Technical Information
Modifies file system
Creates the following files
- %TEMP%\ytmp\tmp42379.bat
- %TEMP%\ytmp\tmp45579.exe
- nul
Deletes the following files
- %TEMP%\ytmp\tmp45579.exe
Deletes itself.
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c if not exist "%TEMP%\afolder" mkdir "%TEMP%\afolder"
- '%WINDIR%\syswow64\reg.exe' delete "HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Visio\Recent Templates" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Visio\Recent Templates" /f
- '%WINDIR%\syswow64\reg.exe' delete "HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Visio\Shape Gallery\History" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Visio\Shape Gallery\History" /f
- '%WINDIR%\syswow64\reg.exe' delete "HKEY_CURRENT_USER\Software\Brother Industries, Ltd.\P-touch Editor\5.1\Recent File List" /f
- '%WINDIR%\syswow64\reg.exe' delete "HKEY_CURRENT_USER\Software\Brother Industries, Ltd.\P-touch Editor\5.1\Recent File List Database" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CURRENT_USER\Software\Brother Industries, Ltd.\P-touch Editor\5.1\Recent File List" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CURRENT_USER\Software\Brother Industries, Ltd.\P-touch Editor\5.1\Recent File List Database" /f
- '%WINDIR%\syswow64\reg.exe' delete "HKEY_CURRENT_USER\Software\Avery Dennison\DesignPro 5.5\Recent File List" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CURRENT_USER\Software\Avery Dennison\DesignPro 5.5\Recent File List" /f
- '%WINDIR%\syswow64\reg.exe' delete "HKEY_CURRENT_USER\Software\Adobe\Adobe Acrobat\10.0\AVGeneral\cRecentFiles" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CURRENT_USER\Software\Adobe\Adobe Acrobat\10.0\AVGeneral\cRecentFiles" /f
- '%WINDIR%\syswow64\reg.exe' delete "HKEY_CURRENT_USER\Software\Camera Bits, Inc.\Photo Mechanic\Recent File List" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CURRENT_USER\Software\Camera Bits, Inc.\Photo Mechanic\Recent File List" /f
- '%WINDIR%\syswow64\reg.exe' delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Paint\Recent File List" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Paint\Recent File List" /f
- '%WINDIR%\syswow64\reg.exe' delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List" /f
- '%WINDIR%\syswow64\reg.exe' delete "HKEY_CURRENT_USER\Software\Nico Mak Computing\WinZip\mru\archives" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CURRENT_USER\Software\Nico Mak Computing\WinZip\mru\archives" /f
- '%WINDIR%\syswow64\reg.exe' delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery" /f
- '%WINDIR%\syswow64\reg.exe' delete "HKEY_CURRENT_USER\Software\Adobe\MediaBrowser\MRU\Photoshop\FileList" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CURRENT_USER\Software\Adobe\MediaBrowser\MRU\Photoshop\FileList" /f
- '%WINDIR%\syswow64\cmd.exe' /c del "Adobe Photoshop X64 CS5 Prefs.psp"
- '%WINDIR%\syswow64\cmd.exe' /c del "NonExportableSettings.xml"
- '%WINDIR%\syswow64\ipconfig.exe' /flushdns
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Visio\Application" /v "NewDocMeasurementUnit" /t REG_SZ /d 2 /f
- '%WINDIR%\syswow64\reg.exe' delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Visio\Application" /v "MyShapesPath" /t REG_SZ /d "C:\Users\Preroll\Documents\My Shapes" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Visio\Application" /v "FormatToClipboard" /t REG_SZ /d 11 /f
- '%WINDIR%\syswow64\cmd.exe' /c if not exist "%TEMP%\ytmp" mkdir "%TEMP%\ytmp"
- '%WINDIR%\syswow64\cmd.exe' /c attrib +h %TEMP%\ytmp
- '%WINDIR%\syswow64\attrib.exe' +h %TEMP%\ytmp
- '%WINDIR%\syswow64\cmd.exe' /c cls
- '%WINDIR%\syswow64\cmd.exe' /c if exist "%TEMP%\ytmp\tmp42379.bat" del "%TEMP%\ytmp\tmp42379.bat"
- '%WINDIR%\syswow64\cmd.exe' /c if exist "%TEMP%\ytmp\tmp45579.exe" del "%TEMP%\ytmp\tmp45579.exe"
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\ytmp\tmp42379.bat "<Full path to file>"
- '%WINDIR%\syswow64\reg.exe' delete "HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\File MRU" /f
- '%WINDIR%\syswow64\reg.exe' delete "HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Place MRU" /f
- '%WINDIR%\syswow64\reg.exe' delete "HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\File MRU" /f
- '%WINDIR%\syswow64\reg.exe' delete "HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Place MRU" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\File MRU" /v "Quick Access Display" /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Place MRU" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\File MRU" /v "Quick Access Display" /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Place MRU" /f
- '%WINDIR%\syswow64\reg.exe' delete "HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Security\Trusted Documents\TrustRecords" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Security\Trusted Documents\TrustRecords" /f
- '%WINDIR%\syswow64\reg.exe' delete "HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Recent Templates" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Recent Templates" /f
- '%WINDIR%\syswow64\reg.exe' delete "HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Recent Templates" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Recent Templates" /f
- '%WINDIR%\syswow64\reg.exe' delete "HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Visio\Application" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Visio\Application" /v "ConfigChangeID" /t REG_DWORD /d 698229 /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Visio\Application" /v "CustomMenusFile" /t REG_SZ /d custom12.vsu /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Visio\Application" /v "CustomToolbarsFile" /t REG_SZ /d custom12.vsu /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Visio\Application" /v "FavoritesStencilName" /t REG_SZ /d Favorites.vss /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Visio\Application" /v "FirstRun" /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Visio\Application" /v "FramePosition" /t REG_SZ /d "225 225 1075 1665" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist" /f
