26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 34:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T457,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Sample 4d83c25a5ea8… — Score 70/100 — Hybrid Analysis","description":"Suspicious verdict for sample 4d83c25a5ea8…. Threat score 70/100. 0/27 AV engines flagged this file. 0 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/4d83c25a5ea8518b153451d8ecb80e24b0f4b72ecdada47f7ebe96e956867b95","keywords":["Suspicious","malware analysis","sandbox report","threat intelligence","4d83c25a5ea8518b153451d8ecb80e24b0f4b72ecdada47f7ebe96e956867b95"],"about":{"@type":"SoftwareApplication","name":"4d83c25a5ea8518b153451d8ecb80e24b0f4b72ecdada47f7ebe96e956867b95","applicationCategory":["pedll","executable"],"identifier":"4d83c25a5ea8518b153451d8ecb80e24b0f4b72ecdada47f7ebe96e956867b95","additionalType":"Suspicious sample"},"threatScore":70,"antivirusDetections":{"malicious":0,"total":27},"behavioralIndicators":{"malicious":0,"suspicious":7},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T2eb93,"nents\"&GetCompressedGuid(ComponentID)&"\" If NOT dicDelRegKey.Exists(sCompReg) Then dicDelRegKey.Add sCompReg,HKCR RegList.WriteLine HiveString(HKCR)&"\"&sCompReg End If sCompReg = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\"&GetCompressedGuid(ComponentID)&"\" If NOT dicDelRegKey.Exists(sCompReg) Then dicDelRegKey.Add sCompReg,HKLM RegList.WriteLine HiveString(HKCR)&"\"&sCompReg End If 'Get the component path If sPath = "" Then sPath = LCase(oMsi.ComponentPath(sCompClient,ComponentID)) sPath = Replace(sPath,"?",":") End If CompVerbose.WriteLine " Path: " & sPath If Len(sPath) > 4 Then If Left(sPath,1) = "0" Then 'Registry keypath Select Case Left(sPath,2) Case "" in Source: sample.bin, " Case Else End Select 'Win32Assemblies LogH2 "Win32Assemblies" If RegEnumKey(HKCR, "Installer\Win32Assemblies\", arrKeys) Then For Each Item in arrKeys If InStr(UCase(Item), OREF)>0 Then RegDeleteKey HKCR, "Installer\Win32Assemblies\"&Item & "\" Next 'Item End If 'RegEnumKey 'Groove blocks reinstall if it locates groove.exe over this key If RegKeyExists(HKCR, "GrooveFile\Shell\Open\Command\") Then sValue = "" RegReadValue HKCR, "GrooveFile\Shell\Open\Command\", "", sValue, "REG_SZ" If InStr(sValue, "\"&OREF&"\")>0 Then RegDeleteKey HKCR, "GrooveFile\" End If 'RegKeyExists End If 'fRemoveAll Select Case OVERSIONMAJOR Case "11" For iLoopCnt = 1 to 3 Select Case iLoopCnt Case 1 'CIW - HKCU sSubKeyName = "Software\Microsoft\OfficeCustomizeWizard\" & OVERSION & "\RegKey" in Source: sample.bin, "If 'Ensure integrity of WI metadata which could fail used APIs otherwise EnsureValidWIMetadata HKCU, "Software\Classes\Installer\Products", COMPRESSED EnsureValidWIMetadata HKCR, "Installer\Products", COMPRESSED EnsureValidWIMetadata HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products", COMPRESSED EnsureValidWIMetadata HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components", COMPRESSED EnsureValidWIMetadata HKCR, "Installer\Components", COMPRESSED 'Add initial known .exe files that might need to be closed dicApps.Add "communicator.exe", "communicator.exe" 'Adding setup.exe to the hard list of processes that are shut down will potentially break wrappers that invoke OffScrub 'dicApps.Add "setup.exe", "setup.exe" Select Case OVERSIONMAJOR Case "12" Case "14" dicApps.Add "bcssync.exe", "bcssync.exe" dicApps.Add "officesas.exe", "officesas.exe" dicApps.Add "officesasscheduler.exe", "officesasscheduler.exe" dicAp" in Source: sample.bin, " Log " - msiexec returned: " & SetupRetVal(sReturn) & " (" & sReturn & ")" & vbCrLf fRebootRequired = fRebootRequired OR (sReturn = "3010") OR (sReturn = "1618") Else Log " -> Removal suppressed in preview mode." LogOnly " -> Command: "&sCmd End If End If 'InScope Next 'Product If i = 0 Then Log " Nothing to remove for msiexec" End Sub 'MsiexecRemoval '======================================================================================================= 'Remove the OSE (Office Source Engine) service Sub RemoveOSE On Error Resume Next DeleteService "ose" 'Delete the folder DeleteFolder sCommonProgramFiles & "\Microsoft Shared\Source Engine" 'Delete the registration RegDeleteKey HKLM,"SYSTEM\CurrentControlSet\Services\ose\" End Sub 'RemoveOSE '======================================================================================================= 'File cleanup operation" in Source: sample.bin, "eProtectionPlatform_Test\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\Common\ActiveX Compatibility\{00024512-0000-0000-C000-000000000046}\" RegDeleteValue HKLM, "SOFTWARE\Microsoft\Office\OneNote\Adapters\", "{456B0D0E-49DD-4C95-8DB6-175F54DE69A3}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{42042206-2D85-11D3-8CFF-005004838597}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{0006F045-0000-0000-C000-000000000046}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{7CCA70DB-DE7A-4" in Source: sample.bin, "Office\" & OVERSION & "\CVHSettings" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\" & OVERSION & "\Common\InstallRoot\Virtual" 'Control Panel Items RegDeleteKey HKLM, "Software\Microsoft\Windows\CurrentVersion\explorer\ControlPanel\NameSpace\{F9ACD2D6-09C8-4103-995C-912DE68DDE1E}" RegDeleteKey HKCR, "CLSID\{F9ACD2D6-09C8-4103-995C-912DE68DDE1E}" RegDeleteKey HKLM, "Software\Microsoft\Windows\CurrentVersion\explorer\ControlPanel\NameSpace\{005CB1F2-224F-4738-B051-91A96758F50C}" RegDeleteKey HKCR, "CLSID\{005CB1F2-224F-4738-B051-91A96758F50C}" sSubKeyName = "SOFTWARE\Microsoft\SoftGrid\4.5\Client\Packages\" If RegEnumKey(HKLM, sSubKeyName, arrKeys) Then For Each Item in arrKeys If CheckDelete(Item) Then RegDeleteKey HKLM, sSubKeyName & Item Next 'Item End If 'RegEnumKey If RegEnumKey(HKCU, sSubKeyName, arrKeys) Then For Each Item in arrKeys If Ch" in Source: sample.bin, "msi" Const RETVALFILE = "ScrubRetValFile.txt" Const OVERSION = "15.0" Const OVERSIONMAJOR = "15" Const OREF = "Office15" Const OREGREF = "OFFICE15." Const ONAME = "Office 2013 MSI" Const OPACKAGE = "PackageRefs" Const OFFICEID = "000000FF1CE}" Const HKCR = &H80000000 Const HKCU = &H80000001 Const HKLM = &H80000002 Const HKU = &H80000003 Const FOR_WRITING = 2 Const PRODLEN = 12 Const COMPPERMANENT = "00000000000000000000000000000000" Const UNCOMPRESSED = 38 Const SQUISHED = 20 Const COMPRESSED = 32 Const REG_ARP = "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" Const VB_YES = 6 Const MSIOPENDATABASEREADONLY = 0 Const LYNC_ALL = "{4A2C120F-307B-4400-B239-F29ADB54D3C6}{5CFD6599-10E5-4CF0-B6E1-BF39D30A64F8}{5CFD6599-10E5-4CF0-B6E1-BF39D30A64F8}{BF3AC8BA-1A0F-42AD-8B65-4250617AF682}{3475BF22-3564-4EF3-A633-C5F3F4582392}{263BA91B-7782-4EEB-A4FC-7BD554CAF1F3}{AA256AE1-6B6A-48E" in Source: sample.bin, "ers\Groove Explorer Icon Overlay 1 (GFS Unread Stub)\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2 (GFS Stub)\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 3 (GFS Folder)\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 4 (GFS Unread Mark)\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\" Case "15" Case Else End Select 'Win32Assemblies LogH2 "Win32Assemblies" If RegEnumKey(HKCR,"Installer\Win32Assembl" in Source: sample.bin, "U Registration RegDeleteKey HKCU, "Software\Microsoft\Office\15.0\Registration" RegDeleteKey HKCU, "Software\Microsoft\Office\16.0\Registration" RegDeleteKey HKCU, "Software\Microsoft\Office\Registration" ' C2R specifics ' AppV key "SOFTWARE\Microsoft\AppV" has already been cleared in uninstall stage ' Virtual InstallRoot RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\15.0\Common\InstallRoot\Virtual" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\16.0\Common\InstallRoot\Virtual" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\Common\InstallRoot\Virtual" ' Mapi Search reg 'O15 If NOT dicKeepSku.Count > 0 Then RegDeleteKey HKLM, "SOFTWARE\Classes\CLSID\{2027FC3B-CF9D-4ec7-A823-38BA308625CC}" 'O16 '{F8E61EDD-EA25-484e-AC8A-7447F2AAE2A9} ' C2R keys RegDeleteKey HKCU, "SOFTWARE\Microsoft\Office\15.0\ClickToRun" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\15.0\ClickToRun" RegDeleteKey HKLM, "SOFTWARE\Microsof" in Source: sample.bin, "me = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\" hDefKey = HKLM Case 2 LogH2 "HKCR UpgradeCodes" sSubKeyName = "Installer\UpgradeCodes\" hDefKey = HKCR Case 3 LogH2 "HKLM Products" sSubKeyName = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\" hDefKey = HKLM Case 4 LogH2 "HKCR Features" sSubKeyName = "Installer\Features\" hDefKey = HKCR Case 5 LogH2 "HKCR Products" sSubKeyName = "Installer\Products\" hDefKey = HKCR Case Else sSubKeyName = "" hDefKey = "" End Select If RegEnumKey(hDefKey,sSubKeyName,arrKeys) Then For Each Item in arrKeys 'Ensure we have the expected length for a compressed GUID If Len(Item)=32 Then 'Expand the GUID" in Source: sample.bin, "RODLEN = 13 Const SQUISHED = 20 Const COMPRESSED = 32 Const REG_ARP = "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" Const VB_YES = 6 Const VB_NO = 7 Const ERROR_SUCCESS = 0 'Bit #1. 0 indicates Success. Script completed successfully Const ERROR_FAIL = 1 'Bit #1. Failure bit. Indicates an overall script failure. 'RESERVED bit! Returned when process is killed from task manager Const ERROR_REBOOT_REQUIRED = 2 'Bit #2. Reboot bit. If set a reboot is required Const ERROR_USERCANCEL = 4 'Bit #3. User Cancel bit. Controlled cancel from script UI Const ERROR_STAGE1 = 8 'Bit #4. Informational. Msiexec based install was not possible Const ERROR_STAGE2 = 16 'Bit #5. Critical. Not all of the intended cleanup operations could be applied Const ERROR_INCOMPLETE = 32 'Bit #6. Pending file renam" in Source: sample.bin, "dGuid(ComponentID)&"\"&GetCompressedGuid(CompClient) If NOT dicDelRegKey.Exists(sCompReg) Then dicDelRegKey.Add sCompReg, HKCR RegList.WriteLine HiveString(HKCR)&"\"&sCompReg End If sCompReg = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\"&GetCompressedGuid(ComponentID)&"\"&GetCompressedGuid(CompClient) If NOT dicDelRegKey.Exists(sCompReg) Then dicDelRegKey.Add sCompReg, HKLM RegList.WriteLine HiveString(HKCR)&"\"&sCompReg End If Else If NOT dicCompPath.Exists(sPath) Then dicCompPath.Add sPath, CompClient End If CompVerbose.WriteLine "AffectedComponent: " & fAffectedComponent " in Source: sample.bin, ".Run (sCmd, 0, True) Log " Return value: " & sReturn End If End If Next 'i ' delete potential blocking registry keys for msiexec based tasks LogH2 "Remove C2R and App-V registry data" For Each sku in dicC2RSuite.Keys ' remove the ARP entry RegDeleteKey HKLM, REG_ARP & sku Next 'sku RegDeleteKey HKCU, "SOFTWARE\Microsoft\Office\15.0\ClickToRun" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\15.0\ClickToRun" RegDeleteKey HKCU, "SOFTWARE\Microsoft\Office\16.0\ClickToRun" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\16.0\ClickToRun" RegDeleteKey HKCU, "SOFTWARE\Microsoft\Office\ClickToRun" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\ClickToRun" ' AppV keys hDefKey = HKCU sSubKeyName = "SOFTWARE\Microsoft\AppV\ISV" Do LogOnly "Scanning key: " & sSubKeyName If RegEnumValues(hDefKey, sSubKeyName, arrNames, arrTypes) Then For Each Name in arrNames " in Source: sample.bin, "ies\",arrKeys) Then For Each Item in arrKeys If InStr(UCase(Item),OREF)>0 Then RegDeleteKey HKCR,"Installer\Win32Assemblies\"&Item & "\" Next 'Item End If 'RegEnumKey 'Groove blocks reinstall if it locates groove.exe over this key If RegKeyExists(HKCR,"GrooveFile\Shell\Open\Command\") Then sValue = "" RegReadValue HKCR,"GrooveFile\Shell\Open\Command\","",sValue,"REG_SZ" If InStr(sValue,"\"&OREF&"\")>0 Then RegDeleteKey HKCR,"GrooveFile\" End If 'RegKeyExists End If 'fRemoveAll Select Case OVERSIONMAJOR Case "11" For iLoopCnt = 1 to 3 Select Case iLoopCnt Case 1 'CIW - HKCU sSubKeyName = "Software\Microsoft\OfficeCustomizeWizard\" & OVERSION & "\RegKeyPaths\" hDefKey = HKCU Case 2 'CIW - HKLM sSubKeyName = "SOFTWARE\Microsoft\OfficeCustomizeWizar" in Source: sample.bin, " Next End If If Not fDetectOnly Then iRetVal = 0 iRetVal = oReg.DeleteKey(hDefKey,sSubKeyName) If NOT (iRetVal=0) Then LogOnly " Delete failed. Return value: "&iRetVal End If End Sub 'RegDeleteKeyEx '======================================================================================================= 'Return the alternate regkey location on 64bit environment Function Wow64Key(hDefKey, sSubKeyName) Dim iPos Select Case hDefKey Case HKCU If Left(sSubKeyName,17) = "Software\Classes\" Then Wow64Key = Left(sSubKeyName,17) & "Wow6432Node\" & Right(sSubKeyName,Len(sSubKeyName)-17) Else iPos = InStr(sSubKeyName,"\") Wow64Key = Left(sSubKeyName,iPos) & "Wow6432Node\" & Right(sSubKeyName,Len(sSubKeyName)-iPos) End If Case HKLM If Left(sSubKeyName,17) = "Software\Classes\" Then Wow64Key = Left(sSu" in Source: sample.bin, "miter = Mid(sVersion, iCnt, 1) Exit Function End If Next 'iCnt End Function '======================================================================================================= 'Check registry access permissions. Failure will terminate the script Function CheckRegPermissions Const KEY_QUERY_VALUE = &H0001 Const KEY_SET_VALUE = &H0002 Const KEY_CREATE_SUB_KEY = &H0004 Const DELETE = &H00010000 Dim sSubKeyName Dim fReturn CheckRegPermissions = True sSubKeyName = "Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\" oReg.CheckAccess HKLM, sSubKeyName, KEY_QUERY_VALUE, fReturn If Not fReturn Then CheckRegPermissions = False oReg.CheckAccess HKLM, sSubKeyName, KEY_SET_VALUE, fReturn If Not fReturn Then CheckRegPermissions = False oReg.CheckAccess HKLM, sSubKeyName, KEY_CREATE_SUB_KEY, fReturn If Not fReturn Then CheckRegPermissions = False oReg.Check" in Source: sample.bin, "WARE\Microsoft\Office\15.0\CleanC2R", "Rerun", sValue, "REG_DWORD") Then ' Rerun has already been tried LogH2 "Error: Removal failed" SetError ERROR_DCAF_FAILURE Exit Sub End If fRebootRequired = True SetError ERROR_REBOOT_REQUIRED SetError ERROR_INCOMPLETE ' cache the script to the local scrub folder oFso.CopyFile WScript.scriptFullName, sScrubDir & "\" & SCRIPTFILE oReg.CreateKey HKLM, "SOFTWARE" oReg.CreateKey HKLM, "SOFTWARE\Microsoft" oReg.CreateKey HKLM, "SOFTWARE\Microsoft\Office" oReg.CreateKey HKLM, "SOFTWARE\Microsoft\Office\15.0" oReg.CreateKey HKLM, "SOFTWARE\Microsoft\Office\15.0\CleanC2R" oReg.SetDWordValue HKLM, "SOFTWARE\Microsoft\Office\15.0\CleanC2R", "Rerun", 1 fSetRunOnce = True ' oReg.CreateKey HKCU, "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" ' oReg.SetStringValue HKCU, "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce", "CleanC2R", "cscript.exe " & chr(34) & sScr" in Source: sample.bin, "Component Then 'Check msidbComponentAttributesPermanent flag If fIsPermanent AND NOT fForce Then fRemoveComponent = False CompVerbose.WriteLine " msidbComponentAttributesPermanent: " & NOT fRemoveComponent End If If fRemoveComponent Then CompVerbose.WriteLine " RESULT: Component IN SCOPE for removal" fIsFile = False : fIsFolder = False 'Component resources go away for this product Err.Clear 'Add the component registration key to ensure removal sCompReg = "Installer\Components\"&GetCompressedGuid(ComponentID)&"\" If NOT dicDelRegKey.Exists(sCompReg) Then dicDelRegKey.Add sCompReg,HKCR RegList.WriteLine HiveString(HKCR)&"\"&sCompReg End If sCompReg = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\"&GetCompressedGuid(ComponentID)&"\" If NOT dicDelRegKey.Exi" in Source: sample.bin, " ' Setup.exe and Msiexec.exe have no Cancel button" & vbCrLf &_ vbTab & "/Quiet ' Script, Setup.exe and Msiexec.exe run quiet with no UI" & vbCrLf &_ vbTab & "/ReturnErorOrSuccess ' Returns 0 for a successful removal. Non-Zero if not." & vbCrLf Wscript.Quit End Sub 'ShowSyntax '------------------------------------------------------------------------------- ' FindInstalledOProducts ' ' Office configuration products are listed with their configuration product ' name in the "Uninstall" key. '------------------------------------------------------------------------------- Sub FindInstalledOProducts Dim ArpItem, prod, cult Dim sCurKey, sValue, sConfigName, sCulture, sDisplayVersion, sVersionFallback Dim sUninstallString, sProd Dim iLeft, iRight Dim arrKeys, arrProducts, arrCultures Dim fSystemComponent0, fDisplayVersion, fUninstallString Const REG_ARP = "SOFTWARE\Microsoft\Windows\Current" in Source: sample.bin, "KLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{D66DC78C-4F61-447F-942B-3FB6980118CF}", False RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\" 'Groove Extensions RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\","{B5A7F190-DDA6-4420-B3BA-52453494E6CD}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{99FD978C-D287-4F50-827F-B2C658EDA8E7}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{920E6DB1-9907-4370-B3A0-BAFC03D81399}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{16F3DD" in Source: sample.bin, " Else If (Mid(Item, 27, PRODLEN)=OFFICEID AND Mid(Item, 4, 2)=OVERSIONMAJOR) AND _ CheckDelete(UCase(Left(Item, 38))) Then RegDeleteKey HKLM, sSubKeyName & Item & "\" End If End If '37 Next 'Item End If 'RegEnumKey 'Registration Log " - HKLM Registration" hDefKey = HKLM sSubKeyName = "SOFTWARE\Microsoft\Office\"&OVERSION&"\Registration\" If RegEnumKey(HKLM, sSubKeyName, arrKeys) Then For Each Item in arrKeys If Len(Item)>37 Then If CheckDelete(UCase(Left(Item, 38))) Then RegDeleteKey HKLM, sSubKeyName & Item & "\" End If Next 'Item End If 'RegEnumKey 'User Preconfigurations Log " - HKLM User Preconfigurations" hDefKey = HKLM sSubKeyName = "SOFTWARE\Microsoft\Office\"&OVERSION&"\User Settings\" If RegEnumKey(HKLM, sSubKeyName, arrKeys) Then For Each Item in arrKeys " in Source: sample.bin, "fRemoveComponent Then iRemCnt = iRemCnt + 1 fAffectedComponent = True 'Since the scope remains within one Office family the keypath for the component 'is assumed to be identical If sCompClient = "" Then sCompClient = CompClient ' flag the CompClient entry for removal sCompReg = "Installer\Components\"&GetCompressedGuid(ComponentID)&"\"&GetCompressedGuid(CompClient) If NOT dicDelRegKey.Exists(sCompReg) Then dicDelRegKey.Add sCompReg, HKCR RegList.WriteLine HiveString(HKCR)&"\"&sCompReg End If sCompReg = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\"&GetCompressedGuid(ComponentID)&"\"&GetCompressedGuid(CompClient) " in Source: sample.bin, "ls\Text Converters\Import\MEWord12\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\Word12\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\Word97\" RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Run\", "GrooveMonitor", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Run\", "LobiServer", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Run\", "BCSSync", False RegDeleteKey HKLM,"SYSTEM\CurrentControlSet\Services\Outlook\" End If RegDeleteValue HKLM,"SOFTWARE\Microsoft\Office\Common\OffDiag\Location\", OVERSIONMAJOR, False RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Office\" & OVERSION & "\" RegDeleteValue HKLM,"SOFTWARE\Microsoft\Office\Common\OffDiag\Location\", OVERSIONMAJOR, False RegDeleteKey HKLM,"SOFTWARE\Microso" in Source: sample.bin, "SE service" Set OseService = oWmiLocal.Execquery("Select * From Win32_Service Where Name like 'ose%'") For Each srvc in OseService If (srvc.StartMode = "Disabled") AND (Not srvc.ChangeStartMode("Manual") = 0) Then _ Log "Conflict detected: OSE service is disabled" If (Not srvc.StartName = "LocalSystem") AND (srvc.Change( , , , , , , "LocalSystem", "")) Then _ Log "Conflict detected: OSE service not running as LocalSystem" Next 'srvc If NOT dicC2RSuite.Count > 0 Then Log "No uninstallable C2R items registered in Uninstall" End If ' call odt based uninstall UninstallOfficeC2R ' remove the published component registration for C2R packages LogH2 "Remove published component registration for C2R packages" ' delete the manifest files For i = 1 To 4 Select Case i Case 1 RegReadValue HKLM, "SOFTWARE\Microsoft\Office\15.0\ClickToRun", "PackageFolder", sPkgFld, "REG_SZ" RegReadValu" in Source: sample.bin, "FTWARE\Microsoft\Office\OneNote\Adapters\", "{456B0D0E-49DD-4C95-8DB6-175F54DE69A3}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{42042206-2D85-11D3-8CFF-005004838597}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{0006F045-0000-0000-C000-000000000046}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{7CCA70DB-DE7A-4FB7-9B2B-52E2335A3B5A}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{506F4668-F13E-4AA1-BB04-B43203AB3CC0}", False R" in Source: sample.bin, "Shared Tools\Text Converters\Import\MEWord12\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\Word12\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\Word97\" RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Run\", "GrooveMonitor", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Run\", "LobiServer", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Run\", "BCSSync", False RegDeleteKey HKLM,"SYSTEM\CurrentControlSet\Services\Outlook\" End If RegDeleteValue HKLM,"SOFTWARE\Microsoft\Office\Common\OffDiag\Location\", OVERSIONMAJOR, False RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Office\" & OVERSION & "\" RegDeleteValue HKLM,"SOFTWARE\Microsoft\Office\Common\OffDiag\Location\", OVERSIONMAJOR, False RegDeleteKey HKLM,"SOFTWA" in Source: sample.bin, " Const RETVALFILE = "ScrubRetValFile.txt" Const OVERSION = "16.0" Const OVERSIONMAJOR = "16" Const OREF = "Office16" Const OREGREF = "OFFICE16." Const ONAME = "Office 2016 MSI" Const OPACKAGE = "PackageRefs" Const OFFICEID = "000000FF1CE}" Const HKCR = &H80000000 Const HKCU = &H80000001 Const HKLM = &H80000002 Const HKU = &H80000003 Const FOR_WRITING = 2 Const PRODLEN = 12 Const COMPPERMANENT = "00000000000000000000000000000000" Const UNCOMPRESSED = 38 Const SQUISHED = 20 Const COMPRESSED = 32 Const REG_ARP = "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" Const VB_YES = 6 Const MSIOPENDATABASEREADONLY = 0 Const LYNC_ALL = "{4A2C120F-307B-4400-B239-F29ADB54D3C6}{5CFD6599-10E5-4CF0-B6E1-BF39D30A64F8}{5CFD6599-10E5-4CF0-B6E1-BF39D30A64F8}{BF3AC8BA-1A0F-42AD-8B65-4250617AF682}{3475BF22-3564-4EF3-A633-C5F3F4582392}{263BA91B-7782-4EEB-A4FC-7BD554CAF1F3}{AA256AE1-6B6A-48E6-995" in Source: sample.bin, " Next 'Item End If 'RegEnumKey 'User Preconfigurations hDefKey = HKLM sSubKeyName = "SOFTWARE\Microsoft\Office\"&OVERSION&"\User Settings\" If RegEnumKey(HKLM,sSubKeyName,arrKeys) Then For Each Item in arrKeys If Len(Item)>37 Then If CheckDelete(UCase(Left(Item,38))) Then RegDeleteKey HKLM,sSubKeyName & Item & "\" End If Next 'Item End If 'RegEnumKey 'Known Keypath settings For Each key in dicDelRegKey.Keys If Right(key,1) = "\" Then RegDeleteKey dicDelRegKey.Item(key),key Else iPos = InStrRev(Key,"\") If iPos > 0 Then RegDeleteValue dicDelRegKey.Item(key), Left(key,iPos - 1), Mid(key,iPos+1) End If Next End Sub 'RegWipe '======================================================================================================= Sub RegWipeWIConfig (hDefKey, sSubKeyName, iLoopCnt) Dim Item, Name Dim sGuid Dim a" in Source: sample.bin, "KeyName, sCurKey, value, sValue, sGuid Dim fkeep, fSystemComponent0, fPackages, fDisplayVersion Dim arrKeys, arrNames, arrTypes, arrMultiSzValues, arrMultiSzNewValues Dim arrTestNames, arrTestTypes Dim i, iLoopCnt, iPos Dim fDelReg 'Wipe registry data 'User Profile settings LogH2 "User Policies" RegDeleteKey HKCU, "Software\Policies\Microsoft\Office\" & OVERSION & "\" If NOT fKeepUser Then RegDeleteKey HKCU, "Software\Microsoft\Office\" & OVERSION & "\" LogH2 "User Settings" End If 'fKeepUser 'Computer specific settings If fClearAddinReg Then RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\Outlook\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\Word\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\Excel\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\PowerPoint\" End If If (fRemoveAll AND NOT fC2rInstalled) OR (fRemoveAll AND fForce) Then LogH2 "Machine Setti" in Source: sample.bin, "age3 : fBypass_Stage3 = False 'Msiexec Dim fBypass_Stage4 : fBypass_Stage4 = False 'CleanUp sendmessage = "continue" 'Create required objects Set oWmiLocal = GetObject("winmgmts:{(Debug)}\\.\root\cimv2") Set oWShell = CreateObject("Wscript.Shell") Set oShellApp = CreateObject("Shell.Application") Set oFso = CreateObject("Scripting.FileSystemObject") Set oMsi = CreateObject("WindowsInstaller.Installer") Set oReg = GetObject("winmgmts:\\.\root\default:StdRegProv") 'Get environment path info sAppData = oWShell.ExpandEnvironmentStrings("%appdata%") sLocalAppData = oWShell.ExpandEnvironmentStrings("%localappdata%") sTemp = oWShell.ExpandEnvironmentStrings("%temp%") sAllUsersProfile = oWShell.ExpandEnvironmentStrings("%allusersprofile%") RegReadValue HKLM, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList", "ProfilesDirectory", sProfilesDirectory, "REG_EXPAND_SZ" If NOT oFso.FolderExists(sProfilesDirectory) Then " in Source: sample.bin, "UserKey, sSquirrelKey, sKey Dim key Dim iCount Dim arrKey If sCustomName = "" Then sCustomName = "CustomUserReset" ' attempt direct delete sCUserKey = "HKCU\Software\Microsoft\Office\" & iVM & ".0\" & sRegKey Log "Remove key " & sCUserKey sCmd = "REG DELETE " & sCUserKey & " /f" sRetVal = oWShell.Run(sCmd, 0, True) 'create user settings key to cover reset for other profiles sSettingsKey = "SOFTWARE\Wow6432Node\Microsoft\Office\" & iVM & ".0\User Settings" If (f64 And fO64) Or (Not f64) Then sSettingsKey = "SOFTWARE\Microsoft\Office\" & iVM & ".0\User Settings" sSquirrelKey = sCustomName & "\Delete\Software\Microsoft\Office\" & iVM & ".0\" & sRegKey arrKey = Split(sSquirrelKey, "\") sKey = sSettingsKey For Each key In arrKey sKey = sKey & "\" & key oReg.CreateKey HKLM, sKey Next iCount = 1 If Not fSafeForRoamingUsers Then If RegReadDWordValue(HKLM, sSettingsKey & "\" & sCustomName, "Count"" in Source: sample.bin, "\Approved\", "{16F3DD56-1AF5-4347-846D-7C10C4192619}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{72853161-30C5-4D22-B7F9-0BBC1D38A37E}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{6C467336-8281-4E60-8204-430CED96822D}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{A449600E-1DC6-4232-B948-9BD794D62056}", False RegDeleteValue HKLM,"SOFTWARE\Mi" in Source: sample.bin, "RE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{920E6DB1-9907-4370-B3A0-BAFC03D81399}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{16F3DD56-1AF5-4347-846D-7C10C4192619}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{72853161-30C5-4D22-B7F9-0BBC1D38A37E}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{6C467336-8281-4E60-8204-430CED96822D}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{B5A7F190-DDA6-4420-B3BA-52453494E" in Source: sample.bin, "RetVal=0) Then LogOnly " Delete failed. Return value: "&iRetVal End If End Sub 'RegDeleteKeyEx '======================================================================================================= 'Return the alternate regkey location on 64bit environment Function Wow64Key(hDefKey, sSubKeyName) Dim iPos Select Case hDefKey Case HKCU If Left(sSubKeyName, 17) = "Software\Classes\" Then Wow64Key = Left(sSubKeyName, 17) & "Wow6432Node\" & Right(sSubKeyName, Len(sSubKeyName)-17) Else iPos = InStr(sSubKeyName, "\") Wow64Key = Left(sSubKeyName, iPos) & "Wow6432Node\" & Right(sSubKeyName, Len(sSubKeyName)-iPos) End If Case HKLM If Left(sSubKeyName, 17) = "Software\Classes\" Then Wow64Key = Left(sSubKeyName, 17) & "Wow6432Node\" & Right(sSubKeyName, Len(sSubKeyName)-17) Else iPos = InStr(sSubKeyName, "\") " in Source: sample.bin, " Extensions\Approved\","{99FD978C-D287-4F50-827F-B2C658EDA8E7}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{920E6DB1-9907-4370-B3A0-BAFC03D81399}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{16F3DD56-1AF5-4347-846D-7C10C4192619}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{72853161-30C5-4D22-B7F9-0BBC1D38A37E}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{6C467336-8281-4E60-8204-430CED96822D}", False RegDeleteValue HKLM,"SOFTWAR" in Source: sample.bin, " RegDeleteValue hDefKey, sSubKeyName & Item & "\", Name, True End If Next 'Name End If 'IsArray(arrNames) 'If all entries were removed - delete the key RegEnumValues hDefKey,sSubKeyName & Item,arrNames,arrTypes If Not IsArray(arrNames) Then RegDeleteKey hDefKey, sSubKeyName & Item & "\" Else 'iLoopCnt >= 3 If CheckDelete(sGuid) Then RegDeleteKey hDefKey, sSubKeyName & Item & "\" End If 'iLoopCnt < 3 End If 'fRemoveAll End If 'Len(Item)=32 Next 'Item End If 'RegEnumKey Next 'iLoopCnt 'Components Log " - Global Components" sSubKeyName = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\" If RegE" in Source: sample.bin, "ch Set oShell = CreateObject("Shell.Application") ' Note: Command line has not been parsed at this point ' build command line for relaunch sCmdLine = Chr(34) & WScript.ScriptFullName & Chr(34) If Wscript.Arguments.Count > 0 Then For Each Argument in Wscript.Arguments Select Case UCase(Argument) Case "/Q", "/QUIET" 'Don't try to relaunch in quiet mode Exit Sub SetError ERROR_ELEVATION_FAILED Case "UAC" 'Already tried elevated relaunch SetError ERROR_ELEVATION_FAILED Exit Sub Case Else sCmdLine = sCmdLine & " " & chr(34) & Argument & chr(34) End Select Next 'Argument End If ' prep work to get the return value from the elevated process iParentProcessId = GetMyProcessId ' ' make user aware of elevation attempt after reboot ' If RegReadValue(HKCU, "SOFTWARE\Mi" in Source: sample.bin, "'Remove the Softgrid services (App-V and Click2Run) Sub RemoveSG If fKeepSG Then Exit Sub On Error Resume Next Log " Softgrid CleanUp" DeleteService("cvhsvc") DeleteService("SftList") DeleteService("SftPlay") DeleteService("SftVol") DeleteService("SftFs") DeleteService("SftVsa") 'Delete the folder DeleteFolder sAppdata & "\SoftGrid Client" DeleteFolder sLocalAppData & "\SoftGrid Client" DeleteFolder sProgramData & "\Microsoft\Application Virtualization Client\SoftGrid Client" DeleteFolder sProgramData & "\Microsoft\Application Virtualization Client" DeleteFolder sProgramfiles & "\Microsoft\Microsoft Application Virtualization Client" DeleteFolder sProgramfiles & "\Microsoft Application Virtualization Client" 'Delete the registration RegDeleteKey HKLM, "SYSTEM\CurrentControlSet\Services\cvhsvc" RegDeleteKey HKLM, "SYSTEM\CurrentControlSet\Services\sftfs" RegDeleteKey HKLM, "SYSTEM\CurrentControlSet\Services" in Source: sample.bin, "Text Converters\Export\Word97\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\MEWord12\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\Word12\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\Word97\" RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\", "GrooveMonitor", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\", "LobiServer", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\", "BCSSync", False RegDeleteKey HKLM, "SYSTEM\CurrentControlSet\Services\Outlook\" End If RegDeleteValue HKLM, "SOFTWARE\Microsoft\Office\Common\OffDiag\Location\", OVERSIONMAJOR, False RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Office\" & OVERSION & "\" RegDeleteValue HKLM, "SOFTWARE\Micros" in Source: sample.bin, "egDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{D66DC78C-4F61-447F-942B-3FB6980118CF}", False RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\" 'Groove Extensions RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\", "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{99FD978C-D287-4F50-827F-B2C658EDA8E7}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{920E6DB1-9907-4370-B3A0-BAFC03D81399}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions" in Source: sample.bin, " '------------------ '------------------------------------------------------------------------------- ' ExitScript ' ' Returncode and reboot handler '------------------------------------------------------------------------------- Sub ExitScript Dim sPrompt ' Update cached error and quit '----------------------------- If NOT CBool(iError AND (ERROR_FAIL + ERROR_INCOMPLETE)) Then RegDeleteValue HKCU, "SOFTWARE\Microsoft\Office\15.0\CleanC2R", "Rerun", False SetRetVal iError ' log result If CBool(iError AND ERROR_INCOMPLETE) Then LogH2 "Removal result: " & iError & " - INCOMPLETE. Uninstall requires a system reboot to complete." Else sTmp = " - SUCCESS" If CBool(iError AND ERROR_USERCANCEL) Then sTmp = " - USER CANCELED" If CBool(iError AND ERROR_FAIL) Then sTmp = " - FAIL" LogH2 "Removal result: " & iError & sTmp End If If CBool(iError AND ERROR_FAIL) Then If CBool(iError AND ERROR_REBOOT" in Source: sample.bin, "If fRemoveOse OR fForce Then RegDeleteKey HKLM,"SOFTWARE\Microsoft\Office Test\" RegDeleteValue HKLM,"SOFTWARE\Microsoft\Office\Common\", "LastAccessInstall", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Office\Common\", "MID", False RegDeleteKey HKLM,"SOFTWARE\Microsoft\Office\Excel\Addins\Microsoft.PerformancePoint.Planning.Client.Excel\" RegDeleteValue HKLM,"SOFTWARE\Microsoft\Office\InfoPath\Converters\Import\InfoPath.DesignerExcelImport\Versions\", OVERSION, False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Office\InfoPath\Converters\Import\InfoPath.DesignerWordImport\Versions\", OVERSION, False RegDeleteKey HKLM,"SOFTWARE\Microsoft\Shared Tools\Text Converters\Export\MEWord12\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Shared Tools\Text Converters\Export\Word12\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Shared Tools\Text Converters\Export\Word97\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\" in Source: sample.bin, "0000 Dim sSubKeyName Dim fReturn CheckRegPermissions = True sSubKeyName = "Software\Microsoft\Windows\" oReg.CheckAccess HKLM, sSubKeyName, KEY_QUERY_VALUE, fReturn If Not fReturn Then CheckRegPermissions = False oReg.CheckAccess HKLM, sSubKeyName, KEY_SET_VALUE, fReturn If Not fReturn Then CheckRegPermissions = False oReg.CheckAccess HKLM, sSubKeyName, KEY_CREATE_SUB_KEY, fReturn If