# Installation Report: CTMServer.exe

Generated by InCtrl5, version 1.0.0.0
Install program: C:\Program Files\Cercsystems\ComeToMe\Server.exe
6/6/2006 7:15 PM

### Contents

- Registry
- Disk Contents
- Ini Files
- Text Files

## Registry

### Keys ignored: 0

- (none)

### Keys added: 4

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\l
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\l
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\l
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\l

### Keys deleted: 4

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\H
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\H
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\H
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\H

### Values added: 4

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "dllhost"
  `Type: REG_SZ`
  `Data: C:\WINDOWS\system32\dllhost.exe`
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "taskmrg"
  `Type: REG_SZ`
  `Data: C:\WINDOWS\system32\taskmrg.exe`
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Windll"
  `Type: REG_SZ`
  `Data: C:\Documents and Settings\Kobayashi\My Documents\SystemControl.exe`
HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache "@C:\WINDOWS\system32\netshell.dll,-1200"
  `Type: REG_SZ`
  `Data: Network Connections`

### Values deleted: 2

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\kmixer\Enum "0"
  `Type: REG_SZ`
  `Data: SW\{b7eafdc0-a680-11d0-96d8-00aa0051e51d}\{9B365890-165F-11D0-A195-0020AFD156E4}`
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kmixer\Enum "0"
  `Type: REG_SZ`
  `Data: SW\{b7eafdc0-a680-11d0-96d8-00aa0051e51d}\{9B365890-165F-11D0-A195-0020AFD156E4}`

### Values changed: 6

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections "SavedLegacySettings"
  `Old type: REG_BINARY`
  `New type: REG_BINARY`
  `Old data: 3C, 00, 00, 00, 7B, 00, 00, 00, 01, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 04, 00, 00, 00, 00, 00, 00, 00, 00, B8, A9, A4, 2C, B1, C4, 01, 01, 00, 00, 00, C0, A8, 00, 03, 00, 00, 00, 00, 00, 00, 00, 00`
  `New data: 3C, 00, 00, 00, 7C, 00, 00, 00, 01, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 04, 00, 00, 00, 00, 00, 00, 00, 00, B8, A9, A4, 2C, B1, C4, 01, 01, 00, 00, 00, C0, A8, 00, 03, 00, 00, 00, 00, 00, 00, 00, 00`
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\RNG "Seed"
  `Old type: REG_BINARY`
  `New type: REG_BINARY`
  `Old data: E9, FD, 43, 17, F5, 1A, C7, 69, 07, A6, 4A, 35, FB, B9, 48, 1D, C5, 1F, 4E, 5B, 70, F4, A3, 43, F2, 31, EF, 80, 3C, 3A, EC, C2, AB, AE, A0, 0D, 31, 1C, A2, 9F, 9F, 19, 30, 3B, 82, E0, 7E, D5, 4F, 7E, 3C, 68, 84, 71, ED, 1C, A6, 03, BC, 92, D7, 57, 91, CF, 09, 64, FE, 4E, 3D, 65, 03, 5E, C1, 1A, 53, 5B, 3A, 13, 1A, C2`
  `New data: 66, 3E, 11, B0, 85, 2F, A5, CB, 90, B3, 04, 35, F3, AB, 60, 13, 76, CA, FB, B2, 36, A6, DE, CE, BF, CD, 72, 67, C7, CA, 4B, DC, EA, 4F, E9, C8, 90, 73, FA, 0B, B9, B9, 7F, 49, A7, 07, 7E, 6D, 2F, E8, FD, 7E, D4, 8B, 79, 23, A2, 5A, 49, E5, 54, 01, 14, A1, 0D, 87, 60, 89, 41, CB, 34, F6, E1, 24, D4, 8B, 72, 25, 00, 9D`
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\kmixer\Enum "Count"
  `Old type: REG_DWORD`
  `New type: REG_DWORD`
  `Old data: 01, 00, 00, 00`
  `New data: 00, 00, 00, 00`
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\kmixer\Enum "NextInstance"
  `Old type: REG_DWORD`
  `New type: REG_DWORD`
  `Old data: 01, 00, 00, 00`
  `New data: 00, 00, 00, 00`
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kmixer\Enum "Count"
  `Old type: REG_DWORD`
  `New type: REG_DWORD`
  `Old data: 01, 00, 00, 00`
  `New data: 00, 00, 00, 00`
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kmixer\Enum "NextInstance"
  `Old type: REG_DWORD`
  `New type: REG_DWORD`
  `Old data: 01, 00, 00, 00`
  `New data: 00, 00, 00, 00`

