Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RUN] 'Shield' = '"%ProgramFiles%\Shield\shdtray.exe"'
- [<HKLM>\SYSTEM\CurrentControlSet\Control\Session Manager] 'BootExecute' = 'autocheck autochk *\nShdSync'
Создает следующие сервисы
- [<HKLM>\System\CurrentControlSet\Services\ShdServ] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\ShdServ] 'ImagePath' = '"%ProgramFiles%\Shield\shdserv.exe"'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\Shieldm] 'ImagePath' = 'System32\DRIVERS\Shieldm.sys'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\Shieldm] 'Start' = '00000000'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\Shieldf] 'ImagePath' = 'System32\DRIVERS\Shieldf.sys'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\Shieldf] 'Start' = '00000000'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\Shdbus] 'ImagePath' = 'System32\DRIVERS\Shdbus.sys'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\Shdbus] 'Start' = '00000000'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\Shield] 'ImagePath' = 'System32\DRIVERS\shield.sys'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\Shield] 'Start' = '00000000'
- [<HKLM>\SYSTEM\ControlSet002\Services\Shield] 'Start' = '00000000'
Модифицирует главную загрузочную запись (MBR).
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\$inst\2.tmp
- %TEMP%\x86\shdserv.exe
- %TEMP%\x86\shdservps.dll
- %TEMP%\x86\shdsync.exe
- %TEMP%\x86\shdtray.exe
- %TEMP%\x86\shdui.dll
- %TEMP%\x86\shield.efi
- %TEMP%\x86\microsoft.vc90.crt.manifest
- %TEMP%\x86\shield.exe
- %TEMP%\$inst\0001.tmp
- %TEMP%\x86\uninstall.exe
- %ProgramFiles%\shield\setup.log
- %ProgramFiles%\shield\128.dat
- %ProgramFiles%\shield\onenote table of contents.onetoc2
- %ProgramFiles%\shield\shield.dat
- %TEMP%\x86\shdmgr.efi
- %TEMP%\x86\shdpub.dll
- %TEMP%\x86\shdidle.dll
- %TEMP%\x86\shdext.dll
- %TEMP%\x86\shdcmd.exe
- %TEMP%\x64\uninstall.exe
- %TEMP%\x64.exe
- %TEMP%\x86\dbghelp.dll
- %TEMP%\x86\help.chm
- %TEMP%\x86\help.chw
- %TEMP%\x86\mfc90.dll
- %ProgramFiles%\shield\dbghelp.dll
- %TEMP%\x86\symsrv.dll
- %TEMP%\x86\mfc90u.dll
- %TEMP%\x86\msvcp90.dll
- %TEMP%\x86\msvcr90.dll
- %TEMP%\x86\netreg.exe
- %TEMP%\x86\onenote table of contents.onetoc2
- %TEMP%\x86\rmclient.dll
- %TEMP%\x86\shdapi.dll
- %TEMP%\x64\symsrv.dll
- %TEMP%\x86\microsoft.vc90.mfc.manifest
- %ProgramFiles%\shield\help.chm
- %ProgramFiles%\shield\mfc90.dll
- %ProgramFiles%\shield\mfc90u.dll
- <DRIVERS>\onenote table of contents.onetoc2
- <DRIVERS>\shdbus.sys
- <DRIVERS>\shield.sys
- <DRIVERS>\shieldf.sys
- <DRIVERS>\shieldm.inf
- <DRIVERS>\shieldm.sys
- <DRIVERS>\shieldmamd64.cat
- %ProgramFiles%\shield\language\lang.en-us.xml
- %TEMP%\x64\shield.exe
- %ProgramFiles%\shield\subconsole.log
- %WINDIR%\temp\udd1385.tmp
- %WINDIR%\temp\udd13a5.tmp
- %WINDIR%\temp\udd13b6.tmp
- %WINDIR%\temp\udd13b7.tmp
