# Installation Report: server

Generated by InCtrl5, version 1.0.0.0
Install program: C:\Documents and Settings\Kobayashi\Desktop\ProRat_SE_Fx18\ProRat_SE_Fx18\server.exe
6/14/2007 4:35 PM

### Contents

- Registry
- Disk Contents
- Ini Files
- Text Files

## Registry

### Keys ignored: 0

- (none)

### Keys added: 10

HKEY_CURRENT_USER\Software\Microsoft\Windows NT Script Host
HKEY_CURRENT_USER\Software\Microsoft\Windows NT Script Host\Microsoft DxDiag
HKEY_CURRENT_USER\Software\Microsoft\Windows NT Script Host\Microsoft DxDiag\WinSettings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\C
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\C
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\C
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\C

### Keys deleted: 4

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\0
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\0
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\0
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\0

### Values added: 20

HKEY_CURRENT_USER\Software\Microsoft\Windows NT Script Host\Microsoft DxDiag\WinSettings "Bulas"
  `Type: REG_SZ`
  `Data: 1`
HKEY_CURRENT_USER\Software\Microsoft\Windows NT Script Host\Microsoft DxDiag\WinSettings "FW_KILL"
  `Type: REG_SZ`
  `Data: 1`
HKEY_CURRENT_USER\Software\Microsoft\Windows NT Script Host\Microsoft DxDiag\WinSettings "Hata"
  `Type: REG_SZ`
  `Data:`
HKEY_CURRENT_USER\Software\Microsoft\Windows NT Script Host\Microsoft DxDiag\WinSettings "ICQ_UIN"
  `Type: REG_SZ`
  `Data: 083/079/0/018`
HKEY_CURRENT_USER\Software\Microsoft\Windows NT Script Host\Microsoft DxDiag\WinSettings "ICQ_UIN2"
  `Type: REG_SZ`
  `Data: 046007686`
HKEY_CURRENT_USER\Software\Microsoft\Windows NT Script Host\Microsoft DxDiag\WinSettings "KSil"
  `Type: REG_SZ`
  `Data: 1`
HKEY_CURRENT_USER\Software\Microsoft\Windows NT Script Host\Microsoft DxDiag\WinSettings "Kurban_Ismi"
  `Type: REG_SZ`
  `Data: whbuhl`
HKEY_CURRENT_USER\Software\Microsoft\Windows NT Script Host\Microsoft DxDiag\WinSettings "LanNotifie"
  `Type: REG_SZ`
  `Data:`
HKEY_CURRENT_USER\Software\Microsoft\Windows NT Script Host\Microsoft DxDiag\WinSettings "Mail"
  `Type: REG_SZ`
  `Data: cnlcdsl`oAx`inn/bnl`
HKEY_CURRENT_USER\Software\Microsoft\Windows NT Script Host\Microsoft DxDiag\WinSettings "Online_List"
  `Type: REG_SZ`
  `Data: iuuq;..vvv/xntsrhud/bnl.bfh,cho.qsns`u/bfh`
HKEY_CURRENT_USER\Software\Microsoft\Windows NT Script Host\Microsoft DxDiag\WinSettings "Port"
  `Type: REG_SZ`
  `Data: 4001`
HKEY_CURRENT_USER\Software\Microsoft\Windows NT Script Host\Microsoft DxDiag\WinSettings "ServerVersionInt"
  `Type: REG_SZ`
  `Data: 19`
HKEY_CURRENT_USER\Software\Microsoft\Windows NT Script Host\Microsoft DxDiag\WinSettings "Sifre"
  `Type: REG_SZ`
  `Data: 032547`
HKEY_CURRENT_USER\Software\Microsoft\Windows NT Script Host\Microsoft DxDiag\WinSettings "Tport"
  `Type: REG_SZ`
  `Data: 0`
HKEY_CURRENT_USER\Software\Microsoft\Windows NT Script Host\Microsoft DxDiag\WinSettings "XP_FW_Disable"
  `Type: REG_SZ`
  `Data: 1`
HKEY_CURRENT_USER\Software\Microsoft\Windows NT Script Host\Microsoft DxDiag\WinSettings "XP_SYS_Recovery"
  `Type: REG_SZ`
  `Data: 1`
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y} "StubPath"
  `Type: REG_SZ`
  `Data: C:\WINDOWS\system\sservice.exe`
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run "DirectX For Microsoft® Windows"
  `Type: REG_SZ`
  `Data: C:\WINDOWS\system32\fservice.exe`
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess "Group"
  `Type: REG_SZ`
  `Data:`
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess "Group"
  `Type: REG_SZ`
  `Data:`

