# Installation Report: extractor

Generated by InCtrl5, version 1.0.0.0
Install program: C:\Program Files\Casper Remote Administration Tool Demo Version\Server.exe
11/3/2006 4:30 PM

### Contents

- Registry
- Disk Contents
- Ini Files
- Text Files

## Registry

### Keys ignored: 0

- (none)

### Keys added: 4

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\firewallpolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\firewallpolicy\standardprofile
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\firewallpolicy
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\firewallpolicy\standardprofile

### Values added: 4

HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache "C:\Program Files\Casper Remote Administration Tool Demo Version\Server.exe"
  `Type: REG_SZ`
  `Data: Server`
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "svhost"
  `Type: REG_SZ`
  `Data: C:\WINDOWS\svhost.exe`
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\firewallpolicy\standardprofile "EnableFirewall"
  `Type: REG_DWORD`
  `Data: 00, 00, 00, 00`
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\firewallpolicy\standardprofile "EnableFirewall"
  `Type: REG_DWORD`
  `Data: 00, 00, 00, 00`

### Values changed: 2

HKEY_CURRENT_USER\SessionInformation "ProgramCount"
  `Old type: REG_DWORD`
  `New type: REG_DWORD`
  `Old data: 09, 00, 00, 00`
  `New data: 0A, 00, 00, 00`
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\RNG "Seed"
  `Old type: REG_BINARY`
  `New type: REG_BINARY`
  `Old data: 55, F4, 0D, A0, 00, 46, 12, 04, 2A, 79, 91, 46, 9C, 7F, 33, 03, A0, C8, 96, 73, C3, 9A, 5F, 5F, 37, C9, 50, 28, D0, 04, 9E, 8A, 68, 12, 9F, 58, C7, 6E, A0, A3, 9A, 54, E4, 8B, B8, C8, 36, 5F, 45, 36, 8E, 05, 16, 34, 42, 97, A5, AE, 69, 22, 1B, 0E, 8B, 57, C0, A8, A0, 90, 2D, CD, 89, 2E, E5, 7E, 10, 91, 1F, 4E, FB, 43`
  `New data: 28, FE, D0, CD, 73, 14, 72, 3F, EF, 90, B6, ED, 92, ED, B2, 8E, 87, 2B, 34, 69, 5E, E2, B3, 3D, 44, DD, CC, 04, A1, 5E, DF, 1F, C3, 53, D2, 5F, 32, 05, B1, D4, C0, 2B, E3, D4, 6F, D5, 71, 87, 79, 46, 65, 48, A4, C8, 68, FF, 71, CD, 95, D0, F8, AC, A9, EA, 13, 61, FA, 60, 09, 77, A6, DB, 83, 03, 72, C4, 10, 23, 2B, AD`

To Contents

## Disk contents

### Drives tracked: 1

- c:\

### Files added: 11

c:\Documents and Settings\Kobayashi\Local Settings\Temp\~DF21FD.tmp
  `Date: 11/3/2006 4:29 PM`
  `Size: 16,384 bytes`
c:\Documents and Settings\Kobayashi\Local Settings\Temp\~DF319D.tmp
  `Date: 11/3/2006 4:29 PM`
  `Size: 16,384 bytes`
c:\WINDOWS\lsass.exe
  `Date: 11/3/2006 4:29 PM`
  `Size: 74,273 bytes`
c:\WINDOWS\svhost.exe
  `Date: 11/3/2006 4:29 PM`
  `Size: 199,986 bytes`
c:\WINDOWS\Prefetch\LSASS.EXE-0551E7A6.pf
  `Date: 11/3/2006 4:30 PM`
  `Size: 11,852 bytes`
c:\WINDOWS\Prefetch\SERVER.EXE-085C6D04.pf
  `Date: 11/3/2006 4:29 PM`
  `Size: 9,734 bytes`
c:\WINDOWS\Prefetch\SVC HOST.EXE-2D409E0B.pf
  `Date: 11/3/2006 4:29 PM`
  `Size: 19,310 bytes`
c:\WINDOWS\Prefetch\SVHOST.EXE-2153A0E5.pf
  `Date: 11/3/2006 4:29 PM`
  `Size: 14,134 bytes`
c:\WINDOWS\system32\setting.dts
  `Date: 11/3/2006 4:29 PM`
  `Size: 308 bytes`
c:\WINDOWS\system32\svc host.exe
  `Date: 11/3/2006 4:29 PM`
  `Size: 90,148 bytes`
c:\WINDOWS\system32\CatRoot2\tmp.edb
  `Date: 11/3/2006 4:29 PM`
  `Size: 1,056,768 bytes`

### Files changed: 9

c:\Documents and Settings\Kobayashi\NTUSER.DAT.LOG
  `Old date: 11/3/2006 4:28 PM`
  `New date: 11/3/2006 4:29 PM`
  `Old size: 1,024 bytes`
  `New size: 1,024 bytes`
c:\Documents and Settings\Kobayashi\Cookies\index.dat
  `Old date: 11/3/2006 4:27 PM`
  `New date: 11/3/2006 4:29 PM`
  `Old size: 32,768 bytes`
  `New size: 32,768 bytes`
c:\Documents and Settings\Kobayashi\Local Settings\History\History.IE5\index.dat
  `Old date: 11/3/2006 4:27 PM`
  `New date: 11/3/2006 4:29 PM`
  `Old size: 49,152 bytes`
  `New size: 49,152 bytes`
c:\Documents and Settings\Kobayashi\Local Settings\Temporary Internet Files\Content.IE5\index.dat
  `Old date: 11/3/2006 4:27 PM`
  `New date: 11/3/2006 4:29 PM`
  `Old size: 671,744 bytes`
  `New size: 671,744 bytes`
c:\WINDOWS\system32\mswinsck.ocx
  `Old date: 10/17/2006 3:49 PM`
  `New date: 11/3/2006 4:29 PM`
  `Old size: 109,284 bytes`
  `New size: 109,284 bytes`
c:\WINDOWS\system32\CatRoot2\edb.log
  `Old date: 11/3/2006 4:15 PM`
  `New date: 11/3/2006 4:29 PM`
  `Old size: 5,242,880 bytes`
  `New size: 5,242,880 bytes`
c:\WINDOWS\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb
  `Old date: 11/3/2006 4:15 PM`
  `New date: 11/3/2006 4:29 PM`
  `Old size: 3,153,920 bytes`
  `New size: 3,153,920 bytes`
c:\WINDOWS\system32\config\software.LOG
  `Old date: 11/3/2006 4:28 PM`
  `New date: 11/3/2006 4:30 PM`
  `Old size: 1,024 bytes`
  `New size: 1,024 bytes`
c:\WINDOWS\system32\config\system.LOG
  `Old date: 11/3/2006 4:28 PM`
  `New date: 11/3/2006 4:29 PM`
  `Old size: 1,024 bytes`
  `New size: 1,024 bytes`

To Contents

## INI file

### Ini files tracked: 4

- C:\boot.ini
- c:\windows\control.ini
- c:\windows\system.ini
- c:\windows\win.ini

To Contents

## Text file

### Text files tracked: 2

- c:\windows\system32\autoexec.nt
- c:\windows\system32\config.nt

To Contents

InCtrl5, Copyright © 2000 by Ziff Davis Media, Inc.
Written by Neil J. Rubenking
First published in PC Magazine, December 5, 2000.