# Installation Report: Rundlll

Generated by InCtrl5, version 1.0.0.0
Install program: C:\Documents and Settings\Kobayashi\Desktop\Rundlll.exe
4-26-2005 6:09 PM

### Contents

- Registry
- Disk Contents
- Ini Files
- Text Files

## Registry

### Keys ignored: 0

- (none)

### Keys added: 9

HKEY_CURRENT_USER\Software\Microsoft\ActiveMovie
HKEY_CURRENT_USER\Software\Microsoft\ActiveMovie\devenum
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\WinOldApp
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MediaResources\msvideo
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ZRundlll
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ZRundlll\Security
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MediaResources\msvideo
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ZRundlll
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ZRundlll\Security

### Values added: 18

HKEY_CURRENT_USER\Software\Microsoft\ActiveMovie\devenum "Version"
  `Type: REG_DWORD`
  `Data: 07, 00, 00, 00`
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count "HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\Xbonlnfuv\Qrfxgbc\Ehaqyyy.rkr"
  `Type: REG_BINARY`
  `Data: 0C, 00, 00, 00, 06, 00, 00, 00, 10, 6C, 59, 85, C5, 4A, C5, 01`
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ZRundlll "Description"
  `Type: REG_SZ`
  `Data: 任我行工作室`
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ZRundlll "DisplayName"
  `Type: REG_SZ`
  `Data: WindowsRWX`
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ZRundlll "ErrorControl"
  `Type: REG_DWORD`
  `Data: 00, 00, 00, 00`
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ZRundlll "ImagePath"
  `Type: REG_EXPAND_SZ`
  `Data: C:\WINNT\system32\ZRundlll.exe -NetSata`
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ZRundlll "ObjectName"
  `Type: REG_SZ`
  `Data: LocalSystem`
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ZRundlll "Start"
  `Type: REG_DWORD`
  `Data: 02, 00, 00, 00`
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ZRundlll "Type"
  `Type: REG_DWORD`
  `Data: 10, 01, 00, 00`
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ZRundlll\Security "Security"
  `Type: REG_BINARY`
  `Data: 01, 00, 14, 80, A0, 00, 00, 00, AC, 00, 00, 00, 14, 00, 00, 00, 30, 00, 00, 00, 02, 00, 1C, 00, 01, 00, 00, 00, 02, 80, 14, 00, FF, 01, 0F, 00, 01, 01, 00, 00, 00, 00, 00, 01, 00, 00, 00, 00, 02, 00, 70, 00, 04, 00, 00, 00, 00, 00, 18, 00, FD, 01, 02, 00, 01, 01, 00, 00, 00, 00, 00, 05, 12, 00, 00, 00, 54, 00, 59, 00, 00, 00, 1C, 00, FF, 01, 0F, 00, 01, 02, 00, 00, 00, 00, 00, 05, 20, 00, 00, 00, 20, 02, 00, 00, 00, 00, 00, 00, 00, 00, 18, 00, 8D, 01, 02, 00, 01, 01, 00, 00, 00, 00, 00, 05, 0B, 00, 00, 00, 20, 02, 00, 00, 00, 00, 1C, 00, FD, 01, 02, 00, 01, 02, 00, 00, 00, 00, 00, 05, 20, 00, 00, 00, 23, 02, 00, 00, 00, 00, 00, 00, 01, 01, 00, 00, 00, 00, 00, 05, 12, 00, 00, 00, 01, 01, 00, 00, 00, 00, 00, 05, 12, 00, 00, 00`
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ZRundlll "Description"
  `Type: REG_SZ`
  `Data: 任我行工作室`
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ZRundlll "DisplayName"
  `Type: REG_SZ`
  `Data: WindowsRWX`
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ZRundlll "ErrorControl"
  `Type: REG_DWORD`
  `Data: 00, 00, 00, 00`
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ZRundlll "ImagePath"
  `Type: REG_EXPAND_SZ`
  `Data: C:\WINNT\system32\ZRundlll.exe -NetSata`
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ZRundlll "ObjectName"
  `Type: REG_SZ`
  `Data: LocalSystem`
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ZRundlll "Start"
  `Type: REG_DWORD`
  `Data: 02, 00, 00, 00`
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ZRundlll "Type"
  `Type: REG_DWORD`
  `Data: 10, 01, 00, 00`
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ZRundlll\Security "Security"
  `Type: REG_BINARY`
  `Data: 01, 00, 14, 80, A0, 00, 00, 00, AC, 00, 00, 00, 14, 00, 00, 00, 30, 00, 00, 00, 02, 00, 1C, 00, 01, 00, 00, 00, 02, 80, 14, 00, FF, 01, 0F, 00, 01, 01, 00, 00, 00, 00, 00, 01, 00, 00, 00, 00, 02, 00, 70, 00, 04, 00, 00, 00, 00, 00, 18, 00, FD, 01, 02, 00, 01, 01, 00, 00, 00, 00, 00, 05, 12, 00, 00, 00, 54, 00, 59, 00, 00, 00, 1C, 00, FF, 01, 0F, 00, 01, 02, 00, 00, 00, 00, 00, 05, 20, 00, 00, 00, 20, 02, 00, 00, 00, 00, 00, 00, 00, 00, 18, 00, 8D, 01, 02, 00, 01, 01, 00, 00, 00, 00, 00, 05, 0B, 00, 00, 00, 20, 02, 00, 00, 00, 00, 1C, 00, FD, 01, 02, 00, 01, 02, 00, 00, 00, 00, 00, 05, 20, 00, 00, 00, 23, 02, 00, 00, 00, 00, 00, 00, 01, 01, 00, 00, 00, 00, 00, 05, 12, 00, 00, 00, 01, 01, 00, 00, 00, 00, 00, 05, 12, 00, 00, 00`

