[Pyro1588]

umd now wants me to run a "quickstart security wizard" before they let me on the wireless. this "wizard" is a broken web script (vbscript, i think) that supposedly "scans your whole computer." it's supposed to do this in roughly 5 seconds, btw.

what i managed to glean is that it basically makes sure file/printer sharing is off and that you're running symantec. yes people, symantec.

as i said, it's broken. it gives a script error in firefox. it refuses to run in ie (because i uninstalled ie =P)

the best part about this is that this high-security "wizard" (which umd bought from God-only-knows-who) is a script that sits there on your hd. not compiled. just source.

as i said, i think it's vbscript. right now because i got an exemption (from a bratty it kid that i wanted to attack) i can't access the script anymore. when my exemption runs out, i'll redownload. at that point, i'm hoping some of our more savvy hackers can help me figure out what to send to their server to get my thumbs-up. i might even be tempted to go wave it in their face =)

[mzxgiant]

Shoot me a copy of the script through e-mail.

[weasel]

Symantec? What are these guys smoking? Symantec is the single most pedantic, invasive piece of software I've seen in a long time. No exception list whatsoever, and the thing picks up the most false positives I've ever seen (it thinks my ZDoom launcher has a virus - all my other scanners would beg to differ!).

[commodorejohn]

Weasel speaks absolute truth.

[Sai'ke]

Symantec will think anything compiled with a goto statement in it is SUSPICIOUS :D

[scorch3000]

commodorejohn, on Aug 14 2008, 06:36 PM, said:

Weasel speaks absolute truth.

We all listen to the one known Weasel, for he is like one of the three wise men of DigitalMZX, compared to you, Goshi and Aise who are the three wise guys. I agree, i've never used this Symantec thingie, don't own a computer of my own, so i wouldn't. However, i havn't heared anything good from it, just random outbusts about how useless it is.

[commodorejohn]

I used Norton once. Not only did it slow things down uncomfortably, it disallowed me from uninstalling it, and when I deleted it manually, lo and behold, it had moved crucial system files to its directory. Time to reinstall Windows, hooray. Maybe it doesn't still do that (this was ~1998ish,) but that was enough to put me off it forever.

This post has been edited by commodorejohn: 15 August 2008 - 02:41 PM

[Frobozz]

commodorejohn, on Aug 15 2008, 09:40 AM, said:

I used Norton once. Not only did it slow things down uncomfortably, it disallowed me from uninstalling it, and when I deleted it manually, lo and behold, it had moved crucial system files to its directory. Time to reinstall Windows, hooray. Maybe it doesn't still do that (this was ~1998ish,) but that was enough to put me off it forever.

Reminds me of Norton Crash Guard. My dad tried installing that once and it totally crashed Windows so bad he had to redo the entire system. Needless to say we told Norton (wasn't Symantec at the time) of the incident. If we paid anything for it, which I doubt, we got our money back.

[Mr. Apol]

buy a mac lololol

[Torte]

I actually liked using the Corporate edition. It was quite nice and I didn't really feel it was THAT big a resource hog.

Also yeah that script seems bloody stupid.

[barbarian]

yeah or install linux ffs llllllllol

[Pyro1588]

according to mzxgiant, this script appears to install a hidden account. now i have to pin that down and go threaten the IT department. grr.

[barbarian]

oh hey if it's vbscript and you're still looking at it post it here or send it to me.

<3 the vbscript.

[Koji]

Just post the source here once you get the chance so we can all look through it/laugh at it.

[scorch3000]

Mr. Apol, on Aug 16 2008, 03:28 AM, said:

buy a mac lololol

Yes, buy a Mac with the handle on top of the moniter, so you can use it as a anchor on the high seas.

[commodorejohn]

scorch3000, on Aug 18 2008, 12:34 PM, said:

Yes, buy a Mac with the handle on top of the moniter, so you can use it as a anchor on the high seas.

My Classic // and I are going to thrash you good for that, boy.

[Pyro1588]

alright, here's the long source. like i said, i don't know what language it is. vbscript was just a guess.

Moved here.

