2.tmp
- %TEMP%\{C22AC0C4-3878-48E6-88A5-1A75A48960E5}\String1033.txt
- %TEMP%\{C22AC0C4-3878-48E6-88A5-1A75A48960E5}\setup.inx
- %WINDIR%\Installer\MSI7.tmp
- %TEMP%\_isE.tmp
- %TEMP%\_isF.tmp
- %TEMP%\_is10.tmp
- %TEMP%\_is11.tmp
- %TEMP%\_is12.tmp
- %TEMP%\{0CACBDED-E1ED-4F85-917C-413B824ACF9F}\ISRT.dll
- %TEMP%\{0CACBDED-E1ED-4F85-917C-413B824ACF9F}\IsConfig.ini
- %TEMP%\{C22AC0C4-3878-48E6-88A5-1A75A48960E5}\_isres_0x0409.dll
- %TEMP%\ExtremeCopy 2.3.4 Pro\filex64.exe
- %TEMP%\ExtremeCopy 2.3.4 Pro\filex86.exe
Перемещает следующие файлы:
- %APPDATA%\ExtremeCopy\ec32.$$A в %APPDATA%\ExtremeCopy\ec32.msi
- %APPDATA%\ExtremeCopy\genflpui.$$A в %APPDATA%\ExtremeCopy\genflpui.dat
Другое:
Ищет следующие окна:
- ClassName: 'InstItClass' WindowName: ''
- ClassName: 'MsiDialogCloseClass' WindowName: ''
- ClassName: '#32770' WindowName: ''
Создает и запускает на исполнение:
- '%TEMP%\ExtremeCopy 2.3.4 Pro\filex86.exe'
Запускает на исполнение:
- '<SYSTEM32>\msiexec.exe' /i "%APPDATA%\ExtremeCopy\ec32.msi" /qb /norestart
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\msiexec.exe' -Embedding 3133855EB199DE3857015946F318DF34
- '<SYSTEM32>\msiexec.exe' -Embedding 03745E5C81174ECE0E53BA739FADA4CF M Global\MSI0000