Not fReturn Then CheckRegPermissions = False oReg.CheckAccess HKLM, sSubKeyName, DELETE, fReturn If Not fReturn Then CheckRegPermissions = False End Function 'CheckRegPermissions '------------------------------------------------------------------------------- ' GetMyProcessId ' ' Returns the process id of the own process '------------------------------------------------------------------------------- Function GetMyProcessId() Dim iParentProcessId iParentProcessId = 0 ' try to obtain from creating a new cscript instance On Error Re" in Source: sample.bin, " Case Else End Select 'UpgradeCodes, WI config, WI global config For iLoopCnt = 1 to 5 Select Case iLoopCnt Case 1 LogH2 "HKLM UpgradeCodes" sSubKeyName = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\" hDefKey = HKLM Case 2 LogH2 "HKCR UpgradeCodes" sSubKeyName = "Installer\UpgradeCodes\" hDefKey = HKCR Case 3 LogH2 "HKLM Products" sSubKeyName = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\" hDefKey = HKLM Case 4 LogH2 "HKCR Features" sSubKeyName = "Installer\Features\" hDefKey = HKCR Case 5 LogH2 "HKCR Products" sSubKeyName = "Installer\Products\" hDefKey = HKCR Case Else sSubKeyName = "" hDefKey = "" End Select If RegEnumKey(hDefKey, s" in Source: sample.bin, "rofile location: " & sProfilesDirectory sCurDir = Left(WScript.ScriptFullName, InStrRev( WScript.ScriptFullName, "\")) LogOnly "Current Directory: " & sCurDir End Sub '------------------------------------------------------------------------------- ' ClearConfigUser ' ' clear HKLM cached user license id '------------------------------------------------------------------------------- Sub ClearConfigUser Dim value Dim sConfigKey, sRetVal, sCmd Dim arrNames, arrTypes If NOT fClearO16 Then Exit Sub sConfigKey = "SOFTWARE\Microsoft\Office\ClickToRun\Configuration" If RegEnumValues(HKLM, sConfigKey, arrNames, arrTypes) Then For Each value in arrNames If (InStr(LCase(value), LCase(".EmailAddress")) > 0) Or (InStr(LCase(value), LCase(".TenantId")) > 0) Or (LCase(value) = "productkeys") Then sCmd = "REG DELETE HKLM\" & sConfigKey & " /v " & value & " /f" sRetVal = oWShell.Run(sCmd, 0, True) " in Source: sample.bin, "& chr(34) LogY "stage0" ' ensure integrity of WI metadata which could fail used APIs otherwise '--------------------------------------------------------------------- LogH1 "Ensure Windows Installer metadata integrity " & " (" & Time & ")" EnsureValidWIMetadata HKCU, "Software\Classes\Installer\Products", COMPRESSED EnsureValidWIMetadata HKCR, "Installer\Products", COMPRESSED EnsureValidWIMetadata HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products", COMPRESSED EnsureValidWIMetadata HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components", COMPRESSED EnsureValidWIMetadata HKCR, "Installer\Components", COMPRESSED ' build a list with installed/registered Office products '------------------------------------------------------- FindInstalledOProducts If dicC2RSuite.Count > 0 Then Log "Registered ARP product(s) found:" For Each Key In dicC2RSuite.Keys Log " - " & Key & " - " & dicC2RSuite.Item(Key) Next 'Key '" in Source: sample.bin, "ight = Mid(sRight, InStr(sRight, " ")) Else sRight = "" sCmd = sLeft & "productstoremove=" & Chr(34) & "AllProducts" & Chr(34) & sRight If fQuiet Then sCmd = sCmd & " displaylevel=" & Chr(34) & "false" & Chr(34) Log "run uninstall: " & sCmd If NOT fDetectOnly Then sReturn = oWShell.Run (sCmd, 0, True) Log "ARP uninstall for OfficeC2R returned with value: " & sReturn End If End If 'fCanUseOdtUninstall Else Log "Skip ODT switch is active" End If Else Log "Uninstall for OfficeC2R not required" End If 'Log uninstall success Log "Log uninstall success" sKey = "SOFTWARE\Microsoft\Office\ClickToRun" Log "HKLM\" & sKey & " still exists: " & RegKeyExists(HKLM, sKey) sFolder = Chr(34) & oWShell.ExpandEnvironmentStrings("%programfiles%") & "\Microsoft Office\root" & Chr(34) Log sFolder & " still exists: " & oFso.FolderExists(sFolder) If" in Source: sample.bin, "sionNT End If End Sub 'RestoreExploer '======================================================================================================= 'Returns the delimiter for a passed in string Function Delimiter (sVersion) Dim iCnt, iAsc Delimiter = " " For iCnt = 1 To Len(sVersion) iAsc = Asc(Mid(sVersion, iCnt, 1)) If Not (iASC >= 48 And iASC <= 57) Then Delimiter = Mid(sVersion, iCnt, 1) Exit Function End If Next 'iCnt End Function '======================================================================================================= 'Check registry access permissions. Failure will terminate the script Function CheckRegPermissions Const KEY_QUERY_VALUE = &H0001 Const KEY_SET_VALUE = &H0002 Const KEY_CREATE_SUB_KEY = &H0004 Const DELETE = &H00010000 Dim sSubKeyName Dim fReturn CheckRegPermissions = True sSubKeyName = "Software\Microsoft\Windo" in Source: sample.bin, "cDelRegKey.Exists(sSubKeyName&Item&"\") Then dicDelRegKey.Add sSubKeyName&Item&"\", HKCR End If End If 'DelReg End If End If 'IsArray End If Next 'Name End If 'IsArray End If 'RegEnumValues End If '32 Next 'Item End If 'RegEnumKey 'Delivery Log " - Delivery" hDefKey = HKLM sSubKeyName = "SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\" If RegEnumKey(HKLM, sSubKeyName, arrKeys) Then For Each Item in arrKeys If Len(Item) > 37 Then If fRemoveAll Then If (Mid(Item, 27, PRODLEN)=OFFICEID AND Mid(Item, 4, 2)=OVERSIONMAJOR) OR _ LCase(Right(Item, 7))=OVERSIONMAJOR&".data" Then RegDeleteKey HKLM, sSubKeyName & Item & "\" " in Source: sample.bin, " remove for msiexec" End Sub 'MsiexecRemoval '======================================================================================================= 'Remove the OSE (Office Source Engine) service Sub RemoveOSE On Error Resume Next DeleteService "ose" 'Delete the folder DeleteFolder sCommonProgramFiles & "\Microsoft Shared\Source Engine" 'Delete the registration RegDeleteKey HKLM,"SYSTEM\CurrentControlSet\Services\ose\" End Sub 'RemoveOSE '======================================================================================================= 'File cleanup operations for the Local Installation Source (MSOCache) Sub WipeLIS Const LISROOT = "MSOCache\All Users\" Dim LogicalDisks, Disk, Folder, SubFolder, MseFolder, File, Files Dim arrSubFolders Dim sFolder Dim fRemoveFolder 'LogH1 "LIS CleanUp" 'Search all hard disks Set LogicalDisks = oWmiLocal.ExecQuery("Select * From Win32_LogicalDisk WHERE DriveType=3") For Each Di" in Source: sample.bin, "OFTWARE\Microsoft\Office\Common\OffDiag\Location\", OVERSIONMAJOR, False RegDeleteKey HKLM, "SOFTWARE\Microsoft\OfficeCustomizeWizard\" & OVERSION & "\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\SOFTWARE\Microsoft\OfficeCustomizeWizard\" & OVERSION & "\" Select Case OVERSIONMAJOR Case "11" 'Jet_Replication sValue = "" If RegReadValue(HKCR, "CLSID\{CC2C83A6-9BE4-11D0-98E7-00C04FC2CAF5}\InprocServer32", "SystemDB", sValue, "REG_SZ") Then If Len(sValue) > Len(sOInstallRoot) Then If LCase(Left(sValue, Len(sOInstallRoot))) = LCase(sOInstallRoot) Then RegDeleteKey HKCR, "CLSID\{CC2C83A6-9BE4-11D0-98E7-00C04FC2CAF5}\InprocServer32\" End If End If Case "12" Case "14" RegDeleteKey HKLM, "SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform_Test\" RegDeleteKey HKLM, "SOFTWARE\Micr" in Source: sample.bin, " If Not fRemoveAll Then For Each Sku in dicKeepSku.Keys If UCase(Item) = OREGREF & Sku Then fkeep = True Exit For End If Next 'Sku End If If Not fkeep Then RegDeleteKey HKLM, sSubKeyName & Item End If Next 'Item End If 'RegEnumKey End Sub 'RegWipeARP '======================================================================================================= 'Clean up Click2Run specific registrations Sub RegWipeC2R Dim Item Dim sSubKeyName Dim arrKeys 'Click2Run Cleanup If fRemoveAll OR fRemoveC2R Then RegDeleteKey HKCU, "Software\Microsoft\Office\CVH" RegDeleteKey HKCU, "Software\Microsoft\Office\" & OVERSION & "\CVH" RegDeleteKey HKLM, "Software\Microsoft\Office\" & OVERSION & "\CVH" RegDeleteKey HKLM, "Software\Microsoft\" in Source: sample.bin, " fRemoveComponent = NOT dicCompPath.Exists(sPath) ' End If If fRemoveComponent Then 'Check msidbComponentAttributesPermanent flag If fIsPermanent AND NOT fForce Then fRemoveComponent = False CompVerbose.WriteLine " msidbComponentAttributesPermanent: " & NOT fRemoveComponent End If If fRemoveComponent Then CompVerbose.WriteLine " RESULT: Component IN SCOPE for removal" fIsFile = False : fIsFolder = False 'Component resources go away for this product Err.Clear 'Add the component registration key to ensure removal sCompReg = "Installer\Components\"&GetCompressedGuid(ComponentID)&"\" If NOT dicDelRegKey.Exists(sCompReg) Then dicDelRegKey.Add sCompReg,HKCR RegList.WriteLine HiveString(HKCR)&"\"&sCompReg End If sCompReg = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S" in Source: sample.bin, "y Next 'iLoopCnt 'Components Log " - Global Components" sSubKeyName = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\" If RegEnumKey(HKLM, sSubKeyName, arrKeys) Then For Each Item in arrKeys 'Ensure we have the expected length for a compressed GUID If Len(Item)=32 Then If RegEnumValues(HKLM, sSubKeyName & Item, arrNames, arrTypes) Then If IsArray(arrNames) Then For Each Name in arrNames If Len(Name)=32 Then sGuid = GetExpandedGuid(Name) If CheckDelete(sGuid) Then RegDeleteValue HKLM, sSubKeyName & Item & "\", Name, False 'Check if the key is now empty If NOT RegEnumValues(HKLM, sSubKeyName & Item, arrTestNames, arrTestTypes) Then " in Source: sample.bin, " 'RegDeleteKey HKCU, "Software\Microsoft\SoftGrid\4.5\Client" 'RegDeleteKey HKCU, "Software\Microsoft\SoftGrid\4.5" End Sub 'RemoveSG '======================================================================================================= 'Stops all Softgrid services and virtual applications Sub ResetSG Dim Processes, Process Dim fWait Dim iRet On Error Resume Next If fKeepSG Then Exit Sub fWait = False Log " Doing Action: ResetSG" 'Close all running (virtualized) Office applications 'OfficeVirt.exe needs to be shut down first Set Processes = oWmiLocal.ExecQuery("Select * From Win32_Process Where Name like 'officevirt%.exe'") For Each Process in Processes Log " - End process " & Process.Name iRet = Process.Terminate() CheckError "ResetSG: " & "Process.Name" fWait = True Next 'Process 'Shut down CVH.exe Set Processes = oWmiLocal.ExecQuery("Select * From Win32_Process Where Name" in Source: sample.bin, "ileExists(profilefolder.path & "\ntuser.dat") Then LogOnly " load: " & profilefolder.path & "\ntuser.dat" & " as " & "HKU\" & profilefolder.name oWShell.Run "reg load " & _ chr(34) & "HKU\" & profilefolder.name & chr(34) & " " & _ chr(34) & profilefolder.path & "\ntuser.dat" & chr(34), 0, True End If ' If oFso.FileExists(profilefolder.path & "\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat") Then ' LogOnly " load: " & profilefolder.path & "\..\UsrClass.dat" & " as " & "HKU\" & profilefolder.name & "_Classes" ' oWShell.Run "reg load " & _ ' chr(34) & "HKU\" & profilefolder.name & "_Classes" & chr(34) & " " & _ ' chr(34) & profilefolder.path & "\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat" & chr(34), 0, True ' End If Next End Sub '--------------------" in Source: sample.bin, "e HKLM, "SOFTWARE\Microsoft\Office\15.0\ClickToRun", "PackageGUID", sPkgGuid, "REG_SZ" Case 2 RegReadValue HKLM, "SOFTWARE\Microsoft\Office\16.0\ClickToRun", "PackageFolder", sPkgFld, "REG_SZ" RegReadValue HKLM, "SOFTWARE\Microsoft\Office\16.0\ClickToRun", "PackageGUID", sPkgGuid, "REG_SZ" Case 3 RegReadValue HKLM, "SOFTWARE\Microsoft\Office\ClickToRun", "PackageFolder", sPkgFld, "REG_SZ" RegReadValue HKLM, "SOFTWARE\Microsoft\Office\ClickToRun", "PackageGUID", sPkgGuid, "REG_SZ" Case 4 sPkgFld = sPackageFolder sPkgGuid = sPackageGuid End Select If oFso.FolderExists(sValue & "\root\Integration") Then sCmd = "cmd.exe /c del " & chr(34) & sPkgFld & "\root\Integration\C2RManifest*.xml" & chr(34) Log " Run: " & sCmd If NOT fDetectOnly Then sReturn = oWShell.Run (sCmd, 0, True) Log " Return value: " & sReturn If oFso.FileExists(sPkgFld & "\root\Integration\integrator.exe") Then " in Source: sample.bin, "lay 1 (GFS Unread Stub)\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2 (GFS Stub)\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 3 (GFS Folder)\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 4 (GFS Unread Mark)\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\" Case 15 Case Else End Select 'Win32Assemblies LogH2 "Win32Assemblies" If RegEnumKey(HKCR,"Installer\Win32Assemblies\",arrKeys) Then " in Source: sample.bin, " 1)) If Not (iASC >= 48 And iASC <= 57) Then Delimiter = Mid(sVersion, iCnt, 1) Exit Function End If Next 'iCnt End Function '======================================================================================================= 'Check registry access permissions. Failure will terminate the script Function CheckRegPermissions Const KEY_QUERY_VALUE = &H0001 Const KEY_SET_VALUE = &H0002 Const KEY_CREATE_SUB_KEY = &H0004 Const DELETE = &H00010000 Dim sSubKeyName Dim fReturn CheckRegPermissions = True sSubKeyName = "Software\Microsoft\Windows\" oReg.CheckAccess HKLM, sSubKeyName, KEY_QUERY_VALUE, fReturn If Not fReturn Then CheckRegPermissions = False oReg.CheckAccess HKLM, sSubKeyName, KEY_SET_VALUE, fReturn If Not fReturn Then CheckRegPermissions = False oReg.CheckAccess HKLM, sSubKeyName, KEY_CREATE_SUB_KEY, fReturn If Not fReturn Then CheckRegPermis" in Source: sample.bin, "6CD}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{A449600E-1DC6-4232-B948-9BD794D62056}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{3D60EDA7-9AB4-4DA8-864C-D9B5F2E7281D}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{387E725D-DC16-4D76-B310-2C93ED4752A0}", False RegDeleteKey HKLM, "SOFTWARE\Classes\*\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM, "SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM, "SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM, "SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKL" in Source: sample.bin, "ponentID)&"\"&GetCompressedGuid(CompClient) If NOT dicDelRegKey.Exists(sCompReg) Then dicDelRegKey.Add sCompReg,HKCR RegList.WriteLine HiveString(HKCR)&"\"&sCompReg End If sCompReg = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\"&GetCompressedGuid(ComponentID)&"\"&GetCompressedGuid(CompClient) If NOT dicDelRegKey.Exists(sCompReg) Then dicDelRegKey.Add sCompReg,HKLM RegList.WriteLine HiveString(HKCR)&"\"&sCompReg End If Else If NOT dicCompPath.Exists(sPath) Then dicCompPath.Add sPath,CompClient End If CompVerbose.WriteLine "AffectedComponent: " & fAffectedComponent CompVerbos" in Source: sample.bin, "tion for typelib " & tl If RegEnumKey(HKLM, sKey, arrKeys) Then For Each k in arrKeys sTLVerKey = sKey & "\" & k If RegEnumKey(HKLM, sTLVerKey, arrKeys2) Then fCanDelete = True Else fCanDelete = False If RegReadValue(HKLM, sTLVerKey & "\0\Win32\", "", sValue, "REG_SZ") Then LogOnly "Found key HKLM\" & sTLVerKey & "\0\Win32\" 'get the safe filepath sFilePath = Left(sValue, InstrRev(sValue, ".") + 3) LogOnly "Found filepath: " & sValue & " - using filepath: " & sFilePath If oFso.FileExists(sFilePath) Then fCanDelete = False fClearTL = False LogOnly "File target still in use. TypeLib registration will persisted." Else fClearTL = fCanDelete " in Source: sample.bin, " sFilePath = Left(sValue, InstrRev(sValue, ".") + 3) LogOnly "Found filepath: " & sValue & " - using filepath: " & sFilePath If oFso.FileExists(sFilePath) Then fCanDelete = False fClearTL = False LogOnly "File target still in use. TypeLib registration will persisted." Else fClearTL = fCanDelete LogOnly "File target not found. Flagging for delete" End If End If 'remove the key if no valid usage references were found If fCanDelete Then LogOnly "Removing version registration: HKLM\" & sTLVerKey RegDeleteKey HKLM, sTLVerKey End If Next 'k End If 'RegEnumKey 'Re-evaluate if there are subkeys left to determin" in Source: sample.bin, " End If End If '37 Next 'Item End If 'RegEnumKey 'Registration Log " - HKLM Registration" hDefKey = HKLM sSubKeyName = "SOFTWARE\Microsoft\Office\"&OVERSION&"\Registration\" If RegEnumKey(HKLM,sSubKeyName,arrKeys) Then For Each Item in arrKeys If Len(Item)>37 Then If CheckDelete(UCase(Left(Item,38))) Then RegDeleteKey HKLM,sSubKeyName & Item & "\" End If Next 'Item End If 'RegEnumKey 'User Preconfigurations Log " - HKLM User Preconfigurations" hDefKey = HKLM sSubKeyName = "SOFTWARE\Microsoft\Office\"&OVERSION&"\User Settings\" If RegEnumKey(HKLM,sSubKeyName,arrKeys) Then For Each Item in arrKeys If Len(Item)>37 Then If CheckDelete(UCase(Left(Item,38))) Then RegDeleteKey HKLM,sSubKeyName & Item & "\" End If Next 'Item End If 'RegEnumKey 'Known Keypath settings Log " - Detc" in Source: sample.bin, "osoft\Office\Common\ActiveX Compatibility\{00024512-0000-0000-C000-000000000046}\" RegDeleteValue HKLM, "SOFTWARE\Microsoft\Office\OneNote\Adapters\", "{456B0D0E-49DD-4C95-8DB6-175F54DE69A3}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{42042206-2D85-11D3-8CFF-005004838597}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{0006F045-0000-0000-C000-000000000046}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{7CCA70DB-DE7A-4FB7-9B2B-52E2335A3B5A}", False RegDeleteValue HKLM, "SOFTWAR" in Source: sample.bin, "sses\Directory\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 1 (GFS Unread Stub)\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2 (GFS Stub)\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 3 (GFS Folder)\" RegDeleteKey HKLM,"S" in Source: sample.bin, "" verb.DoIt End Select Next Set verb = Nothing Set fldItem = Nothing Set oShellAppUnPin = Nothing On Error Goto 0 End Sub '------------------------------------------------------------------------------- ' ClearTaskBand ' ' Clears contents from the users taskband to get rid of pinned items '------------------------------------------------------------------------------- Sub ClearTaskBand () Dim sid Dim sTaskBand, sHKUTaskBand Dim arrSid sTaskBand = "Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband\" RegDeleteValue HKCU, sTaskBand, "Favorites", False RegDeleteValue HKCU, sTaskBand, "FavoritesRemovedChanges", False RegDeleteValue HKCU, sTaskBand, "FavoritesChanges", False RegDeleteValue HKCU, sTaskBand, "FavoritesResolve", False RegDeleteValue HKCU, sTaskBand, "FavoritesVersion", False ' enum all profiles in HKU LoadUsersReg If NOT RegEnumKey(HKU, "", arrSid) Then Exit Sub Fo" in Source: sample.bin, " For Each Item in dicC2RSuite.Items ' Log " - " & Item ' Next 'Item Else Log "No registered product(s) found" End If ' locate the C2R %PackageFolder% and the PackageGuid '--------------------------------------------------- sPackageFolder = "" If RegReadValue(HKLM, "SOFTWARE\Microsoft\Office\15.0\ClickToRun", "PackageFolder", sValue, "REG_SZ") Then sPackageFolder = sValue ElseIf RegReadValue(HKLM, "SOFTWARE\Microsoft\Office\16.0\ClickToRun", "PackageFolder", sPackageFolder, "REG_SZ") Then sPackageFolder = sValue ElseIf RegReadValue(HKLM, "SOFTWARE\Microsoft\Office\ClickToRun", "PackageFolder", sPackageFolder, "REG_SZ") Then sPackageFolder = sValue End If ' if sPackageFolder is invalid set it to the c2r registry reference string If NOT Len(sPackageFolder) > 0 OR IsNull(sPackageFolder) Then If oFso.FolderExists(oWShell.ExpandEnvironmentStrings("%programfiles%") & "\Microsoft Office 15") Then sPackageFolder = oWShell.ExpandEnvironmentStrings("%programfiles%") & "\Micro" in Source: sample.bin, "ngs" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\" & OVERSION & "\" If fRemoveOse OR fForce Then RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office Test\" RegDeleteValue HKLM, "SOFTWARE\Microsoft\Office\Common\", "LastAccessInstall", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Office\Common\", "MID", False RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\Excel\Addins\Microsoft.PerformancePoint.Planning.Client.Excel\" RegDeleteValue HKLM, "SOFTWARE\Microsoft\Office\InfoPath\Converters\Import\InfoPath.DesignerExcelImport\Versions\", OVERSION, False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Office\InfoPath\Converters\Import\InfoPath.DesignerWordImport\Versions\", OVERSION, False RegDeleteKey HKLM, "SOFTWARE\Microsoft\Shared Tools\Text Converters\Export\MEWord12\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Shared Tools\Text Converters\Export\Word12\" RegDeleteKey HKLM, "SOFTWARE\Microsoft" in Source: sample.bin, " 'get the safe filepath sFilePath = Left(sValue, InstrRev(sValue, ".") + 3) LogOnly "Found filepath: " & sValue & " - using filepath: " & sFilePath If oFso.FileExists(sFilePath) Then fCanDelete = False fClearTL = False LogOnly "File target still in use. TypeLib registration will persisted." Else fClearTL = fCanDelete LogOnly "File target not found. Flagging for delete" End If End If 'remove the key if no valid usage references were found If fCanDelete Then LogOnly "Removing version registration: HKLM\" & sTLVerKey RegDeleteKey HKLM, sTLVerKey End If Next 'k End If 'RegEnumKey " in Source: sample.bin, " Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 1 (GFS Unread Stub)\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2 (GFS Stub)\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 3 (GFS Folder)\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 4 (GFS Unread Mark)\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\" Case 15 " in Source: sample.bin, "soft Office 15" ElseIf oFso.FolderExists(oWShell.ExpandEnvironmentStrings("%programfiles%") & "\Microsoft Office 16") Then sPackageFolder = oWShell.ExpandEnvironmentStrings("%programfiles%") & "\Microsoft Office 16" ElseIf oFso.FolderExists(oWShell.ExpandEnvironmentStrings("%programfiles%") & "\Microsoft Office\PackageManifests") Then sPackageFolder = oWShell.ExpandEnvironmentStrings("%programfiles%") & "\Microsoft Office" ElseIf oFso.FolderExists(oWShell.ExpandEnvironmentStrings("%programfiles(x86)%") & "\Microsoft Office\PackageManifests") Then sPackageFolder = oWShell.ExpandEnvironmentStrings("%programfiles(x86)%") & "\Microsoft Office" End If End If sPackageGuid = "" If RegReadValue(HKLM, "SOFTWARE\Microsoft\Office\15.0\ClickToRun", "PackageGUID", sValue, "REG_SZ") Then sPackageGuid = sValue ElseIf RegReadValue(HKLM, "SOFTWARE\Microsoft\Office\16.0\ClickToRun", "PackageGUID", sValue, "REG_SZ") Then sPackageGuid = sValue ElseIf RegReadValue(HKLM, "SOFTWARE\Microsoft\Office\Click" in Source: sample.bin, "Paths\" hDefKey = HKCU Case 2 'CIW - HKLM sSubKeyName = "SOFTWARE\Microsoft\OfficeCustomizeWizard\" & OVERSION & "\RegKeyPaths\" hDefKey = HKLM Case 3 'Add/Remove Programs sSubKeyName = REG_ARP hDefKey = HKLM End Select If RegEnumKey(hDefKey, sSubKeyName, arrKeys) Then For Each Item in arrKeys 'OFFICEID id If Len(Item)>37 Then sGuid = UCase(Left(Item, 38)) If Right(sGuid, PRODLEN)=OFFICEID Then If CheckDelete(sGuid) Then RegDeleteKey hDefKey, sSubKeyName & Item & "\" End If End If 'Right(Item, PRODLEN)=OFFICEID End If 'Len(Item)>37 Next 'Item If iLoopCnt " in Source: sample.bin, "lorer\NetworkNeighborhood\Namespace\{46137B78-0EC3-426D-8B89-FF7C3A458B5E}" ' VolumeCaches RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Microsoft Office Temp Files" ' Set Processes = oWmiLocal.ExecQuery("Select * From Win32_Process Where Name like 'explorer.exe'") ' For Each Process in Processes ' sOut = "End process '" & Process.Name ' iRet = Process.Terminate() ' CheckError "ClearShellIntegrationReg: " & Process.Name ' Log sOut & "' returned: " & iRet ' Next 'Process ' wscript.sleep 500 RestoreExplorer FreeObjects wscript.sleep 500 InitObjects End Sub 'ClearShellIntegrationReg '------------------------------------------------------------------------------- ' RegWipeTypeLib ' ' Clear out left behind Typelib registrations '------------------------------------------------------------------------------- 'Clean out known typelib registration Sub RegWipeTypeLib Dim " in Source: sample.bin, " Log "Remove entry: HKLM\" & sConfigKey & "\" & value End If Next End If End Sub 'ClearConfigUser '------------------------------------------------------------------------------- ' ClearSCALicCache ' ' clear local license cache for SharedComputerActivation '------------------------------------------------------------------------------- Sub ClearSCALicCache Dim sLocalAppData, sValue sLocalAppData = oWShell.ExpandEnvironmentStrings("%localappdata%") If fClearO15 Then ClearFolder sLocalAppData & "\Microsoft\Office\15.0\Licensing" If fClearO16 Then ClearFolder sLocalAppData & "\Microsoft\Office\16.0\Licensing" 'Check for custom token location If RegReadStringValue(HKLM, "Software\Microsoft\Office\16.0\Common\Licensing", "SCLCacheOverrideDirectory", sValue) Then ClearSCAFolder sValue End If End Sub 'ClearSCALicCache '------------------------------------------------------------------------------- ' ClearVNextL" in Source: sample.bin, "< 3 Then If RegEnumValues(hDefKey, sSubKeyName, arrNames, arrTypes) Then i = 0 For Each Name in arrNames If RegReadValue(hDefKey, sSubKeyName, Name, sValue, arrTypes(i)) Then If sValue = sGuid Then RegDeleteValue hDefKey, sSubKeyName, Name, False End If i = i + 1 Next End If End If End If If NOT RegEnumKey(hDefKey, sSubKeyName, arrKeys) Then RegDeleteKey hDefKey, "Software\Microsoft\OfficeCustomizeWizard\11.0\" If NOT RegEnumKey(hDefKey, "Software\Microsoft\OfficeCustomizeWizard\11.0\", arrKeys) Then RegDeleteKey hDefKey, "Software\Microsoft\OfficeCustomizeWizard\" Next 'iLoopCnt Case "12" 'Add/Remove Programs RegWipeARP Case "14" 'Add/Remove Programs RegWipeARP " in Source: sample.bin, "ft\OfficeCustomizeWizard\" & OVERSION & "\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\SOFTWARE\Microsoft\OfficeCustomizeWizard\" & OVERSION & "\" Select Case OVERSIONMAJOR Case "11" 'Jet_Replication sValue = "" If RegReadValue(HKCR,"CLSID\{CC2C83A6-9BE4-11D0-98E7-00C04FC2CAF5}\InprocServer32","SystemDB",sValue,"REG_SZ") Then If Len(sValue) > Len(sOInstallRoot) Then If LCase(Left(sValue,Len(sOInstallRoot))) = LCase(sOInstallRoot) Then RegDeleteKey HKCR,"CLSID\{CC2C83A6-9BE4-11D0-98E7-00C04FC2CAF5}\InprocServer32\" End If End If Case "12" Case "14" RegDeleteKey HKLM,"SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform_Test\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Office\Common\ActiveX Compatibility\{00024512-0000-0000-C000-000000000046}\" RegDeleteValue HKLM,"SOFTWARE\M" in Source: sample.bin, "Each name in arrNames If RegReadValue(HKLM, sSubKeyName, name, sValue, "REG_SZ") Then If IsC2R(sValue) Then RegDeleteValue HKLM, sSubKeyName, name, False End If Next 'item End If RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run", "Lync15", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run", "Lync16", False ' ARP ' Note: configuration entries have already been removed ' as part of the 'Uninstall' stage If RegEnumKey(HKLM, REG_ARP, arrKeys) Then For Each item in arrKeys If Len(item) > 37 Then sGuid = UCase(Left(item, 38)) If CheckDelete(sGuid) Then RegDeleteKey HKLM, REG_ARP & item & "\" End If 'Len(Item)>37 Next 'Item End If ' UpgradeCodes, WI config, WI global config LogH2 "Scan Windows Installer metadata for removeable UpgradeCodes" For iLoopCnt = 1 to 5 Select Case " in Source: sample.bin, " sCompReg = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\"&GetCompressedGuid(ComponentID)&"\"&GetCompressedGuid(CompClient) If NOT dicDelRegKey.Exists(sCompReg) Then dicDelRegKey.Add sCompReg,HKLM RegList.WriteLine HiveString(HKCR)&"\"&sCompReg End If Else If NOT dicCompPath.Exists(sPath) Then dicCompPath.Add sPath,CompClient End If CompVerbose.WriteLine "AffectedComponent: " & fAffectedComponent CompVerbose.WriteLine " CompClient now set to: " & sCompClient Else CompVerbose.Write "InScope: " & fRemoveComponent & "; " End If Else CompVerbose.WriteLine "Error: Invalid metadata" If NOT dicFLError." in Source: sample.bin, "playVersion = GetMsiProductVersion(sMsiFile) If sDisplayVersion = "" Then sDisplayVersion = OVERSION & ".0000.0000" sDisplayName = GetMsiProductName(sMsiFile) If sDisplayName = "" Then sDisplayName = sProductCode Select Case OVERSIONMAJOR Case "9", "10", "11" sLang = CInt("&h" & Mid(sProductCode, 6, 4)) Case "12", "14" sLang = CInt("&h" & Mid(sProductCode, 16, 4)) Case Else End Select For iCnt = 1 To 3 Select Case iCnt Case 1 sCurKey = REG_ARP & sProductCode oReg.CreateKey HKLM, sCurKey Case 2 sCurKey = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\" & GetCompressedGuid(sProductCode) oReg.CreateKey HKLM, sCurKey oReg.CreateKey HKLM, sCurKey & "\Features" oReg.CreateKey HKLM, sCurKey & "\InstallProperties" oReg.CreateKey HKLM, sCurKey & "\Patches" oReg.CreateKey HKLM, sCurKey & "\Usag" in Source: sample.bin, "e = "SYSTEM\CurrentControlSet\Control\Session Manager" sValueName = "PendingFileRenameOperations" LogH2 "Add " & dicDelInUse.Count & " PendingFileRenameOperations" If NOT RegValExists(hDefKey, sKeyName, sValueName) Then ReDim arrData(-1) Else oReg.GetMultiStringValue hDefKey, sKeyName, sValueName, arrData End If i = UBound(arrData) + 1 ReDim Preserve arrData(UBound(arrData) + (dicDelInUse.Count * 2)) For Each key in dicDelInUse.Keys LogOnly " " & key arrData(i) = "\??