To Contents

## Disk contents

### Drives tracked: 1

- c:\

### Files added: 9

c:\Documents and Settings\All Users\Templates\Svchost.exe
  `Date: 6/6/2006 6:49 PM`
  `Size: 258,048 bytes`
c:\Documents and Settings\Kobayashi\Local Settings\Temp\~DFDEB3.tmp
  `Date: 6/6/2006 6:51 PM`
  `Size: 16,384 bytes`
c:\Documents and Settings\Kobayashi\Local Settings\Temporary Internet Files\Content.IE5\0M6N1PJ4\CAMNEZQT.php
  `Date: 6/6/2006 6:52 PM`
  `Size: 19 bytes`
c:\Documents and Settings\Kobayashi\Local Settings\Temporary Internet Files\Content.IE5\TFFYG7WA\index[1].htm
  `Date: 6/6/2006 6:51 PM`
  `Size: 174 bytes`
c:\Documents and Settings\Kobayashi\My Documents\SystemControl.exe
  `Date: 6/6/2006 6:49 PM`
  `Size: 258,048 bytes`
c:\WINDOWS\dllhost.exe
  `Date: 6/6/2006 6:49 PM`
  `Size: 258,048 bytes`
c:\WINDOWS\Prefetch\SERVER.EXE-0B362B54.pf
  `Date: 6/6/2006 6:52 PM`
  `Size: 43,540 bytes`
c:\WINDOWS\system32\taskmrg.exe
  `Date: 6/6/2006 6:49 PM`
  `Size: 258,048 bytes`
c:\WINDOWS\system32\zlib.dll
  `Date: 6/6/2006 6:51 PM`
  `Size: 53,248 bytes`

### Files deleted: 2

c:\Documents and Settings\Kobayashi\Local Settings\Temporary Internet Files\Content.IE5\0M6N1PJ4\index[1].htm
  `Date: 6/6/2006 6:47 PM`
  `Size: 174 bytes`
c:\Program Files\Cercsystems\ComeToMe\runbat.bat
  `Date: 6/6/2006 6:49 PM`
  `Size: 2 bytes`

### Files changed: 6

c:\Documents and Settings\Kobayashi\NTUSER.DAT.LOG
  `Old date: 6/6/2006 6:51 PM`
  `New date: 6/6/2006 6:54 PM`
  `Old size: 1,024 bytes`
  `New size: 1,024 bytes`
c:\Documents and Settings\Kobayashi\Cookies\index.dat
  `Old date: 6/6/2006 6:48 PM`
  `New date: 6/6/2006 6:51 PM`
  `Old size: 32,768 bytes`
  `New size: 32,768 bytes`
c:\Documents and Settings\Kobayashi\Local Settings\History\History.IE5\index.dat
  `Old date: 6/6/2006 6:48 PM`
  `New date: 6/6/2006 6:51 PM`
  `Old size: 49,152 bytes`
  `New size: 49,152 bytes`
c:\Documents and Settings\Kobayashi\Local Settings\History\History.IE5\MSHist012006060620060607\index.dat
  `Old date: 6/6/2006 6:48 PM`
  `New date: 6/6/2006 6:51 PM`
  `Old size: 32,768 bytes`
  `New size: 32,768 bytes`
c:\Documents and Settings\Kobayashi\Local Settings\Temporary Internet Files\Content.IE5\index.dat
  `Old date: 6/6/2006 6:48 PM`
  `New date: 6/6/2006 6:51 PM`
  `Old size: 557,056 bytes`
  `New size: 557,056 bytes`
c:\WINDOWS\system32\config\software.LOG
  `Old date: 6/6/2006 6:49 PM`
  `New date: 6/6/2006 6:52 PM`
  `Old size: 1,024 bytes`
  `New size: 1,024 bytes`

To Contents

## INI file

### Ini files tracked: 4

- C:\boot.ini
- c:\windows\control.ini
- c:\windows\system.ini
- c:\windows\win.ini

To Contents

## Text file

### Text files tracked: 2

- c:\windows\system32\autoexec.nt
- c:\windows\system32\config.nt

To Contents

InCtrl5, Copyright © 2000 by Ziff Davis Media, Inc.
Written by Neil J. Rubenking
First published in PC Magazine, December 5, 2000.