### Values changed: 13

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\RNG "Seed"
  `Old type: REG_BINARY`
  `New type: REG_BINARY`
  `Old data: E8, 17, A3, 68, 35, A2, FF, EC, A5, BB, 74, EE, 57, 4C, F5, 4A, 6D, AC, D8, 54, C9, 84, 29, 08, AC, 06, 2A, 7D, EE, 6A, 22, 5D, 43, F4, 6E, F5, 2D, 82, A7, 29, 7E, 9F, 2F, 36, 98, 9C, F0, 29, 7E, B7, AC, AF, 43, D9, 0D, FF, 67, 96, C5, E2, 95, AE, 79, 02, B0, 8B, FE, AA, 3E, 96, A3, 11, A1, 78, 36, 88, 3E, 62, 83, F1`
  `New data: D6, 98, 25, 94, C1, F0, 39, 0D, 10, 95, 10, 26, E8, B7, B3, CB, 72, EF, E3, AD, 89, AE, AC, C5, 0C, F4, CA, 70, 12, E4, 4B, D5, C7, 74, A9, B7, 35, 8E, 2D, F6, D0, 14, 02, AB, 45, EE, 04, 94, 3B, 63, 4C, 61, 52, EC, 66, DD, 4F, 6E, E1, 50, 20, 35, 46, 70, D5, 82, 8F, 29, FD, 42, 93, 16, BC, 4C, 9C, F0, C8, CA, 83, 6B`
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore "DisableSR"
  `Old type: REG_DWORD`
  `New type: REG_DWORD`
  `Old data: 00, 00, 00, 00`
  `New data: 01, 00, 00, 00`
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell"
  `Old type: REG_SZ`
  `New type: REG_SZ`
  `Old data: Explorer.exe`
  `New data: Explorer.exe C:\WINDOWS\system32\fservice.exe`
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess "Start"
  `Old type: REG_DWORD`
  `New type: REG_DWORD`
  `Old data: 03, 00, 00, 00`
  `New data: 04, 00, 00, 00`
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sr "ImagePath"
  `Old type: REG_EXPAND_SZ`
  `New type: REG_EXPAND_SZ`
  `Old data: System32\DRIVERS\sr.sys`
  `New data: \SystemRoot\System32\DRIVERS\sr.sys`
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sr "Start"
  `Old type: REG_DWORD`
  `New type: REG_DWORD`
  `Old data: 00, 00, 00, 00`
  `New data: 04, 00, 00, 00`
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sr\Parameters "FirstRun"
  `Old type: REG_DWORD`
  `New type: REG_DWORD`
  `Old data: 00, 00, 00, 00`
  `New data: 01, 00, 00, 00`
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice "Start"
  `Old type: REG_DWORD`
  `New type: REG_DWORD`
  `Old data: 02, 00, 00, 00`
  `New data: 04, 00, 00, 00`
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess "Start"
  `Old type: REG_DWORD`
  `New type: REG_DWORD`
  `Old data: 03, 00, 00, 00`
  `New data: 04, 00, 00, 00`
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sr "ImagePath"
  `Old type: REG_EXPAND_SZ`
  `New type: REG_EXPAND_SZ`
  `Old data: System32\DRIVERS\sr.sys`
  `New data: \SystemRoot\System32\DRIVERS\sr.sys`
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sr "Start"
  `Old type: REG_DWORD`
  `New type: REG_DWORD`
  `Old data: 00, 00, 00, 00`
  `New data: 04, 00, 00, 00`
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sr\Parameters "FirstRun"
  `Old type: REG_DWORD`
  `New type: REG_DWORD`
  `Old data: 00, 00, 00, 00`
  `New data: 01, 00, 00, 00`
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srservice "Start"
  `Old type: REG_DWORD`
  `New type: REG_DWORD`
  `Old data: 02, 00, 00, 00`
  `New data: 04, 00, 00, 00`