- %PROGRAMDATA%\microsoft\windows\start menu\programs\bhat recovery king\bhat recovery king.lnk
- %PROGRAMDATA%\microsoft\windows\start menu\programs\bhat recovery king\tray icon.lnk
- %ProgramFiles%\shield\uninstall.exe
- %ProgramFiles%\shield\shdext.dll
- %ProgramFiles%\shield\symsrv.dll
- %ProgramFiles%\shield\shdcmd.exe
- %ProgramFiles%\shield\microsoft.vc90.crt.manifest
- %ProgramFiles%\shield\microsoft.vc90.mfc.manifest
- %ProgramFiles%\shield\msvcp90.dll
- %ProgramFiles%\shield\msvcr90.dll
- %ProgramFiles%\shield\netreg.exe
- %ProgramFiles%\shield\rmclient.dll
- %ProgramFiles%\shield\shdapi.dll
- %PROGRAMDATA%\microsoft\windows\start menu\programs\bhat recovery king\user's guide.lnk
- %ProgramFiles%\shield\shdvss.dll
- %ProgramFiles%\shield\shdidle.dll
- %ProgramFiles%\shield\shdpub.dll
- %ProgramFiles%\shield\shdserv.exe
- %ProgramFiles%\shield\shdservps.dll
- <SYSTEM32>\shdsync.exe
- %ProgramFiles%\shield\shdtray.exe
- %ProgramFiles%\shield\shdui.dll
- %ProgramFiles%\shield\shield.exe
- <DRIVERS>\shdump.sys
- %TEMP%\x64\shield.efi
- %TEMP%\x64\shdext.dll
- %TEMP%\drivers\win7\x86\shield.sys
- %TEMP%\drivers\win7\x86\shieldf.sys
- %TEMP%\drivers\win7\x86\shieldm.inf
- %TEMP%\drivers\win7\x86\shieldm.sys
- %TEMP%\drivers\win7\x86\shieldmnt86.cat
- %TEMP%\drivers\xp\onenote table of contents.onetoc2
- %TEMP%\drivers\onenote table of contents.onetoc2
- %TEMP%\drivers\xp\x64\onenote table of contents.onetoc2
- %TEMP%\drivers\xp\x64\shield.sys
- %TEMP%\drivers\xp\x64\shieldf.sys
- %TEMP%\drivers\xp\x64\shieldm.inf
- %TEMP%\drivers\xp\x64\shieldm.sys
- %TEMP%\drivers\xp\x64\shieldmamd64.cat
- %TEMP%\drivers\xp\x86\onenote table of contents.onetoc2
- %TEMP%\drivers\win7\x86\shdbus.sys
- %TEMP%\drivers\win7\x86\shdump.sys
- %TEMP%\drivers\win7\x86\onenote table of contents.onetoc2
- %TEMP%\drivers\win7\x64\shieldmamd64.cat
- %TEMP%\drivers\win7\x64\shieldm.sys
- %TEMP%\common\onenote table of contents.onetoc2
- %TEMP%\common\shield.dat
- %TEMP%\deployment tools\language\onenote table of contents.onetoc2
- %TEMP%\deployment tools\language\shdcfg.xml
- %TEMP%\deployment tools\onenote table of contents.onetoc2
- %TEMP%\deployment tools\setautosetup.exe
- %TEMP%\drivers\xp\x86\shdbus.sys
- %TEMP%\drivers\xp\x64\shdbus.sys
- %TEMP%\deployment tools\setup ini wizard.exe
- %TEMP%\drivers\win7\x64\onenote table of contents.onetoc2
- %TEMP%\drivers\win7\x64\shdbus.sys
- %TEMP%\drivers\win7\x64\shdump.sys
- %TEMP%\drivers\win7\x64\shield.sys
- %TEMP%\drivers\win7\x64\shieldf.sys
- %TEMP%\drivers\win7\x64\shieldm.inf
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\drivers\win7\onenote table of contents.onetoc2
- %TEMP%\drivers\xp\x86\shield.sys
- %TEMP%\drivers\xp\x86\shieldf.sys
- %TEMP%\drivers\xp\x86\shieldm.inf
- %TEMP%\x64\msvcp90.dll
- %TEMP%\x64\msvcr90.dll
- %TEMP%\x64\netreg.exe
- %TEMP%\x64\onenote table of contents.onetoc2
