Output folder: C:\DOCUME~1\THE~1.GOL\LOCALS~1\Temp\nsd123B.tmp Extract: test.txt Rename: C:\DOCUME~1\THE~1.GOL\LOCALS~1\Temp\nsd123B.tmp\test.txt->C:\DOCUME~1\THE~1.GOL\LOCALS~1\Temp\nsd123B.tmp\test.avi Rename: C:\DOCUME~1\THE~1.GOL\LOCALS~1\Temp\nsd123B.tmp\test.avi->C:\DOCUME~1\THE~1.GOL\LOCALS~1\Temp\nsd123B.tmp\test.jpg FindExecutable: C:\windows\system32\shimgvw.dll .jpg:vjpegFile shell\open\command: Values read from the registry ===================================== FileManager %SystemRoot%\Explorer.exe /idlist,%I,%L TextEditor C:\windows\system32\notepad.exe CommandPromt C:\windows\system32\cmd.exe AudioPlayer "D:\Media\foobar2000\foobar2000.exe" "%1" MediaPlayer C:\Program Files\Media Player Classic\mplayerc.exe GfxViewer GfxEditor Broswer D:\COMMUNICATION\FIREFOX\FIREFOX.EXE -url "%1" Dun %SystemRoot%\system32\rasphone.exe -lt "%1" Email D:\COMMUNICATION\THUNDERBIRD\THUNDERBIRD.EXE -compose %1 IRC D:\Communication\X-Chat 2\xchat.exe "%1" FTP D:\COMMUNICATION\FIREFOX\FIREFOX.EXE -url "%1" IM Values after my magic ==================================== FileManager C:\windows\Explorer.exe TextEditor C:\windows\system32\notepad.exe CommandPromt C:\windows\system32\cmd.exe AudioPlayer D:\Media\foobar2000\foobar2000.exe MediaPlayer C:\Program Files\Media Player Classic\mplayerc.exe GfxViewer GfxEditor Broswer D:\COMMUNICATION\FIREFOX\FIREFOX.EXE Dun C:\windows\system32\rasphone.exe Email D:\COMMUNICATION\THUNDERBIRD\THUNDERBIRD.EXE IRC D:\Communication\X-Chat 2\xchat.exe FTP D:\COMMUNICATION\FIREFOX\FIREFOX.EXE IM Completed