\" & key arrData(i + 1) = "" i = i + 2 Next 'key oReg.SetMultiStringValue hDefKey, sKeyName, sValueName, arrData End Sub 'ScheduleDeleteEx '------------------------------------------------------------------------------- ' DeleteEmptyFolders ' ' Deletes an individual folder structure if empty '------------------------------------------------------------------------------- Sub DeleteEmptyFolder (sFolder) Dim Folder " in Source: sample.bin, " For Each Item in arrKeys If InStr(UCase(Item),OREF)>0 Then RegDeleteKey HKCR,"Installer\Win32Assemblies\"&Item & "\" Next 'Item End If 'RegEnumKey 'Groove blocks reinstall if it locates groove.exe over this key If RegKeyExists(HKCR,"GrooveFile\Shell\Open\Command\") Then sValue = "" RegReadValue HKCR,"GrooveFile\Shell\Open\Command\","",sValue,"REG_SZ" If InStr(sValue,"\"&OREF&"\")>0 Then RegDeleteKey HKCR,"GrooveFile\" End If 'RegKeyExists End If 'fRemoveAll Select Case OVERSIONMAJOR Case "11" For iLoopCnt = 1 to 3 Select Case iLoopCnt Case 1 'CIW - HKCU sSubKeyName = "Software\Microsoft\OfficeCustomizeWizard\" & OVERSION & "\RegKeyPaths\" hDefKey = HKCU Case 2 'CIW - HKLM sSubKeyName = "SOFTWARE\Microsoft\OfficeCustomizeWizard\" & OVERSION & "\RegKeyPaths\" in Source: sample.bin, "OFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 4 (GFS Unread Mark)\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\" Case Else End Select 'Win32Assemblies LogH2 "Win32Assemblies" If RegEnumKey(HKCR,"Installer\Win32Assemblies\",arrKeys) Then For Each Item in arrKeys If InStr(UCase(Item),OREF)>0 Then RegDeleteKey HKCR,"Installer\Win32Assemblies\"&Item & "\" Next 'Item End If 'RegEnumKey 'Groove blocks reinstall if it locates groove.exe over this key If RegKeyExists(HKCR,"GrooveFile\Shell\Open\Command\") Then sValue = "" RegReadValue HKCR,"GrooveFile\Shell\Open\Command\","",sValue,"REG_SZ" If InStr(sValue,"\"&OREF&"\")>0 Then RegDeleteKey HKCR,"GrooveFile\" End If 'RegKeyExists End If 'f" in Source: sample.bin, " LogOnly "File target not found. Flagging for delete" End If End If If RegReadValue(HKLM, sTLVerKey & "\9\Win32\", "", sValue, "REG_SZ") Then LogOnly "Found key HKLM\" & sTLVerKey & "\9\Win32\" 'get the safe filepath sFilePath = Left(sValue, InstrRev(sValue, ".") + 3) LogOnly "Found filepath: " & sValue & " - using filepath: " & sFilePath If oFso.FileExists(sFilePath) Then fCanDelete = False fClearTL = False LogOnly "File target still in use. TypeLib registration will persisted." Else fClearTL = fCanDelete LogOnly "File target not found. Flagging for delete" End If End If If Reg" in Source: sample.bin, "Version\Uninstall\" Const REG_O15RPROPERTYBAG = "SOFTWARE\Microsoft\Office\15.0\ClickToRun\propertyBag\" Const REG_O15C2RCONFIGURATION = "SOFTWARE\Microsoft\Office\15.0\ClickToRun\Configuration\" Const REG_O15C2RPRODUCTIDS = "SOFTWARE\Microsoft\Office\15.0\ClickToRun\ProductReleaseIDs\Active\" Const REG_O16C2RCONFIGURATION = "SOFTWARE\Microsoft\Office\16.0\ClickToRun\Configuration\" Const REG_O16C2RPRODUCTIDS = "SOFTWARE\Microsoft\Office\16.0\ClickToRun\ProductReleaseIDs\Active\" Const REG_C2RCONFIGURATION = "SOFTWARE\Microsoft\Office\ClickToRun\Configuration\" Const REG_C2RPRODUCTIDS = "SOFTWARE\Microsoft\Office\ClickToRun\ProductReleaseIDs\" If dicInstalledSku.Count > 0 Then Exit Sub 'Already done from command line parser fDisplayVersion = False ' identify C2R products LogH1 "Detect installed products " LogOnly "Check for O15 C2R products" ' Check O15 Configuration key If RegReadValue(HKLM, REG_O15C2RCONFIGURATION, "ProductRelea" in Source: sample.bin, "======================================================================= 'Detect if Click2Run products are installed on the client Function C2RInstalled Dim Key, sPKey, sValue, VProd Dim arrKeys If RegEnumKey (HKLM, REG_ARP, arrKeys) Then For Each Key in arrKeys If InScope(Key)=38 Then If RegReadValue(HKLM, REG_ARP&"\"&Key, "CVH", sValue, "REG_DWORD") Then If sValue = "1" Then C2RInstalled = True Exit Function End If End If End If Next 'Key End If If RegEnumKey (HKLM, "SOFTWARE\Microsoft\SoftGrid\4.5\Client\Applications", arrKeys) Then For Each Key in arrKeys If Len(Key)>15 Then 'Get Partial product Key sPKey = Right(Key, 16) If Left(sPKey, 4) = "90" & OVERSIONMAJOR Then If GetProductID(Mid(sPKey, 5, 4)) = "CLICK2R" in Source: sample.bin, " If Not fDetectOnly Then iRetVal = 0 iRetVal = oReg.DeleteKey(hDefKey,sSubKeyName) If NOT (iRetVal=0) Then LogOnly " Delete failed. Return value: "&iRetVal End If End Sub 'RegDeleteKeyEx '======================================================================================================= 'Return the alternate regkey location on 64bit environment Function Wow64Key(hDefKey, sSubKeyName) Dim iPos Select Case hDefKey Case HKCU If Left(sSubKeyName,17) = "Software\Classes\" Then Wow64Key = Left(sSubKeyName,17) & "Wow6432Node\" & Right(sSubKeyName,Len(sSubKeyName)-17) Else iPos = InStr(sSubKeyName,"\") Wow64Key = Left(sSubKeyName,iPos) & "Wow6432Node\" & Right(sSubKeyName,Len(sSubKeyName)-iPos) End If Case HKLM If Left(sSubKeyName,17) = "Software\Classes\" Then Wow64Key = Left(sSubKeyName,17) & "Wow6432Node\" " in Source: sample.bin, "on, sCurKey, sDisplayName, sLang, sProductCode, sTmpKey Dim iCnt 'Create a temporary keys to simulate an installed product sProductCode = "" sProductCode = GetMsiProductCode(sMsiFile) sDisplayVersion = GetMsiProductVersion(sMsiFile) If sDisplayVersion = "" Then sDisplayVersion = OVERSION & ".0000.0000" sDisplayName = GetMsiProductName(sMsiFile) If sDisplayName = "" Then sDisplayName = sProductCode Select Case OVERSIONMAJOR Case "9", "10", "11" sLang = CInt("&h" & Mid(sProductCode, 6, 4)) Case "12", "14" sLang = CInt("&h" & Mid(sProductCode, 16, 4)) Case Else End Select For iCnt = 1 To 3 Select Case iCnt Case 1 sCurKey = REG_ARP & sProductCode oReg.CreateKey HKLM, sCurKey Case 2 sCurKey = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\" & GetCompressedGuid(sProductCode) oReg.CreateKey HKLM, sCurKey " in Source: sample.bin, "(Item, 7))=OVERSIONMAJOR&".data" Then RegDeleteKey HKLM, sSubKeyName & Item & "\" Else If (Mid(Item, 27, PRODLEN)=OFFICEID AND Mid(Item, 4, 2)=OVERSIONMAJOR) AND _ CheckDelete(UCase(Left(Item, 38))) Then RegDeleteKey HKLM, sSubKeyName & Item & "\" End If End If '37 Next 'Item End If 'RegEnumKey 'Registration Log " - HKLM Registration" hDefKey = HKLM sSubKeyName = "SOFTWARE\Microsoft\Office\"&OVERSION&"\Registration\" If RegEnumKey(HKLM, sSubKeyName, arrKeys) Then For Each Item in arrKeys If Len(Item)>37 Then If CheckDelete(UCase(Left(Item, 38))) Then RegDeleteKey HKLM, sSubKeyName & Item & "\" End If Next 'Item End If 'RegEnumKey 'User Preconfigurations Log " - HKLM User Preconfigurations" hDefKey = HKLM sSubKeyName = "SOFTWARE\Microsoft\Office\"&OVERSION&"\User Settings\" If Reg" in Source: sample.bin, "veOSE On Error Resume Next DeleteService "ose" 'Delete the folder DeleteFolder sCommonProgramFiles & "\Microsoft Shared\Source Engine" 'Delete the registration RegDeleteKey HKLM, "SYSTEM\CurrentControlSet\Services\ose\" End Sub 'RemoveOSE '======================================================================================================= 'File cleanup operations for the Local Installation Source (MSOCache) Sub WipeLIS Const LISROOT = "MSOCache\All Users\" Dim LogicalDisks, Disk, Folder, SubFolder, MseFolder, File, Files Dim arrSubFolders Dim sFolder Dim fRemoveFolder 'LogH1 "LIS CleanUp" 'Search all hard disks Set LogicalDisks = oWmiLocal.ExecQuery("Select * From Win32_LogicalDisk WHERE DriveType=3") For Each Disk in LogicalDisks If oFso.FolderExists(Disk.DeviceID & "\" & LISROOT) Then Set Folder = oFso.GetFolder(Disk.DeviceID & "\" & LISROOT) For Each Subfolder in Folder.Subfolders " in Source: sample.bin, "Installer\Components\"&GetCompressedGuid(ComponentID)&"\" If NOT dicDelRegKey.Exists(sCompReg) Then dicDelRegKey.Add sCompReg, HKCR RegList.WriteLine HiveString(HKCR)&"\"&sCompReg End If sCompReg = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\"&GetCompressedGuid(ComponentID)&"\" If NOT dicDelRegKey.Exists(sCompReg) Then dicDelRegKey.Add sCompReg, HKLM RegList.WriteLine HiveString(HKCR)&"\"&sCompReg End If 'Get the component path If sPath = "" Then sPath = LCase(oMsi.ComponentPath(sCompClient, ComponentID)) sPath = Replace(sPath, "?", ":") End If CompVerbose.WriteLine " Path: " & sPath If Len(sPath) > 4 Then If Left(sPath, 1) = "0" Then 'Registry keypath Select Case Left(sPath, 2) " in Source: sample.bin, "elete" End If End If If RegReadValue(HKLM, sTLVerKey & "\9\Win32\", "", sValue, "REG_SZ") Then LogOnly "Found key HKLM\" & sTLVerKey & "\9\Win32\" 'get the safe filepath sFilePath = Left(sValue, InstrRev(sValue, ".") + 3) LogOnly "Found filepath: " & sValue & " - using filepath: " & sFilePath If oFso.FileExists(sFilePath) Then fCanDelete = False fClearTL = False LogOnly "File target still in use. TypeLib registration will persisted." Else fClearTL = fCanDelete LogOnly "File target not found. Flagging for delete" End If End If If RegReadValue(HKLM, sTLVerKey & "\0\Win64\", "", sValue, "RE" in Source: sample.bin, "") Set dicInstalledSku = CreateObject("Scripting.Dictionary") Set dicRemoveSku = CreateObject("Scripting.Dictionary") Set dicKeepSku = CreateObject("Scripting.Dictionary") Set dicKeepLis = CreateObject("Scripting.Dictionary") Set dicKeepFolder = CreateObject("Scripting.Dictionary") Set dicApps = CreateObject("Scripting.Dictionary") Set dicDelRegKey = CreateObject("Scripting.Dictionary") Set dicKeepReg = CreateObject("Scripting.Dictionary") Set dicSrv = CreateObject("Scripting.Dictionary") Set dicCSuite = CreateObject("Scripting.Dictionary") Set dicCSingle = CreateObject("Scripting.Dictionary") 'Create the temp folder If Not oFso.FolderExists(sScrubDir) Then oFso.CreateFolder sScrubDir 'Set the default logging directory sLogDir = sScrubDir 'Call the command line parser ParseCmdLine 'Ensure CScript as engine If NOT fCScript AND NOT fQuiet Then RelaunchAsCScript 'Get Office Install Folder If NOT RegReadValue(HKLM,"SOFTWARE\Microsoft\Office\"&OVERSION&"\Common\InstallRoot","Path",sO" in Source: sample.bin, "E\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{B5A7F190-DDA6-4420-B3BA-52453494E6CD}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{A449600E-1DC6-4232-B948-9BD794D62056}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{3D60EDA7-9AB4-4DA8-864C-D9B5F2E7281D}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{387E725D-DC16-4D76-B310-2C93ED4752A0}", False RegDeleteKey HKLM,"SOFTWARE\Classes\*\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Cla" in Source: sample.bin, "in ComputerItem sOSinfo = sOSinfo & Item.Caption sOSinfo = sOSinfo & Item.OtherTypeDescription sOSinfo = sOSinfo & ", " & "SP " & Item.ServicePackMajorVersion sOSinfo = sOSinfo & ", " & "Version: " & Item.Version sOsVersion = Item.Version sOSinfo = sOSinfo & ", " & "Codepage: " & Item.CodeSet sOSinfo = sOSinfo & ", " & "Country Code: " & Item.CountryCode sOSinfo = sOSinfo & ", " & "Language: " & Item.OSLanguage Next DetectOSBitness DetectOfficeBitness CreateLog LogOnly "Remove O15 Lic: " & fClearO15 LogOnly "Remove O16 Lic: " & fClearO16 LogOnly "Quiet mode: " & fQuiet RegReadExpStringValue HKLM, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList", "ProfilesDirectory", sProfilesDirectory If NOT oFso.FolderExists(sProfilesDirectory) Then sProfilesDirectory = oFso.GetParentFolderName(oWShell.ExpandEnvironmentStrings("%userprofile%")) End If LogOnly "Users p" in Source: sample.bin, " sKey, arrKeys) Then For Each k in arrKeys sTLVerKey = sKey & "\" & k If RegEnumKey(HKLM, sTLVerKey, arrKeys2) Then fCanDelete = True Else fCanDelete = False If RegReadValue(HKLM, sTLVerKey & "\0\Win32\", "", sValue, "REG_SZ") Then LogOnly "Found key HKLM\" & sTLVerKey & "\0\Win32\" 'get the safe filepath sFilePath = Left(sValue, InstrRev(sValue, ".") + 3) LogOnly "Found filepath: " & sValue & " - using filepath: " & sFilePath If oFso.FileExists(sFilePath) Then fCanDelete = False fClearTL = False LogOnly "File target still in use. TypeLib registration will persisted." Else fClearTL = fCanDelete LogOnly "File target not found. Flagging for d" in Source: sample.bin, ", sCount) Then iCount = CInt(sCount) + 1 End If oReg.SetDWordValue HKLM, sSettingsKey & "\" & sCustomName, "Count", iCount oReg.SetDWordValue HKLM, sSettingsKey & "\" & sCustomName, "Order", 1 LogOnly "Add SettingsKey: HKLM\" & sKey LogOnly "Count: " & iCount End Sub 'ResetUserKeyEx '------------------------------------------------------------------------------- ' CleanOSPP ' ' unpkeys the licenses from OSPP '------------------------------------------------------------------------------- Sub CleanOSPP (sFilter) Dim pi Dim oProductInstances ' Initialize the software protection platform object with a filter on Office 2013/2016 products If GetVersionNT > 601 Then Set oProductInstances = oWmiLocal.ExecQuery("SELECT ID, ApplicationId, PartialProductKey, Description, Name, ProductKeyID FROM SoftwareLicensingProduct WHERE ApplicationId = '" & OfficeAppId & "' " & "AND PartialProductKey <> NULL") Else Set oProductInstances = oWmiLocal.ExecQuery("SE" in Source: sample.bin, "crosoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{3D60EDA7-9AB4-4DA8-864C-D9B5F2E7281D}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{387E725D-DC16-4D76-B310-2C93ED4752A0}", False RegDeleteKey HKLM,"SOFTWARE\Classes\*\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifi" in Source: sample.bin, "icrosoft\Office\OneNote\Adapters\","{456B0D0E-49DD-4C95-8DB6-175F54DE69A3}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{42042206-2D85-11D3-8CFF-005004838597}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{0006F045-0000-0000-C000-000000000046}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{7CCA70DB-DE7A-4FB7-9B2B-52E2335A3B5A}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{506F4668-F13E-4AA1-BB04-B43203AB3CC0}", False RegDeleteValue H" in Source: sample.bin, "atures\" hDefKey = HKCR RegWipeWIConfig hDefKey, sSubKeyName, iLoopCnt Case 5 sSubKeyName = "Installer\Products\" hDefKey = HKCR RegWipeWIConfig hDefKey, sSubKeyName, iLoopCnt Case 6 hDefKey = HKLM sSubKeyName = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\" If RegEnumKey(hDefKey, sSubKeyName, arrKeys) Then For Each key in arrKeys RegWipeWIConfig hDefKey, sSubKeyName & key & "\Installer\Products\", iLoopCnt Next End If sSubKeyName = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\" If RegEnumKey(hDefKey, sSubKeyName, arrKeys) Then For Each key in arrKeys RegWipeWIConfig hDefKey, sSubKeyName & key & "\Products\", iLoopCnt Next End If End Select Next 'iLoopCnt 'Components sSub" in Source: sample.bin, " sSubKeyName = "Software\Microsoft\OfficeCustomizeWizard\" & OVERSION & "\RegKeyPaths\" hDefKey = HKCU Case 2 'CIW - HKLM sSubKeyName = "SOFTWARE\Microsoft\OfficeCustomizeWizard\" & OVERSION & "\RegKeyPaths\" hDefKey = HKLM Case 3 'Add/Remove Programs sSubKeyName = REG_ARP hDefKey = HKLM End Select If RegEnumKey(hDefKey, sSubKeyName, arrKeys) Then For Each Item in arrKeys 'OFFICEID id If Len(Item)>37 Then sGuid = UCase(Left(Item, 38)) If Right(sGuid, PRODLEN)=OFFICEID Then If CheckDelete(sGuid) Then RegDeleteKey hDefKey, sSubKeyName & Item & "\" End If End If 'Right(Item, PRODLEN)=OFFICEID " in Source: sample.bin, "\Shared Tools\Text Converters\Export\Word97\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\MEWord12\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\Word12\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\Word97\" RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\", "GrooveMonitor", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\", "LobiServer", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\", "BCSSync", False RegDeleteKey HKLM, "SYSTEM\CurrentControlSet\Services\Outlook\" End If RegDeleteValue HKLM, "SOFTWARE\Microsoft\Office\Common\OffDiag\Location\", OVERSIONMAJOR, False RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Office\" & OVERSION & "\" RegDeleteValue HKLM, "S" in Source: sample.bin, "RE\Microsoft\OfficeCustomizeWizard\" & OVERSION & "\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\SOFTWARE\Microsoft\OfficeCustomizeWizard\" & OVERSION & "\" sCustWiz = ".Default\SOFTWARE\Microsoft\OfficeCustomizeWizard\" RegDeleteKey HKU,sCustWiz & OVERSION & "\" If NOT RegEnumKey(HKU,sCustWiz,arrKeys) Then RegDeleteKey HKU, sCustWiz sCustWiz = "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\SOFTWARE\Microsoft\OfficeCustomizeWizard\" RegDeleteKey HKLM,sCustWiz & OVERSION & "\" If NOT RegEnumKey(HKLM,sCustWiz,arrKeys) Then RegDeleteKey HKLM, sCustWiz Select Case OVERSIONMAJOR Case "11" 'Jet_Replication sValue = "" If RegReadValue(HKCR,"CLSID\{CC2C83A6-9BE4-11D0-98E7-00C04FC2CAF5}\InprocServer32","SystemDB",sValue,"REG_SZ") Then If Len(sValue) > Len(sOInstallRoot) Then If LCase(" in Source: sample.bin, " = "SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" CONST STR_HEARTBEATPATH = "\Microsoft\Office\Heartbeat\HeartbeatCache.xml" CONST REG_SPP = "SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" CONST REG_SCAEXP_BASE = "HKCU\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentEcs\" CONST REG_SCAEXP_END = "\Flights\ofc5juzsw45rcw0" CONST REG_SCAEXP_OVERRIDE = "HKLM\SOFTWARE\Microsoft\Office\Common\Experiment\ofc5juzsw45rcw0" CONST REG_SCAO15 = "HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun\Configuration\SharedComputerLicensing" CONST REG_SCAO16 = "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration\SharedComputerLicensing" CONST VALUE_SCAEXP_FLAVOR = "exp" CONST VALUE_SCAEXP_OVERRIDE_FLAVOR = "expoverride" CONST VALUE_SCAO15_FLAVOR = "o15" CONST VALUE_SCA016_FLAVOR = "o16" CONST VALUE_SC" in Source: sample.bin, "============================================ 'Office products are listed with their ProductCode in the "Uninstall" key Sub FindInstalledOProducts Dim ArpItem, prod, Item, File, key Dim sConfigName, sValue, sSubKeyName, sManagedLocalPackageKey, sGuid Dim arrKeys, arrProducts Dim fIsVanilla 'Query msi to get a list of Office products For Each prod in oMsi.Products If Len(prod) = 38 Then If InScope(prod) Then sConfigName = "" sConfigName = UCase(GetProductID(Mid(prod, 4, 2))) If Not dicInstalledSku.Exists(prod) Then dicInstalledSku.Add UCase(prod), sConfigName End If 'InScope End If '38 Next 'prod ' locate managed per-user products sSubKeyName = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\" If RegEnumKey(HKLM, sSubKeyName, arrKeys) Then For Each key in arrKeys If NOT dicManaged.Exists(key) Then dicManaged.Add key, key " in Source: sample.bin, "iLoopCnt Case 1 sSubKeyName = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\" hDefKey = HKLM Case 2 sSubKeyName = "Installer\UpgradeCodes\" hDefKey = HKCR Case 3 sSubKeyName = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\" hDefKey = HKLM Case 4 sSubKeyName = "Installer\Features\" hDefKey = HKCR Case 5 sSubKeyName = "Installer\Products\" hDefKey = HKCR End Select If RegEnumKey(hDefKey, sSubKeyName, arrKeys) Then For Each item in arrKeys ' ensure the expected length for a compressed GUID If Len(item) = 32 Then ' expand the GUID sGuid = GetExpandedGuid(item) ' check if it's an Office key If CheckDelete(sGuid) Then " in Source: sample.bin, " If RegEnumKey(HKLM, sSubKeyName & key & "\Installer\Products\", arrProducts) Then For Each prod in arrProducts If Len(prod) = 32 Then sGuid = GetExpandedGuid(prod) If InScope(sGuid) Then sConfigName = "" sConfigName = UCase(GetProductID(Mid(sGuid, 4, 2))) If Not dicInstalledSku.Exists(sGuid) Then dicInstalledSku.Add UCase(sGuid), sConfigName sManagedLocalPackageKey = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\" & key & "\Products\" & prod If RegReadValue(HKLM,sManagedLocalPackageKey, "ManagedLocalPackage", sValue,"REG_SZ") Then If oFso.FileExists(sValue) Then oFso.CopyFile sValue, sScrubDir & "\" & Product & ".msi", True End If End If 'InScope " in Source: sample.bin, " = oWShell.ExpandEnvironmentStrings("%localappdata%") sTemp = oWShell.ExpandEnvironmentStrings("%temp%") sAllUsersProfile = oWShell.ExpandEnvironmentStrings("%allusersprofile%") RegReadValue HKLM, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList", "ProfilesDirectory", sProfilesDirectory, "REG_EXPAND_SZ" If NOT oFso.FolderExists(sProfilesDirectory) Then sProfilesDirectory = oFso.GetParentFolderName(oWShell.ExpandEnvironmentStrings("%userprofile%")) End If sProgramFiles = oWShell.ExpandEnvironmentStrings("%programfiles%") 'Deferred until after architecture check 'sProgramFilesX86 = oWShell.ExpandEnvironmentStrings("%programfiles(x86)%") sCommonProgramFiles = oWShell.ExpandEnvironmentStrings("%commonprogramfiles%") 'Deferred until after architecture check 'sCommonProgramFilesX86 = oWShell.ExpandEnvironmentStrings("%CommonProgramFiles(x86)%") sProgramData = oWSHell.ExpandEnvironmentStrings("%programdata%") sWinDir = oWShell.ExpandEnviro" in Source: sample.bin, "n = False fTestRerun = False fIsElevated = False fNoElevate = False fSetRunOnce = False fUserConsent = False fReturnErrorOrSuccess = False fSkipSD = False fClearTaskBand = False fUnpinMode = False fKeepLicense = False fOffline = False fForceArpUninstall = False ' create required objects '------------------------ InitObjects ' get environment path values '---------------------------- sAppData = oWShell.ExpandEnvironmentStrings("%appdata%") sLocalAppData = oWShell.ExpandEnvironmentStrings("%localappdata%") sTemp = oWShell.ExpandEnvironmentStrings("%temp%") sAllUsersProfile = oWShell.ExpandEnvironmentStrings("%allusersprofile%") RegReadValue HKLM, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList", "ProfilesDirectory", sProfilesDirectory, "REG_EXPAND_SZ" If NOT oFso.FolderExists(sProfilesDirectory) Then sProfilesDirectory = oFso.GetParentFolde" in Source: sample.bin, "oft\Office\Common\OffDiag\Location\", OVERSIONMAJOR, False RegDeleteKey HKLM, "SOFTWARE\Microsoft\OfficeCustomizeWizard\" & OVERSION & "\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\SOFTWARE\Microsoft\OfficeCustomizeWizard\" & OVERSION & "\" Select Case OVERSIONMAJOR Case "11" 'Jet_Replication sValue = "" If RegReadValue(HKCR, "CLSID\{CC2C83A6-9BE4-11D0-98E7-00C04FC2CAF5}\InprocServer32", "SystemDB", sValue, "REG_SZ") Then If Len(sValue) > Len(sOInstallRoot) Then If LCase(Left(sValue, Len(sOInstallRoot))) = LCase(sOInstallRoot) Then RegDeleteKey HKCR, "CLSID\{CC2C83A6-9BE4-11D0-98E7-00C04FC2CAF5}\InprocServer32\" End If End If Case "12" Case "14" RegDeleteKey HKLM, "SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\OfficeSoftwar" in Source: sample.bin, " End If 'IsArray End If Next 'Name End If 'IsArray End If 'RegEnumValues End If '32 Next 'Item End If 'RegEnumKey 'Delivery Log " - Delivery" hDefKey = HKLM sSubKeyName = "SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\" If RegEnumKey(HKLM,sSubKeyName,arrKeys) Then For Each Item in arrKeys If Len(Item) > 37 Then If fRemoveAll Then If (Mid(Item,27,PRODLEN)=OFFICEID AND Mid(Item,4,2)=OVERSIONMAJOR) OR _ LCase(Right(Item,7))=OVERSIONMAJOR&".data" Then RegDeleteKey HKLM,sSubKeyName & Item & "\" Else If (Mid(Item,27,PRODLEN)=OFFICEID AND Mid(Item,4,2)=OVERSIONMAJOR) AND _ CheckDelete(UCase(Left(Item,38))) Then RegDeleteKey HKLM,sSubKeyName & Item & "\" End If End" in Source: sample.bin, "RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\" & OVERSION & "\" If fRemoveOse OR fForce Then RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office Test\" RegDeleteValue HKLM, "SOFTWARE\Microsoft\Office\Common\", "LastAccessInstall", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Office\Common\", "MID", False RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\Excel\Addins\Microsoft.PerformancePoint.Planning.Client.Excel\" RegDeleteValue HKLM, "SOFTWARE\Microsoft\Office\InfoPath\Converters\Import\InfoPath.DesignerExcelImport\Versions\", OVERSION, False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Office\InfoPath\Converters\Import\InfoPath.DesignerWordImport\Versions\", OVERSION, False RegDeleteKey HKLM, "SOFTWARE\Microsoft\Shared Tools\Text Converters\Export\MEWord12\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Shared Tools\Text Converters\Export\Word12\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Shared Tools\" in Source: sample.bin, " If '37 Next 'Item End If 'RegEnumKey 'Registration Log " - HKLM Registration" hDefKey = HKLM sSubKeyName = "SOFTWARE\Microsoft\Office\"&OVERSION&"\Registration\" If RegEnumKey(HKLM,sSubKeyName,arrKeys) Then For Each Item in arrKeys If Len(Item)>37 Then If CheckDelete(UCase(Left(Item,38))) Then RegDeleteKey HKLM,sSubKeyName & Item & "\" End If Next 'Item End If 'RegEnumKey 'User Preconfigurations Log " - HKLM User Preconfigurations" hDefKey = HKLM sSubKeyName = "SOFTWARE\Microsoft\Office\"&OVERSION&"\User Settings\" If RegEnumKey(HKLM,sSubKeyName,arrKeys) Then For Each Item in arrKeys If Len(Item)>37 Then If CheckDelete(UCase(Left(Item,38))) Then RegDeleteKey HKLM,sSubKeyName & Item & "\" End If Next 'Item End If 'RegEnumKey 'Known Keypath settings Log " - Detcted KeyPath settings" For Ea" in Source: sample.bin, "ayVersion Dim arrKeys, arrNames, arrTypes, arrMultiSzValues, arrMultiSzNewValues Dim arrTestNames, arrTestTypes Dim i, iLoopCnt, iPos Dim fDelReg 'Wipe registry data 'User Profile settings LogH2 "User Policies" RegDeleteKey HKCU,"Software\Policies\Microsoft\Office\" & OVERSION & "\" If NOT fKeepUser Then RegDeleteKey HKCU,"Software\Microsoft\Office\" & OVERSION & "\" LogH2 "User Settings" End If 'fKeepUser 'Computer specific settings If fClearAddinReg Then RegDeleteKey HKLM,"SOFTWARE\Microsoft\Office\Outlook\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Office\Word\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Office\Excel\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Office\PowerPoint\" End If If (fRemoveAll AND NOT fC2rInstalled) OR (fRemoveAll AND fForce) Then LogH2 "Machine Settings" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Office\" & OVERSION & "\" If fRemove" in Source: sample.bin, " 32bit regkey location on a 64bit environment '------------------------------------------------------------------------------- Function Wow64Key(hDefKey, sSubKeyName) Dim iPos Select Case hDefKey Case HKCU If Left(sSubKeyName, 17) = "Software\Classes\" Then Wow64Key = Left(sSubKeyName, 17) & "Wow6432Node\" & Right(sSubKeyName, Len(sSubKeyName) - 17) Else iPos = InStr(sSubKeyName, "\") Wow64Key = Left(sSubKeyName, iPos) & "Wow6432Node\" & Right(sSubKeyName, Len(sSubKeyName) - iPos) End If Case HKLM If Left(sSubKeyName, 17) = "Software\Classes\" Then Wow64Key = Left(sSubKeyName, 17) & "Wow6432Node\" & Right(sSubKeyName, Len(sSubKeyName) - 17) Else iPos = InStr(sSubKeyName, "\") Wow64Key = Left(sSubKeyName, iPos) & "Wow6432Node\" & Right(sSubKeyName, Len(sSubKeyName) - iPos) End If Case Else Wow64Key = "Wow6432Node\" & sSubKeyName End Selec" in Source: sample.bin, "KeyName = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\" hDefKey = HKLM If RegEnumKey(hDefKey, sSubKeyName, arrKeys) Then For Each key in arrKeys RegWipeWIComponents hDefKey, sSubKeyName & key & "\Components\" Next End If sSubKeyName = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\" If RegEnumKey(hDefKey, sSubKeyName, arrKeys) Then For Each key in arrKeys RegWipeWIComponents hDefKey, sSubKeyName & key & "\Installer\Components\" Next End If 'Published Components sSubKeyName = "Installer\Components\" hDefKey = HKCR RegWipeWIPublishedComponents hDefKey, sSubKeyName sSubKeyName = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\" hDefKey = HKLM If RegEnumKey(hDefKey, sSubKeyName, arrKeys) Then For Each key in arrKeys RegWipeWIComponents hDefKey, sSubKeyName & key & "\Installer\Components\" Next End If " in Source: sample.bin, "radeCodes" sSubKeyName = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\" hDefKey = HKLM Case 2 LogH2 "HKCR UpgradeCodes" sSubKeyName = "Installer\UpgradeCodes\" hDefKey = HKCR Case 3 LogH2 "HKLM Products" sSubKeyName = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\" hDefKey = HKLM Case 4 LogH2 "HKCR Features" sSubKeyName = "Installer\Features\" hDefKey = HKCR Case 5 LogH2 "HKCR Products" sSubKeyName = "Installer\Products\" hDefKey = HKCR Case Else sSubKeyName = "" hDefKey = "" End Select If RegEnumKey(hDefKey,sSubKeyName,arrKeys) Then For Each Item in arrKeys 'Ensure we have the expected length for a compressed GUID If Len(Item)=32 Then " in Source: sample.bin, "r Each sid in arrSid sHKUTaskBand = sid & "\" & sTaskBand RegDeleteValue HKCU, sHKUTaskBand, "Favorites", False RegDeleteValue HKCU, sHKUTaskBand, "FavoritesRemovedChanges", False RegDeleteValue HKCU, sHKUTaskBand, "FavoritesChanges", False RegDeleteValue HKCU, sHKUTaskBand, "FavoritesResolve", False RegDeleteValue HKCU, sHKUTaskBand, "FavoritesVersion", False Next 'sid End Sub 'ClearTaskBand '------------------------------------------------------------------------------- ' LoadUsersReg ' ' Loads the HKCU for all local users '------------------------------------------------------------------------------- Sub LoadUsersReg () Dim profilefolder Dim sValue LogH1 "Load User Registry Profiles" On Error Resume Next oReg.GetExpandedStringValue HKLM, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList", "ProfilesDirectory", sValue For Each profilefolder in oFso.GetFolder(sValue).SubFolders If oFso.F" in Source: sample.bin, " CheckRegPermissions = True sSubKeyName = "Software\Microsoft\Windows\" oReg.CheckAccess HKLM, sSubKeyName, KEY_QUERY_VALUE, fReturn If Not fReturn Then CheckRegPermissions = False oReg.CheckAccess HKLM, sSubKeyName, KEY_SET_VALUE, fReturn If Not fReturn Then CheckRegPermissions = False oReg.CheckAccess HKLM, sSubKeyName, KEY_CREATE_SUB_KEY, fReturn If Not fReturn Then CheckRegPermissions = False oReg.CheckAccess HKLM, sSubKeyName, DELETE, fReturn If Not fReturn Then CheckRegPermissions = False End Function 'CheckRegPermissions '======================================================================================================= 'Check if a product will be removed Function CheckDeleteEx (sProductCode) CheckDeleteEx = False If CheckDelete (sProductCode) Then CheckDeleteEx = True Exit Function End If If (fRemoveAll AND NOT fC2rInstalled) OR (fRemoveAll AND fForce) Then CheckDeleteEx = InScope(sP" in Source: sample.bin, " = REG_ARP & sProductCode oReg.CreateKey HKLM,sCurKey Case 2 sCurKey = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\" & GetCompressedGuid(sProductCode) oReg.CreateKey HKLM,sCurKey oReg.CreateKey HKLM,sCurKey & "\Features" oReg.CreateKey HKLM,sCurKey & "\InstallProperties" oReg.CreateKey HKLM,sCurKey & "\Patches" oReg.CreateKey HKLM,sCurKey & "\Usage" sCurKey = sCurKey & "\InstallProperties" oReg.SetStringValue HKLM,sCurKey,"LocalPackage",sMsiFile Case 3 sCurKey = "Installer\Products\" & GetCompressedGuid(sProductCode) sTmpKey = sCurKey oReg.CreateKey HKCR,sCurKey oReg.SetDWordValue HKCR,sCurKey,"AdvertiseFlags",388 oReg.SetDWordValue HKCR,sCurKey,"Assignment",1 oReg.SetDWordValue HKCR,sCurKey,"AuthorizedLUAApp",0 oReg.SetStringValue HKCR,sCurKey,"Client" in Source: sample.bin, "yName = "Software\Microsoft\Windows\" oReg.CheckAccess HKLM, sSubKeyName, KEY_QUERY_VALUE, fReturn If Not fReturn Then CheckRegPermissions = False oReg.CheckAccess HKLM, sSubKeyName, KEY_SET_VALUE, fReturn If Not fReturn Then CheckRegPermissions = False oReg.CheckAccess HKLM, sSubKeyName, KEY_CREATE_SUB_KEY, fReturn If Not fReturn Then CheckRegPermissions = False oReg.CheckAccess HKLM, sSubKeyName, DELETE, fReturn If Not fReturn Then CheckRegPermissions = False End Function 'CheckRegPermissions '======================================================================================================= 'Check if a product will be removed Function CheckDeleteEx (sProductCode) CheckDeleteEx = False If CheckDelete (sProductCode) Then CheckDeleteEx = True Exit Function End If If (fRemoveAll AND NOT fC2rInstalled) OR (fRemoveAll AND fForce) Then CheckDeleteEx = InScope(sProductCode) AND NOT dicKeepProd.Exists(UCase(" in Source: sample.bin, "e failed. Return value: "&iRetVal End If End Sub 'RegDeleteKeyEx '======================================================================================================= 'Return the alternate regkey location on 64bit environment Function Wow64Key(hDefKey, sSubKeyName) Dim iPos Select Case hDefKey Case HKCU If Left(sSubKeyName,17) = "Software\Classes\" Then Wow64Key = Left(sSubKeyName,17) & "Wow6432Node\" & Right(sSubKeyName,Len(sSubKeyName)-17) Else iPos = InStr(sSubKeyName,"\") Wow64Key = Left(sSubKeyName,iPos) & "Wow6432Node\" & Right(sSubKeyName,Len(sSubKeyName)-iPos) End If Case HKLM If Left(sSubKeyName,17) = "Software\Classes\" Then Wow64Key = Left(sSubKeyName,17) & "Wow6432Node\" & Right(sSubKeyName,Len(sSubKeyName)-17) Else iPos = InStr(sSubKeyName,"\") Wow64Key = Left(sSubKeyName,iPos) &" in Source: sample.bin, "2B-3FB6980118CF}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{46137B78-0EC3-426D-8B89-FF7C3A458B5E}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{8BA85C75-763B-4103-94EB-9470F12FE0F7}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{CD55129A-B1A1-438E-A425-CEBC7DC684EE}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}", False ' BHO RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-495" in Source: sample.bin, ", 0, True) Log " - msiexec returned: " & SetupRetVal(sReturn) & " (" & sReturn & ")" & vbCrLf fRebootRequired = fRebootRequired OR (sReturn = "3010") OR (sReturn = "1618") Else Log " -> Removal suppressed in preview mode." LogOnly " -> Command: "&sCmd End If End If 'InScope Next 'Product If i = 0 Then Log " Nothing to remove for msiexec" End Sub 'MsiexecRemoval '======================================================================================================= 'Remove the OSE (Office Source Engine) service Sub RemoveOSE On Error Resume Next DeleteService "ose" 'Delete the folder DeleteFolder sCommonProgramFiles & "\Microsoft Shared\Source Engine" 'Delete the registration RegDeleteKey HKLM, "SYSTEM\CurrentControlSet\Services\ose\" End Sub 'RemoveOSE '======================================================================================================= " in Source: sample.bin, "","17","18","1A","1B","1E","1F","23","33","44","A1","CA","E0","E3","FD","FF" If NOT dicCSuite.Exists(UCase(prod)) Then dicCSuite.Add UCase(prod),dicInstalledSku.Item(prod) 'Server Case "14","2E","32","92","A5" If NOT dicSrv.Exists(UCase(prod)) Then dicSrv.Add UCase(prod),dicInstalledSku.Item(prod) Case Else 'Standalone If NOT dicCSingle.Exists(UCase(prod)) Then dicCSingle.Add UCase(prod),dicInstalledSku.Item(prod) End Select Next 'prod Else ' check if OffScrub should run a computer that has never had Office installed If fRunOnVanilla Then Exit Sub fIsVanilla = True If RegReadValue(HKLM,"SOFTWARE\Clients\Mail","",sValue,"REG_SZ") Then fIsVanilla = fIsVanilla AND NOT (UCase(sValue) = "MICROSOFT OUTLOOK") End If ' apply the detection result fNoOrphansMode = fNoOrphansMode OR fIsVanilla End If " in Source: sample.bin, "e RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{7CCA70DB-DE7A-4FB7-9B2B-52E2335A3B5A}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{506F4668-F13E-4AA1-BB04-B43203AB3CC0}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{D66DC78C-4F61-447F-942B-3FB6980118CF}", False RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\" 'Groove Extensions RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\","{B5A7F190-DDA6-4420-B3BA-52453494E6CD}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell" in Source: sample.bin, " End If End If 'IsArray End If Next 'Name End If 'IsArray End If 'RegEnumValues End If '32 Next 'Item End If 'RegEnumKey 'Delivery Log " - Delivery" hDefKey = HKLM sSubKeyName = "SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\" If RegEnumKey(HKLM,sSubKeyName,arrKeys) Then For Each Item in arrKeys If Len(Item) > 37 Then If fRemoveAll Then If (Mid(Item,27,PRODLEN)=OFFICEID AND Mid(Item,4,2)=OVERSIONMAJOR) OR _ LCase(Right(Item,7))=OVERSIONMAJOR&".data" Then RegDeleteKey HKLM,sSubKeyName & Item & "\" Else If (Mid(Item,27,PRODLEN)=OFFICEID AND Mid(Item,4,2)=OVERSIONMAJOR) AND _ CheckDelete(UCase(Left(Item,38))) Then RegDeleteKey HKLM,sSubKeyName & Item & "\" " in Source: sample.bin, "12 Then fRemoveC2R = False Exit Sub End If If fForce Then If NOT fKeepSG Then fRemoveAppV = True Exit Sub End If fRemoveAppV = False If fKeepSG Then Exit Sub If RegEnumKey (HKLM, "SOFTWARE\Microsoft\SoftGrid\4.5\Client\Applications", arrKeys) Then For Each Key in arrKeys If Len(Key)>15 Then 'Get Partial product Key sPKey = Right(Key, 16) If Left(sPKey, 4) = "90"&OVERSIONMAJOR Then If NOT GetProductID(Mid(sPKey, 5, 4)) = "CLICK2RUN" Then Exit Sub Else Exit Sub End If Else Exit Sub End If Next 'Key Else Exit Sub End If 'If we got here it's only Click2Run apps fRemoveAppV = True End Sub 'CheckRemoveSG '======================================================================================================= " in Source: sample.bin, "ubDir & "\" & SCRIPTFILE & chr(34) End Sub '------------------------------------------------------------------------------- ' SetRunOnce ' ' Create a RunOnce entry to resume setup after a reboot '------------------------------------------------------------------------------- Sub SetRunOnce Dim sValue oReg.CreateKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion" oReg.CreateKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" sValue = "cscript.exe " & chr(34) & sScrubDir & "\" & SCRIPTFILE & chr(34) & " /NoElevate /Relaunched" oReg.SetStringValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce", "O15CleanUp", sValue End Sub 'SetRunOnce " in Source: sample.bin, "moved - delete the key If NOT RegEnumValues(hDefKey, sSubKeyName & item, arrNames, arrTypes) Then RegDeleteKey hDefKey, sSubKeyName & item & "\" Else 'iLoopCnt >= 3 RegDeleteKey hDefKey, sSubKeyName & item & "\" End If 'iLoopCnt < 3 End If 'InScope End If 'Len(Item)=32 Next 'Item End If 'RegEnumKey Next 'iLoopCnt ' Components in Global LogH2 "Scan Windows Installer Global Components metadata" sSubKeyName = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\" hDefKey = HKLM If RegEnumKey(hDefKey, sSubKeyName, arrKeys) Then For Each item in arrKeys ' ensure the expected length for a compressed GUID If Len(Item) = 32 Then If RegEnumValues(hDefKey, sSubKeyName & item, arrNames, arrTypes) Then For Each name in arrNa" in Source: sample.bin, " If IsC2R(Name) Then RegDeleteValue hDefKey, sSubKeyName, Name, False Next 'Name End If 'RegEnumValues If hDefKey = HKLM Then Exit Do hDefKey = HKLM Loop hDefKey = HKCU sSubKeyName = "SOFTWARE\Microsoft\AppVISV" Do LogOnly "Scanning key: " & sSubKeyName If RegEnumValues(hDefKey, sSubKeyName, arrNames, arrTypes) Then For Each Name in arrNames If IsC2R(Name) Then