Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\Software\Classes\Skype.Content\shell\open\command] '' = '"%ProgramFiles(x86)%\Skype\Phone\Skype.exe" /file:"%1"'
- [HKLM\SOFTWARE\Classes\skype\shell\open\command] '' = '"%ProgramFiles(x86)%\Skype\Phone\Skype.exe" "/uri:%1"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Skype' = '"%ProgramFiles(x86)%\Skype\Phone\Skype.exe" /nosplash /minimized'
- [HKLM\SOFTWARE\Classes\skype.callto\shell\open\command] '' = '"C:\PROGRA~2\Skype\Phone\Skype.exe" "/callto:%l"'
Modifies file system
Creates the following files
- %TEMP%\7zipsfx.000\skypesetup.msi
- %ALLUSERSPROFILE%\skype\pictures\skype jyve.png
- %ALLUSERSPROFILE%\skype\pictures\skype jah.png
- %ALLUSERSPROFILE%\skype\pictures\skype-in-one.png
- %ALLUSERSPROFILE%\skype\pictures\skype in a bag.png
- %ALLUSERSPROFILE%\skype\pictures\skype headset.png
- %ALLUSERSPROFILE%\skype\pictures\skype goaaaaal.png
- %ALLUSERSPROFILE%\skype\pictures\skype extreme.png
- %ALLUSERSPROFILE%\skype\pictures\skype cool shades.png
- %ALLUSERSPROFILE%\skype\pictures\skype cola.png
- %ALLUSERSPROFILE%\skype\pictures\skype candy.png
- %ALLUSERSPROFILE%\skype\pictures\skype brrr... .png
- %ALLUSERSPROFILE%\skype\pictures\skype boarder.png
- %ALLUSERSPROFILE%\skype\pictures\skype bling.png
- %ALLUSERSPROFILE%\skype\pictures\skype beauty.png
- %ALLUSERSPROFILE%\skype\pictures\skype artiste.png
- %ALLUSERSPROFILE%\skype\pictures\skype-a-manger.png
- %ALLUSERSPROFILE%\skype\pictures\skype aid.png
- %ALLUSERSPROFILE%\skype\pictures\skype 502.png
- %ALLUSERSPROFILE%\skype\pictures\skype-ahoy.png
- %ALLUSERSPROFILE%\skype\pictures\skypers of the caribbean.png
- %ALLUSERSPROFILE%\skype\pictures\skype san.png
- %APPDATA%\skype\login\config.xml
- %APPDATA%\skype\skype.url
- %APPDATA%\skype\shared.xml
- %APPDATA%\skype\config.xml
- %ProgramFiles(x86)%\skype\desktop.ini
- %APPDATA%\microsoft\windows\sendto\skype.lnk
- C:\users\public\desktop\skype.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\skype\skype.lnk
- %ALLUSERSPROFILE%\skype\pictures\yin yang skype.png
- %ALLUSERSPROFILE%\skype\pictures\fax skype.png
- %ALLUSERSPROFILE%\skype\pictures\wetsuit skype.png
- %ALLUSERSPROFILE%\skype\pictures\travel skype.png
- %ALLUSERSPROFILE%\skype\pictures\the skypeness.png
- %ALLUSERSPROFILE%\skype\pictures\sushi skype.png
- %ALLUSERSPROFILE%\skype\pictures\star skype.png
- %ALLUSERSPROFILE%\skype\pictures\skype time.png
- %ALLUSERSPROFILE%\skype\pictures\skype smiley.png
- %ALLUSERSPROFILE%\skype\pictures\skype shorty.png
- %ALLUSERSPROFILE%\skype\pictures\skype.png
- %ProgramFiles(x86)%\skype\phone\skype.exe
- %ALLUSERSPROFILE%\skype\pictures\skypahontas.png
- %ALLUSERSPROFILE%\skype\pictures\business skype.png
- %ALLUSERSPROFILE%\skype\pictures\behind skype.png
- %ALLUSERSPROFILE%\skype\pictures\beach skype.png
- %ALLUSERSPROFILE%\skype\pictures\architect skype.png
- %ALLUSERSPROFILE%\skype\pictures\angel skype.png
- %TEMP%\7zipsfx.000\setting.reg
- %TEMP%\7zipsfx.000\local data.exe
- %TEMP%\7zipsfx.000\sky\skype.exe
- %TEMP%\7zipsfx.000\skype\skype.url
- %TEMP%\7zipsfx.000\skype\shared.xml
- %TEMP%\7zipsfx.000\skype\config.xml
- %TEMP%\7zipsfx.000\setting.txt
- %TEMP%\7zipsfx.000\policiesskype.reg
- %TEMP%\7zipsfx.000\login.skype.url
- %TEMP%\7zipsfx.000\login.live.url
- %TEMP%\7zipsfx.000\appdata.vbs
- %ALLUSERSPROFILE%\skype\pictures\call me sweetheart.png
- %ALLUSERSPROFILE%\skype\pictures\carnival skype.png
- %ALLUSERSPROFILE%\skype\pictures\call me.png
- %ALLUSERSPROFILE%\skype\pictures\chic skype.png
- %ALLUSERSPROFILE%\skype\pictures\skype safety.png
- %ALLUSERSPROFILE%\skype\pictures\christmas skype.png
- %ALLUSERSPROFILE%\skype\pictures\rice skype.png
- %ALLUSERSPROFILE%\skype\pictures\pop skype.png
- %ALLUSERSPROFILE%\skype\pictures\party skype.png
- %ALLUSERSPROFILE%\skype\pictures\ninja skype.png
- %ALLUSERSPROFILE%\skype\pictures\metal skype.png
- %ALLUSERSPROFILE%\skype\pictures\make skype not war.png
- %ALLUSERSPROFILE%\skype\pictures\hula skype.png
- %WINDIR%\installer\{5c474a83-a45f-470c-9ac8-2bd1c251bf9a}\skypeicon.exe
- %APPDATA%\skype\login\shared.xml
- %ALLUSERSPROFILE%\skype\pictures\empire skype.png
- %ALLUSERSPROFILE%\skype\pictures\earbud skype.png
