Hi,
I recently tried out the latest versions of SlySoft’s apps and have noticed some unusual behavior. Could someone please verify my findings?
(1) Orphaned Registry Entries
There are now some new registry entries that do not follow standard practices: HKCU\CloneCD and HKCU\SlySoft. Both are empty, and I have yet to see them recreated since I deleted them (possibly created by the installer rather than the apps themselves).
(2) Constantly Accessed Temp File
There is a new file in \Windows which seems to be given a random filename in the format S%8.8.tmp where %8.8 is an eight digit hexadecimal number. In fact you can even see the string in ElbyCDIO.dll at 0x0000078C: \SystemRoot %s\S%8.8X.tmp. The ElbyCDIO service creates then accesses it every ten seconds in a seemingly infinite loop! I don’t know if the registry entry HKLM\Software\Microsoft\Windows NT\CurrentVersion\elbyTemp\TempFile has anything to do with it, but that reg entry is peculiar in and of itself.
I am not sure which app is responsible, but I suspect CloneCD is the center since ElbyCDIO was started with it and CCD is the only one with a weird reg entry. I installed and tested all of SlySoft’s apps (latest versions) today and found that CloneCD, AnyDVD, CloneDVD, and Virtual CloneDrive use ElbyCDIO while CloneDVDMobile and GameJackal do not.
So can anyone confirm these observations? Thanks.