RegDeleteValue hDefKey, sSubKeyName, Name, False Next 'Name End If 'RegEnumValues If hDefKey = HKLM Then Exit Do hDefKey = HKLM Loop ' msiexec based uninstall sMsiProp = " REBOOT=ReallySuppress NOREMOVESPAWN=True" LogH2 "Detect Msi based products" For Each prod in oMsi.Products If CheckDelete(prod) Then Log "Call msiexec.exe to remove " & prod sUninstallCmd = "msiexec.exe /x" & prod & sMsiProp If fQuiet Then " in Source: sample.bin, " If If RegReadStringValue(HKLM, "SOFTWARE\Wow6432Node\Microsoft\Office\15.0\Common\InstallRoot", "Path", sInstallRootPath) Then 'fO64 = Not (InStr(sInstallRootPath, "(x86)") > 0) fO64 = False Exit Sub End If If RegReadStringValue(HKLM, "SOFTWARE\Microsoft\Office\Common\InstallRoot", "Path", sInstallRootPath) Then 'fO64 = Not (InStr(sInstallRootPath, "(x86)") > 0) fO64 = True Exit Sub End If If RegReadStringValue(HKLM, "SOFTWARE\Microsoft\Office\15.0\Common\InstallRoot", "Path", sInstallRootPath) Then 'fO64 = Not (InStr(sInstallRootPath, "(x86)") > 0) fO64 = True Exit Sub End If End Sub 'DetectOfficeBitness '------------------------------------------------------------------------------- ' DetectOSBitness ' ' detect bitness of the operating system '------------------------------------------------------------------------------- Sub DetectOSBitness () Dim ComputerItem, item Set ComputerItem = oWmiLocal.ExecQuery("Select * from Win32_ComputerSystem") " in Source: sample.bin, "de oReg.CreateKey HKLM,sCurKey Case 2 sCurKey = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\" & GetCompressedGuid(sProductCode) oReg.CreateKey HKLM,sCurKey oReg.CreateKey HKLM,sCurKey & "\Features" oReg.CreateKey HKLM,sCurKey & "\InstallProperties" oReg.CreateKey HKLM,sCurKey & "\Patches" oReg.CreateKey HKLM,sCurKey & "\Usage" sCurKey = sCurKey & "\InstallProperties" oReg.SetStringValue HKLM,sCurKey,"LocalPackage",sMsiFile Case 3 sCurKey = "Installer\Products\" & GetCompressedGuid(sProductCode) sTmpKey = sCurKey oReg.CreateKey HKCR,sCurKey oReg.SetDWordValue HKCR,sCurKey,"AdvertiseFlags",388 oReg.SetDWordValue HKCR,sCurKey,"Assignment",1 oReg.SetDWordValue HKCR,sCurKey,"AuthorizedLUAApp",0 oReg.SetStringValue HKCR,sCurKey,"Clients",":" oRe" in Source: sample.bin, "RemoveAll Select Case OVERSIONMAJOR Case "11" For iLoopCnt = 1 to 3 Select Case iLoopCnt Case 1 'CIW - HKCU sSubKeyName = "Software\Microsoft\OfficeCustomizeWizard\" & OVERSION & "\RegKeyPaths\" hDefKey = HKCU Case 2 'CIW - HKLM sSubKeyName = "SOFTWARE\Microsoft\OfficeCustomizeWizard\" & OVERSION & "\RegKeyPaths\" hDefKey = HKLM Case 3 'Add/Remove Programs sSubKeyName = REG_ARP hDefKey = HKLM End Select If RegEnumKey(hDefKey,sSubKeyName,arrKeys) Then For Each Item in arrKeys 'OFFICEID id If Len(Item)>37 Then sGuid = UCase(Left(Item,38)) If Right(sGuid,PRODLEN)=OFFICEID Then If CheckDelete(sGuid) Then " in Source: sample.bin, "(sScrubDir) Then oFso.CreateFolder sScrubDir 'Set the default logging directory sLogDir = sScrubDir 'Call the command line parser ParseCmdLine 'Ensure CScript as engine If NOT fCScript AND NOT fQuiet Then RelaunchAsCScript 'Get Office Install Folder If NOT RegReadValue(HKLM,"SOFTWARE\Microsoft\Office\"&OVERSION&"\Common\InstallRoot","Path",sOInstallRoot,"REG_SZ") Then sOInstallRoot = sProgramFiles & "\Microsoft Office\"&OREF End If 'Ensure integrity of WI metadata which could fail used APIs otherwise EnsureValidWIMetadata HKCU,"Software\Classes\Installer\Products",COMPRESSED EnsureValidWIMetadata HKCR,"Installer\Products",COMPRESSED EnsureValidWIMetadata HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products",COMPRESSED EnsureValidWIMetadata HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components",COMPRESSED EnsureValidWIMetadata HKCR,"Installer\Components",COMPRESSED 'Add initial known .exe files that might need to" in Source: sample.bin, " If Right(sSubKeyName, 1) = "\" Then sSubKeyName = Left(sSubKeyName, Len(sSubKeyName) - 1) End If On Error Resume Next ' exception handler If (hDefKey = HKLM) AND (sSubKeyName = "SOFTWARE\Microsoft\Office\15.0\ClickToRun") Then If NOT fDetectOnly Then iRetVal = oWShell.Run("reg delete HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun /f", 0, True) Exit Sub End If ' regular recursion oReg.EnumKey hDefKey, sSubKeyName, arrSubkeys If IsArray(arrSubkeys) Then For Each sSubkey In arrSubkeys RegDeleteKeyEx hDefKey, sSubKeyName & "\" & sSubkey Next End If If Not fDetectOnly Then iRetVal = 0 iRetVal = oReg.DeleteKey(hDefKey, sSubKeyName) If NOT (iRetVal = 0) Then LogOnly " Delete failed. Return value: "&iRetVal End If On Error Goto 0 End Sub 'RegDeleteKeyEx '------------------------------------------------------------------------------- ' Wow64Key ' ' Return the" in Source: sample.bin, "56-1AF5-4347-846D-7C10C4192619}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{72853161-30C5-4D22-B7F9-0BBC1D38A37E}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{6C467336-8281-4E60-8204-430CED96822D}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{B5A7F190-DDA6-4420-B3BA-52453494E6CD}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{A449600E-1DC6-4232-B948-9BD794D62056}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVers" in Source: sample.bin, "ipting.Dictionary") Set dicKeepSku = CreateObject("Scripting.Dictionary") Set dicKeepLis = CreateObject("Scripting.Dictionary") Set dicKeepFolder = CreateObject("Scripting.Dictionary") Set dicApps = CreateObject("Scripting.Dictionary") Set dicDelRegKey = CreateObject("Scripting.Dictionary") Set dicKeepReg = CreateObject("Scripting.Dictionary") Set dicSrv = CreateObject("Scripting.Dictionary") Set dicCSuite = CreateObject("Scripting.Dictionary") Set dicCSingle = CreateObject("Scripting.Dictionary") 'Create the temp folder If Not oFso.FolderExists(sScrubDir) Then oFso.CreateFolder sScrubDir 'Set the default logging directory sLogDir = sScrubDir 'Call the command line parser ParseCmdLine 'Ensure CScript as engine If NOT fCScript AND NOT fQuiet Then RelaunchAsCScript 'Get Office Install Folder If NOT RegReadValue(HKLM, "SOFTWARE\Microsoft\Office\"&OVERSION&"\Common\InstallRoot", "Path", sOInstallRoot, "REG_SZ") Then sOInstallRoot = sProgramFiles & "\Microsoft Office\"&OREF End " in Source: sample.bin, "TestNames, arrTestTypes) Then If NOT dicDelRegKey.Exists(sSubKeyName&Item&"\") Then dicDelRegKey.Add sSubKeyName&Item&"\", HKCR End If End If 'DelReg End If End If 'IsArray End If Next 'Name End If 'IsArray End If 'RegEnumValues End If '32 Next 'Item End If 'RegEnumKey 'Delivery Log " - Delivery" hDefKey = HKLM sSubKeyName = "SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\" If RegEnumKey(HKLM, sSubKeyName, arrKeys) Then For Each Item in arrKeys If Len(Item) > 37 Then If fRemoveAll Then If (Mid(Item, 27, PRODLEN)=OFFICEID AND Mid(Item, 4, 2)=OVERSIONMAJOR) OR _ LCase(Right" in Source: sample.bin, "t\Office\15.0\ClickToRunStore" RegDeleteKey HKCU, "SOFTWARE\Microsoft\Office\16.0\ClickToRun" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\16.0\ClickToRun" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\16.0\ClickToRunStore" RegDeleteKey HKCU, "SOFTWARE\Microsoft\Office\ClickToRun" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\ClickToRun" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\ClickToRunStore" ' Office key in HKLM If Not dicKeepSku.Count > 0 Then 'double calls to ensure Wow6432 gets cleared out as well RegDeleteKey HKLM, "Software\Microsoft\Office\15.0" RegDeleteKey HKLM, "Software\Microsoft\Office\15.0" RegDeleteKey HKLM, "Software\Microsoft\Office\16.0" RegDeleteKey HKLM, "Software\Microsoft\Office\16.0" End If ClearOfficeHKLM "SOFTWARE\Microsoft\Office" ' Run key sSubKeyName = "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" If RegEnumValues (HKLM, sSubKeyName, arrNames, arrTypes) Then For " in Source: sample.bin, "nd Select For iCnt = 1 To 3 Select Case iCnt Case 1 sCurKey = REG_ARP & sProductCode oReg.CreateKey HKLM,sCurKey Case 2 sCurKey = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\" & GetCompressedGuid(sProductCode) oReg.CreateKey HKLM,sCurKey oReg.CreateKey HKLM,sCurKey & "\Features" oReg.CreateKey HKLM,sCurKey & "\InstallProperties" oReg.CreateKey HKLM,sCurKey & "\Patches" oReg.CreateKey HKLM,sCurKey & "\Usage" sCurKey = sCurKey & "\InstallProperties" oReg.SetStringValue HKLM,sCurKey,"LocalPackage",sMsiFile Case 3 sCurKey = "Installer\Products\" & GetCompressedGuid(sProductCode) sTmpKey = sCurKey oReg.CreateKey HKCR,sCurKey oReg.SetDWordValue HKCR,sCurKey,"AdvertiseFlags",388 oReg.SetDWordValue HKCR,sCurKey,"Assignment",1 oReg.SetD" in Source: sample.bin, "9-BA22-42B3008E02FF}" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}" RegDeleteKey HKLM, "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}" RegDeleteKey HKLM, "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}" RegDeleteKey HKLM, "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}" ' OneNote Namespace Extension for Desktop RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}" ' Web Sites RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\Namespace\{B28AA736-876B-46DA-B3A8-84C5E30BA492}" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Exp" in Source: sample.bin, "aunchAsCScript 'Get Office Install Folder If NOT RegReadValue(HKLM,"SOFTWARE\Microsoft\Office\"&OVERSION&"\Common\InstallRoot","Path",sOInstallRoot,"REG_SZ") Then sOInstallRoot = sProgramFiles & "\Microsoft Office\"&OREF End If 'Ensure integrity of WI metadata which could fail used APIs otherwise EnsureValidWIMetadata HKCU,"Software\Classes\Installer\Products",COMPRESSED EnsureValidWIMetadata HKCR,"Installer\Products",COMPRESSED EnsureValidWIMetadata HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products",COMPRESSED EnsureValidWIMetadata HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components",COMPRESSED EnsureValidWIMetadata HKCR,"Installer\Components",COMPRESSED 'Add initial known .exe files that might need to be closed dicApps.Add "communicator.exe", "communicator.exe" 'Adding setup.exe to the hard list of processes that are shut down will potentially break wrappers that invoke OffScrub 'dicApps.Add "setup.exe", "setup.ex" in Source: sample.bin, "zeWizard\11.0\",arrKeys) Then RegDeleteKey hDefKey,"Software\Microsoft\OfficeCustomizeWizard\" Next 'iLoopCnt Case "12" 'Add/Remove Programs RegWipeARP Case "14" 'Add/Remove Programs RegWipeARP Case Else End Select 'UpgradeCodes, WI config, WI global config For iLoopCnt = 1 to 6 Select Case iLoopCnt Case 1 sSubKeyName = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\" hDefKey = HKLM RegWipeWIConfig hDefKey, sSubKeyName, iLoopCnt Case 2 sSubKeyName = "Installer\UpgradeCodes\" hDefKey = HKCR RegWipeWIConfig hDefKey, sSubKeyName, iLoopCnt Case 3 sSubKeyName = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\" hDefKey = HKLM RegWipeWIConfig hDefKey, sSubKeyName, iLoopCnt Case 4 sSubKeyName = "Installer\Fe" in Source: sample.bin, " RegWipeARP Case "14" 'Add/Remove Programs RegWipeARP Case Else End Select 'UpgradeCodes, WI config, WI global config For iLoopCnt = 1 to 5 Select Case iLoopCnt Case 1 LogH2 "HKLM UpgradeCodes" sSubKeyName = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\" hDefKey = HKLM Case 2 LogH2 "HKCR UpgradeCodes" sSubKeyName = "Installer\UpgradeCodes\" hDefKey = HKCR Case 3 LogH2 "HKLM Products" sSubKeyName = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\" hDefKey = HKLM Case 4 LogH2 "HKCR Features" sSubKeyName = "Installer\Features\" hDefKey = HKCR Case 5 LogH2 "HKCR Products" sSubKeyName = "Installer\Products\" hDefKey = HKCR Case Else sSubKeyN" in Source: sample.bin, " If RegValExists(HKLM, "SOFTWARE\Microsoft\Office\ClickToRun\ProductReleaseIDs\Active\culture", "x-none") Or _ RegValExists(HKLM, "SOFTWARE\Microsoft\Office\15.0\ClickToRun\ProductReleaseIDs\Active\culture", "x-none") Or _ RegValExists(HKLM, "SOFTWARE\Microsoft\Office\ClickToRun\ProductReleaseIDs", "ActiveConfiguration") Then LogH "ODT Uninstall C2R " & iVerODT & ".0" If NOT fForceArpUninstall Then 'build the remove.xml BuildRemoveXml 'verify ODT is available If oFso.FileExists(sScriptDir & "ODT" & iVerODT & "\setup.exe") Then sODTFullPath = sScriptDir & "ODT" & iVerODT & "\setup.exe" fCanUseOdtUninstall = True Else 'ODT not available. Try to download If NOT fOffline Then If iVerODT = 15 Then If HttpDownloadFile("https://download.microsoft.com/download/6/2/3/6230F7A2-D8A9-478B-AC5C-57091B632FCF/off" in Source: sample.bin, " For Each Process in Processes ' sOut = "End process '" & Process.Name ' iRet = Process.Terminate() ' CheckError "ClearShellIntegrationReg: " & Process.Name ' Log sOut & "' returned: " & iRet ' Next 'Process ' wscript.sleep 500 ' Protocol Handlers RegDeleteKey HKLM, "SOFTWARE\Classes\Protocols\Handler\osf" ' Context Menu Handlers RegDeleteKey HKLM, "SOFTWARE\Classes\CLSID\{573FFD05-2805-47C2-BCE0-5F19512BEB8D}" 'RegDeleteKey HKLM, "SOFTWARE\Classes\CLSID\{4693FF15-B962-420A-9E5D-176F7D4B8321}" RegDeleteKey HKLM, "SOFTWARE\Classes\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}" RegDeleteKey HKLM, "SOFTWARE\Classes\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}" RegDeleteKey HKLM, "SOFTWARE\Classes\CLSID\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}" RegDeleteKey HKLM, "SOFTWARE\Classes\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}" ' Groove ShellIconOverlayIdentifiers RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows" in Source: sample.bin, "rNames If RegReadValue(hDefKey,sSubKeyName,Name,sValue,arrTypes(i)) Then If sValue = sGuid Then RegDeleteValue hDefKey, sSubKeyName, Name, False End If i = i + 1 Next End If End If End If If NOT RegEnumKey(hDefKey,sSubKeyName,arrKeys) Then RegDeleteKey hDefKey,"Software\Microsoft\OfficeCustomizeWizard\11.0\" If NOT RegEnumKey(hDefKey,"Software\Microsoft\OfficeCustomizeWizard\11.0\",arrKeys) Then RegDeleteKey hDefKey,"Software\Microsoft\OfficeCustomizeWizard\" Next 'iLoopCnt Case "12" 'Add/Remove Programs RegWipeARP Case "14" 'Add/Remove Programs RegWipeARP Case Else End Select 'UpgradeCodes, WI config, WI global config For iLoopCnt = 1 to 5 Select Case iLoopCnt Case 1 LogH2 "HKLM Upg" in Source: sample.bin, "es, fDisplayVersion Dim arrKeys, arrNames, arrTypes, arrMultiSzValues, arrMultiSzNewValues Dim arrTestNames, arrTestTypes Dim i, iLoopCnt, iPos Dim fDelReg 'Wipe registry data 'User Profile settings LogH2 "User Policies" RegDeleteKey HKCU,"Software\Policies\Microsoft\Office\" & OVERSION & "\" If NOT fKeepUser Then RegDeleteKey HKCU,"Software\Microsoft\Office\" & OVERSION & "\" LogH2 "User Settings" End If 'fKeepUser 'Computer specific settings If fClearAddinReg Then RegDeleteKey HKLM,"SOFTWARE\Microsoft\Office\Outlook\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Office\Word\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Office\Excel\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Office\PowerPoint\" End If If (fRemoveAll AND NOT fC2rInstalled) OR (fRemoveAll AND fForce) Then LogH2 "Machine Settings" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Office\" & OVERSION & "\" " in Source: sample.bin, "Ose OR fForce Then RegDeleteKey HKLM,"SOFTWARE\Microsoft\Office Test\" RegDeleteValue HKLM,"SOFTWARE\Microsoft\Office\Common\", "LastAccessInstall", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Office\Common\", "MID", False RegDeleteKey HKLM,"SOFTWARE\Microsoft\Office\Excel\Addins\Microsoft.PerformancePoint.Planning.Client.Excel\" RegDeleteValue HKLM,"SOFTWARE\Microsoft\Office\InfoPath\Converters\Import\InfoPath.DesignerExcelImport\Versions\", OVERSION, False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Office\InfoPath\Converters\Import\InfoPath.DesignerWordImport\Versions\", OVERSION, False RegDeleteKey HKLM,"SOFTWARE\Microsoft\Shared Tools\Text Converters\Export\MEWord12\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Shared Tools\Text Converters\Export\Word12\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Shared Tools\Text Converters\Export\Word97\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Shared Too" in Source: sample.bin, "ReadValue(HKLM, sTLVerKey & "\0\Win64\", "", sValue, "REG_SZ") Then LogOnly "Found key HKLM\" & sTLVerKey & "\0\Win64\" 'get the safe filepath sFilePath = Left(sValue, InstrRev(sValue, ".") + 3) LogOnly "Found filepath: " & sValue & " - using filepath: " & sFilePath If oFso.FileExists(sFilePath) Then fCanDelete = False fClearTL = False LogOnly "File target still in use. TypeLib registration will persisted." Else fClearTL = fCanDelete LogOnly "File target not found. Flagging for delete" End If End If If RegReadValue(HKLM, sTLVerKey & "\9\Win64\", "", sValue, "REG_SZ") Then LogOnly "Found key HKLM\" & sTLVerKey & "\9\Win64\" " in Source: sample.bin, " End If 'Len(Item)>37 Next 'Item If iLoopCnt < 3 Then If RegEnumValues(hDefKey, sSubKeyName, arrNames, arrTypes) Then i = 0 For Each Name in arrNames If RegReadValue(hDefKey, sSubKeyName, Name, sValue, arrTypes(i)) Then If sValue = sGuid Then RegDeleteValue hDefKey, sSubKeyName, Name, False End If i = i + 1 Next End If End If End If If NOT RegEnumKey(hDefKey, sSubKeyName, arrKeys) Then RegDeleteKey hDefKey, "Software\Microsoft\OfficeCustomizeWizard\11.0\" If NOT RegEnumKey(hDefKey, "Software\Microsoft\OfficeCustomizeWizard\11.0\", arrKeys) Then RegDeleteKey hDefKey, "Software\Microsoft\OfficeCustomizeWizard\" Next 'iLoopCnt Case "12" 'Add/Remove Programs " in Source: sample.bin, "FB7-9B2B-52E2335A3B5A}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{506F4668-F13E-4AA1-BB04-B43203AB3CC0}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{D66DC78C-4F61-447F-942B-3FB6980118CF}", False RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\" 'Groove Extensions RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\", "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{99FD978C-D287-4F50-827F-B2C658EDA8E7}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}", False RegDeleteValue HKLM, "SOFTWA" in Source: sample.bin, "ft\OfficeCustomizeWizard\" & OVERSION & "\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\SOFTWARE\Microsoft\OfficeCustomizeWizard\" & OVERSION & "\" Select Case OVERSIONMAJOR Case "11" 'Jet_Replication sValue = "" If RegReadValue (HKCR, "CLSID\{CC2C83A6-9BE4-11D0-98E7-00C04FC2CAF5}\InprocServer32", "SystemDB", sValue, "REG_SZ") Then If Len(sValue) > Len(sOInstallRoot) Then If LCase(Left(sValue, Len(sOInstallRoot))) = LCase (sOInstallRoot) Then RegDeleteKey HKCR, "CLSID\{CC2C83A6-9BE4-11D0-98E7-00C04FC2CAF5}\InprocServer32\" End If End If Case "12" Case "14" RegDeleteKey HKLM,"SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform_Test\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Office\Common\ActiveX Compatibility\{00024512-0000-0000-C000-000000000046}\" RegDeleteValue HKLM,"SO" in Source: sample.bin, "s\CurrentVersion\Shell Extensions\Approved\", "{A449600E-1DC6-4232-B948-9BD794D62056}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{3D60EDA7-9AB4-4DA8-864C-D9B5F2E7281D}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{387E725D-DC16-4D76-B310-2C93ED4752A0}", False RegDeleteKey HKLM, "SOFTWARE\Classes\*\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM, "SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM, "SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM, "SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM, "SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\XXX" in Source: sample.bin, " RegDeleteValue hDefKey, sSubKeyName & Item & "\", Name, True End If Next 'Name End If 'IsArray(arrNames) 'If all entries were removed - delete the key RegEnumValues hDefKey,sSubKeyName & Item,arrNames,arrTypes If Not IsArray(arrNames) Then RegDeleteKey hDefKey, sSubKeyName & Item & "\" Else 'iLoopCnt >= 3 If CheckDelete(sGuid) Then RegDeleteKey hDefKey, sSubKeyName & Item & "\" End If 'iLoopCnt < 3 End If 'fRemoveAll End If 'Len(Item)=32 Next 'Item End If 'RegEnumKey Next 'iLoopCnt 'Components Log " - Global Components" sSubKeyName = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\" If RegEnumKey(HKLM,sSubKeyName,arrKeys) " in Source: sample.bin, "InstallRoot,"REG_SZ") Then sOInstallRoot = sProgramFiles & "\Microsoft Office\"&OREF End If 'Ensure integrity of WI metadata which could fail used APIs otherwise EnsureValidWIMetadata HKCU,"Software\Classes\Installer\Products",COMPRESSED EnsureValidWIMetadata HKCR,"Installer\Products",COMPRESSED EnsureValidWIMetadata HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products",COMPRESSED EnsureValidWIMetadata HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components",COMPRESSED EnsureValidWIMetadata HKCR,"Installer\Components",COMPRESSED 'Add initial known .exe files that might need to be closed dicApps.Add "communicator.exe", "communicator.exe" 'Adding setup.exe to the hard list of processes that are shut down will potentially break wrappers that invoke OffScrub 'dicApps.Add "setup.exe", "setup.exe" Select Case OVERSIONMAJOR Case "12" Case "14" dicApps.Add "bcssync.exe","bcssync.exe" dicApps.Add "officesas.exe","officesas" in Source: sample.bin, "Left(sValue,Len(sOInstallRoot))) = LCase(sOInstallRoot) Then RegDeleteKey HKCR,"CLSID\{CC2C83A6-9BE4-11D0-98E7-00C04FC2CAF5}\InprocServer32\" End If End If Case "12" Case "14" RegDeleteKey HKLM,"SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform_Test\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Office\Common\ActiveX Compatibility\{00024512-0000-0000-C000-000000000046}\" RegDeleteValue HKLM,"SOFTWARE\Microsoft\Office\OneNote\Adapters\","{456B0D0E-49DD-4C95-8DB6-175F54DE69A3}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{42042206-2D85-11D3-8CFF-005004838597}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{0006F045-0000-0000-C000-000000000046}", Fals" in Source: sample.bin, "B1-9907-4370-B3A0-BAFC03D81399}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{16F3DD56-1AF5-4347-846D-7C10C4192619}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{72853161-30C5-4D22-B7F9-0BBC1D38A37E}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{6C467336-8281-4E60-8204-430CED96822D}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Window" in Source: sample.bin, "etup Dim fBypass_Stage3 : fBypass_Stage3 = False 'Msiexec Dim fBypass_Stage4 : fBypass_Stage4 = False 'CleanUp 'Create required objects Set oWmiLocal = GetObject("winmgmts:{(Debug)}\\.\root\cimv2") Set oWShell = CreateObject("Wscript.Shell") Set oShellApp = CreateObject("Shell.Application") Set oFso = CreateObject("Scripting.FileSystemObject") Set oMsi = CreateObject("WindowsInstaller.Installer") Set oReg = GetObject("winmgmts:\\.\root\default:StdRegProv") 'Get environment path info sAppData = oWShell.ExpandEnvironmentStrings("%appdata%") sLocalAppData = oWShell.ExpandEnvironmentStrings("%localappdata%") sTemp = oWShell.ExpandEnvironmentStrings("%temp%") sAllUsersProfile = oWShell.ExpandEnvironmentStrings("%allusersprofile%") RegReadValue HKLM, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList", "ProfilesDirectory", sProfilesDirectory, "REG_EXPAND_SZ" If NOT oFso.FolderExists(sProfilesDirectory) Then sProfilesDi" in Source: sample.bin, "WARE\Microsoft\Office\" & OVERSION & "\Common\InstallRoot", "Path", sOInstallRoot, "REG_SZ") Then sOInstallRoot = sProgramFiles & "\Microsoft Office\" & OREF End If 'Ensure integrity of WI metadata which could fail used APIs otherwise EnsureValidWIMetadata HKCU, "Software\Classes\Installer\Products", COMPRESSED EnsureValidWIMetadata HKCR, "Installer\Products", COMPRESSED EnsureValidWIMetadata HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products", COMPRESSED EnsureValidWIMetadata HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components", COMPRESSED EnsureValidWIMetadata HKCR, "Installer\Components", COMPRESSED 'Add initial known .exe files that might need to be closed dicApps.Add "communicator.exe", "communicator.exe" 'Adding setup.exe to the hard list of processes that are shut down will potentially break wrappers that invoke OffScrub 'dicApps.Add "setup.exe", "setup.exe" Select Case OVERSIONMAJOR Case "12" Case "14" " in Source: sample.bin, "M, "SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 1 (GFS Unread Stub)\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2 (GFS Stub)\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 3 (GFS Folder)\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 4 (GFS Unread Mark)\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Object" in Source: sample.bin, " RegDeleteKey hDefKey, sSubKeyName & Item & "\" End If End If 'Right(Item,PRODLEN)=OFFICEID End If 'Len(Item)>37 Next 'Item If iLoopCnt < 3 Then If RegEnumValues(hDefKey,sSubKeyName,arrNames,arrTypes) Then i = 0 For Each Name in arrNames If RegReadValue(hDefKey,sSubKeyName,Name,sValue,arrTypes(i)) Then If sValue = sGuid Then RegDeleteValue hDefKey, sSubKeyName, Name, False End If i = i + 1 Next End If End If End If If NOT RegEnumKey(hDefKey,sSubKeyName,arrKeys) Then RegDeleteKey hDefKey,"Software\Microsoft\OfficeCustomizeWizard\11.0\" If NOT RegEnumKey(hDefKey,"Software\Microsoft\OfficeCustomi" in Source: sample.bin, "LFILE = "ScrubRetValFile.txt" Const OVERSION = "11.0" Const OVERSIONMAJOR = "11" Const OREF = "Office11" Const OREGREF = "" Const ONAME = "Office 2003" Const OPACKAGE = "" Const OFFICEID = "6000-11D3-8CFE-0150048383C9}" Const HKCR = &H80000000 Const HKCU = &H80000001 Const HKLM = &H80000002 Const HKU = &H80000003 Const FOR_WRITING = 2 Const PRODLEN = 28 Const COMPPERMANENT = "00000000000000000000000000000000" Const UNCOMPRESSED = 38 Const SQUISHED = 20 Const COMPRESSED = 32 Const REG_ARP = "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" Const VB_YES = 6 Const MSIOPENDATABASEREADONLY = 0 Const ERROR_SUCCESS = 0 'Bit #1. 0 indicates Success. Script completed successfully Const ERROR_FAIL = 1 'Bit #1. Failure bit. Indicates an overall script failure. 'RESERVED bit! Returned when process is kil" in Source: sample.bin, "G_SZ") Then LogOnly "Found key HKLM\" & sTLVerKey & "\0\Win64\" 'get the safe filepath sFilePath = Left(sValue, InstrRev(sValue, ".") + 3) LogOnly "Found filepath: " & sValue & " - using filepath: " & sFilePath If oFso.FileExists(sFilePath) Then fCanDelete = False fClearTL = False LogOnly "File target still in use. TypeLib registration will persisted." Else fClearTL = fCanDelete LogOnly "File target not found. Flagging for delete" End If End If If RegReadValue(HKLM, sTLVerKey & "\9\Win64\", "", sValue, "REG_SZ") Then LogOnly "Found key HKLM\" & sTLVerKey & "\9\Win64\" 'get the safe filepath " in Source: sample.bin, "ion\Shell Extensions\Approved\","{3D60EDA7-9AB4-4DA8-864C-D9B5F2E7281D}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{387E725D-DC16-4D76-B310-2C93ED4752A0}", False RegDeleteKey HKLM,"SOFTWARE\Classes\*\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Over" in Source: sample.bin, "Bypass_Stage3 : fBypass_Stage3 = False 'Msiexec Dim fBypass_Stage4 : fBypass_Stage4 = False 'CleanUp 'Create required objects Set oWmiLocal = GetObject("winmgmts:{(Debug)}\\.\root\cimv2") Set oWShell = CreateObject("Wscript.Shell") Set oShellApp = CreateObject("Shell.Application") Set oFso = CreateObject("Scripting.FileSystemObject") Set oMsi = CreateObject("WindowsInstaller.Installer") Set oReg = GetObject("winmgmts:\\.\root\default:StdRegProv") LogY "stage0" 'Get environment path info sAppData = oWShell.ExpandEnvironmentStrings("%appdata%") sLocalAppData = oWShell.ExpandEnvironmentStrings("%localappdata%") sTemp = oWShell.ExpandEnvironmentStrings("%temp%") sAllUsersProfile = oWShell.ExpandEnvironmentStrings("%allusersprofile%") RegReadValue HKLM, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList", "ProfilesDirectory", sProfilesDirectory, "REG_EXPAND_SZ" If NOT oFso.FolderExists(sProfilesDirectory) Then sProf" in Source: sample.bin, "------------------------------------------ Sub DetectOfficeBitness () Dim sOPlatform, sInstallRootPath fO64 = False If Not f64 Then Exit Sub If RegReadStringValue(HKLM, "SOFTWARE\Microsoft\Office\ClickToRun\Configuration", "platform", sOPlatform) Then fO64 = (sOPlatform = "x64") Exit Sub End If If RegReadStringValue(HKLM, "SOFTWARE\Microsoft\Office\15.0\ClickToRun\Configuration", "platform", sOPlatform) Then fO64 = (sOPlatform = "x64") Exit Sub End If If RegReadStringValue(HKLM, "SOFTWARE\Microsoft\Office\ClickToRun\propertyBag", "Platform", sOPlatform) Then fO64 = (sOPlatform = "x64") Exit Sub End If If RegReadStringValue(HKLM, "SOFTWARE\Microsoft\Office\15.0\ClickToRun\propertyBag", "Platform", sOPlatform) Then fO64 = (sOPlatform = "x64") Exit Sub End If If RegReadStringValue(HKLM, "SOFTWARE\Wow6432Node\Microsoft\Office\Common\InstallRoot", "Path", sInstallRootPath) Then 'fO64 = Not (InStr(sInstallRootPath, "(x86)") > 0) fO64 = False Exit Sub End" in Source: sample.bin, "\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Microsoft SPFS Icon Overlay 1 (ErrorConflict)" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Microsoft SPFS Icon Overlay 2 (SyncInProgress)" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Microsoft SPFS Icon Overlay 3 (InSync)" RegDeleteKey HKLM, "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Microsoft SPFS Icon Overlay 1 (ErrorConflict)" RegDeleteKey HKLM, "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Microsoft SPFS Icon Overlay 2 (SyncInProgress)" RegDeleteKey HKLM, "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Microsoft SPFS Icon Overlay 3 (InSync)" ' Shell extensions RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{B28AA736-876B-46DA-" in Source: sample.bin, "ipSD : fSkipSD = False 'Default to not Skip the Shortcut Detection Dim fTryReconcile : fTryReconcile = False Dim fx86Only : fx86Only = False Dim fx64Only : fx64Only = False 'Create required objects Set oWmiLocal = GetObject("winmgmts:{(Debug)}\\.\root\cimv2") Set oWShell = CreateObject("Wscript.Shell") Set oShellApp = CreateObject("Shell.Application") Set oFso = CreateObject("Scripting.FileSystemObject") Set oMsi = CreateObject("WindowsInstaller.Installer") Set oReg = GetObject("winmgmts:\\.