### Values changed: 2

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count "HRZR_EHACNGU"
  `Old type: REG_BINARY`
  `New type: REG_BINARY`
  `Old data: 0C, 00, 00, 00, 9D, 01, 00, 00, A0, 66, B3, 3D, C4, 4A, C5, 01`
  `New data: 0C, 00, 00, 00, 9E, 01, 00, 00, 10, 6C, 59, 85, C5, 4A, C5, 01`
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\RNG "Seed"
  `Old type: REG_BINARY`
  `New type: REG_BINARY`
  `Old data: 98, BB, AC, AC, 65, 16, 9E, 20, 9E, A6, 80, 7B, F6, 38, 93, 8E, 21, 13, D0, C9, 08, 7A, 3D, BD, BE, 7B, BA, BD, A5, 76, B6, 5E, 32, 1F, 37, 31, 42, 0A, 37, 68, 20, D8, 35, B0, 11, 91, 1D, 5C, 84, 06, FF, 63, B3, F8, EE, F2, 75, 6E, A6, 3F, 7D, C8, 7E, 04, 44, 09, A7, 43, FF, BF, 4F, 4A, C1, 62, FC, 51, 53, DC, 8F, 74`
  `New data: 37, 2C, DE, B3, D1, E8, 4B, BA, 95, EA, 03, 72, AF, 1E, B3, 84, 97, E7, 51, 10, 27, E2, 30, F9, 15, 4E, 1C, 2C, B3, 9B, 74, A8, 60, 8D, 7F, B5, AC, 9D, DB, 2A, 3F, 22, DC, A2, 81, 11, A6, 13, A6, 33, 65, B4, B2, BF, 25, D9, 4F, 7F, 4B, FA, 11, EE, 82, 18, 8B, A5, 56, 1B, 16, 5B, 81, 57, E2, 5F, F0, 20, A8, B2, 39, 82`

To Contents

## Disk contents

### Drives tracked: 1

- c:\

### Files added: 1

c:\WINNT\system32\ZRundlll.exe
  `Date: 4-19-2005 1:27 AM`
  `Size: 498,817 bytes`

### Files deleted: 1

c:\Documents and Settings\Kobayashi\Desktop\Rundlll.exe
  `Date: 4-19-2005 1:27 AM`
  `Size: 498,817 bytes`

### Files changed: 6

c:\Documents and Settings\Kobayashi\NTUSER.DAT
  `Old date: 4-26-2005 6:06 PM`
  `New date: 4-26-2005 6:07 PM`
  `Old size: 544,768 bytes`
  `New size: 548,864 bytes`
c:\Documents and Settings\Kobayashi\ntuser.dat.LOG
  `Old date: 4-26-2005 6:06 PM`
  `New date: 4-26-2005 6:07 PM`
  `Old size: 1,024 bytes`
  `New size: 1,024 bytes`
c:\WINNT\system32\config\software
  `Old date: 4-26-2005 5:57 PM`
  `New date: 4-26-2005 6:07 PM`
  `Old size: 10,903,552 bytes`
  `New size: 10,903,552 bytes`
c:\WINNT\system32\config\software.LOG
  `Old date: 4-26-2005 5:57 PM`
  `New date: 4-26-2005 6:07 PM`
  `Old size: 1,024 bytes`
  `New size: 1,024 bytes`
c:\WINNT\system32\config\system
  `Old date: 4-26-2005 5:59 PM`
  `New date: 4-26-2005 6:07 PM`
  `Old size: 2,576,384 bytes`
  `New size: 2,576,384 bytes`
c:\WINNT\system32\config\SYSTEM.ALT
  `Old date: 4-26-2005 5:59 PM`
  `New date: 4-26-2005 6:07 PM`
  `Old size: 2,576,384 bytes`
  `New size: 2,576,384 bytes`

To Contents

## INI file

### Ini files tracked: 4

- C:\boot.ini
- c:\winnt\control.ini
- c:\winnt\system.ini
- c:\winnt\win.ini

To Contents

## Text file

### Text files tracked: 2

- c:\winnt\system32\autoexec.nt
- c:\winnt\system32\config.nt

To Contents

InCtrl5, Copyright © 2000 by Ziff Davis Media, Inc.
Written by Neil J. Rubenking
First published in PC Magazine, December 5, 2000.