- %TEMP%\x64\rmclient.dll
- %TEMP%\x64\shdapi.dll
- %TEMP%\x64\shdcmd.exe
- %TEMP%\x64\shdidle.dll
- %TEMP%\x64\shdvss.dll
- %TEMP%\x64\shdloader.efi
- %TEMP%\x64\shdmgr.ef_
- %TEMP%\x64\shdpub.dll
- %TEMP%\x64\shdserv.exe
- %TEMP%\x64\shdservps.dll
- %TEMP%\x64\shdsync.exe
- %TEMP%\x64\shdtray.exe
- %TEMP%\x64\microsoft.vc90.mfc.manifest
- %TEMP%\plugin\shdvss03.dll
- %TEMP%\x64\microsoft.vc90.crt.manifest
- %TEMP%\plugin\onenote table of contents.onetoc2
- %TEMP%\drivers\xp\x86\shieldm.sys
- %TEMP%\drivers\xp\x86\shieldmnt86.cat
- %TEMP%\language\lang.en-us.xml
- %TEMP%\language\onenote table of contents.onetoc2
- %TEMP%\language\ssfont.en-us.ttf
- %TEMP%\language\subsys.en-us.xml
- %TEMP%\onenote table of contents.onetoc2
- %TEMP%\x64\shdui.dll
- %TEMP%\x64\mfc90.dll
- %TEMP%\plugin\shdvssxp.dll
- %TEMP%\setup.exe
- %TEMP%\setup.ini
- %TEMP%\trace\onenote table of contents.onetoc2
- %TEMP%\trace\setup.exe.txt
- %TEMP%\x64\dbghelp.dll
- %TEMP%\x64\help.chm
- %TEMP%\x64\mfc90u.dll
- %PROGRAMDATA%\microsoft\windows\start menu\programs\bhat recovery king\uninstall.lnk
Присваивает атрибут 'скрытый' для следующих файлов
- %TEMP%\common\onenote table of contents.onetoc2
- %TEMP%\x64\onenote table of contents.onetoc2
- %TEMP%\trace\onenote table of contents.onetoc2
- %TEMP%\plugin\onenote table of contents.onetoc2
- %TEMP%\onenote table of contents.onetoc2
- %TEMP%\language\onenote table of contents.onetoc2
- %TEMP%\drivers\xp\x86\onenote table of contents.onetoc2
- %TEMP%\x86\onenote table of contents.onetoc2
- %TEMP%\drivers\xp\x64\onenote table of contents.onetoc2
- %TEMP%\drivers\win7\x86\onenote table of contents.onetoc2
- %TEMP%\drivers\win7\x64\onenote table of contents.onetoc2
- %TEMP%\drivers\win7\onenote table of contents.onetoc2
- %TEMP%\drivers\onenote table of contents.onetoc2
- %TEMP%\deployment tools\onenote table of contents.onetoc2
- %TEMP%\deployment tools\language\onenote table of contents.onetoc2
- %TEMP%\drivers\xp\onenote table of contents.onetoc2
- %ProgramFiles%\shield\shield.dat
Удаляет следующие файлы
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\$inst\0001.tmp
- %TEMP%\$inst\2.tmp
- %WINDIR%\temp\udd1385.tmp
- %WINDIR%\temp\udd13a5.tmp
- %WINDIR%\temp\udd13b6.tmp
- %WINDIR%\temp\udd13b7.tmp
Другое
Создает и запускает на исполнение
- '%TEMP%\setup.exe' /s
- '%TEMP%\x64.exe' "%TEMP%\Setup.exe" /s
- '%ProgramFiles%\shield\shdserv.exe' /service
- '%TEMP%\setup.exe' /s' (со скрытым окном)
- '<SYSTEM32>\bcdedit.exe' /enum' (со скрытым окном)
- '<SYSTEM32>\wbem\wmic.exe' recoveros set AutoReboot = 0' (со скрытым окном)
Запускает на исполнение
- '<SYSTEM32>\bcdedit.exe' /enum
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\Shield\shdservps.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\Shield\shdext.dll
- '<SYSTEM32>\wbem\wmic.exe' recoveros set AutoReboot = 0