\root\default:StdRegProv") 'Get environment path info sAppData = oWShell.ExpandEnvironmentStrings("%appdata%") sLocalAppData = oWShell.ExpandEnvironmentStrings("%localappdata%") sTemp = oWShell.ExpandEnvironmentStrings("%temp%") sAllUsersProfile = oWShell.ExpandEnvironmentStrings("%allusersprofile%") RegReadValue HKLM, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList", "ProfilesDirectory", sProfilesDirectory," in Source: sample.bin, " If RegReadValue(hDefKey,sSubKeyName,Name,sValue,arrTypes(i)) Then If sValue = sGuid Then RegDeleteValue hDefKey,sSubKeyName,Name, False End If i = i + 1 Next End If End If End If If NOT RegEnumKey(hDefKey,sSubKeyName,arrKeys) Then RegDeleteKey hDefKey,"Software\Microsoft\OfficeCustomizeWizard\11.0\" If NOT RegEnumKey(hDefKey,"Software\Microsoft\OfficeCustomizeWizard\11.0\",arrKeys) Then RegDeleteKey hDefKey,"Software\Microsoft\OfficeCustomizeWizard\" Next 'iLoopCnt Case "12" 'Add/Remove Programs RegWipeARP Case "14" 'Add/Remove Programs RegWipeARP Case Else End Select 'UpgradeCodes, WI config, WI global config For iLoopCnt = 1 to 5 Select Case iLoopCnt Case 1 LogH2 "HKLM UpgradeCodes" sSubKeyNa" in Source: sample.bin, " 'Delivery hDefKey = HKLM sSubKeyName = "SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\" If RegEnumKey(HKLM,sSubKeyName,arrKeys) Then For Each Item in arrKeys If InStr(UCase(Item)&"}",OFFICEID)>0 Then If NOT dicKeepLis.Exists(UCase(Item)) Then RegDeleteKey HKLM,sSubKeyName & Item & "\" ElseIf LCase(Item) = "microsoft.watson.alrtintl.data" OR _ LCase(Item) = "microsoft.watson.watsonrc.data" Then If NOT dicKeepLis.Count > 0 Then RegDeleteKey HKLM,sSubKeyName & Item & "\" End If Next 'Item End If 'RegEnumKey 'Registration hDefKey = HKLM sSubKeyName = "SOFTWARE\Microsoft\Office\"&OVERSION&"\Registration\" If RegEnumKey(HKLM,sSubKeyName,arrKeys) Then For Each Item in arrKeys If Len(Item)>37 Then If CheckDelete(UCase(Left(Item,38))) Then RegDeleteKey HKLM,sSubKeyName & Item & "\" End If " in Source: sample.bin, "B3A8-84C5E30BA492}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{8B02D659-EBBB-43D7-9BBA-52CF22C5B025}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{42042206-2D85-11D3-8CFF-005004838597}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{506F4668-F13E-4AA1-BB04-B43203AB3CC0}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{D66DC78C-4F61-447F-94" in Source: sample.bin, "\sftlist" RegDeleteKey HKLM, "SYSTEM\CurrentControlSet\Services\sftplay" RegDeleteKey HKLM, "SYSTEM\CurrentControlSet\Services\sftredir" RegDeleteKey HKLM, "SYSTEM\CurrentControlSet\Services\sftvol" RegDeleteKey HKLM, "SYSTEM\CurrentControlSet\Services\sftvsa" RegDeleteKey HKLM, "SYSTEM\CurrentControlSet\Services\sftfs" RegDeleteKey HKLM, "SOFTWARE\Microsoft\SoftGrid\4.5" RegDeleteKey HKCU, "Software\Microsoft\SoftGrid\4.5\Client\AppFS" RegDeleteKey HKCU, "Software\Microsoft\SoftGrid\4.5\Client\Applications" RegDeleteKey HKCU, "Software\Microsoft\SoftGrid\4.5\Client\FileExtensions" RegDeleteKey HKCU, "Software\Microsoft\SoftGrid\4.5\Client\FileTypes" RegDeleteKey HKCU, "Software\Microsoft\SoftGrid\4.5\Client\UserInfo" 'C2R places custom permissions on these regkeys which prevent them from getting deleted 'RegDeleteKey HKCU, "Software\Microsoft\SoftGrid\4.5\Client\Network" 'RegDeleteKey HKCU, "Software\Microsoft\SoftGrid\4.5\Client\Packages"" in Source: sample.bin, " If fIsPermanent AND NOT fForce Then fRemoveComponent = False CompVerbose.WriteLine " msidbComponentAttributesPermanent: " & NOT fRemoveComponent End If If fRemoveComponent Then CompVerbose.WriteLine " RESULT: Component IN SCOPE for removal" fIsFile = False : fIsFolder = False 'Component resources go away for this product Err.Clear 'Add the component registration key to ensure removal sCompReg = "Installer\Components\"&GetCompressedGuid(ComponentID)&"\" If NOT dicDelRegKey.Exists(sCompReg) Then dicDelRegKey.Add sCompReg, HKCR RegList.WriteLine HiveString(HKCR)&"\"&sCompReg End If sCompReg = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\"&GetCompressedGuid(ComponentID)&"\" If NOT dicDelRegKey.Exists(sCompReg) Then dicDelRegKey.Add sCompReg, HKLM " in Source: sample.bin, "0-C265-11D0-BCED-00A0C90AB50F};{C04E4E5E-89E6-43C0-92BD-D3F2C7FBA5C4};{C3D19104-7A67-4EB0-B459-D5B2E734D430};{C78F486B-F679-4af5-9166-4E4D7EA1CEFC};{CA973FCA-E9C3-4B24-B864-7218FC1DA7BA};{CBA4EBC4-0C04-468d-9F69-EF3FEED03236};{CBBC4772-C9A4-4FE8-B34B-5EFBD68F8E27};{CD2194AA-11BE-4EFD-97A6-74C39C6508FF};{E0B12BAE-FC67-446C-AAE8-4FA1F00153A7};{E985809A-84A6-4F35-86D6-9B52119AB9D7};{ECD5307E-4419-43CF-8BDA-C9946AC375CF};{EDCD5812-6A06-43C3-AFAC-46EF5D14E22C};{EDCD5812-6A06-43C3-AFAC-46EF5D14E22C};{EDCD5812-6A06-43C3-AFAC-46EF5D14E22C};{EDDCFF16-3AEE-4883-BD91-0F3978640DFB};{EE9CFA8C-F997-4221-BE2F-85A5F603218F};{F2A7EE29-8BF6-4a6d-83F1-098E366C709C};{F3685D71-1FC6-4CBD-B244-E60D8C89990B}" End Select arrTypeLibs = Split(sTypeLibs, ";") sTLKey = "Software\Classes\TypeLib\" 'iterate all known typelibs For Each tl in arrTypeLibs fClearTL = False sKey = sTLKey & tl If RegKeyExists(HKLM, sKey) Then 'enum subkeys LogOnly "Found registra" in Source: sample.bin, " CompVerbose.Write "CheckDelete: " & fRemoveComponent & "; " If fRemoveComponent Then iRemCnt = iRemCnt + 1 fAffectedComponent = True 'Since the scope remains within one Office family the keypath for the component 'is assumed to be identical If sCompClient = "" Then sCompClient = CompClient ' flag the CompClient entry for removal sCompReg = "Installer\Components\"&GetCompressedGuid(ComponentID)&"\"&GetCompressedGuid(CompClient) If NOT dicDelRegKey.Exists(sCompReg) Then dicDelRegKey.Add sCompReg,HKCR RegList.WriteLine HiveString(HKCR)&"\"&sCompReg End If sCompReg = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Com" in Source: sample.bin, ": "&iRetVal End If End Sub 'RegDeleteKeyEx '======================================================================================================= 'Return the alternate regkey location on 64bit environment Function Wow64Key(hDefKey, sSubKeyName) Dim iPos Select Case hDefKey Case HKCU If Left(sSubKeyName, 17) = "Software\Classes\" Then Wow64Key = Left(sSubKeyName, 17) & "Wow6432Node\" & Right(sSubKeyName, Len(sSubKeyName)-17) Else iPos = InStr(sSubKeyName, "\") Wow64Key = Left(sSubKeyName, iPos) & "Wow6432Node\" & Right(sSubKeyName, Len(sSubKeyName)-iPos) End If Case HKLM If Left(sSubKeyName, 17) = "Software\Classes\" Then Wow64Key = Left(sSubKeyName, 17) & "Wow6432Node\" & Right(sSubKeyName, Len(sSubKeyName)-17) Else iPos = InStr(sSubKeyName, "\") Wow64Key = Left(sSubKeyName, iPos) & "Wow6432No" in Source: sample.bin, "t RETVALFILE = "ScrubRetValFile.txt" Const OVERSION = "12.0" Const OVERSIONMAJOR = "12" Const OREF = "Office12" Const OREGREF = "" Const ONAME = "Office 2007" Const OPACKAGE = "PackageIds" Const OFFICEID = "000000FF1CE}" Const HKCR = &H80000000 Const HKCU = &H80000001 Const HKLM = &H80000002 Const HKU = &H80000003 Const FOR_WRITING = 2 Const PRODLEN = 12 Const COMPPERMANENT = "00000000000000000000000000000000" Const UNCOMPRESSED = 38 Const SQUISHED = 20 Const COMPRESSED = 32 Const REG_ARP = "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" Const VB_YES = 6 Const MSIOPENDATABASEREADONLY = 0 Const LYNC_ALL = "{4A2C120F-307B-4400-B239-F29ADB54D3C6}{5CFD6599-10E5-4CF0-B6E1-BF39D30A64F8}{5CFD6599-10E5-4CF0-B6E1-BF39D30A64F8}{BF3AC8BA-1A0F-42AD-8B65-4250617AF682}{3475BF22-3564-4EF3-A633-C5F3F4582392}{263BA91B-7782-4EEB-A4FC-7BD554CAF1F3}{AA256AE1-6B6A-48E6-9957-B38F92CA614B}{D79" in Source: sample.bin, "g "Check download success. " & sLocalPath & " exists: " & oFso.FileExists(sLocalPath) HttpDownloadFile = oFso.FileExists(sLocalPath) End Function 'HttpDownloadFile '------------------------------------------------------------------------------- ' UninstallOfficeC2R ' ' Uninstall all of Office C2R through ODT '------------------------------------------------------------------------------- Sub UninstallOfficeC2R () Dim sCmd, sReturn, sODTFullPath, sKey, sFolder, sUrl, sLeft, sRight Dim iVerODT Dim fCanUseOdtUninstall On Error Resume Next fCanUseOdtUninstall = False sODTFullPath = "" iVerODT = 0 If RegValExists(HKLM, "SOFTWARE\Microsoft\Office\15.0\ClickToRun\ProductReleaseIDs\Active\culture", "x-none") Then iVerODT = 15 If RegValExists(HKLM, "SOFTWARE\Microsoft\Office\ClickToRun\ProductReleaseIDs\Active\culture", "x-none") Or _ RegValExists(HKLM, "SOFTWARE\Microsoft\Office\ClickToRun\ProductReleaseIDs", "ActiveConfiguration") Then iVerODT = 16 " in Source: sample.bin, " End If 'Len(Item)=32 Next 'Item End If 'RegEnumKey Next 'iLoopCnt 'Components Log " - Global Components" sSubKeyName = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\" If RegEnumKey(HKLM, sSubKeyName, arrKeys) Then For Each Item in arrKeys 'Ensure we have the expected length for a compressed GUID If Len(Item)=32 Then If RegEnumValues(HKLM, sSubKeyName & Item, arrNames, arrTypes) Then If IsArray(arrNames) Then For Each Name in arrNames If Len(Name)=32 Then sGuid = GetExpandedGuid(Name) If CheckDelete(sGuid) Then RegDeleteValue HKLM, sSubKeyName & Item & "\", Name, False 'Check if the key is now empty If NOT RegEn" in Source: sample.bin, "E\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{506F4668-F13E-4AA1-BB04-B43203AB3CC0}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{D66DC78C-4F61-447F-942B-3FB6980118CF}", False RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\" 'Groove Extensions RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\", "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{99FD978C-D287-4F50-827F-B2C658EDA8E7}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{920E6D" in Source: sample.bin, "4E5E-89E6-43C0-92BD-D3F2C7FBA5C4};{C3D19104-7A67-4EB0-B459-D5B2E734D430};{C78F486B-F679-4af5-9166-4E4D7EA1CEFC};{CA973FCA-E9C3-4B24-B864-7218FC1DA7BA};{CBA4EBC4-0C04-468d-9F69-EF3FEED03236};{CBBC4772-C9A4-4FE8-B34B-5EFBD68F8E27};{CD2194AA-11BE-4EFD-97A6-74C39C6508FF};{E0B12BAE-FC67-446C-AAE8-4FA1F00153A7};{E985809A-84A6-4F35-86D6-9B52119AB9D7};{ECD5307E-4419-43CF-8BDA-C9946AC375CF};{EDCD5812-6A06-43C3-AFAC-46EF5D14E22C};{EDCD5812-6A06-43C3-AFAC-46EF5D14E22C};{EDCD5812-6A06-43C3-AFAC-46EF5D14E22C};{EDDCFF16-3AEE-4883-BD91-0F3978640DFB};{EE9CFA8C-F997-4221-BE2F-85A5F603218F};{F2A7EE29-8BF6-4a6d-83F1-098E366C709C};{F3685D71-1FC6-4CBD-B244-E60D8C89990B}" arrTypeLibs = Split(sTypeLibs, ";") sTLKey = "Software\Classes\TypeLib\" 'iterate all known typelibs For Each tl in arrTypeLibs fClearTL = False sKey = sTLKey & tl If RegKeyExists(HKLM, sKey) Then 'enum subkeys LogOnly "Found registration for typelib " & tl If RegEnumKey(HKLM," in Source: sample.bin, "ILE = "ScrubRetValFile.txt" Const OVERSION = "14.0" Const OVERSIONMAJOR = "14" Const OREF = "Office14" Const OREGREF = "OFFICE14." Const ONAME = "Office 2010" Const OPACKAGE = "PackageRefs" Const OFFICEID = "000000FF1CE}" Const HKCR = &H80000000 Const HKCU = &H80000001 Const HKLM = &H80000002 Const HKU = &H80000003 Const FOR_WRITING = 2 Const PRODLEN = 12 Const COMPPERMANENT = "00000000000000000000000000000000" Const UNCOMPRESSED = 38 Const SQUISHED = 20 Const COMPRESSED = 32 Const REG_ARP = "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" Const VB_YES = 6 Const MSIOPENDATABASEREADONLY = 0 Const LYNC_ALL = "{4A2C120F-307B-4400-B239-F29ADB54D3C6}{5CFD6599-10E5-4CF0-B6E1-BF39D30A64F8}{5CFD6599-10E5-4CF0-B6E1-BF39D30A64F8}{BF3AC8BA-1A0F-42AD-8B65-4250617AF682}{3475BF22-3564-4EF3-A633-C5F3F4582392}{263BA91B-7782-4EEB-A4FC-7BD554CAF1F3}{AA256AE1-6B6A-48E6-9957-B38F92CA614B}{D7" in Source: sample.bin, "esume Next DeleteService "ose" 'Delete the folder DeleteFolder sCommonProgramFiles & "\Microsoft Shared\Source Engine" 'Delete the registration RegDeleteKey HKLM,"SYSTEM\CurrentControlSet\Services\ose\" End Sub 'RemoveOSE '======================================================================================================= 'Identify which parts of the LIS (MSOCache) will not be removed Sub CheckLIS Dim Prod Dim sDownloadCode If NOT dicKeepProd.Count > 0 Then Exit Sub 'Loop all products that remain installed For Each Prod in dicKeepProd.Keys If RegReadValue(HKLM,"SOFTWARE\Microsoft\Office\11.0\Delivery\"&Prod,"DownloadCode",sDownloadCode,"REG_SZ") Then If dicKeepLis.Exists(UCase(sDownloadCode)) Then dicKeepLis.Item(sDownloadCode) = dicKeepLis.Item(sDownloadCode)&","&UCase(Prod) Else dicKeepLis.Add UCase(sDownloadCode),UCase(Prod) End If End If Next" in Source: sample.bin, "ackages, fDisplayVersion Dim arrKeys, arrNames, arrTypes, arrMultiSzValues, arrMultiSzNewValues Dim arrTestNames, arrTestTypes Dim i, iLoopCnt, iPos Dim fDelReg 'Wipe registry data 'LogH1 "Registry CleanUp" 'Wipe registry data 'User Profile settings LogH2 "User Policies" RegDeleteKey HKCU, "Software\Policies\Microsoft\Office\" & OVERSION & "\" If NOT fKeepUser Then RegDeleteKey HKCU, "Software\Microsoft\Office\" & OVERSION & "\" LogH2 "User Settings" End If 'fKeepUser 'Computer specific settings If fClearAddinReg Then RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\Outlook\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\Word\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\Excel\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\PowerPoint\" End If If (fRemoveAll AND NOT fC2rInstalled) OR (fRemoveAll AND fForce) Then LogH2 "Machine Settings" " in Source: sample.bin28:T849,Found string "eam.Type = 1 'adTypeBinary oStream.Open oStream.LoadFromFile(strFileName) ' Default encoding is ascii strEncoding = "ascii" strData = BinaryToString(oStream.Read(2)) ' Check for little endian (x86) unicode preamble If (Len(strData) = 2) and strData = (Chr(255) + Chr(254)) Then strEncoding = "unicode" Else oStream.Position = 0 strData = BinaryToString(oStream.Read(3)) ' Check for utf-8 preamble If (Len(strData) >= 3) and strData = (Chr(239) + Chr(187) + Chr(191)) Then strEncoding = "utf-8" End If End If oStream.Close GetFileEncoding = strEncoding End Function '//////////////////////////////////////////////////////////////////////////////////////// '//////////////////////////////////////////////////////////////////////////////////////// ' Converts binary data (VT_UI1 | VT_ARRAY) to a string (BSTR) Function BinaryToString(dataBinary) Dim i Dim str Fo" (Indicator: ".loadfromfile("; Source: "sample.bin"), Found string "r i = 1 To LenB(dataBinary) str = str & Chr(AscB(MidB(dataBinary, i, 1))) Next BinaryToString = str End Function '//////////////////////////////////////////////////////////////////////////////////////// '//////////////////////////////////////////////////////////////////////////////////////// ' Returns string containing the whole text file data. ' Supports ascii, unicode (little-endian) and utf-8 encoding. Function ReadAllTextFile(strFileName) Dim strData Set oStream = CreateObject("ADODB.Stream") oStream.Type = 2 'adTypeText oStream.Open oStream.Charset = GetFileEncoding(strFileName) oStream.LoadFromFile(strFileName) strData = oStream.ReadText(-1) 'adReadAll oStream.Close ReadAllTextFile = strData End Function '//////////////////////////////////////////////////////////////////////////////////////// '//////////////////////////////////////////////////////////////////////////////////////// Function sppErrHandle(strCo" (Indicator: ".loadfromfile("; Source: "sample.bin")29:T6723,"re Name like 'officevirt%.exe'") For Each Process in Processes If dicApps.Exists(LCase(Process.Name)) Then Log " - End process " & Process.Name iRet = Process.Terminate() CheckError "CloseOfficeApps: " & "Process.Name" fWait = True End If Next 'Process Set Processes = oWmiLocal.ExecQuery("Select * From Win32_Process") For Each Process in Processes If dicApps.Exists(LCase(Process.Name)) Then Log " - End process " & Process.Name iRet = Process.Terminate() CheckError "CloseOfficeApps: " & "Process.Name" If Process.Name = "CVH.EXE" Then fWait = True Else For Each prop in Process.Properties_ If prop.Name = "ExecutablePath" Then If InStr(UCase(prop.Value), UCase(sOInstallRoot)) > 0 Then Log " - End process '" & Process.Name iRet = Process.Terminate() " (Indicator: " win32_process"; Source: "sample.bin"), "p to automatic. " & MSG_ISCMD_ELEVATED) quitExit() End If Else Set colListOfServices = objWMI.ExecQuery _ ("Select * from Win32_Service ") For Each objService in colListOfServices If LCase(objService.Name) = "osppsvc" Then Select Case LCase(objService.State) Case "running" objService.StopService() WScript.Sleep(15000) objService.StartService() WScript.Sleep(15000) Case Else objService.StartService() WScript.Sleep(15000) End Select Exit For End If Next Set objService = Nothing Set colListOfServices = Nothing Set colListOfServices = objWMI.ExecQuery _ ("Select * from Win32_Service ") For Each objService in colListOfServices If LCase(objService.Name) = "osppsvc" Then If LCase(objService.State) = "" (Indicator: " win32_service"; Source: "sample.bin"), "ocess in Processes If fEndCurrentInstalls Then Log " - End process " & Process.Name iRet = Process.Terminate() CheckError "EndCurrentInstalls: " & Process.Name Else Log " - Skip termination of process: " & Process.Name End If Next 'Process StopService "msiserver" End Sub 'EndCurrentInstalls '======================================================================================================= 'Uses WMI to stop a service Function StopService(sService) Dim Services, Service Dim sQuery Dim iRet On Error Resume Next iRet = 0 sQuery = "Select * From Win32_Service Where Name='" & sService & "'" Set Services = oWmiLocal.Execquery(sQuery) 'Stop the service For Each Service in Services If UCase(Service.State) = "STARTED" Then iRet = Service.StopService If UCase(Service.State) = "RUNNING" Then iRet = Service.StopService Next 'Service StopServi" (Indicator: " win32_service"; Source: "sample.bin"), "en ClearIdentityCache If fSignOutOfWAM Then InvokeSignOutOfWAM LogH2 "Cleanup end" ' END '------------------------------------------------------------------------------- ' Initialize ' ' Initialize script settings '------------------------------------------------------------------------------- Sub Initialize Dim ComputerItem, Item Dim sOsVersion 'Check if we're running as 32 bit process on a 64 bit OS If InStr(LCase(wscript.path), "syswow64") > 0 Then RelaunchAs64Host Set oWmiLocal = GetObject("winmgmts:\\.\root\cimv2") Set oReg = GetObject("winmgmts:\\.\root\default:StdRegProv") Set oFso = CreateObject("Scripting.FileSystemObject") sTemp = oWShell.ExpandEnvironmentStrings("%TEMP%") fCScript = (UCase(Mid(Wscript.FullName, Len(Wscript.Path) + 2, 1)) = "C") ' get Win32_OperatingSystem details '---------------------------------- Set ComputerItem = oWmiLocal.ExecQuery("Select * from Win32_OperatingSystem") For Each Item " (Indicator: " win32_operatingsystem"; Source: "sample.bin"), "s to remove:" SkuLog.WriteLine "===============" For Each SkuKey in dicRemoveSku.Keys SkuLog.WriteLine " - " & SkuKey Next 'Key SkuLog.WriteLine vbCrLf & "Products to remove:" SkuLog.WriteLine "===================" For Each p in oMsi.Products If CheckDeleteEx(p) Then SkuLog.Write " - " & p & " - " SkuLog.Write oMsi.ProductInfo(p, "ProductName") SkuLog.WriteLine " " End If 'InScope Next 'Product SkuLog.Close Set SkuLog = Nothing End Sub 'LogSkuResults '======================================================================================================= 'End all running instances of applications that will be removed Sub CloseOfficeApps Dim Processes, Process, prop Dim fWait Dim iRet On Error Resume Next fWait = False Log " Doing Action: CloseOfficeApps" Set Processes = oWmiLocal.ExecQuery("Select * From Win32_Process") " (Indicator: " win32_process"; Source: "sample.bin"), "ile, scFiles, oFile, Folder, SubFolder, Processes, Process, item Dim sFile, sFolder, sPath, sConfigName, sContents, sProductCode, sLocalDrives,sScQuery Dim sValue, sScRoots Dim arrSubfolders, arrShortCutRoots Dim fKeepFolder, fDeleteSC Dim iRet,iCnt,iPos LogH2 "Individual files" If IsArray(arrDeleteFiles) Then If fForce OR fQuiet Then Log " Doing Action: StopOSE" iRet = StopService("ose") Set Processes = oWmiLocal.ExecQuery("Select * From Win32_Process Where Name like 'ose%.exe'") For Each Process in Processes LogOnly " - Running process : " & Process.Name Log " -> Ending process: " & Process.Name iRet = Process.Terminate() Next 'Process LogOnly " End Action: StopOSE" CloseOfficeApps End If 'Wipe individual files detected earlier LogH2 "Remove left behind files" For Each sFile in arrDe" (Indicator: " win32_process"; Source: "sample.bin"), "de\" & Right(sSubKeyName, Len(sSubKeyName)-iPos) End If Case Else Wow64Key = "Wow6432Node\" & sSubKeyName End Select 'hDefKey End Function 'Wow64Key '======================================================================================================= 'Remove duplicate entries from a one dimensional array Function RemoveDuplicates(Array) Dim Item Dim oDic Set oDic = CreateObject("Scripting.Dictionary") For Each Item in Array If Not oDic.Exists(Item) Then oDic.Add Item, Item Next 'Item RemoveDuplicates = oDic.Keys End Function 'RemoveDuplicates '======================================================================================================= 'End running instances of setup Sub EndCurrentInstalls () Dim Processes, Process Dim iRet Set Processes = oWmiLocal.ExecQuery("Select * From Win32_Process Where Name like '%setup%' OR Name like '%install%'") For Each Process in " (Indicator: " win32_process"; Source: "sample.bin"), "sume Next iParentProcessId = GetObject("winmgmts:root\cimv2").Get("Win32_Process.Handle='" & oWShell.Exec("cscript.exe").ProcessId & "'").ParentProcessId On Error Goto 0 If iParentProcessId > 0 Then ' succeeded to obtain the process id GetMyProcessId = iParentProcessId Exit Function End If ' failed to obtain the id from the creation of a new instance ' get it from enum of Win32_Process Dim Process, Processes Err.Clear Set Processes = oWmiLocal.ExecQuery("Select * From Win32_Process WHERE Name='cscript.exe' AND CommandLine like '%" & SCRIPTNAME & "%'") For Each Process in Processes iParentProcessId = Process.ProcessId Exit For Next GetMyProcessId = iParentProcessId End Function 'GetMyProcessId '------------------------------------------------------------------------------- ' Delimiter ' ' Returns the delimiter for a passed in string '------------------------------------------------------------" (Indicator: " win32_process"; Source: "sample.bin"), " Dim sWqlFolder Dim iRet sWqlFolder = Replace(sFolder, "\", "\\") Set Folders = oWmiLocal.ExecQuery ("Select * from Win32_Directory where name = '" & sWqlFolder & "'") For Each Folder in Folders iRet = Folder.Delete Next 'Folder LogOnly " Delete (wmi) for folder " & sFolder & " returned: " & iRet End Sub '------------------------------------------------------------------------------- ' Wow64Folder ' ' Returns the WOW folder structure to handle folder-path operations on ' 64 bit environments '------------------------------------------------------------------------------- Function Wow64Folder(sFolder) If LCase(Left(sFolder, Len(sWinDir & "\System32"))) = LCase(sWinDir & "\System32") Then Wow64Folder = sWinDir & "\syswow64" & Right(sFolder, Len(sFolder) - Len(sWinDir & "\System32")) ElseIf LCase(Left(sFolder, Len(sProgramFiles))) = LCase(sProgramFiles) Then Wow64Folder = sProgramFilesX86 & Right(sFolder, Len(sFolder) - " (Indicator: " win32_directory"; Source: "sample.bin"), " Each Process in Processes iSpawnedProcessId = Process.ProcessId Exit For Next 'Process ' monitor the tasklist to detect the end of the spawned process While oWmiLocal.ExecQuery("Select * From Win32_Process WHERE ProcessId='" & iSpawnedProcessId & "'").Count > 0 WScript.Sleep 3000 Wend ' get the return value from the file Wscript.Quit GetRetValFromFile End If ' elevation failed (user declined) SetError ERROR_ELEVATION_USERDECLINED End Sub 'RelaunchElevated '------------------------------------------------------------------------------- ' GetMyProcessId ' ' Returns the process id of the own process '------------------------------------------------------------------------------- Function GetMyProcessId() Dim iParentProcessId iParentProcessId = 0 ' try to obtain from creating a new cscript instance On Error Resume Next iParentProcessId = GetObject("winmgmts:root\cimv2").Get("Win" (Indicator: " win32_process"; Source: "sample.bin"), " For Each item In ComputerItem f64 = Instr(Left(item.SystemType, 3), "64") > 0 Next End Sub 'DetectOSBitness '------------------------------------------------------------------------------- ' GetVersionNT ' ' Calculate the VerionNT number as integer '------------------------------------------------------------------------------- Function GetVersionNT () Dim sOsVersion Dim arrVersion Dim qOS Dim oOsItem Set qOS = oWmiLocal.ExecQuery( "Select * from Win32_OperatingSystem") For Each oOsItem in qOS sOsVersion = oOsItem.Version Next arrVersion = Split( sOsVersion, GetDelimiter( sOsVersion)) GetVersionNT = CInt( arrVersion( 0)) * 100 + CInt( arrVersion( 1)) End Function '------------------------------------------------------------------------------- ' GetDelimiter ' ' Returns the delimiter in a version string '------------------------------------------------------------------------------- Function GetDelimiter (sV" (Indicator: " win32_operatingsystem"; Source: "sample.bin"), "SE service" Set OseService = oWmiLocal.Execquery("Select * From Win32_Service Where Name like 'ose%'") For Each srvc in OseService If (srvc.StartMode = "Disabled") AND (Not srvc.ChangeStartMode("Manual") = 0) Then _ Log "Conflict detected: OSE service is disabled" If (Not srvc.StartName = "LocalSystem") AND (srvc.Change( , , , , , , "LocalSystem", "")) Then _ Log "Conflict detected: OSE service not running as LocalSystem" Next 'srvc If NOT dicC2RSuite.Count > 0 Then Log "No uninstallable C2R items registered in Uninstall" End If ' call odt based uninstall UninstallOfficeC2R ' remove the published component registration for C2R packages LogH2 "Remove published component registration for C2R packages" ' delete the manifest files For i = 1 To 4 Select Case i Case 1 RegReadValue HKLM, "SOFTWARE\Microsoft\Office\15.0\ClickToRun", "PackageFolder", sPkgFld, "REG_SZ" RegReadValu" (Indicator: " win32_service"; Source: "sample.bin"), "rEventCode,strSource,strMachine) Call Log( MSG_SEARCHFOR & strMessage & "<<<<< Log: " & strLog & " Source: " & strSource & " Event: " & strEventCode & " >>>>>" ) Call Log( MSG_SEPERATE) Set objEvents = objWMI.ExecQuery _ ("Select * from Win32_NTLogEvent Where Logfile = '" & strLog & "'" & " and "_ & "EventCode = '" & strEventCode & "'" & " and SourceName = '" & strSource & "'") If objEvents.Count > 0 Then Call Log( MSG_SEPERATESMALL) For each objEvent in objEvents dtmEventDate = objEvent.TimeWritten strTimeWritten = WMIDateStringToDate(dtmEventDate) Call Log( "Coordinated Universal Time Written: " & strTimeWritten) Call Log( objEvent.Message) Call Log( MSG_SEPERATESMALL) Next Call Log( MSG_SEPERATE) Else Call Log( MSG_NOEVENTS) Call Log( MSG_SEPERATE) End If Set objEvents = Nothing End Function '//////////////////////////////////////////////////////////////////////////////////////" (Indicator: " win32_ntlogevent"; Source: "sample.bin"), " needed Sub RestoreExplorer Dim Processes, Result, oAT, DateTime, JobID Dim sCmd 'Non critical routine. Don't fail on error On Error Resume Next wscript.sleep 1000 Set Processes = oWmiLocal.ExecQuery("Select * From Win32_Process Where Name='explorer.exe'") If Processes.Count < 1 Then oWShell.Run "explorer.exe" 'To handle this in case of System context, schedule and run as interactive task If iVersionNT > 502 Then 'Vista and later oWShell.Run "SCHTASKS /Create /TN OffScrEx /TR explorer /SC ONCE /ST 12:00 /IT",0,True oWShell.Run "SCHTASKS /Run /TN OffScrEx", 0, True oWShell.Run "SCHTASKS /Delete /TN OffScrEx /F", 0, False Else Set oAT = oWmiLocal.Get("Win32_ScheduledJob") Set DateTime = CreateObject("WbemScripting.SWbemDateTime") DateTime.SetVarDate DateAdd("n",1,Now),True Result = oAT.Create("explorer.exe", DateTime.Value, , , , T" (Indicator: " win32_process"; Source: "sample.bin"), "\cimv2").Get("Win32_Process.Handle='" & oWShell.Exec("cscript.exe").ProcessId & "'").ParentProcessId On Error Goto 0 If iParentProcessId > 0 Then ' succeeded to obtain the process id GetMyProcessId = iParentProcessId Exit Function End If ' failed to obtain the id from the creation of a new instance ' get it from enum of Win32_Process Dim Process, Processes Err.Clear Set Processes = oWmiLocal.ExecQuery("Select * From Win32_Process WHERE Name='cscript.exe' AND CommandLine like '%" & SCRIPTNAME & "%'") For Each Process in Processes iParentProcessId = Process.ProcessId Exit For Next GetMyProcessId = iParentProcessId End Function 'GetMyProcessId '------------------------------------------------------------------------------- ' SetError ' ' Set error bit(s) '------------------------------------------------------------------------------- Sub SetError(ErrorBit) iError = iError OR ErrorBit Se" (Indicator: " win32_process"; Source: "sample.bin"), "ce = (iRet = 0) End Function 'StopService '======================================================================================================= 'Delete a service Sub DeleteService(sService) Dim Services, Service, Processes, Process Dim sQuery, sStates Dim iRet On Error Resume Next sStates = "STARTED;RUNNING" sQuery = "Select * From Win32_Service Where Name='" & sService & "'" Set Services = oWmiLocal.Execquery(sQuery) 'Stop and delete the service For Each Service in Services Log " Found service " & sService & " in state " & Service.State If InStr(sStates,UCase(Service.State))>0 Then iRet = Service.StopService() 'Ensure no more instances of the service are running Set Processes = oWmiLocal.ExecQuery("Select * From Win32_Process Where Name='" & sService & ".exe'") For Each Process in Processes iRet = Process.Terminate() Next 'Process If Not fDetectOnly Then " (Indicator: " win32_service"; Source: "sample.bin"), "nmentStrings("%windir%") sWICacheDir = sWinDir & "\" & "Installer" sScrubDir = sTemp & "\" & SCRIPTNAME sNotepad = sWinDir & "\notepad.exe" ' Get current script host fCScript = UCase(Mid(Wscript.FullName, Len(Wscript.Path) + 2, 1)) = "C" 'Detect if we're running on a 64 bit OS Set ComputerItem = oWmiLocal.ExecQuery("Select * from Win32_ComputerSystem") For Each Item In ComputerItem f64 = Instr(Left(Item.SystemType,3),"64") > 0 If f64 Then Exit For Next If f64 Then sProgramFilesX86 = oWShell.ExpandEnvironmentStrings("%programfiles(x86)%") If f64 Then sCommonProgramFilesX86 = oWShell.ExpandEnvironmentStrings("%CommonProgramFiles(x86)%") 'Get OS details and VersionNT Set ComputerItem = oWmiLocal.ExecQuery("Select * from Win32_OperatingSystem") For Each Item in ComputerItem sOSinfo = sOSinfo & Item.Caption sOSinfo = sOSinfo & Item.OtherTypeDescription sOSinfo = sOSinfo & ", " & "SP " & Item.ServicePackMajorVersion sOSinfo = sOSinfo &" (Indicator: " win32_computersystem"; Source: "sample.bin"), " 'Check if KMS key installed. If yes retrieve the SKUID value. ExecuteQuery "ID, ApplicationId, Description, Name","ApplicationId = '" & OfficeAppId & "' " & "AND PartialProductKey <> NULL ",productClass For each instance in productinstances sppErrHandle "" intIsKms = InStr(UCase(instance.Description),"KMS") If intIsKms <> 0 Then strSkuId = instance.ID Exit For End If Next If strSkuId = Null Then Call Log( MSG_CMID & MSG_CMID_NOTFOUND) quitExit() End If 'Return the last Office KMS event containing containing the SKUID value for the installed KMS key. '& retrieve the CMID value from the event. oKmsEventCounter = 0 eventCode = "12288" Set objEvents = objWMI.ExecQuery _ ("Select * from Win32_NTLogEvent Where Logfile = 'Application' and " _ & "EventCode = '" & e" (Indicator: " win32_ntlogevent"; Source: "sample.bin"), " For Each Argument in Wscript.Arguments Select Case UCase(Argument) Case "/Q", "/QUIET" 'Don't try to relaunch in quiet mode Exit Sub SetError ERROR_ELEVATION_FAILED Case "UAC" 'Already tried elevated relaunch SetError ERROR_ELEVATION_FAILED Exit Sub Case Else sCmdLine = sCmdLine & " " & chr(34) & Argument & chr(34) End Select Next 'Argument End If ' prep work to get the return value from the elevated process iParentProcessId = GetMyProcessId ' launch the elevated instance oShell.ShellExecute "cscript.exe", sCmdLine & " /NoElevate UAC", "", "runas", 1 ' get the process id of the spawned instance WScript.Sleep 500 Set Processes = oWmiLocal.ExecQuery("Select * From Win32_Process WHERE ParentProcessId='" & iParentProcessId & "'") If Processes.Count > 0 Then For" (Indicator: " win32_process"; Source: "sample.bin"), "id GetMyProcessId = iParentProcessId Exit Function End If ' failed to obtain the id from the creation of a new instance ' get it from enum of Win32_Process Dim Process, Processes Err.Clear Set Processes = oWmiLocal.ExecQuery("Select * From Win32_Process WHERE Name='cscript.exe' AND CommandLine like '%" & SCRIPTNAME & "%'") For Each Process in Processes iParentProcessId = Process.ProcessId Exit For Next GetMyProcessId = iParentProcessId End Function 'GetMyProcessId '------------------------------------------------------------------------------- ' SetError ' ' Set error bit(s) '------------------------------------------------------------------------------- Sub SetError(ErrorBit) iError = iError OR ErrorBit Select Case ErrorBit Case ERROR_DCAF_FAILURE, ERROR_STAGE2, ERROR_ELEVATION_USERDECLINED, ERROR_ELEVATION, ERROR_SCRIPTINIT iError = iError OR ERROR_FAIL End Select End Sub '----" (Indicator: " win32_process"; Source: "sample.bin"), "p%' OR Name like '%install%'") For Each Process in Processes If fEndCurrentInstalls Then Log " - End process " & Process.Name iRet = Process.Terminate() CheckError "EndCurrentInstalls: " & Process.Name Else Log " - Skip termination of process: " & Process.Name End If Next 'Process StopService "msiserver" End Sub 'EndCurrentInstalls '======================================================================================================= 'Uses WMI to stop a service Function StopService(sService) Dim Services, Service Dim sQuery Dim iRet On Error Resume Next iRet = 0 sQuery = "Select * From Win32_Service Where Name='" & sService & "'" Set Services = oWmiLocal.Execquery(sQuery) 'Stop the service For Each Service in Services If UCase(Service.State) = "STARTED" Then iRet = Service.StopService If UCase(Service.State) = "RUNNING" Then iRet = Service." (Indicator: " win32_service"; Source: "sample.bin"), "wscript.sleep 10000" CvhbsQuiet.WriteLine "Do" CvhbsQuiet.WriteLine "Set Processes = oWmiLocal.ExecQuery("&chr(34)&"Select * From Win32_Process Where Name='cvhbs.exe'"&chr(34)&")" CvhbsQuiet.WriteLine "iCnt = Processes.Count" CvhbsQuiet.WriteLine "If iCnt > 0 Then" CvhbsQuiet.WriteLine "sCommand = "&chr(34)&"tasklist /FI "&chr(34)&sQuote&chr(34)&"WINDOWTITLE eq click*"&chr(34)&sQuote&chr(34)&" /FO CSV /NH"&chr(34) CvhbsQuiet.WriteLine "Set oExec = oShell.Exec(sCommand)" CvhbsQuiet.WriteLine "sCmdOut = oExec.StdOut.ReadAll()" CvhbsQuiet.WriteLine "Do While oExec.Status = 0" CvhbsQuiet.WriteLine "WScript.Sleep 200" CvhbsQuiet.WriteLine "Loop" CvhbsQuiet.WriteLine "If InStr(sCmdOut,"&chr(34)&","&chr(34)&")>0 Then" CvhbsQuiet.WriteLine "sCmdOut = Replace(sCmdOut,chr(34),"&chr(34)&chr(34)&")" CvhbsQuiet.WriteLine "arrCol = Split(sCmdOut,"&chr(34)&","&chr(34)&")" CvhbsQuiet.WriteLine "sPi" (Indicator: " win32_process"; Source: "sample.bin"), "RIPTNAME & " - Reboot Required") = VB_YES Then Dim colOS, oOS Dim oWmiReboot Set oWmiReboot = GetObject("winmgmts:{impersonationLevel=impersonate,(Shutdown)}!\\.\root\cimv2") Set colOS = oWmiReboot.ExecQuery ("Select * from Win32_OperatingSystem") For Each oOS in colOS oOS.Reboot() Next End If End If End If If NOT fQuiet Then For Each Item in Wscript.Arguments If Item = "UAC" Then wscript.stdout.write "Press to close this window" sTemp = wscript.stdin.read(1) End If Next 'Argument End If LogY "ok" wscript.quit iError End Sub 'ExitScript '======================================================================================================= '======================================================================================================= 'Stage" (Indicator: " win32_operatingsystem"; Source: "sample.bin"), "StopService Next 'Service StopService = (iRet = 0) End Function 'StopService '======================================================================================================= 'Delete a service Sub DeleteService(sService) Dim Services, Service, Processes, Process Dim sQuery, sStates Dim iRet On Error Resume Next sStates = "STARTED;RUNNING" sQuery = "Select * From Win32_Service Where Name='" & sService & "'" Set Services = oWmiLocal.Execquery(sQuery) 'Stop and delete the service For Each Service in Services Log " Found service " & sService & " in state " & Service.State If InStr(sStates, UCase(Service.State))>0 Then iRet = Service.StopService() 'Ensure no more instances of the service are running Set Processes = oWmiLocal.ExecQuery("Select * From Win32_Process Where Name='" & sService & ".exe'") For Each Process in Processes iRet = Process.Terminate() Next 'P" (Indicator: " win32_service"; Source: "sample.bin"), "s for the Local Installation Source (MSOCache) Sub WipeLIS Const LISROOT = "MSOCache\All Users\" Dim LogicalDisks, Disk, Folder, SubFolder, MseFolder, File, Files Dim arrSubFolders Dim sFolder Dim fRemoveFolder 'LogH1 "LIS CleanUp" 'Search all hard disks Set LogicalDisks = oWmiLocal.ExecQuery("Select * From Win32_LogicalDisk WHERE DriveType=3") For Each Disk in LogicalDisks If oFso.FolderExists(Disk.DeviceID & "\" & LISROOT) Then Set Folder = oFso.GetFolder(Disk.DeviceID & "\" & LISROOT) For Each Subfolder in Folder.Subfolders If Len(Subfolder) > 37 Then If fRemoveAll Then If (Mid(Subfolder.Name,27,PRODLEN) = OFFICEID AND Mid(SubFolder.Name,4,2)=OVERSIONMAJOR) OR _ LCase(Right(Subfolder.Name,7)) = OVERSIONMAJOR &".data" Then DeleteFolder Subfolder.Path Else If (Mid(Subfolder.Name,27,PR" (Indicator: " win32_logicaldisk"; Source: "sample.bin")2a:Tc98,Found reference to API "age3 : fBypass_Stage3 = False 'Msiexec Dim fBypass_Stage4 : fBypass_Stage4 = False 'CleanUp sendmessage = "continue" 'Create required objects Set oWmiLocal = GetObject("winmgmts:{(Debug)}\\.