I'm a huge dumbass! Ban me! - let us infect your computer with our virus to keep you safe from other viruses.

[scorch3000]

Meh, computers. What are you gonna do?

[GetDizzy]

Heh... I like how anything other than XP Home or 2K is a "Bad OS"

[zzo38]

The script is a HTML Application file (using VB-Script) for Windows. HTML Application files can only run in Windows by creating a file with a .HTA extension. I can find a lot of stupid codes in that file, including unnecessary stuff, stuff that doesn't make sense, and others. For one thing it checks for and tries to delete wget.exe twice. Another thing is one error-checking code checks for errors twice in a row with nothing in between. And it changes some settings that you might not want changed. There are also other badly designed codes and stuff in there. The ShowBlankPW function does not seem to care wihether or not the administrator password is blank if you are using XP Home. Strings are sometimes used where it should be numbers. And other stupid things as well.

This post has been edited by zzo38: 22 August 2008 - 02:35 AM

[Pyro1588]

alright, if someone has the time, i'd really appreciate several excerpts of code and an explanation of just what they do.

you see, i never saw a EULA or agreed to anything. i think i'm going to head over to IT and ask them just what the hell they think they're allowed to do.

[Dima]

Hi,

someone posted a link to this thread on thedailywtf.com and being a good samaritan I thought I'd help. Unfortunately I only have a 20 minutes right now and I'll be away for the weekend so this is probably a time saver for whoever ends up helping you properly.

Here's the gutted version of the script which basically answers yes to all the checks. For the symantec bull it looks up versions which I don't know.

To run this script create a file something.vbs and paste it in there. Probably create the file in the same location as links.exe

If their back end doesn't do too many checks this ought to work.

This is all I can do in 20 min...

Regards

D

'_________________________Begin Global Vars________________________________________________

'#########Begin Version#########
Const intVersionMajor = 1
Const intVersionMinor = 1
Const intVerisonSub = 35
'#########End Version###########

Const strDelim = ";"

'########################Begin Urls###############################################
Dim strCmdSendErrUrl
Dim strCkVersionUrl
Dim strLoadNewVersionUrl
Dim strWebIpUrl
Dim strSendResultsUrl
Dim strSendResultsUrl2

'Production Web Destination
Const strURLBase = "http://yogi.d.umn.edu"

'#########################End Urls############################################

Dim boolFirstRun
Dim objDialogWindow
Dim strAllSettings
Dim strErrLine
Dim strArr
Dim strOS
Dim strAdminAcctPwBlank
Dim strOtherAcctPwBlank
'_________________________End Global Vars________________________________________________

strCmdSendErrUrl = strURLBase & "/cgi-bin/qs/senderr-qsbasic.cgi?"
strCkVersionUrl = strURLBase & "/qs/qsbasic.txt"
strLoadNewVersionUrl = strURLBase & "/qs/qsbasic.exe"
strWebIpUrl = strURLBase & "/cgi-bin/qs/addr.cgi"
strSendResultsUrl = strURLBase & "/cgi-bin/qs/qs.cgi?"


Const adVarChar = 200
Const MaxCharacters = 255
Const adInteger = 3
Const adBoolean = 11
Const strXP = "Windows XP"
Const str2k = "Windows 2000"

