Advanced IM Password Recovery
Overview
Advanced IM Password Recovery is a software program developed by ElcomSoft Co. The most common release is 4.40.417.1375, with over 98% of all installations currently using this version. It adds registry entry for the current user which will allow the program to automatically start each time it is rebooted. Upon being installed, the software adds a Windows Service which is designed to run continuously in the background. Manually stopping the service has been seen to cause the program to stop functing properly. It adds a background controller service that is set to automatically run. Delaying the start of this service is possible through the service manager. A scheduled task is added to Windows Task Scheduler in order to launch the program at various scheduled times (the schedule varies depending on the version). The primary executable is named ARCHPR.exe. The setup package generally installs about 42 files and is usually about 27.87 MB (29,220,505 bytes). Relative to the overall usage of users who have this installed on their PCs, most are running Windows 7 (SP1) and Windows XP. While about 62% of users of Advanced IM Password Recovery come from the United States, it is also popular in South Africa and BY.
Program details
URL: www.elcomsoft.ru
Installation folder: C:\Program Files\Elcomsoft Password Recovery\
Uninstaller: MsiExec.exe /X{F21D8FA8-34BD-4416-A488-96CDB89D44C1}
(The Windows Installer is used for the installation, maintenance, and removal.)
Estimated size: 27.87 MB
Language: English (United States)
Files installed by Advanced IM Password Recovery
-
edpr_console.exe - Elcomsoft Distributed Password Recovery (Elcomsoft Distributed Password Recovery Console)
-
edpr_server.exe - Elcomsoft Distributed Password Recovery Server
-
epr_agent.exe - Elcomsoft Password Recovery Agent
-
GPUManager.exe - GPU Manager Utility
-
ambpr.exe - Advanced MailBox Password Recovery
-
ARCHPR.exe - Advanced Archive Password Recovery (ARCHPR Application)
-
PSPR.exe - Proactive System Password Recovery
-
aopr.exe - Advanced Office Password Recovery (AOPR Application)
-
EFDD.exe - ElcomSoft Forensic Disk Decryptor
-
EPPB.exe - Elcomsoft Phone Password Breaker
-
atex.exe - Elcomsoft Apple Token Extractor
-
wdeinfo.exe - Elcomsoft Password Recovery (Elcomsoft Distributed Password Recovery)
-
aefsdr.exe - Advanced EFS Data Recovery (Advanced EFS Data Recovery Professional)
-
PPA.exe - Proactive Password Auditor
-
esil.dll - ElcomSoft Info Library (ESIL)
-
EWSA.exe - ElcomSoft Co.Ltd. ewsa (Elcomsoft Wireless Security Auditor)
-
ewsaserv.exe - PSPR Service (PSPRSERV)
-
ewsaserv64.exe
-
psprserv.exe
-
psprserv64.exe
-
awprhook.dll - AWPRHook (AWPRHook dll)
-
awprhook64.dll
-
awprserv.dll - AWPRSERV (AWPRSERV dll)
-
awprserv64.dll
-
ewsaserv.dll - EWSASERV (EWSASERV dll)
-
ewsaserv64.dll
-
aimpr.exe - Advanced Instant Messengers Password Recovery
-
APDFPR.exe - Advanced PDF Password Recovery
-
ASQLPR.exe - Advanced SQL Password Recovery
Behaviors exhibited
Scheduled Task
- ARCHPR.exe is scheduled as a task with the class '{C576B535-174E-4058-A42E-B70F666368DE}' (runs on registration).
4 Services
- ewsaserv.exe runs as a service named 'EWSA Control Service' (EWSASERV).
- psprserv64.exe runs as a service named 'PSPR Control Service' (PSPRSERV).
- ewsaserv64.exe runs as a service named 'EWSA Control Service' (EWSASERV).
- psprserv.exe runs as a service named 'PSPR Control Service' (PSPRSERV).
2 Startup Files (User Run)
- edpr_server.exe is loaded in the current user (HKCU) registry as an auto-starting executable named 'ElcomSoft DPR Server' and executes as C:\Program Files\Elcomsoft Password Recovery\Distributed Password Recovery\edpr_server.exe.
- epr_agent.exe is loaded in the current user (HKCU) registry as an auto-starting executable named 'Elcomsoft Distributed Agent' and executes as "C:\Program Files\Elcomsoft Password Recovery\Distributed Password Recovery\epr_agent.exe" -s.
How do I remove Advanced IM Password Recovery?
You can uninstall Advanced IM Password Recovery from your computer by using the Add/Remove Program feature in the Window's Control Panel.
- On the Start menu (for Windows 8, right-click the screen's bottom-left corner), click Control Panel, and then, under Programs, do one of the following:
- Windows Vista/7/8/10: Click Uninstall a Program.
- Windows XP: Click Add or Remove Programs.
- When you find the program Advanced IM Password Recovery, click it, and then do one of the following:
- Windows Vista/7/8/10: Click Uninstall.
- Windows XP: Click the Remove or Change/Remove tab (to the right of the program).
- Follow the prompts. A progress bar shows you how long it will take to remove Advanced IM Password Recovery.
OS VERSIONS
Win 7 (SP1) 67%
Win 10 17%
|
|
WHEN IT STARTS
Auto-starting? Yes
(Found in the run registry)
|
|
USER ACTIONS
 |
Uninstall it 23%
Keep it 77%
|
|
Windows
Which Windows OS versions does it run on?
| Windows 7 |
66.67% |
|
| Windows XP |
16.67% |
|
| Windows 10 |
16.67% |
|
Which OS releases does it run on? |
| Windows 7 Ultimate |
41.67% |
|
| Windows 7 Home Premium |
16.67% |
|
| Microsoft Windows XP |
16.67% |
|
| Windows 8.1 Pro |
8.33% |
|
| Windows 8.1 |
8.33% |
|
| Windows 7 Enterprise |
8.33% |
|
Geography
61.90% of installs come from the United States
Which countries install it?
| United States |
61.90% |
| South Africa |
4.76% |
| BY |
4.76% |
| Belgium |
4.76% |
| Mexico |
4.76% |
| IQ |
4.76% |
| Germany |
4.76% |
| Italy |
4.76% |
| United Kingdom |
4.76% |
PC manufacturers
What PC manufacturers (OEMs) have it installed?
| Hewlett-Packard |
33.33% |
|
| Dell |
22.22% |
|
| Samsung |
11.11% |
|
| Intel |
11.11% |
|
| Acer |
11.11% |
|
| Alienware |
11.11% |
|
Common models |
| HP Pavilion g6 Notebook P... |
22.22% |
|
| HP Pavilion 15 Notebook P... |
11.11% |
|
| Acer Aspire E1-571 |
11.11% |
|
| HP-Pavilion WC703AA-UUG H... |
11.11% |
|
| Dell Latitude E6520 |
11.11% |
|
| Samsung RV411/RV511/E3511... |
11.11% |
|
About ElcomSoft Co
ElcomSoft developes Windows security and productivity applications for business and private customers.
Publisher URL: www.elcomsoft.com