\root\cimv2") Set oWShell = CreateObject("Wscript.Shell") Set oShellApp = CreateObject("Shell.Application") Set oFso = CreateObject("Scripting.FileSystemObject") Set oMsi = CreateObject("WindowsInstaller.Installer") Set oReg = GetObject("winmgmts:\\.\root\default:StdRegProv") 'Get environment path info sAppData = oWShell.ExpandEnvironmentStrings("%appdata%") sLocalAppData = oWShell.ExpandEnvironmentStrings("%localappdata%") sTemp = oWShell.ExpandEnvironmentStrings("%temp%") sAllUsersProfile = oWShell.ExpandEnvironmentStrings("%allusersprofile%") RegReadValue HKLM, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList", "ProfilesDirectory", sProfilesDirectory, "REG_EXPAND_SZ" If NOT oFso.FolderExists(sProfilesDirectory) Then " (Indicator: "sendmessage"; Source: "sample.bin"), Found reference to API "sion (0)) * 100 + CInt(arrVersion (1)) 'Check if we're running as 32 bit process on a 64 bit OS If InStr(LCase(wscript.path), "syswow64") > 0 Then RelaunchAs64Host fElevated = CheckRegPermissions If NOT fElevated AND NOT fNoElevate Then LogY "Setting sendmessage to dontsend" sendmessage = "dontsend" 'Try to relaunch elevated RelaunchElevated ' can't relaunch. Exit out SetError ERROR_ELEVATION If UCase(Mid(Wscript.FullName, Len(Wscript.Path) + 2, 1)) = "C" Then If Not fLogInitialized Then CreateLog Log "Error: Insufficient registry access permissions - exiting" End If SetRetVal iError 'Undo temporary entries created in ARP TmpKeyCleanUp 'wscript.quit 3 ExitScript End If ' set retval for file based logic '-------------------------------- ' value needs to be kept on 'user abort' SetRetVal ERROR_USER_ABORT ' create dictionary objects '-------------------------- Set dicKeepProd = CreateObject("Scripting.Dictionary" (Indicator: "sendmessage"; Source: "sample.bin"), Found reference to API "510. Critical error. Returned when user aborts with + or closes the cmd window Const ERROR_SUCCESS_CONFIG_COMPLETE = 1728 Const ERROR_SUCCESS_REBOOT_REQUIRED = 3010 '======================================================================================================= Dim oFso, oMsi, oReg, oWShell, oWmiLocal, oShellApp Dim ComputerItem, Item, LogStream, TmpKey Dim arrTmpSKUs, arrDeleteFiles, arrDeleteFolders, arrMseFolders, arrVersion Dim dicKeepProd, dicKeepLis, dicApps, dicKeepFolder, dicDelRegKey, dicKeepReg Dim dicInstalledSku, dicRemoveSku, dicKeepSku, dicSrv, dicCSuite, dicCSingle Dim f64, fLegacyProductFound, fCScript Dim sTmp, sSkuRemoveList, sWinDir, sWICacheDir, sMode Dim sAppData, sTemp, sScrubDir, sProgramFiles, sProgramFilesX86, sCommonProgramFiles Dim sAllusersProfile, sOSinfo, sOSVersion, sCommonProgramFilesX86, sProfilesDirectory Dim sProgramData, sLocalAppData, sOInstallRoot, sNotepad Dim iVersionNT, iError Dim pipename, pipeStream, fs Dim sendmessage '=====" (Indicator: "sendmessage"; Source: "sample.bin")2b:T1cc6,"Item In ComputerItem f64 = Instr(Left(Item.SystemType, 3), "64") > 0 If f64 Then Exit For Next If f64 Then sProgramFilesX86 = oWShell.ExpandEnvironmentStrings("%programfiles(x86)%") If f64 Then sCommonProgramFilesX86 = oWShell.ExpandEnvironmentStrings("%CommonProgramFiles(x86)%") 'Get OS details and VersionNT Set ComputerItem = oWmiLocal.ExecQuery("Select * from Win32_OperatingSystem") For Each Item in ComputerItem sOSinfo = sOSinfo & Item.Caption sOSinfo = sOSinfo & Item.OtherTypeDescription sOSinfo = sOSinfo & ", " & "SP " & Item.ServicePackMajorVersion sOSinfo = sOSinfo & ", " & "Version: " & Item.Version sOsVersion = Item.Version sOSinfo = sOSinfo & ", " & "Codepage: " & Item.CodeSet sOSinfo = sOSinfo & ", " & "Country Code: " & Item.CountryCode sOSinfo = sOSinfo & ", " & "Language: " & Item.OSLanguage Next 'Build the VersionNT number arrVersion = Split(sOsVersion, Delimiter(sOsVersion)) iVersionNt = CInt(arrVersion (0)) * 100 + CInt(arrVer" (Indicator: "countrycode") in Source: sample.bin, "m details '---------------------------------- Set ComputerItem = oWmiLocal.ExecQuery("Select * from Win32_OperatingSystem") For Each Item in ComputerItem sOSinfo = sOSinfo & Item.Caption sOSinfo = sOSinfo & Item.OtherTypeDescription sOSinfo = sOSinfo & ", " & "SP " & Item.ServicePackMajorVersion sOSinfo = sOSinfo & ", " & "Version: " & Item.Version sOsVersion = Item.Version sOSinfo = sOSinfo & ", " & "Codepage: " & Item.CodeSet sOSinfo = sOSinfo & ", " & "Country Code: " & Item.CountryCode sOSinfo = sOSinfo & ", " & "Language: " & Item.OSLanguage Next ' get VersionNT number '--------------------- arrVersion = Split(sOsVersion, Delimiter(sOsVersion)) iVersionNt = CInt(arrVersion(0)) * 100 + CInt(arrVersion(1)) ' ensure sufficient registry permisions '-------------------------------------- fIsElevated = CheckRegPermissions If NOT fIsElevated AND NOT fNoElevate Then '" (Indicator: "countrycode") in Source: sample.bin, "in ComputerItem sOSinfo = sOSinfo & Item.Caption sOSinfo = sOSinfo & Item.OtherTypeDescription sOSinfo = sOSinfo & ", " & "SP " & Item.ServicePackMajorVersion sOSinfo = sOSinfo & ", " & "Version: " & Item.Version sOsVersion = Item.Version sOSinfo = sOSinfo & ", " & "Codepage: " & Item.CodeSet sOSinfo = sOSinfo & ", " & "Country Code: " & Item.CountryCode sOSinfo = sOSinfo & ", " & "Language: " & Item.OSLanguage Next DetectOSBitness DetectOfficeBitness CreateLog LogOnly "Remove O15 Lic: " & fClearO15 LogOnly "Remove O16 Lic: " & fClearO16 LogOnly "Quiet mode: " & fQuiet RegReadExpStringValue HKLM, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList", "ProfilesDirectory", sProfilesDirectory If NOT oFso.FolderExists(sProfilesDirectory) Then sProfilesDirectory = oFso.GetParentFolderName(oWShell.ExpandEnvironmentStrings("%userprofile%")) End If LogOnly "Users p" (Indicator: "countrycode") in Source: sample.bin, "n32_ComputerSystem") For Each Item In ComputerItem f64 = Instr(Left(Item.SystemType,3),"64") > 0 If f64 Then Exit For Next If f64 Then sProgramFilesX86 = oWShell.ExpandEnvironmentStrings("%programfiles(x86)%") If f64 Then sCommonProgramFilesX86 = oWShell.ExpandEnvironmentStrings("%CommonProgramFiles(x86)%") 'Get OS details and VersionNT Set ComputerItem = oWmiLocal.ExecQuery("Select * from Win32_OperatingSystem") For Each Item in ComputerItem sOSinfo = sOSinfo & Item.Caption sOSinfo = sOSinfo & Item.OtherTypeDescription sOSinfo = sOSinfo & ", " & "SP " & Item.ServicePackMajorVersion sOSinfo = sOSinfo & ", " & "Version: " & Item.Version sOsVersion = Item.Version sOSinfo = sOSinfo & ", " & "Codepage: " & Item.CodeSet sOSinfo = sOSinfo & ", " & "Country Code: " & Item.CountryCode sOSinfo = sOSinfo & ", " & "Language: " & Item.OSLanguage Next 'Build the VersionNT number arrVersion = Split(sOsVersion, Delimiter(sOsVersion)) iVersionNt = CInt(arrVer" (Indicator: "countrycode") in Source: sample.bin, " ", " & "Version: " & Item.Version sOsVersion = Item.Version sOSinfo = sOSinfo & ", " & "Codepage: " & Item.CodeSet sOSinfo = sOSinfo & ", " & "Country Code: " & Item.CountryCode sOSinfo = sOSinfo & ", " & "Language: " & Item.OSLanguage Next 'Build the VersionNT number arrVersion = Split(sOsVersion, Delimiter(sOsVersion)) iVersionNt = CInt(arrVersion (0)) * 100 + CInt(arrVersion (1)) 'Check if we're running as 32 bit process on a 64 bit OS If InStr(LCase(wscript.path), "syswow64") > 0 Then RelaunchAs64Host fElevated = CheckRegPermissions If NOT fElevated AND NOT fNoElevate Then 'Try to relaunch elevated RelaunchElevated ' can't relaunch. Exit out SetError ERROR_ELEVATION If UCase(Mid(Wscript.FullName, Len(Wscript.Path) + 2, 1)) = "C" Then If Not fLogInitialized Then CreateLog Log "Error: Insufficient registry access permissions - exiting" End If SetRetVal iError 'Undo temporary entries created in ARP TmpKeyClean" (Indicator: "countrycode") in Source: sample.bin, "try Code: " & Item.CountryCode sOSinfo = sOSinfo & ", " & "Language: " & Item.OSLanguage Next 'Build the VersionNT number arrVersion = Split(sOsVersion, Delimiter(sOsVersion)) iVersionNt = CInt(arrVersion (0)) * 100 + CInt(arrVersion (1)) 'Check if we're running as 32 bit process on a 64 bit OS If InStr(LCase(wscript.path), "syswow64") > 0 Then RelaunchAs64Host fElevated = CheckRegPermissions If NOT fElevated AND NOT fNoElevate Then 'Try to relaunch elevated RelaunchElevated ' can't relaunch. Exit out SetError ERROR_ELEVATION If UCase(Mid(Wscript.FullName, Len(Wscript.Path) + 2, 1)) = "C" Then If Not fLogInitialized Then CreateLog Log "Error: Insufficient registry access permissions - exiting" End If SetRetVal iError 'Undo temporary entries created in ARP TmpKeyCleanUp 'wscript.quit 3 ExitScript End If ' set retval for file based logic '-------------------------------- ' value needs to be kept on 'user abort' " (Indicator: "countrycode") in Source: sample.bin, "en(Wscript.Path) + 2, 1)) = "C" 'Detect if we're running on a 64 bit OS Set ComputerItem = oWmiLocal.ExecQuery("Select * from Win32_ComputerSystem") For Each Item In ComputerItem f64 = Instr(Left(Item.SystemType, 3), "64") > 0 If f64 Then Exit For Next If f64 Then sProgramFilesX86 = oWShell.ExpandEnvironmentStrings("%programfiles(x86)%") If f64 Then sCommonProgramFilesX86 = oWShell.ExpandEnvironmentStrings("%CommonProgramFiles(x86)%") 'Get OS details and VersionNT Set ComputerItem = oWmiLocal.ExecQuery("Select * from Win32_OperatingSystem") For Each Item in ComputerItem sOSinfo = sOSinfo & Item.Caption sOSinfo = sOSinfo & Item.OtherTypeDescription sOSinfo = sOSinfo & ", " & "SP " & Item.ServicePackMajorVersion sOSinfo = sOSinfo & ", " & "Version: " & Item.Version sOsVersion = Item.Version sOSinfo = sOSinfo & ", " & "Codepage: " & Item.CodeSet sOSinfo = sOSinfo & ", " & "Country Code: " & Item.CountryCode sOSinfo = sOSinfo & ", " & "Language: " &" (Indicator: "countrycode") in Source: sample.bin2c:T197b,"msi" Const RETVALFILE = "ScrubRetValFile.txt" Const OVERSION = "15.0" Const OVERSIONMAJOR = "15" Const OREF = "Office15" Const OREGREF = "OFFICE15." Const ONAME = "Office 2013 MSI" Const OPACKAGE = "PackageRefs" Const OFFICEID = "000000FF1CE}" Const HKCR = &H80000000 Const HKCU = &H80000001 Const HKLM = &H80000002 Const HKU = &H80000003 Const FOR_WRITING = 2 Const PRODLEN = 12 Const COMPPERMANENT = "00000000000000000000000000000000" Const UNCOMPRESSED = 38 Const SQUISHED = 20 Const COMPRESSED = 32 Const REG_ARP = "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" Const VB_YES = 6 Const MSIOPENDATABASEREADONLY = 0 Const LYNC_ALL = "{4A2C120F-307B-4400-B239-F29ADB54D3C6}{5CFD6599-10E5-4CF0-B6E1-BF39D30A64F8}{5CFD6599-10E5-4CF0-B6E1-BF39D30A64F8}{BF3AC8BA-1A0F-42AD-8B65-4250617AF682}{3475BF22-3564-4EF3-A633-C5F3F4582392}{263BA91B-7782-4EEB-A4FC-7BD554CAF1F3}{AA256AE1-6B6A-48E" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: sample.bin, "RODLEN = 13 Const SQUISHED = 20 Const COMPRESSED = 32 Const REG_ARP = "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" Const VB_YES = 6 Const VB_NO = 7 Const ERROR_SUCCESS = 0 'Bit #1. 0 indicates Success. Script completed successfully Const ERROR_FAIL = 1 'Bit #1. Failure bit. Indicates an overall script failure. 'RESERVED bit! Returned when process is killed from task manager Const ERROR_REBOOT_REQUIRED = 2 'Bit #2. Reboot bit. If set a reboot is required Const ERROR_USERCANCEL = 4 'Bit #3. User Cancel bit. Controlled cancel from script UI Const ERROR_STAGE1 = 8 'Bit #4. Informational. Msiexec based install was not possible Const ERROR_STAGE2 = 16 'Bit #5. Critical. Not all of the intended cleanup operations could be applied Const ERROR_INCOMPLETE = 32 'Bit #6. Pending file renam" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: sample.bin, " Const RETVALFILE = "ScrubRetValFile.txt" Const OVERSION = "16.0" Const OVERSIONMAJOR = "16" Const OREF = "Office16" Const OREGREF = "OFFICE16." Const ONAME = "Office 2016 MSI" Const OPACKAGE = "PackageRefs" Const OFFICEID = "000000FF1CE}" Const HKCR = &H80000000 Const HKCU = &H80000001 Const HKLM = &H80000002 Const HKU = &H80000003 Const FOR_WRITING = 2 Const PRODLEN = 12 Const COMPPERMANENT = "00000000000000000000000000000000" Const UNCOMPRESSED = 38 Const SQUISHED = 20 Const COMPRESSED = 32 Const REG_ARP = "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" Const VB_YES = 6 Const MSIOPENDATABASEREADONLY = 0 Const LYNC_ALL = "{4A2C120F-307B-4400-B239-F29ADB54D3C6}{5CFD6599-10E5-4CF0-B6E1-BF39D30A64F8}{5CFD6599-10E5-4CF0-B6E1-BF39D30A64F8}{BF3AC8BA-1A0F-42AD-8B65-4250617AF682}{3475BF22-3564-4EF3-A633-C5F3F4582392}{263BA91B-7782-4EEB-A4FC-7BD554CAF1F3}{AA256AE1-6B6A-48E6-995" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: sample.bin, "LFILE = "ScrubRetValFile.txt" Const OVERSION = "11.0" Const OVERSIONMAJOR = "11" Const OREF = "Office11" Const OREGREF = "" Const ONAME = "Office 2003" Const OPACKAGE = "" Const OFFICEID = "6000-11D3-8CFE-0150048383C9}" Const HKCR = &H80000000 Const HKCU = &H80000001 Const HKLM = &H80000002 Const HKU = &H80000003 Const FOR_WRITING = 2 Const PRODLEN = 28 Const COMPPERMANENT = "00000000000000000000000000000000" Const UNCOMPRESSED = 38 Const SQUISHED = 20 Const COMPRESSED = 32 Const REG_ARP = "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" Const VB_YES = 6 Const MSIOPENDATABASEREADONLY = 0 Const ERROR_SUCCESS = 0 'Bit #1. 0 indicates Success. Script completed successfully Const ERROR_FAIL = 1 'Bit #1. Failure bit. Indicates an overall script failure. 'RESERVED bit! Returned when process is kil" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: sample.bin, "t RETVALFILE = "ScrubRetValFile.txt" Const OVERSION = "12.0" Const OVERSIONMAJOR = "12" Const OREF = "Office12" Const OREGREF = "" Const ONAME = "Office 2007" Const OPACKAGE = "PackageIds" Const OFFICEID = "000000FF1CE}" Const HKCR = &H80000000 Const HKCU = &H80000001 Const HKLM = &H80000002 Const HKU = &H80000003 Const FOR_WRITING = 2 Const PRODLEN = 12 Const COMPPERMANENT = "00000000000000000000000000000000" Const UNCOMPRESSED = 38 Const SQUISHED = 20 Const COMPRESSED = 32 Const REG_ARP = "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" Const VB_YES = 6 Const MSIOPENDATABASEREADONLY = 0 Const LYNC_ALL = "{4A2C120F-307B-4400-B239-F29ADB54D3C6}{5CFD6599-10E5-4CF0-B6E1-BF39D30A64F8}{5CFD6599-10E5-4CF0-B6E1-BF39D30A64F8}{BF3AC8BA-1A0F-42AD-8B65-4250617AF682}{3475BF22-3564-4EF3-A633-C5F3F4582392}{263BA91B-7782-4EEB-A4FC-7BD554CAF1F3}{AA256AE1-6B6A-48E6-9957-B38F92CA614B}{D79" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: sample.bin, "ILE = "ScrubRetValFile.txt" Const OVERSION = "14.0" Const OVERSIONMAJOR = "14" Const OREF = "Office14" Const OREGREF = "OFFICE14." Const ONAME = "Office 2010" Const OPACKAGE = "PackageRefs" Const OFFICEID = "000000FF1CE}" Const HKCR = &H80000000 Const HKCU = &H80000001 Const HKLM = &H80000002 Const HKU = &H80000003 Const FOR_WRITING = 2 Const PRODLEN = 12 Const COMPPERMANENT = "00000000000000000000000000000000" Const UNCOMPRESSED = 38 Const SQUISHED = 20 Const COMPRESSED = 32 Const REG_ARP = "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" Const VB_YES = 6 Const MSIOPENDATABASEREADONLY = 0 Const LYNC_ALL = "{4A2C120F-307B-4400-B239-F29ADB54D3C6}{5CFD6599-10E5-4CF0-B6E1-BF39D30A64F8}{5CFD6599-10E5-4CF0-B6E1-BF39D30A64F8}{BF3AC8BA-1A0F-42AD-8B65-4250617AF682}{3475BF22-3564-4EF3-A633-C5F3F4582392}{263BA91B-7782-4EEB-A4FC-7BD554CAF1F3}{AA256AE1-6B6A-48E6-9957-B38F92CA614B}{D7" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: sample.bin2d:T1d21,Observed string: " Each Process in Processes iSpawnedProcessId = Process.ProcessId Exit For Next 'Process ' monitor the tasklist to detect the end of the spawned process While oWmiLocal.ExecQuery("Select * From Win32_Process WHERE ProcessId='" & iSpawnedProcessId & "'").Count > 0 WScript.Sleep 3000 Wend ' get the return value from the file Wscript.Quit GetRetValFromFile End If ' elevation failed (user declined) SetError ERROR_ELEVATION_USERDECLINED End Sub 'RelaunchElevated '------------------------------------------------------------------------------- ' GetMyProcessId ' ' Returns the process id of the own process '------------------------------------------------------------------------------- Function GetMyProcessId() Dim iParentProcessId iParentProcessId = 0 ' try to obtain from creating a new cscript instance On Error Resume Next iParentProcessId = GetObject("winmgmts:root\cimv2").Get("Win" (Indicator: " tasklist ") in Source: sample.bin, Observed string: "wscript.sleep 10000" CvhbsQuiet.WriteLine "Do" CvhbsQuiet.WriteLine "Set Processes = oWmiLocal.ExecQuery("&chr(34)&"Select * From Win32_Process Where Name='cvhbs.exe'"&chr(34)&")" CvhbsQuiet.WriteLine "iCnt = Processes.Count" CvhbsQuiet.WriteLine "If iCnt > 0 Then" CvhbsQuiet.WriteLine "sCommand = "&chr(34)&"tasklist /FI "&chr(34)&sQuote&chr(34)&"WINDOWTITLE eq click*"&chr(34)&sQuote&chr(34)&" /FO CSV /NH"&chr(34) CvhbsQuiet.WriteLine "Set oExec = oShell.Exec(sCommand)" CvhbsQuiet.WriteLine "sCmdOut = oExec.StdOut.ReadAll()" CvhbsQuiet.WriteLine "Do While oExec.Status = 0" CvhbsQuiet.WriteLine "WScript.Sleep 200" CvhbsQuiet.WriteLine "Loop" CvhbsQuiet.WriteLine "If InStr(sCmdOut,"&chr(34)&","&chr(34)&")>0 Then" CvhbsQuiet.WriteLine "sCmdOut = Replace(sCmdOut,chr(34),"&chr(34)&chr(34)&")" CvhbsQuiet.WriteLine "arrCol = Split(sCmdOut,"&chr(34)&","&chr(34)&")" CvhbsQuiet.WriteLine "sPi" [Source: sample.bin], Observed string: " Exit Sub SetError ERROR_ELEVATION_FAILED Case "UAC" 'Already tried elevated relaunch SetError ERROR_ELEVATION_FAILED Exit Sub Case Else sCmdLine = sCmdLine & " " & chr(34) & Argument & chr(34) End Select Next 'Argument End If ' prep work to get the return value from the elevated process iParentProcessId = GetMyProcessId ' launch the elevated instance oShell.ShellExecute "cscript.exe", sCmdLine & " /NoElevate UAC", "", "runas", 1 ' get the process id of the spawned instance WScript.Sleep 500 Set Processes = oWmiLocal.ExecQuery("Select * From Win32_Process WHERE ParentProcessId='" & iParentProcessId & "'") If Processes.Count > 0 Then For Each Process in Processes iSpawnedProcessId = Process.ProcessId Exit For Next 'Process ' monitor the tasklist to detect the end of the spawned proces" (Indicator: " tasklist ") in Source: sample.bin, Observed string: "cess WHERE ParentProcessId='" & iParentProcessId & "'") If Processes.Count > 0 Then For Each Process in Processes iSpawnedProcessId = Process.ProcessId Exit For Next 'Process ' monitor the tasklist to detect the end of the spawned process While oWmiLocal.ExecQuery("Select * From Win32_Process WHERE ProcessId='" & iSpawnedProcessId & "'").Count > 0 WScript.Sleep 3000 Wend ' get the return value from the file Wscript.Quit GetRetValFromFile End If ' elevation failed (user declined) SetError ERROR_ELEVATION_USERDECLINED End Sub 'RelaunchElevated '------------------------------------------------------------------------------- ' GetMyProcessId ' ' Returns the process id of the own process '------------------------------------------------------------------------------- Function GetMyProcessId() Dim iParentProcessId iParentProcessId = 0 ' try to obtain from creating a new cscript" (Indicator: " tasklist ") in Source: sample.bin, Observed string: "crosoft\Office\15.0\CleanC2R", "Rerun", sValue, "REG_DWORD") Then ' oWShell.Popup "System reboot complete. OffScrub will now prompt for elevation!", 10, SCRIPTNAME & " - NOTE!" ' End If ' launch the elevated instance oShell.ShellExecute "cscript.exe", sCmdLine & " /NoElevate UAC", "", "runas", 1 ' get the process id of the spawned instance WScript.Sleep 500 Set Processes = oWmiLocal.ExecQuery("Select * From Win32_Process WHERE ParentProcessId='" & iParentProcessId & "'") If Processes.Count > 0 Then For Each Process in Processes iSpawnedProcessId = Process.ProcessId Exit For Next 'Process ' monitor the tasklist to detect the end of the spawned process While oWmiLocal.ExecQuery("Select * From Win32_Process WHERE ProcessId='" & iSpawnedProcessId & "'").Count > 0 WScript.Sleep 3000 Wend ' get the return value from the file Wscript.Quit GetRetValFromFile End If ' eleva" (Indicator: " tasklist ") in Source: sample.bin, Observed string: "rocess WHERE ParentProcessId='" & iParentProcessId & "'") If Processes.Count > 0 Then For Each Process in Processes iSpawnedProcessId = Process.ProcessId Exit For Next 'Process ' monitor the tasklist to detect the end of the spawned process While oWmiLocal.ExecQuery("Select * From Win32_Process WHERE ProcessId='" & iSpawnedProcessId & "'").Count > 0 WScript.Sleep 3000 Wend ' get the return value from the file Wscript.Quit GetRetValFromFile End If ' elevation failed (user declined) SetError ERROR_ELEVATION_USERDECLINED End Sub 'RelaunchElevated '------------------------------------------------------------------------------- ' GetMyProcessId ' ' Returns the process id of the own process '------------------------------------------------------------------------------- Function GetMyProcessId() Dim iParentProcessId iParentProcessId = 0 ' try to obtain from creating a new cscri" (Indicator: " tasklist ") in Source: sample.bin, Observed string: "Then For Each Process in Processes iSpawnedProcessId = Process.ProcessId Exit For Next 'Process ' monitor the tasklist to detect the end of the spawned process While oWmiLocal.ExecQuery("Select * From Win32_Process WHERE ProcessId='" & iSpawnedProcessId & "'").Count > 0 WScript.Sleep 3000 Wend ' get the return value from the file Wscript.Quit GetRetValFromFile End If ' elevation failed (user declined) SetError ERROR_ELEVATION_USERDECLINED End Sub 'RelaunchElevated '------------------------------------------------------------------------------- ' GetMyProcessId ' ' Returns the process id of the own process '------------------------------------------------------------------------------- Function GetMyProcessId() Dim iParentProcessId iParentProcessId = 0 ' try to obtain from creating a new cscript instance On Error Resume Next iParentProcessId = GetObject("winmgmts:root" (Indicator: " tasklist ") in Source: sample.bin2e:T2039,"ls\Text Converters\Import\MEWord12\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\Word12\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\Word97\" RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Run\", "GrooveMonitor", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Run\", "LobiServer", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Run\", "BCSSync", False RegDeleteKey HKLM,"SYSTEM\CurrentControlSet\Services\Outlook\" End If RegDeleteValue HKLM,"SOFTWARE\Microsoft\Office\Common\OffDiag\Location\", OVERSIONMAJOR, False RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Office\" & OVERSION & "\" RegDeleteValue HKLM,"SOFTWARE\Microsoft\Office\Common\OffDiag\Location\", OVERSIONMAJOR, False RegDeleteKey HKLM,"SOFTWARE\Microso" in Source: sample.bin, "Shared Tools\Text Converters\Import\MEWord12\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\Word12\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\Word97\" RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Run\", "GrooveMonitor", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Run\", "LobiServer", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Run\", "BCSSync", False RegDeleteKey HKLM,"SYSTEM\CurrentControlSet\Services\Outlook\" End If RegDeleteValue HKLM,"SOFTWARE\Microsoft\Office\Common\OffDiag\Location\", OVERSIONMAJOR, False RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Office\" & OVERSION & "\" RegDeleteValue HKLM,"SOFTWARE\Microsoft\Office\Common\OffDiag\Location\", OVERSIONMAJOR, False RegDeleteKey HKLM,"SOFTWA" in Source: sample.bin, "KeyName, sCurKey, value, sValue, sGuid Dim fkeep, fSystemComponent0, fPackages, fDisplayVersion Dim arrKeys, arrNames, arrTypes, arrMultiSzValues, arrMultiSzNewValues Dim arrTestNames, arrTestTypes Dim i, iLoopCnt, iPos Dim fDelReg 'Wipe registry data 'User Profile settings LogH2 "User Policies" RegDeleteKey HKCU, "Software\Policies\Microsoft\Office\" & OVERSION & "\" If NOT fKeepUser Then RegDeleteKey HKCU, "Software\Microsoft\Office\" & OVERSION & "\" LogH2 "User Settings" End If 'fKeepUser 'Computer specific settings If fClearAddinReg Then RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\Outlook\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\Word\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\Excel\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\PowerPoint\" End If If (fRemoveAll AND NOT fC2rInstalled) OR (fRemoveAll AND fForce) Then LogH2 "Machine Setti" in Source: sample.bin, "Text Converters\Export\Word97\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\MEWord12\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\Word12\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\Word97\" RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\", "GrooveMonitor", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\", "LobiServer", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\", "BCSSync", False RegDeleteKey HKLM, "SYSTEM\CurrentControlSet\Services\Outlook\" End If RegDeleteValue HKLM, "SOFTWARE\Microsoft\Office\Common\OffDiag\Location\", OVERSIONMAJOR, False RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Office\" & OVERSION & "\" RegDeleteValue HKLM, "SOFTWARE\Micros" in Source: sample.bin, "\Shared Tools\Text Converters\Export\Word97\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\MEWord12\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\Word12\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\Word97\" RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\", "GrooveMonitor", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\", "LobiServer", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\", "BCSSync", False RegDeleteKey HKLM, "SYSTEM\CurrentControlSet\Services\Outlook\" End If RegDeleteValue HKLM, "SOFTWARE\Microsoft\Office\Common\OffDiag\Location\", OVERSIONMAJOR, False RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Office\" & OVERSION & "\" RegDeleteValue HKLM, "S" in Source: sample.bin, "ayVersion Dim arrKeys, arrNames, arrTypes, arrMultiSzValues, arrMultiSzNewValues Dim arrTestNames, arrTestTypes Dim i, iLoopCnt, iPos Dim fDelReg 'Wipe registry data 'User Profile settings LogH2 "User Policies" RegDeleteKey HKCU,"Software\Policies\Microsoft\Office\" & OVERSION & "\" If NOT fKeepUser Then RegDeleteKey HKCU,"Software\Microsoft\Office\" & OVERSION & "\" LogH2 "User Settings" End If 'fKeepUser 'Computer specific settings If fClearAddinReg Then RegDeleteKey HKLM,"SOFTWARE\Microsoft\Office\Outlook\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Office\Word\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Office\Excel\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Office\PowerPoint\" End If If (fRemoveAll AND NOT fC2rInstalled) OR (fRemoveAll AND fForce) Then LogH2 "Machine Settings" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Office\" & OVERSION & "\" If fRemove" in Source: sample.bin, "es, fDisplayVersion Dim arrKeys, arrNames, arrTypes, arrMultiSzValues, arrMultiSzNewValues Dim arrTestNames, arrTestTypes Dim i, iLoopCnt, iPos Dim fDelReg 'Wipe registry data 'User Profile settings LogH2 "User Policies" RegDeleteKey HKCU,"Software\Policies\Microsoft\Office\" & OVERSION & "\" If NOT fKeepUser Then RegDeleteKey HKCU,"Software\Microsoft\Office\" & OVERSION & "\" LogH2 "User Settings" End If 'fKeepUser 'Computer specific settings If fClearAddinReg Then RegDeleteKey HKLM,"SOFTWARE\Microsoft\Office\Outlook\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Office\Word\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Office\Excel\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Office\PowerPoint\" End If If (fRemoveAll AND NOT fC2rInstalled) OR (fRemoveAll AND fForce) Then LogH2 "Machine Settings" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Office\" & OVERSION & "\" " in Source: sample.bin, "ackages, fDisplayVersion Dim arrKeys, arrNames, arrTypes, arrMultiSzValues, arrMultiSzNewValues Dim arrTestNames, arrTestTypes Dim i, iLoopCnt, iPos Dim fDelReg 'Wipe registry data 'LogH1 "Registry CleanUp" 'Wipe registry data 'User Profile settings LogH2 "User Policies" RegDeleteKey HKCU, "Software\Policies\Microsoft\Office\" & OVERSION & "\" If NOT fKeepUser Then RegDeleteKey HKCU, "Software\Microsoft\Office\" & OVERSION & "\" LogH2 "User Settings" End If 'fKeepUser 'Computer specific settings If fClearAddinReg Then RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\Outlook\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\Word\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\Excel\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\PowerPoint\" End If If (fRemoveAll AND NOT fC2rInstalled) OR (fRemoveAll AND fForce) Then LogH2 "Machine Settings" " in Source: sample.bin2f:T10bc,Observed string: "e HKLM, "SOFTWARE\Microsoft\Office\15.0\ClickToRun", "PackageGUID", sPkgGuid, "REG_SZ" Case 2 RegReadValue HKLM, "SOFTWARE\Microsoft\Office\16.0\ClickToRun", "PackageFolder", sPkgFld, "REG_SZ" RegReadValue HKLM, "SOFTWARE\Microsoft\Office\16.0\ClickToRun", "PackageGUID", sPkgGuid, "REG_SZ" Case 3 RegReadValue HKLM, "SOFTWARE\Microsoft\Office\ClickToRun", "PackageFolder", sPkgFld, "REG_SZ" RegReadValue HKLM, "SOFTWARE\Microsoft\Office\ClickToRun", "PackageGUID", sPkgGuid, "REG_SZ" Case 4 sPkgFld = sPackageFolder sPkgGuid = sPackageGuid End Select If oFso.FolderExists(sValue & "\root\Integration") Then sCmd = "cmd.exe /c del " & chr(34) & sPkgFld & "\root\Integration\C2RManifest*.xml" & chr(34) Log " Run: " & sCmd If NOT fDetectOnly Then sReturn = oWShell.Run (sCmd, 0, True) Log " Return value: " & sReturn If oFso.FileExists(sPkgFld & "\root\Integration\integrator.exe") Then " (Indicator: "cmd.exe /c del") in Source: sample.bin, Observed string: "e HKLM, "SOFTWARE\Microsoft\Office\15.0\ClickToRun", "PackageGUID", sPkgGuid, "REG_SZ" Case 2 RegReadValue HKLM, "SOFTWARE\Microsoft\Office\16.0\ClickToRun", "PackageFolder", sPkgFld, "REG_SZ" RegReadValue HKLM, "SOFTWARE\Microsoft\Office\16.0\ClickToRun", "PackageGUID", sPkgGuid, "REG_SZ" Case 3 RegReadValue HKLM, "SOFTWARE\Microsoft\Office\ClickToRun", "PackageFolder", sPkgFld, "REG_SZ" RegReadValue HKLM, "SOFTWARE\Microsoft\Office\ClickToRun", "PackageGUID", sPkgGuid, "REG_SZ" Case 4 sPkgFld = sPackageFolder sPkgGuid = sPackageGuid End Select If oFso.FolderExists(sValue & "\root\Integration") Then sCmd = "cmd.exe /c del " & chr(34) & sPkgFld & "\root\Integration\C2RManifest*.xml" & chr(34) Log " Run: " & sCmd If NOT fDetectOnly Then sReturn = oWShell.Run (sCmd, 0, True) Log " Return value: " & sReturn If oFso.FileExists(sPkgFld & "\root\Integration\integrator.exe") Then " (Indicator: "/c del ") in Source: sample.bin, Observed string: "er: " & sDelFolder CheckError "DeleteFolder" ' try to delete as many folder contents as possible ' before the recursive error handling is called Set Folder = oFso.GetFolder(sDelFolder) For Each fld in Folder.Subfolders sCmd = "cmd.exe /c rd /s " & chr(34) & fld.Path & chr(34) & " /q" oWShell.Run sCmd, 0, True Next 'fld sCmd = "cmd.exe /c del " & chr(34) & fld.Path & "\*.*" & chr(34) oWShell.Run sCmd, 0, True Set Folder = Nothing ' schedule an additional run of the tool after reboot If NOT fRerun Then Rerun ' schedule folder for delete on next reboot ScheduleDeleteFolder sDelFolder End If 'Err <> 0 Else LogOnly "Preview mode. Disallowing delete of folder: " & sDelFolder End If On Error Goto 0 End Sub 'DeleteFolder Sub DeleteFolder_WMI (sFolder) Dim Folder, Folders" (Indicator: "cmd.exe /c del") in Source: sample.bin, Observed string: "er: " & sDelFolder CheckError "DeleteFolder" ' try to delete as many folder contents as possible ' before the recursive error handling is called Set Folder = oFso.GetFolder(sDelFolder) For Each fld in Folder.Subfolders sCmd = "cmd.exe /c rd /s " & chr(34) & fld.Path & chr(34) & " /q" oWShell.Run sCmd, 0, True Next 'fld sCmd = "cmd.exe /c del " & chr(34) & fld.Path & "\*.*" & chr(34) oWShell.Run sCmd, 0, True Set Folder = Nothing ' schedule an additional run of the tool after reboot If NOT fRerun Then Rerun ' schedule folder for delete on next reboot ScheduleDeleteFolder sDelFolder End If 'Err <> 0 Else LogOnly "Preview mode. Disallowing delete of folder: " & sDelFolder End If On Error Goto 0 End Sub 'DeleteFolder Sub DeleteFolder_WMI (sFolder) Dim Folder, Folders" (Indicator: "/c del ") in Source: sample.bin30:T526,Pattern match: "www.microsoft.com/pkiops/crl/miccodsigpca2011_2011-07-08.crl0a", Pattern match: "https://support.office.com/ru-ru/article/uninstall-office-2013-office-2016-or-office-365-from-a-windows-computer-9dd49b83-264a-477a-8fcc-2fdf5dbf61d8", Pattern match: "http://www.microsoft.com0", Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0", Pattern match: "https://www.microsoft.com/en-us/download/confirmation.aspx?id=36778", Pattern match: "http://go.microsoft.com/fwlink/?linkid=866973", Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0", Pattern match: "www.microsoft.com/pkiops/docs/primarycps.htm0@", Pattern match: "http://support.microsoft.com/kb/2870357#error0x", Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0", Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z", Pattern match: "www.microsoft.com/pkiops/certs/miccodsigpca2011_2011-07-08.crt0", Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^", Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z", Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@", Pattern match: "https://download.microsoft.com/download/6/2/3/6230f7a2-d8a9-478b-ac5c-57091b632fcf/off"31:T683e,Found string "will kill running applications which can result in data loss! <- CAUTION Dim fForce : fForce = False 'CAUTION! -> "fForce" will kill running applications which can result in data loss! <- CAUTION Dim fLogInitialized : fLogInitialized = False Dim fBypass_Stage1 : fBypass_Stage1 = True 'Component Detection Dim fBypass_Stage2 : fBypass_Stage2 = False 'Msiexec Dim fBypass_Stage3 : fBypass_Stage3 = False 'CleanUp Dim fRunOnVanilla : fRunOnVanilla = True Dim fNoOrphansMode : fNoOrphansMode = False 'Create required objects Set oWmiLocal = GetObject("winmgmts:{(Debug)}\\.