To Contents

## Disk contents

### Drives tracked: 1

- c:\

### Files added: 10

c:\WINDOWS\services.exe
  `Date: 6/14/2007 4:18 PM`
  `Size: 349,228 bytes`
c:\WINDOWS\Prefetch\FSERVICE.EXE-2E4F6E14.pf
  `Date: 6/14/2007 4:33 PM`
  `Size: 18,640 bytes`
c:\WINDOWS\Prefetch\NET.EXE-01A53C2F.pf
  `Date: 6/14/2007 4:33 PM`
  `Size: 6,306 bytes`
c:\WINDOWS\Prefetch\NET1.EXE-029B9DB4.pf
  `Date: 6/14/2007 4:33 PM`
  `Size: 8,012 bytes`
c:\WINDOWS\Prefetch\SERVER.EXE-3ABC0562.pf
  `Date: 6/14/2007 4:33 PM`
  `Size: 19,910 bytes`
c:\WINDOWS\Prefetch\SERVICES.EXE-2B0DDD57.pf
  `Date: 6/14/2007 4:34 PM`
  `Size: 20,256 bytes`
c:\WINDOWS\system\sservice.exe
  `Date: 6/14/2007 4:18 PM`
  `Size: 349,228 bytes`
c:\WINDOWS\system32\fservice.exe
  `Date: 6/14/2007 4:18 PM`
  `Size: 349,228 bytes`
c:\WINDOWS\system32\reginv.dll
  `Date: 6/14/2007 4:33 PM`
  `Size: 36,864 bytes`
c:\WINDOWS\system32\winkey.dll
  `Date: 6/14/2007 4:33 PM`
  `Size: 24,576 bytes`

### Files deleted: 2

c:\Documents and Settings\Kobayashi\Desktop\ProRat_SE_Fx18\ProRat_SE_Fx18\server.exe
  `Date: 6/14/2007 4:18 PM`
  `Size: 349,228 bytes`
c:\WINDOWS\system32\Restore\MachineGuid.txt
  `Date: 10/13/2004 3:52 PM`
  `Size: 78 bytes`

### Files changed: 5

c:\Documents and Settings\Kobayashi\NTUSER.DAT.LOG
  `Old date: 6/14/2007 4:33 PM`
  `New date: 6/14/2007 4:34 PM`
  `Old size: 1,024 bytes`
  `New size: 1,024 bytes`
c:\WINDOWS\Prefetch\CMD.EXE-087B4001.pf
  `Old date: 6/14/2007 4:09 PM`
  `New date: 6/14/2007 4:33 PM`
  `Old size: 6,122 bytes`
  `New size: 6,386 bytes`
c:\WINDOWS\system32\config\software.LOG
  `Old date: 6/14/2007 4:33 PM`
  `New date: 6/14/2007 4:34 PM`
  `Old size: 1,024 bytes`
  `New size: 1,024 bytes`
c:\WINDOWS\system32\config\system.LOG
  `Old date: 6/14/2007 4:33 PM`
  `New date: 6/14/2007 4:33 PM`
  `Old size: 1,024 bytes`
  `New size: 1,024 bytes`
c:\WINDOWS\system32\wbem\Logs\wbemess.log
  `Old date: 6/14/2007 3:44 PM`
  `New date: 6/14/2007 4:33 PM`
  `Old size: 17,435 bytes`
  `New size: 17,627 bytes`

To Contents

## INI file

### Ini files tracked: 4

- C:\boot.ini
- c:\windows\control.ini
- c:\windows\system.ini
- c:\windows\win.ini

To Contents

## Text file

### Text files tracked: 2

- c:\windows\system32\autoexec.nt
- c:\windows\system32\config.nt

To Contents

InCtrl5, Copyright © 2000 by Ziff Davis Media, Inc.
Written by Neil J. Rubenking
First published in PC Magazine, December 5, 2000.