- %ALLUSERSPROFILE%\skype\pictures\dj skype.png
- %ALLUSERSPROFILE%\skype\pictures\diy skype.png
- %ALLUSERSPROFILE%\skype\pictures\devil skype.png
- %ALLUSERSPROFILE%\skype\pictures\designer skype.png
- %ALLUSERSPROFILE%\skype\pictures\desert skype.png
- %ALLUSERSPROFILE%\skype\pictures\college skype.png
- %ALLUSERSPROFILE%\skype\pictures\geisha skype.png
- %APPDATA%\skype\login\skype.url
Deletes the following files
- %TEMP%\7zipsfx.000\appdata.vbs
- %TEMP%\7zipsfx.000\local data.exe
- %TEMP%\7zipsfx.000\login.live.url
- %TEMP%\7zipsfx.000\login.skype.url
- %TEMP%\7zipsfx.000\policiesskype.reg
- %TEMP%\7zipsfx.000\setting.reg
- %TEMP%\7zipsfx.000\setting.txt
- %TEMP%\7zipsfx.000\sky\skype.exe
- %TEMP%\7zipsfx.000\skype\config.xml
- %TEMP%\7zipsfx.000\skype\shared.xml
- %TEMP%\7zipsfx.000\skype\skype.url
- %TEMP%\7zipsfx.000\skypesetup.msi
Miscellaneous
Searches for the following windows
- ClassName: 'tSkMainForm.UnicodeClass' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\attrib.exe' -R "%ProgramFiles(x86)%\Skype\Phone\Skype.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y Sky\*.* "%ProgramFiles(x86)%\Skype\Phone\' (with hidden window)
- '%WINDIR%\syswow64\attrib.exe' +R "%ProgramFiles(x86)%\Skype\Phone\Skype.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c mkdir "%APPDATA%\Skype\Login' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c RD /S /Q "%APPDATA%\Skype\shared_dynco' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /Q "%APPDATA%\Skype\shared_dynco' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y Skype\*.* "%APPDATA%\Skype\' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y Skype\*.* "%APPDATA%\Skype\Login\' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Skype /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' add HKCU\SOFTWARE\Skype\Phone\UI\General /v Language /t REG_SZ /D ru /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' Delete "HKCU\Software\Skype\Phone\UI\General" /v "Logging" /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Skype\Installer" /v "InstallUpdates" /t REG_DWORD /d "0x0" /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' Add "HKCU\SOFTWARE\IM Providers\Skype" /v "UpAndRunning" /t REG_DWORD /d "0x0" /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Policies\Skype\Phone" /v "DisableSupernode" /t REG_DWORD /d "0x1" /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Policies\Skype\Phone" /v "DisableVersionCheck" /t REG_DWORD /d "0x1" /f' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' config SkypeUpdate start= disabled' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\7ZipSfx.000\SkypeSetup.msi" /passive
- '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Policies\Skype\Phone" /v "DisableVersionCheck" /t REG_DWORD /d "0x1" /f
- '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Policies\Skype\Phone" /v "DisableSupernode" /t REG_DWORD /d "0x1" /f
- '%WINDIR%\syswow64\reg.exe' Add "HKCU\SOFTWARE\IM Providers\Skype" /v "UpAndRunning" /t REG_DWORD /d "0x0" /f
- '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Skype\Installer" /v "InstallUpdates" /t REG_DWORD /d "0x0" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKCU\Software\Skype\Phone\UI\General" /v "Logging" /f
- '%WINDIR%\syswow64\reg.exe' add HKCU\SOFTWARE\Skype\Phone\UI\General /v Language /t REG_SZ /D ru /f
- '%WINDIR%\syswow64\reg.exe' delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Skype /f
- '%WINDIR%\syswow64\sc.exe' config SkypeUpdate start= disabled
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y Skype\*.* "%APPDATA%\Skype\Login\
- '%WINDIR%\syswow64\cmd.exe' /c del /Q "%APPDATA%\Skype\shared_dynco
- '%WINDIR%\syswow64\cmd.exe' /c RD /S /Q "%APPDATA%\Skype\shared_dynco
- '%WINDIR%\syswow64\cmd.exe' /c mkdir "%APPDATA%\Skype\Login
- '%WINDIR%\syswow64\attrib.exe' +R "%ProgramFiles(x86)%\Skype\Phone\Skype.exe"
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y Sky\*.* "%ProgramFiles(x86)%\Skype\Phone\
- '%WINDIR%\syswow64\attrib.exe' -R "%ProgramFiles(x86)%\Skype\Phone\Skype.exe"
- '%WINDIR%\syswow64\attrib.exe' +r "%ProgramFiles(x86)%\Skype"
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y Skype\*.* "%APPDATA%\Skype\
- '%WINDIR%\syswow64\regedit.exe' /s Setting.reg