\root\cimv2") Set oWShell = CreateObject("Wscript.Shell") Set oShellApp = CreateObject("Shell.Application") Set oFso = CreateObject("Scripting.FileSystemObject") Set oMsi = CreateObject("WindowsInstaller.Installer") Set oReg = GetObject("winmgmts:\\.\root\default:StdRegProv") 'Get environment path info sAppData = oWShell.ExpandEnvironmentStrings("%appdata%") sLocalAppData " (Indicator: "root\cimv2"; in Source: "sample.bin"), Found string "p to automatic. " & MSG_ISCMD_ELEVATED) quitExit() End If Else Set colListOfServices = objWMI.ExecQuery _ ("Select * from Win32_Service ") For Each objService in colListOfServices If LCase(objService.Name) = "osppsvc" Then Select Case LCase(objService.State) Case "running" objService.StopService() WScript.Sleep(15000) objService.StartService() WScript.Sleep(15000) Case Else objService.StartService() WScript.Sleep(15000) End Select Exit For End If Next Set objService = Nothing Set colListOfServices = Nothing Set colListOfServices = objWMI.ExecQuery _ ("Select * from Win32_Service ") For Each objService in colListOfServices If LCase(objService.Name) = "osppsvc" Then If LCase(objService.State) = "" (Indicator: "wmi.exe"; in Source: "sample.bin"), Found string "en ClearIdentityCache If fSignOutOfWAM Then InvokeSignOutOfWAM LogH2 "Cleanup end" ' END '------------------------------------------------------------------------------- ' Initialize ' ' Initialize script settings '------------------------------------------------------------------------------- Sub Initialize Dim ComputerItem, Item Dim sOsVersion 'Check if we're running as 32 bit process on a 64 bit OS If InStr(LCase(wscript.path), "syswow64") > 0 Then RelaunchAs64Host Set oWmiLocal = GetObject("winmgmts:\\.\root\cimv2") Set oReg = GetObject("winmgmts:\\.\root\default:StdRegProv") Set oFso = CreateObject("Scripting.FileSystemObject") sTemp = oWShell.ExpandEnvironmentStrings("%TEMP%") fCScript = (UCase(Mid(Wscript.FullName, Len(Wscript.Path) + 2, 1)) = "C") ' get Win32_OperatingSystem details '---------------------------------- Set ComputerItem = oWmiLocal.ExecQuery("Select * from Win32_OperatingSystem") For Each Item " (Indicator: "root\cimv2"; in Source: "sample.bin"), Found string "---------------------- ' CreateLog ' ' Create the removal log file '------------------------------------------------------------------------------- Sub CreateLog Dim DateTime Dim sLogName On Error Resume Next ' create the log file Set DateTime = CreateObject("WbemScripting.SWbemDateTime") DateTime.SetVarDate Now, True sLogName = sLogDir & "\" & oWShell.ExpandEnvironmentStrings("%COMPUTERNAME%") sLogName = sLogName & "_" & Left(DateTime.Value, 14) sLogName = sLogName & "_ScrubLog.txt" Err.Clear Set LogStream = oFso.CreateTextFile(sLogName, True, True) If Err <> 0 Then Err.Clear sLogDir = sScrubDir sLogName = sLogDir & "\" & oWShell.ExpandEnvironmentStrings("%COMPUTERNAME%") sLogName = sLogName & "_" & Left(DateTime.Value, 14) sLogName = sLogName & "_ScrubLog.txt" Set LogStream = oFso.CreateTextFile(sLogName, True, True) End If On Error Goto 0 LogH2 "Microsoft Cust" (Indicator: "wbemscripting."; in Source: "sample.bin"), Found string "End If End If Else If strUser <> "" Then globalPopFailure MSG_CREDENTIALERR,True End If If strMachine = "" Or LCase(strMachine) = LCase(strLocal) Then Set objWMI1 = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & "." & "\root\default:StdRegProv") Set objWMI = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & "." & "\root\cimv2") Else Set objWMI1 = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strMachine & "\root\default:StdRegProv") Set objWMI = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strMachine & "\root\cimv2") End If End If wmiErrHandle() setWinOS() End Function '//////////////////////////////////////////////////////////////////////////////////////// '//////////////////////////////////////////////////////////////////////////////////////// Private Function" (Indicator: "root\cimv2"; in Source: "sample.bin"), Found string "sume Next iParentProcessId = GetObject("winmgmts:root\cimv2").Get("Win32_Process.Handle='" & oWShell.Exec("cscript.exe").ProcessId & "'").ParentProcessId On Error Goto 0 If iParentProcessId > 0 Then ' succeeded to obtain the process id GetMyProcessId = iParentProcessId Exit Function End If ' failed to obtain the id from the creation of a new instance ' get it from enum of Win32_Process Dim Process, Processes Err.Clear Set Processes = oWmiLocal.ExecQuery("Select * From Win32_Process WHERE Name='cscript.exe' AND CommandLine like '%" & SCRIPTNAME & "%'") For Each Process in Processes iParentProcessId = Process.ProcessId Exit For Next GetMyProcessId = iParentProcessId End Function 'GetMyProcessId '------------------------------------------------------------------------------- ' Delimiter ' ' Returns the delimiter for a passed in string '------------------------------------------------------------" (Indicator: "root\cimv2"; in Source: "sample.bin"), Found string " 'Unsupported - osppsvc only supports this. globalPopFailure MSG_UNSUPPORTEDOPEROS7 & vbCr & strCommand,True End If ElseIf strCommand = "/dtokils" Then Err.Clear Set objWmiDate = CreateObject("WBemScripting.SWbemDateTime") ExecuteQuery "ILID, ILVID, AuthorizationStatus, ExpirationDate, Description, AdditionalInfo","",tokenClass For Each instance in productinstances sppErrHandle "" i = i + 1 Call Log( "License ID (ILID): " & instance.ILID) Call Log( "Version ID (ILvID): " & instance.ILVID) If Not IsNull(instance.ExpirationDate) Then objWmiDate.Value = instance.ExpirationDate If (objWmiDate.GetFileTime(false) <> 0) Then Call Log( "Expiry Date: " & objWmiDate.GetVarDate) End If End If If Not IsNull(instance.AdditionalInfo) Then Call Log( "Additional Info: " & instance.AdditionalInfo) End If If Not IsNull(instance.Authorizati" (Indicator: "wbemscripting."; in Source: "sample.bin"), Found string " Each Process in Processes iSpawnedProcessId = Process.ProcessId Exit For Next 'Process ' monitor the tasklist to detect the end of the spawned process While oWmiLocal.ExecQuery("Select * From Win32_Process WHERE ProcessId='" & iSpawnedProcessId & "'").Count > 0 WScript.Sleep 3000 Wend ' get the return value from the file Wscript.Quit GetRetValFromFile End If ' elevation failed (user declined) SetError ERROR_ELEVATION_USERDECLINED End Sub 'RelaunchElevated '------------------------------------------------------------------------------- ' GetMyProcessId ' ' Returns the process id of the own process '------------------------------------------------------------------------------- Function GetMyProcessId() Dim iParentProcessId iParentProcessId = 0 ' try to obtain from creating a new cscript instance On Error Resume Next iParentProcessId = GetObject("winmgmts:root\cimv2").Get("Win" (Indicator: "root\cimv2"; in Source: "sample.bin"), Found string "rEventCode,strSource,strMachine) Call Log( MSG_SEARCHFOR & strMessage & "<<<<< Log: " & strLog & " Source: " & strSource & " Event: " & strEventCode & " >>>>>" ) Call Log( MSG_SEPERATE) Set objEvents = objWMI.ExecQuery _ ("Select * from Win32_NTLogEvent Where Logfile = '" & strLog & "'" & " and "_ & "EventCode = '" & strEventCode & "'" & " and SourceName = '" & strSource & "'") If objEvents.Count > 0 Then Call Log( MSG_SEPERATESMALL) For each objEvent in objEvents dtmEventDate = objEvent.TimeWritten strTimeWritten = WMIDateStringToDate(dtmEventDate) Call Log( "Coordinated Universal Time Written: " & strTimeWritten) Call Log( objEvent.Message) Call Log( MSG_SEPERATESMALL) Next Call Log( MSG_SEPERATE) Else Call Log( MSG_NOEVENTS) Call Log( MSG_SEPERATE) End If Set objEvents = Nothing End Function '//////////////////////////////////////////////////////////////////////////////////////" (Indicator: "wmi.exe"; in Source: "sample.bin"), Found string " needed Sub RestoreExplorer Dim Processes, Result, oAT, DateTime, JobID Dim sCmd 'Non critical routine. Don't fail on error On Error Resume Next wscript.sleep 1000 Set Processes = oWmiLocal.ExecQuery("Select * From Win32_Process Where Name='explorer.exe'") If Processes.Count < 1 Then oWShell.Run "explorer.exe" 'To handle this in case of System context, schedule and run as interactive task If iVersionNT > 502 Then 'Vista and later oWShell.Run "SCHTASKS /Create /TN OffScrEx /TR explorer /SC ONCE /ST 12:00 /IT",0,True oWShell.Run "SCHTASKS /Run /TN OffScrEx", 0, True oWShell.Run "SCHTASKS /Delete /TN OffScrEx /F", 0, False Else Set oAT = oWmiLocal.Get("Win32_ScheduledJob") Set DateTime = CreateObject("WbemScripting.SWbemDateTime") DateTime.SetVarDate DateAdd("n",1,Now),True Result = oAT.Create("explorer.exe", DateTime.Value, , , , T" (Indicator: "wbemscripting."; in Source: "sample.bin"), Found string "h = True End Select Next 'Argument End If sCmd = sCmd & " /ChangedHostBitness" If fQuietRelaunch Then sCmd = Replace (sCmd, "\cscript.exe", "\wscript.exe") Wscript.Quit CLng(oWShell.Run (sCmd, 0, True)) Else Wscript.Quit CLng(oWShell.Run (sCmd, 1, True)) End If End Sub 'RelaunchAs64Host '------------------------------------------------------------------------------- ' CreateLog ' ' Create the removal log file '------------------------------------------------------------------------------- Sub CreateLog Dim DateTime Dim sLogName On Error Resume Next ' create the log file Set DateTime = CreateObject("WbemScripting.SWbemDateTime") DateTime.SetVarDate Now, True If sLogDir = "" Then sLogDir = sTemp sLogName = sLogDir & "\" & oWShell.ExpandEnvironmentStrings("%COMPUTERNAME%") sLogName = sLogName & "_" & Left(DateTime.Value, 14) sLogName = sLogName & "_OLicenseClean.txt" " (Indicator: "wbemscripting."; in Source: "sample.bin"), Found string "Call Log( MSG_DESCRIPTION & instance.Description) 'EvaluationEndDate always returns a value. When an expiry date is not defined "1/1/1601" is returned. 'So avoid displaying this against RTM licenses as that date = no expiry defined. If instance.EvaluationEndDate <> "" Then Set objDate = CreateObject("WBemScripting.SWbemDateTime") objDate.Value = instance.EvaluationEndDate If objDate.GetVarDate() <> "1/1/1601" Then Call Log( MSG_LICEXPIRY & objDate.GetVarDate()) End If Set objDate = Nothing End If Select Case instance.LicenseStatus Case 0 Call Log( MSG_LICSTATUS & MSG_UNLICENSED) " (Indicator: "wbemscripting."; in Source: "sample.bin"), Found string " 'Check if KMS key installed. If yes retrieve the SKUID value. ExecuteQuery "ID, ApplicationId, Description, Name","ApplicationId = '" & OfficeAppId & "' " & "AND PartialProductKey <> NULL ",productClass For each instance in productinstances sppErrHandle "" intIsKms = InStr(UCase(instance.Description),"KMS") If intIsKms <> 0 Then strSkuId = instance.ID Exit For End If Next If strSkuId = Null Then Call Log( MSG_CMID & MSG_CMID_NOTFOUND) quitExit() End If 'Return the last Office KMS event containing containing the SKUID value for the installed KMS key. '& retrieve the CMID value from the event. oKmsEventCounter = 0 eventCode = "12288" Set objEvents = objWMI.ExecQuery _ ("Select * from Win32_NTLogEvent Where Logfile = 'Application' and " _ & "EventCode = '" & e" (Indicator: "wmi.exe"; in Source: "sample.bin"), Found string "age3 : fBypass_Stage3 = False 'Msiexec Dim fBypass_Stage4 : fBypass_Stage4 = False 'CleanUp sendmessage = "continue" 'Create required objects Set oWmiLocal = GetObject("winmgmts:{(Debug)}\\.\root\cimv2") Set oWShell = CreateObject("Wscript.Shell") Set oShellApp = CreateObject("Shell.Application") Set oFso = CreateObject("Scripting.FileSystemObject") Set oMsi = CreateObject("WindowsInstaller.Installer") Set oReg = GetObject("winmgmts:\\.\root\default:StdRegProv") 'Get environment path info sAppData = oWShell.ExpandEnvironmentStrings("%appdata%") sLocalAppData = oWShell.ExpandEnvironmentStrings("%localappdata%") sTemp = oWShell.ExpandEnvironmentStrings("%temp%") sAllUsersProfile = oWShell.ExpandEnvironmentStrings("%allusersprofile%") RegReadValue HKLM, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList", "ProfilesDirectory", sProfilesDirectory, "REG_EXPAND_SZ" If NOT oFso.FolderExists(sProfilesDirectory) Then " (Indicator: "root\cimv2"; in Source: "sample.bin"), Found string "RIPTNAME & " - Reboot Required") = VB_YES Then Dim colOS, oOS Dim oWmiReboot Set oWmiReboot = GetObject("winmgmts:{impersonationLevel=impersonate,(Shutdown)}!\\.\root\cimv2") Set colOS = oWmiReboot.ExecQuery ("Select * from Win32_OperatingSystem") For Each oOS in colOS oOS.Reboot() Next End If End If End If If NOT fQuiet Then For Each Item in Wscript.Arguments If Item = "UAC" Then wscript.stdout.write "Press to close this window" sTemp = wscript.stdin.read(1) End If Next 'Argument End If LogY "ok" wscript.quit iError End Sub 'ExitScript '======================================================================================================= '======================================================================================================= 'Stage" (Indicator: "root\cimv2"; in Source: "sample.bin"), Found string "vbCrLf End Sub 'ParseCmdLine '======================================================================================================= '------------------------------------------------------------------------------- ' CreateLog ' ' Create the removal log file '------------------------------------------------------------------------------- Sub CreateLog Dim DateTime Dim sLogName On Error Resume Next ' create the log file Set DateTime = CreateObject("WbemScripting.SWbemDateTime") DateTime.SetVarDate Now, True sLogName = sLogDir & "\" & oWShell.ExpandEnvironmentStrings("%COMPUTERNAME%") sLogName = sLogName & "_" & Left(DateTime.Value, 14) sLogName = sLogName & "_ScrubLog.txt" Err.Clear Set LogStream = oFso.CreateTextFile(sLogName, True, True) If Err <> 0 Then Err.Clear sLogDir = sScrubDir sLogName = sLogDir & "\" & oWShell.ExpandEnvironmentStrings("%COMPUTERNAME%") sLogName = sLogName & "_" & L" (Indicator: "wbemscripting."; in Source: "sample.bin"), Found string "/ '//////////////////////////////////////////////////////////////////////////////////////// Function connectWMI(strMachine,strUser,strPassword,ctype) On Error Resume Next If ctype = "" Then If strMachine = "" Or LCase(strMachine) = LCase(strLocal) Then Set objWMI = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & "." & "\root\cimv2") Else If strUser = "" And strPassword = "" Then Set objWMI = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strMachine & "\root\cimv2") Else Set objSWbemLocator = CreateObject("WbemScripting.SWbemLocator") Set objWMI = objSWbemLocator.ConnectServer _ (strMachine, "\root\cimv2", strUser, strPassword) wmiErr = CStr(Hex(Err.Number)) If Len(wmiErr) = "8" Then getDescription "0x" & wmiErr,"wmi" End If objWMI.Security_.ImpersonationLevel = 3 " (Indicator: "root\cimv2"; in Source: "sample.bin"), Found string "et. The current value return code translates to: " If fOverallSuccess Then iError = ERROR_SUCCESS LogY "result:stage5:true" Log sTmp & "SUCCESS" Else LogY "result:stage5:false" Log sTmp & "ERROR" End If End If ' Reboot handling If fRebootRequired Then LogY "reboot" sPrompt = "In order to complete uninstall, a system reboot is necessary. Would you like to reboot now?" If NOT fQuiet Then If MsgBox(sPrompt, vbYesNo, SCRIPTNAME & " - Reboot Required") = VB_YES Then Dim colOS, oOS Dim oWmiReboot Set oWmiReboot = GetObject("winmgmts:{impersonationLevel=impersonate,(Shutdown)}!\\.\root\cimv2") Set colOS = oWmiReboot.ExecQuery ("Select * from Win32_OperatingSystem") For Each oOS in colOS oOS.Reboot() Next End If End If End " (Indicator: "root\cimv2"; in Source: "sample.bin"), Found string "s in case of System context, schedule and run as interactive task If iVersionNT > 502 Then 'Vista and later oWShell.Run "SCHTASKS /Create /TN OffScrEx /TR explorer /SC ONCE /ST 12:00 /IT", 0, True oWShell.Run "SCHTASKS /Run /TN OffScrEx", 0, True oWShell.Run "SCHTASKS /Delete /TN OffScrEx /F", 0, False Else Set oAT = oWmiLocal.Get("Win32_ScheduledJob") Set DateTime = CreateObject("WbemScripting.SWbemDateTime") DateTime.SetVarDate DateAdd("n", 1, Now), True Result = oAT.Create("explorer.exe", DateTime.Value, , , , True, JobID) End If 'iVersionNT End If End Sub 'RestoreExploer '======================================================================================================= 'Returns the delimiter for a passed in string Function Delimiter (sVersion) Dim iCnt, iAsc Delimiter = " " For iCnt = 1 To Len(sVersion) iAsc = Asc(Mid(sVersion, iCnt," (Indicator: "wbemscripting."; in Source: "sample.bin"), Found string "InitObjects () Set oWmiLocal = GetObject("winmgmts:\\.\root\cimv2") Set oWShell = CreateObject("Wscript.Shell") Set oShellApp = CreateObject("Shell.Application") Set oFso = CreateObject("Scripting.FileSystemObject") Set oMsi = CreateObject("WindowsInstaller.Installer") Set oReg = GetObject("winmgmts:\\.\root\default:StdRegProv") End Sub 'InitObjects '------------------------------------------------------------------------------- ' FreeObjects ' ' Free initialized global objects '------------------------------------------------------------------------------- Sub FreeObjects () Set oWmiLocal = Nothing Set oWShell = Nothing Set oShellApp = Nothing Set oFso = Nothing Set oMsi = Nothing Set oReg = Nothing End Sub 'FreeObjects '------------------------------------------------------------------------------- ' ParseCmdLine ' ' Command line parser '---------------------" (Indicator: "root\cimv2"; in Source: "sample.bin"), Found string " If Not fLogInitialized Then CreateLog LogH2 "Arguments: " & sArguments & vbCrLf End Sub 'ParseCmdLine '======================================================================================================= '------------------------------------------------------------------------------- ' CreateLog ' ' Create the removal log file '------------------------------------------------------------------------------- Sub CreateLog Dim DateTime Dim sLogName On Error Resume Next ' create the log file Set DateTime = CreateObject("WbemScripting.SWbemDateTime") DateTime.SetVarDate Now, True sLogName = sLogDir & "\" & oWShell.ExpandEnvironmentStrings("%COMPUTERNAME%") sLogName = sLogName & "_" & Left(DateTime.Value, 14) sLogName = sLogName & "_ScrubLog.txt" Err.Clear Set LogStream = oFso.CreateTextFile(sLogName, True, True) If Err <> 0 Then Err.Clear sLogDir = sScrubDir sLogName = sLogDir & "\" & oWShell" (Indicator: "wbemscripting."; in Source: "sample.bin"), Found string "" If fOverallSuccess Then iError = ERROR_SUCCESS Log sTmp & "SUCCESS" Else Log sTmp & "ERROR" End If End If LogH2 "Removal end." ' Reboot handling If fRebootRequired Then LogY "reboot" Log vbCrLf & "A restart is required to complete the operation!" sPrompt = "In order to complete uninstall, a system reboot is necessary. Would you like to reboot now?" If NOT (fQuiet OR fPassive OR fNoReboot) Then If MsgBox(sPrompt, vbYesNo, SCRIPTNAME & " - Reboot Required") = VB_YES Then Dim colOS, oOS Dim oWmiReboot Set oWmiReboot = GetObject("winmgmts:{impersonationLevel=impersonate,(Shutdown)}!\\.\root\cimv2") Set colOS = oWmiReboot.ExecQuery ("Select * from Win32_OperatingSystem") For Each oOS in colOS oOS.Reboot() Next End If End If En" (Indicator: "root\cimv2"; in Source: "sample.bin"), Found string "t fail script execution when getting the return value from file fails If oFso.FileExists(sScrubDir & "\" & RETVALFILE) Then Set RetValFileStream = oFso.OpenTextFile(sScrubDir & "\" & RETVALFILE, 1, False, -2) GetRetValFromFile = RetValFileStream.ReadAll RetValFileStream.Close Exit Function End If Err.Clear On Error Goto 0 GetRetValFromFile = ERROR_UNKNOWN End Function 'GetRetValFromFile '------------------------------------------------------------------------------- ' CreateLog ' ' Create the removal log file '------------------------------------------------------------------------------- Sub CreateLog Dim DateTime Dim sLogName On Error Resume Next ' create the log file Set DateTime = CreateObject("WbemScripting.SWbemDateTime") DateTime.SetVarDate Now, True sLogName = sLogDir & "\" & oWShell.ExpandEnvironmentStrings("%COMPUTERNAME%") sLogName = sLogName & "_" & Left(DateTime.Value, 14) " (Indicator: "wbemscripting."; in Source: "sample.bin"), Found string " CheckError "CloseOfficeApps: " & "Process.Name" fWait = True End If End If 'ExcecutablePath Next 'prop End If Next 'Process If fWait Then wscript.sleep 10000 End If LogOnly " End Action: CloseOfficeApps" End Sub 'CloseOfficeApps '======================================================================================================= 'CVHBS.exe has no true unattended option 'To ensure quiet automation does not break this dialog box handler monitors the process Sub CvhbsDialogHandler Dim CvhbsQuiet Dim sRunCmd, sQuote Set CvhbsQuiet = oFso.CreateTextFile(sScrubDir&"\CvhbsQuiet.vbs", True, True) sQuote = "&chr(34)&" CvhbsQuiet.WriteLine "On Error Resume Next" CvhbsQuiet.WriteLine "Set oShell = CreateObject("&chr(34)&"WScript.Shell"&chr(34)&")" CvhbsQuiet.WriteLine "Set oWmiLocal = GetObject("&chr(34)&"winmgmts:\\.\root\cimv2"&chr(34)&")" CvhbsQuiet.WriteLine "" (Indicator: "root\cimv2"; in Source: "sample.bin"), Found string "lid To: " & vt) Call Log( MSG_SEPERATE) End Function '//////////////////////////////////////////////////////////////////////////////////////// '//////////////////////////////////////////////////////////////////////////////////////// Function ExecuteQuery(strSelect,strWhere,strClass) Err.Clear If strWhere = "" Then Set productinstances = objWMI.ExecQuery("SELECT " & strSelect & " FROM " & strClass) Else Set productinstances = objWMI.ExecQuery("SELECT " & strSelect & " FROM " & strClass & " WHERE " & strWhere) End If sppErrHandle "" End Function '//////////////////////////////////////////////////////////////////////////////////////// '//////////////////////////////////////////////////////////////////////////////////////// Function performLicAction(strCommand,strValue,strMachine) On Error Resume Next If strCommand = "/dhistorykms" Or strCommand = "/dhistoryacterr" Then verifyFileExists currentDir & "slerror.xml" If strCommand = "/dhistorykms" " (Indicator: "wmi.exe"; in Source: "sample.bin")32:T10b3,Observed string: " End If Next 'prod Case Else End Select If fAdd Then CompVerbose.WriteLine " Added as new file to dictionary" oDic.Add sPath & "\" & sFile, sFile FileList.WriteLine sFile & vbTab & sPath & "\" & sFile If Len(sFile)>4 Then sFile = LCase(sFile) If Right(sFile, 4) = ".exe" Then If NOT dicApps.Exists(sFile) Then Select Case sFile Case "setup.exe", "ose.exe", "osppsvc.exe", "explorer.exe", "cvhsvc.exe", "sftvsa.exe", "sftlist.exe", "sftplay.exe", "sf" (Indicator: ""sftp") in Source: sample.bin, Observed string: " oDic.Add sPath & "\" & sFile,sFile FileList.WriteLine sFile & vbTab & sPath & "\" & sFile If Len(sFile)>4 Then sFile = LCase(sFile) If Right(sFile,4) = ".exe" Then If NOT dicApps.Exists(sFile) Then Select Case sFile Case "setup.exe","ose.exe","osppsvc.exe","explorer.exe","cvhsvc.exe","sftvsa.exe","sftlist.exe","sftplay.exe","sftvol.exe","sftfs.exe" Case Else dicApps.Add sFile,LCase(sPath) & "\" & sFile CompVerbose.WriteLine " Added to the list of processes that need to be closed." " (Indicator: ""sftp") in Source: sample.bin, Observed string: "'Remove the Softgrid services (App-V and Click2Run) Sub RemoveSG If fKeepSG Then Exit Sub On Error Resume Next Log " Softgrid CleanUp" DeleteService("cvhsvc") DeleteService("SftList") DeleteService("SftPlay") DeleteService("SftVol") DeleteService("SftFs") DeleteService("SftVsa") 'Delete the folder DeleteFolder sAppdata & "\SoftGrid Client" DeleteFolder sLocalAppData & "\SoftGrid Client" DeleteFolder sProgramData & "\Microsoft\Application Virtualization Client\SoftGrid Client" DeleteFolder sProgramData & "\Microsoft\Application Virtualization Client" DeleteFolder sProgramfiles & "\Microsoft\Microsoft Application Virtualization Client" DeleteFolder sProgramfiles & "\Microsoft Application Virtualization Client" 'Delete the registration RegDeleteKey HKLM, "SYSTEM\CurrentControlSet\Services\cvhsvc" RegDeleteKey HKLM, "SYSTEM\CurrentControlSet\Services\sftfs" RegDeleteKey HKLM, "SYSTEM\CurrentControlSet\Services" (Indicator: ""sftp") in Source: sample.bin, Observed string: "='cvh.exe'") For Each Process in Processes Log " - End process " & Process.Name iRet = Process.Terminate() CheckError "ResetSG: " & "Process.Name" Next 'Process 'Close running instances Set Processes = oWmiLocal.ExecQuery("Select * From Win32_Process") For Each Process in Processes If dicApps.Exists(LCase(Process.Name)) Then Log " - End process " & Process.Name iRet = Process.Terminate() CheckError "CloseOfficeApps: " & "Process.Name" End If Next 'Process If fWait Then wscript.sleep 10000 'Stop all SoftGrid services iRet = StopService("cvhsvc") iRet = StopService("SftList") iRet = StopService("SftPlay") iRet = StopService("SftVol") iRet = StopService("SftFs") iRet = StopService("SftVsa") End Sub 'ResetSG '======================================================================================================= 'File cleanup operations for the Local" (Indicator: ""sftp") in Source: sample.bin33:Tccf8,Found string "ers\Groove Explorer Icon Overlay 1 (GFS Unread Stub)\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2 (GFS Stub)\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 3 (GFS Folder)\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 4 (GFS Unread Mark)\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\" Case "15" Case Else End Select 'Win32Assemblies LogH2 "Win32Assemblies" If RegEnumKey(HKCR,"Installer\Win32Assembl" (Indicator: "software\microsoft\windows\currentversion\explorer\browser helper objects"; in Source: "sample.bin"), Found string "ers\Groove Explorer Icon Overlay 1 (GFS Unread Stub)\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2 (GFS Stub)\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 3 (GFS Folder)\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 4 (GFS Unread Mark)\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\" Case "15" Case Else End Select 'Win32Assemblies LogH2 "Win32Assemblies" If RegEnumKey(HKCR,"Installer\Win32Assembl" (Indicator: "software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers"; in Source: "sample.bin"), Found string "WARE\Microsoft\Office\15.0\CleanC2R", "Rerun", sValue, "REG_DWORD") Then ' Rerun has already been tried LogH2 "Error: Removal failed" SetError ERROR_DCAF_FAILURE Exit Sub End If fRebootRequired = True SetError ERROR_REBOOT_REQUIRED SetError ERROR_INCOMPLETE ' cache the script to the local scrub folder oFso.CopyFile WScript.scriptFullName, sScrubDir & "\" & SCRIPTFILE oReg.CreateKey HKLM, "SOFTWARE" oReg.CreateKey HKLM, "SOFTWARE\Microsoft" oReg.CreateKey HKLM, "SOFTWARE\Microsoft\Office" oReg.CreateKey HKLM, "SOFTWARE\Microsoft\Office\15.0" oReg.CreateKey HKLM, "SOFTWARE\Microsoft\Office\15.0\CleanC2R" oReg.SetDWordValue HKLM, "SOFTWARE\Microsoft\Office\15.0\CleanC2R", "Rerun", 1 fSetRunOnce = True ' oReg.CreateKey HKCU, "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" ' oReg.SetStringValue HKCU, "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce", "CleanC2R", "cscript.exe " & chr(34) & sScr" (Indicator: "software\microsoft\windows\currentversion\run"; in Source: "sample.bin"), Found string "WARE\Microsoft\Office\15.0\CleanC2R", "Rerun", sValue, "REG_DWORD") Then ' Rerun has already been tried LogH2 "Error: Removal failed" SetError ERROR_DCAF_FAILURE Exit Sub End If fRebootRequired = True SetError ERROR_REBOOT_REQUIRED SetError ERROR_INCOMPLETE ' cache the script to the local scrub folder oFso.CopyFile WScript.scriptFullName, sScrubDir & "\" & SCRIPTFILE oReg.CreateKey HKLM, "SOFTWARE" oReg.CreateKey HKLM, "SOFTWARE\Microsoft" oReg.CreateKey HKLM, "SOFTWARE\Microsoft\Office" oReg.CreateKey HKLM, "SOFTWARE\Microsoft\Office\15.0" oReg.CreateKey HKLM, "SOFTWARE\Microsoft\Office\15.0\CleanC2R" oReg.SetDWordValue HKLM, "SOFTWARE\Microsoft\Office\15.0\CleanC2R", "Rerun", 1 fSetRunOnce = True ' oReg.CreateKey HKCU, "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" ' oReg.SetStringValue HKCU, "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce", "CleanC2R", "cscript.exe " & chr(34) & sScr" (Indicator: "software\microsoft\windows\currentversion\runonce"; in Source: "sample.bin"), Found string "KLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{D66DC78C-4F61-447F-942B-3FB6980118CF}", False RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\" 'Groove Extensions RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\","{B5A7F190-DDA6-4420-B3BA-52453494E6CD}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{99FD978C-D287-4F50-827F-B2C658EDA8E7}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{920E6DB1-9907-4370-B3A0-BAFC03D81399}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{16F3DD" (Indicator: "software\microsoft\windows\currentversion\explorer\browser helper objects"; in Source: "sample.bin"), Found string "KLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{D66DC78C-4F61-447F-942B-3FB6980118CF}", False RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\" 'Groove Extensions RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\","{B5A7F190-DDA6-4420-B3BA-52453494E6CD}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{99FD978C-D287-4F50-827F-B2C658EDA8E7}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{920E6DB1-9907-4370-B3A0-BAFC03D81399}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{16F3DD" (Indicator: "software\microsoft\windows\currentversion\explorer\shellexecutehooks"; in Source: "sample.bin"), Found string "ls\Text Converters\Import\MEWord12\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\Word12\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\Word97\" RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Run\", "GrooveMonitor", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Run\", "LobiServer", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Run\", "BCSSync", False RegDeleteKey HKLM,"SYSTEM\CurrentControlSet\Services\Outlook\" End If RegDeleteValue HKLM,"SOFTWARE\Microsoft\Office\Common\OffDiag\Location\", OVERSIONMAJOR, False RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Office\" & OVERSION & "\" RegDeleteValue HKLM,"SOFTWARE\Microsoft\Office\Common\OffDiag\Location\", OVERSIONMAJOR, False RegDeleteKey HKLM,"SOFTWARE\Microso" (Indicator: "software\microsoft\windows\currentversion\run"; in Source: "sample.bin"), Found string "Shared Tools\Text Converters\Import\MEWord12\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\Word12\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\Word97\" RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Run\", "GrooveMonitor", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Run\", "LobiServer", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Run\", "BCSSync", False RegDeleteKey HKLM,"SYSTEM\CurrentControlSet\Services\Outlook\" End If RegDeleteValue HKLM,"SOFTWARE\Microsoft\Office\Common\OffDiag\Location\", OVERSIONMAJOR, False RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Office\" & OVERSION & "\" RegDeleteValue HKLM,"SOFTWARE\Microsoft\Office\Common\OffDiag\Location\", OVERSIONMAJOR, False RegDeleteKey HKLM,"SOFTWA" (Indicator: "software\microsoft\windows\currentversion\run"; in Source: "sample.bin"), Found string "Text Converters\Export\Word97\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\MEWord12\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\Word12\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\Word97\" RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\", "GrooveMonitor", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\", "LobiServer", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\", "BCSSync", False RegDeleteKey HKLM, "SYSTEM\CurrentControlSet\Services\Outlook\" End If RegDeleteValue HKLM, "SOFTWARE\Microsoft\Office\Common\OffDiag\Location\", OVERSIONMAJOR, False RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Office\" & OVERSION & "\" RegDeleteValue HKLM, "SOFTWARE\Micros" (Indicator: "software\microsoft\windows\currentversion\run"; in Source: "sample.bin"), Found string "egDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{D66DC78C-4F61-447F-942B-3FB6980118CF}", False RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\" 'Groove Extensions RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\", "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{99FD978C-D287-4F50-827F-B2C658EDA8E7}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{920E6DB1-9907-4370-B3A0-BAFC03D81399}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions" (Indicator: "software\microsoft\windows\currentversion\explorer\browser helper objects"; in Source: "sample.bin"), Found string "egDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{D66DC78C-4F61-447F-942B-3FB6980118CF}", False RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\" 'Groove Extensions RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\", "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{99FD978C-D287-4F50-827F-B2C658EDA8E7}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{920E6DB1-9907-4370-B3A0-BAFC03D81399}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions" (Indicator: "software\microsoft\windows\currentversion\explorer\shellexecutehooks"; in Source: "sample.bin"), Found string "lay 1 (GFS Unread Stub)\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2 (GFS Stub)\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 3 (GFS Folder)\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 4 (GFS Unread Mark)\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\" Case 15 Case Else End Select 'Win32Assemblies LogH2 "Win32Assemblies" If RegEnumKey(HKCR,"Installer\Win32Assemblies\",arrKeys) Then " (Indicator: "software\microsoft\windows\currentversion\explorer\browser helper objects"; in Source: "sample.bin"), Found string "lay 1 (GFS Unread Stub)\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2 (GFS Stub)\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 3 (GFS Folder)\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 4 (GFS Unread Mark)\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\" Case 15 Case Else End Select 'Win32Assemblies LogH2 "Win32Assemblies" If RegEnumKey(HKCR,"Installer\Win32Assemblies\",arrKeys) Then " (Indicator: "software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers"; in Source: "sample.bin"), Found string "6CD}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{A449600E-1DC6-4232-B948-9BD794D62056}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{3D60EDA7-9AB4-4DA8-864C-D9B5F2E7281D}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{387E725D-DC16-4D76-B310-2C93ED4752A0}", False RegDeleteKey HKLM, "SOFTWARE\Classes\*\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM, "SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM, "SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM, "SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKL" (Indicator: "software\classes\allfilesystemobjects\shellex\contextmenuhandlers"; in Source: "sample.bin"), Found string "6CD}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{A449600E-1DC6-4232-B948-9BD794D62056}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{3D60EDA7-9AB4-4DA8-864C-D9B5F2E7281D}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{387E725D-DC16-4D76-B310-2C93ED4752A0}", False RegDeleteKey HKLM, "SOFTWARE\Classes\*\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM, "SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM, "SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM, "SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKL" (Indicator: "software\classes\directory\shellex\contextmenuhandlers"; in Source: "sample.bin"), Found string "6CD}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{A449600E-1DC6-4232-B948-9BD794D62056}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{3D60EDA7-9AB4-4DA8-864C-D9B5F2E7281D}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{387E725D-DC16-4D76-B310-2C93ED4752A0}", False RegDeleteKey HKLM, "SOFTWARE\Classes\*\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM, "SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM, "SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM, "SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKL" (Indicator: "shellex\contextmenuhandlers"; in Source: "sample.bin"), Found string "sses\Directory\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 1 (GFS Unread Stub)\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2 (GFS Stub)\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 3 (GFS Folder)\" RegDeleteKey HKLM,"S" (Indicator: "software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers"; in Source: "sample.bin"), Found string "sses\Directory\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 1 (GFS Unread Stub)\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2 (GFS Stub)\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 3 (GFS Folder)\" RegDeleteKey HKLM,"S" (Indicator: "shellex\contextmenuhandlers"; in Source: "sample.bin"), Found string " Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 1 (GFS Unread Stub)\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2 (GFS Stub)\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 3 (GFS Folder)\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 4 (GFS Unread Mark)\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\" Case 15 " (Indicator: "software\microsoft\windows\currentversion\explorer\browser helper objects"; in Source: "sample.bin"), Found string " Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 1 (GFS Unread Stub)\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2 (GFS Stub)\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 3 (GFS Folder)\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 4 (GFS Unread Mark)\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\" Case 15 " (Indicator: "software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers"; in Source: "sample.bin"), Found string "Each name in arrNames If RegReadValue(HKLM, sSubKeyName, name, sValue, "REG_SZ") Then If IsC2R(sValue) Then RegDeleteValue HKLM, sSubKeyName, name, False End If Next 'item End If RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run", "Lync15", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run", "Lync16", False ' ARP ' Note: configuration entries have already been removed ' as part of the 'Uninstall' stage If RegEnumKey(HKLM, REG_ARP, arrKeys) Then For Each item in arrKeys If Len(item) > 37 Then sGuid = UCase(Left(item, 38)) If CheckDelete(sGuid) Then RegDeleteKey HKLM, REG_ARP & item & "\" End If 'Len(Item)>37 Next 'Item End If ' UpgradeCodes, WI config, WI global config LogH2 "Scan Windows Installer metadata for removeable UpgradeCodes" For iLoopCnt = 1 to 5 Select Case " (Indicator: "software\microsoft\windows\currentversion\run"; in Source: "sample.bin"), Found string "OFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 4 (GFS Unread Mark)\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\" Case Else End Select 'Win32Assemblies LogH2 "Win32Assemblies" If RegEnumKey(HKCR,"Installer\Win32Assemblies\",arrKeys) Then For Each Item in arrKeys If InStr(UCase(Item),OREF)>0 Then RegDeleteKey HKCR,"Installer\Win32Assemblies\"&Item & "\" Next 'Item End If 'RegEnumKey 'Groove blocks reinstall if it locates groove.exe over this key If RegKeyExists(HKCR,"GrooveFile\Shell\Open\Command\") Then sValue = "" RegReadValue HKCR,"GrooveFile\Shell\Open\Command\","",sValue,"REG_SZ" If InStr(sValue,"\"&OREF&"\")>0 Then RegDeleteKey HKCR,"GrooveFile\" End If 'RegKeyExists End If 'f" (Indicator: "software\microsoft\windows\currentversion\explorer\browser helper objects"; in Source: "sample.bin"), Found string "E\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{B5A7F190-DDA6-4420-B3BA-52453494E6CD}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{A449600E-1DC6-4232-B948-9BD794D62056}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{3D60EDA7-9AB4-4DA8-864C-D9B5F2E7281D}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{387E725D-DC16-4D76-B310-2C93ED4752A0}", False RegDeleteKey HKLM,"SOFTWARE\Classes\*\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Cla" (Indicator: "software\classes\allfilesystemobjects\shellex\contextmenuhandlers"; in Source: "sample.bin"), Found string "E\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{B5A7F190-DDA6-4420-B3BA-52453494E6CD}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{A449600E-1DC6-4232-B948-9BD794D62056}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{3D60EDA7-9AB4-4DA8-864C-D9B5F2E7281D}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{387E725D-DC16-4D76-B310-2C93ED4752A0}", False RegDeleteKey HKLM,"SOFTWARE\Classes\*\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Cla" (Indicator: "shellex\contextmenuhandlers"; in Source: "sample.bin"), Found string "crosoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{3D60EDA7-9AB4-4DA8-864C-D9B5F2E7281D}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{387E725D-DC16-4D76-B310-2C93ED4752A0}", False RegDeleteKey HKLM,"SOFTWARE\Classes\*\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifi" (Indicator: "software\classes\allfilesystemobjects\shellex\contextmenuhandlers"; in Source: "sample.bin"), Found string "crosoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{3D60EDA7-9AB4-4DA8-864C-D9B5F2E7281D}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{387E725D-DC16-4D76-B310-2C93ED4752A0}", False RegDeleteKey HKLM,"SOFTWARE\Classes\*\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifi" (Indicator: "software\classes\directory\shellex\contextmenuhandlers"; in Source: "sample.bin"), Found string "crosoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{3D60EDA7-9AB4-4DA8-864C-D9B5F2E7281D}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{387E725D-DC16-4D76-B310-2C93ED4752A0}", False RegDeleteKey HKLM,"SOFTWARE\Classes\*\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifi" (Indicator: "shellex\contextmenuhandlers"; in Source: "sample.bin"), Found string "\Shared Tools\Text Converters\Export\Word97\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\MEWord12\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\Word12\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\Word97\" RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\", "GrooveMonitor", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\", "LobiServer", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\", "BCSSync", False RegDeleteKey HKLM, "SYSTEM\CurrentControlSet\Services\Outlook\" End If RegDeleteValue HKLM, "SOFTWARE\Microsoft\Office\Common\OffDiag\Location\", OVERSIONMAJOR, False RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Office\" & OVERSION & "\" RegDeleteValue HKLM, "S" (Indicator: "software\microsoft\windows\currentversion\run"; in Source: "sample.bin"), Found string "2B-3FB6980118CF}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{46137B78-0EC3-426D-8B89-FF7C3A458B5E}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{8BA85C75-763B-4103-94EB-9470F12FE0F7}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{CD55129A-B1A1-438E-A425-CEBC7DC684EE}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}", False ' BHO RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-495" (Indicator: "software\microsoft\windows\currentversion\explorer\browser helper objects"; in Source: "sample.bin"), Found string "e RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{7CCA70DB-DE7A-4FB7-9B2B-52E2335A3B5A}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{506F4668-F13E-4AA1-BB04-B43203AB3CC0}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{D66DC78C-4F61-447F-942B-3FB6980118CF}", False RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\" 'Groove Extensions RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\","{B5A7F190-DDA6-4420-B3BA-52453494E6CD}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell" (Indicator: "software\microsoft\windows\currentversion\explorer\browser helper objects"; in Source: "sample.bin"), Found string "e RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{7CCA70DB-DE7A-4FB7-9B2B-52E2335A3B5A}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{506F4668-F13E-4AA1-BB04-B43203AB3CC0}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{D66DC78C-4F61-447F-942B-3FB6980118CF}", False RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\" 'Groove Extensions RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\","{B5A7F190-DDA6-4420-B3BA-52453494E6CD}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell" (Indicator: "software\microsoft\windows\currentversion\explorer\shellexecutehooks"; in Source: "sample.bin"), Found string "ubDir & "\" & SCRIPTFILE & chr(34) End Sub '------------------------------------------------------------------------------- ' SetRunOnce ' ' Create a RunOnce entry to resume setup after a reboot '------------------------------------------------------------------------------- Sub SetRunOnce Dim sValue oReg.CreateKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion" oReg.CreateKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" sValue = "cscript.exe " & chr(34) & sScrubDir & "\" & SCRIPTFILE & chr(34) & " /NoElevate /Relaunched" oReg.SetStringValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce", "O15CleanUp", sValue End Sub 'SetRunOnce " (Indicator: "software\microsoft\windows\currentversion\run"; in Source: "sample.bin"), Found string "ubDir & "\" & SCRIPTFILE & chr(34) End Sub '------------------------------------------------------------------------------- ' SetRunOnce ' ' Create a RunOnce entry to resume setup after a reboot '------------------------------------------------------------------------------- Sub SetRunOnce Dim sValue oReg.CreateKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion" oReg.CreateKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" sValue = "cscript.exe " & chr(34) & sScrubDir & "\" & SCRIPTFILE & chr(34) & " /NoElevate /Relaunched" oReg.SetStringValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce", "O15CleanUp", sValue End Sub 'SetRunOnce " (Indicator: "software\microsoft\windows\currentversion\runonce"; in Source: "sample.bin"), Found string "t\Office\15.0\ClickToRunStore" RegDeleteKey HKCU, "SOFTWARE\Microsoft\Office\16.0\ClickToRun" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\16.0\ClickToRun" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\16.0\ClickToRunStore" RegDeleteKey HKCU, "SOFTWARE\Microsoft\Office\ClickToRun" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\ClickToRun" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\ClickToRunStore" ' Office key in HKLM If Not dicKeepSku.Count > 0 Then 'double calls to ensure Wow6432 gets cleared out as well RegDeleteKey HKLM, "Software\Microsoft\Office\15.0" RegDeleteKey HKLM, "Software\Microsoft\Office\15.0" RegDeleteKey HKLM, "Software\Microsoft\Office\16.0" RegDeleteKey HKLM, "Software\Microsoft\Office\16.0" End If ClearOfficeHKLM "SOFTWARE\Microsoft\Office" ' Run key sSubKeyName = "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" If RegEnumValues (HKLM, sSubKeyName, arrNames, arrTypes) Then For " (Indicator: "software\microsoft\windows\currentversion\run"; in Source: "sample.bin"), Found string "9-BA22-42B3008E02FF}" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}" RegDeleteKey HKLM, "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}" RegDeleteKey HKLM, "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}" RegDeleteKey HKLM, "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}" ' OneNote Namespace Extension for Desktop RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}" ' Web Sites RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\Namespace\{B28AA736-876B-46DA-B3A8-84C5E30BA492}" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Exp" (Indicator: "software\microsoft\windows\currentversion\explorer\browser helper objects"; in Source: "sample.bin"), Found string "9-BA22-42B3008E02FF}" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}" RegDeleteKey HKLM, "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}" RegDeleteKey HKLM, "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}" RegDeleteKey HKLM, "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}" ' OneNote Namespace Extension for Desktop RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}" ' Web Sites RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\Namespace\{B28AA736-876B-46DA-B3A8-84C5E30BA492}" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Exp" (Indicator: "software\wow6432node\microsoft\windows\currentversion\explorer\browser helper objects"; in Source: "sample.bin"), Found string "FB7-9B2B-52E2335A3B5A}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{506F4668-F13E-4AA1-BB04-B43203AB3CC0}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{D66DC78C-4F61-447F-942B-3FB6980118CF}", False RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\" 'Groove Extensions RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\", "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{99FD978C-D287-4F50-827F-B2C658EDA8E7}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}", False RegDeleteValue HKLM, "SOFTWA" (Indicator: "software\microsoft\windows\currentversion\explorer\browser helper objects"; in Source: "sample.bin"), Found string "FB7-9B2B-52E2335A3B5A}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{506F4668-F13E-4AA1-BB04-B43203AB3CC0}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{D66DC78C-4F61-447F-942B-3FB6980118CF}", False RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\" 'Groove Extensions RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\", "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{99FD978C-D287-4F50-827F-B2C658EDA8E7}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}", False RegDeleteValue HKLM, "SOFTWA" (Indicator: "software\microsoft\windows\currentversion\explorer\shellexecutehooks"; in Source: "sample.bin"), Found string "s\CurrentVersion\Shell Extensions\Approved\", "{A449600E-1DC6-4232-B948-9BD794D62056}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{3D60EDA7-9AB4-4DA8-864C-D9B5F2E7281D}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{387E725D-DC16-4D76-B310-2C93ED4752A0}", False RegDeleteKey HKLM, "SOFTWARE\Classes\*\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM, "SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM, "SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM, "SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM, "SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\XXX" (Indicator: "software\classes\allfilesystemobjects\shellex\contextmenuhandlers"; in Source: "sample.bin"), Found string "s\CurrentVersion\Shell Extensions\Approved\", "{A449600E-1DC6-4232-B948-9BD794D62056}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{3D60EDA7-9AB4-4DA8-864C-D9B5F2E7281D}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{387E725D-DC16-4D76-B310-2C93ED4752A0}", False RegDeleteKey HKLM, "SOFTWARE\Classes\*\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM, "SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM, "SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM, "SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM, "SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\XXX" (Indicator: "software\classes\directory\shellex\contextmenuhandlers"; in Source: "sample.bin"), Found string "s\CurrentVersion\Shell Extensions\Approved\", "{A449600E-1DC6-4232-B948-9BD794D62056}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{3D60EDA7-9AB4-4DA8-864C-D9B5F2E7281D}", False RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{387E725D-DC16-4D76-B310-2C93ED4752A0}", False RegDeleteKey HKLM, "SOFTWARE\Classes\*\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM, "SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM, "SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM, "SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM, "SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\XXX" (Indicator: "shellex\contextmenuhandlers"; in Source: "sample.bin"), Found string "M, "SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 1 (GFS Unread Stub)\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2 (GFS Stub)\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 3 (GFS Folder)\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 4 (GFS Unread Mark)\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Object" (Indicator: "software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers"; in Source: "sample.bin"), Found string "M, "SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 1 (GFS Unread Stub)\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2 (GFS Stub)\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 3 (GFS Folder)\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 4 (GFS Unread Mark)\" RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Object" (Indicator: "shellex\contextmenuhandlers"; in Source: "sample.bin"), Found string "ion\Shell Extensions\Approved\","{3D60EDA7-9AB4-4DA8-864C-D9B5F2E7281D}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{387E725D-DC16-4D76-B310-2C93ED4752A0}", False RegDeleteKey HKLM,"SOFTWARE\Classes\*\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Over" (Indicator: "software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers"; in Source: "sample.bin"), Found string "ion\Shell Extensions\Approved\","{3D60EDA7-9AB4-4DA8-864C-D9B5F2E7281D}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{387E725D-DC16-4D76-B310-2C93ED4752A0}", False RegDeleteKey HKLM,"SOFTWARE\Classes\*\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Over" (Indicator: "software\classes\allfilesystemobjects\shellex\contextmenuhandlers"; in Source: "sample.bin"), Found string "ion\Shell Extensions\Approved\","{3D60EDA7-9AB4-4DA8-864C-D9B5F2E7281D}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{387E725D-DC16-4D76-B310-2C93ED4752A0}", False RegDeleteKey HKLM,"SOFTWARE\Classes\*\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Over" (Indicator: "software\classes\directory\shellex\contextmenuhandlers"; in Source: "sample.bin"), Found string "ion\Shell Extensions\Approved\","{3D60EDA7-9AB4-4DA8-864C-D9B5F2E7281D}", False RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{387E725D-DC16-4D76-B310-2C93ED4752A0}", False RegDeleteKey HKLM,"SOFTWARE\Classes\*\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\" RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Over" (Indicator: "shellex\contextmenuhandlers"; in Source: "sample.bin")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"4d83c25a5ea8518b153451d8ecb80e24b0f4b72ecdada47f7ebe96e956867b95","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":70,"unified_at_epoch_ms":1793800127063,"unified_at":"2026-11-04T13:48:47.063Z","metadata":{"hashes":{"sha256":"4d83c25a5ea8518b153451d8ecb80e24b0f4b72ecdada47f7ebe96e956867b95","sha1":"8394d3b9b08aade2f914c987f9218c9543886c9b","md5":"106609ce242f7b20a4510b103a3ed411"},"file_info":{"file_name":"4d83c25a5ea8518b153451d8ecb80e24b0f4b72ecdada47f7ebe96e956867b95","file_type":["pedll","executable"],"file_type_id":"dll","file_size":2595216,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793799912000,"last_seen":1793800109000,"last_multi_scan":1793800109000}},"detections":{"summary":{"verdict":"suspicious","score":70,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":29},"sandbox_signatures":{"informative_count":37,"suspicious_count":7,"malicious_count":0,"total":44},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Found WMI keywords in script (string)"},{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to stop windows services"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Able to retrieve Windows product key"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Reference explorer.exe process"},{"type":"informative","value":"Contains ability to load content from specified source"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate running processes using Tasklist"},{"type":"informative","value":"References to WMI query strings used for process discovery"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"suspicious","value":"Contains ability to scan the ARP cache"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify COM objects"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute an application (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify auto-execute functionality"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"suspicious","value":"Able to delete scheduled task(s)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Able to unregister service from Service Control Manager"},{"type":"informative","value":"Contains ability to start a service (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"YARA signature match - RSA algorithm (keys)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found mail information locations related strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Data from Removable Media","attack_id":"T1025","attack_id_wiki":"https://attack.mitre.org/techniques/T1025","identifiers":[{"type":"informative","value":"Able to retrieve system driver type"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to transfer files remotely using SFTP"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Impairment","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"suspicious","value":"Contains scheduled task related strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to retrieve geographical location"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RSA algorithm (keys)","description":"YARA signature for RSA public and private key matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-62","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$27","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to load content from specified source","description":"$28","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-554","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"file/memory contains long string with (Indicator: \"StartService\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-209","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"file/memory contains long string with (Indicator: \"cmd.exe /c\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-174","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found WMI keywords in script (string)","description":"Observed WMI keyword:\"{impersonationLevel=impersonate}\" [Source: sample.bin]","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-155","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"file/memory contains long string with (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1570","id":"string-322","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - reateTextFile(\"\\\\.\\pipe\\offscrub_pipe\", True)\n\tpipeStream.WriteLine(sLog)\n\tpipeStream.Close()\n WScript.Sleep 5000\nEnd Sub\n\n'-------------------------------------------------------------------------------\n' ExitScript\n'\n' Returncode and reboot handler \n'-------------------------------------------------------------------------------\nSub ExitScript\n Dim sPrompt\n\n ' Update cached error and quit\n '-----------------------------\n SetRetVal iError\n Log vbCrLf & \"For detailed logging please refer to the log in folder \" & chr(34) & sScrubDir & chr(34) & vbCrLf\n\n ' log result\n If CBool(iError AND ERROR_INCOMPLETE) Then \n LogH2 \"Removal result: \" & iError & \" - INCOMPLETE. Uninstall requires a system reboot to complete.\"\n Else\n sTmp = \" - SUCCESS\"\n If CBool(iError AND ERROR_USERCANCEL) Then sTmp = \" - USER CANCELED\"\n If CBool(iError AND ERROR_FAIL) Then sTmp = \" - FAIL\"\n LogH2 \"Removal result: \" & iError & sTmp\n End If\n If","origin":"sample.bin","mitre_attack_id":"T1559","id":"string-146","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"$29","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-55","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"file/memory contains long string with (Indicator: \" Win32_Process\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-513","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"file/memory contains long string with (Indicator: \"select * from \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-433","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"ExpandEnvironmentStrings (in long string)\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"file/memory contains long string with (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-663","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"file/memory contains long string with (Indicator: \"GetFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"file/memory contains long string with (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system driver type","description":"file/memory contains long string with (Indicator: \".drivetype\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1025","id":"string-713","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$2a","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"file/memory contains long string with (Indicator: \"set \"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"\"set \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-326","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve geographical location","description":"$2b","origin":"sample.bin","mitre_attack_id":"T1614","id":"string-575","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve Windows product key","description":"file/memory contains long string(Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-694","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"file/memory contains long string with (Indicator: \" Win32_Process\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \" Win32_Service\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \" Win32_OperatingSystem\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \" Win32_Directory\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \" Win32_ntlogevent\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \" Win32_ComputerSystem\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \" Win32_LogicalDisk\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-507","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegEnumKey (in long string)\" in \"sample.bin\", Found registry query API: \"RegRead (in long string)\" in \"sample.bin\", Found registry query API: \"RegEnumValue (in long string)\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-229","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"$2c","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-96","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"file/memory contains long string with (Indicator: \"tasklist\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"tasklist /fi\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"sc delete\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-126","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate running processes using Tasklist","description":"$2d","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-517","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found mail information locations related strings","description":"$2e","origin":"sample.bin","mitre_attack_id":"T1114","id":"string-129","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"file/memory contains long string with (Indicator: \"\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1056.001","id":"string-556","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"aes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKey (in long string)\" in \"sample.bin\", Found registry deletion API: \"RegDeleteValue (in long string)\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-230","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"file/memory contains long string with (Indicator: \"DeleteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to stop windows services","description":"file/memory contains long string with (Indicator: \"net stop\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-522","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"System Security","name":"Found registry location strings which can modify COM objects","description":"Observed string: \"software\\classes\\clsid\" [Source: sample.bin]","origin":"sample.bin","mitre_attack_id":"T1546.015","id":"string-344","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"$2f","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-408","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$30","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://support.office.com\", Found HTTPS url \"https://www.microsoft.com\", Found HTTPS url \"https://download.microsoft.com\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to scan the ARP cache","description":"file/memory contains long string with (Indicator: \"\"arp \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1018","id":"string-363","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"$31","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-30","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to transfer files remotely using SFTP","description":"$32","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-578","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Unusual Characteristics","name":"Reference explorer.exe process","description":"file/memory contains long string with (Indicator: \"explorer.exe\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-481","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to unregister service from Service Control Manager","description":"file/memory contains long string(Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-690","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found registry location strings which can modify auto-execute functionality","description":"$33","origin":"sample.bin","mitre_attack_id":"T1547","id":"string-184","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Installation/Persistence","name":"Contains scheduled task related strings","description":"file/memory contains long string with (Indicator: \"schtasks /create\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"schtasks /run\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1053.005","id":"string-128","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Able to delete scheduled task(s)","description":"file/memory contains long string with (Indicator: \"schtasks /delete\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1685","id":"string-629","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 20:null 24:[["$","title","0",{"children":"Suspicious Sample 4d83c25a5ea8… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Suspicious verdict for sample 4d83c25a5ea8…. Threat score 70/100. 0/27 AV engines flagged this file. 0 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/4d83c25a5ea8518b153451d8ecb80e24b0f4b72ecdada47f7ebe96e956867b95"}],["$","meta","4",{"property":"og:title","content":"Suspicious Sample 4d83c25a5ea8… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Suspicious verdict for sample 4d83c25a5ea8…. Threat score 70/100. 0/27 AV engines flagged this file. 0 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/4d83c25a5ea8518b153451d8ecb80e24b0f4b72ecdada47f7ebe96e956867b95"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Suspicious Sample 4d83c25a5ea8… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Suspicious verdict for sample 4d83c25a5ea8…. Threat score 70/100. 0/27 AV engines flagged this file. 0 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L34","11",{}]]