Dim strHTML
Dim objRun
Dim GetSettingsCMD
Dim objFile
Dim objFSO
Dim objShell
Dim strCompliant
Dim strSDB
Dim rsDataList
Dim strMaxpasswdLen
Dim strMaxpasswdAge
Dim strComputer
Dim objNetwork
Dim strUserName
Dim strDomain
Dim strComputerName
Dim strDy
Dim strTme
Dim intQVal
Dim strHexQVal
Dim dt
Dim strTimeStamp
Dim strSdbLog
Dim str2kanalyzeCMD
Dim strXPanalyzeCMD
Dim strSysPath
Dim oRegExp, colMatches, oMatch
Dim objLogFile
Dim strPattern
Dim strOut
Dim strLog
Dim strCharacters
Dim strClump
Dim strBuff
Dim strLogMismatch
Dim longStrPosition
Dim strStyle
Dim strRegSettings
Dim lngQVal
Dim strOSfriendly
Dim objWMIService
Dim colOperatingSystems
Dim objOperatingSystem
Dim varTQVal
Dim intFileAndPrintSh
Dim intSuccess
Dim intLMServer
Dim intNoPw
Dim strTest
Dim strErrAdmin
Dim objSdbLog
Dim strFileSharingIndicator
Dim strFWIndicator
Dim strAccum
Dim SAVinstalled
Dim longDefTodayDiff
Dim dateOldDef
Dim dateLU
Dim strAcctDelim
Dim strBlankPasswdAcct
Dim strLMhashAcct
Dim strArrBlankPasswdAcct
Dim strArrLMhashAcct
Dim LongBlankPasswdSZ
Dim LongLMhashSZ
Dim strBlnkNTLMhash
Dim strBlankLMhash
Dim boolBailOut
Dim intDecision
Dim strPlaceHolder
Dim intOS_VerSP
Dim strAllTests
Dim strNX
Dim strPasswdTest
Dim strXPHome
Dim objMySAV
Dim boolNoAUfix
Dim strNoSP2mesg
Dim intVerSP

strAcctDelim = ":"
strXPHome = "0"
strAdminAcctPwBlank = "0"
strOtherAcctPwBlank = "0"
strNX = "0"


boolFirstRun = True
'version ck
boolBailOut = False

On Error Resume Next
strComputer = "."
strOS = "XP"
strXPHome = "1"
intVerSP = 3
strDy = FormatDateTime(Now, vbLongDate)
strTme = FormatDateTime(Now, vbLongTime)
strComputer = "."
strSysPath = objFSO.GetSpecialFolder(0).Path   'same as %systemRoot%
dt = Now
strTimeStamp = CStr(Year(dt)) & CStr(Month(dt)) & CStr(Day(dt)) & CStr(Hour(dt)) & CStr(Second(dt))
strSdbLog = strSysPath & "\security\logs\OITSEC_ck" & strTimeStamp & ".txt"
intFileAndPrintSh = 1 '1=off , 0=on


Set rsDataList = CreateObject("ADODB.Recordset")
rsDataList.Fields.Append "SettingID", adVarChar, MaxCharacters
rsDataList.Fields.Append "SettingName", adVarChar, MaxCharacters
rsDataList.Fields.Append "PolicySetting", adVarChar, MaxCharacters
rsDataList.Fields.Append "QueryValue", adVarChar, MaxCharacters
rsDataList.Fields.Append "Compliant", adInteger    '0 = not compliant, 1 = compliant -1 = error reading
rsDataList.Fields.Append "FixIt", adInteger    '0 = not fixable, 1 = fixable,  -1 = error reading
rsDataList.open


strFWIndicator = "1"


strRegSettings = GetRegs(strOS)


strArr = Split(strRegSettings, strDelim, -1)

    SAVinstalled = True

    dateLU = GetLUrevDate()

    longDefTodayDiff = DefRevAge(dateLU)
    '**********         0                    1               2-24
    strAllSettings = intFileAndPrintSh & strDelim & strFWIndicator & strDelim & strRegSettings & strDelim
    '**********                   25                            26                    27
    strAllSettings = strAllSettings & CStr(DatePart("yyyy", dateLU)) & strDelim & CStr(DatePart("m", dateLU)) & strDelim & CStr(DatePart("d", dateLU)) & strDelim
    '**********                28
    strAllSettings = strAllSettings & CStr(longDefTodayDiff) & strDelim
    '**********                29
    strAllSettings = strAllSettings & GetSAVParent & strDelim
    '**********               30-36
    strAllSettings = strAllSettings & GetIf() & strDelim
    '**********                37
    strAllSettings = strAllSettings & UDate(dt) & strDelim
    '**********                38                39              40
    strAllSettings = strAllSettings & intVersionMajor & strDelim & intVersionMinor & strDelim & intVerisonSub & strDelim
    '**********                41                 42,43
    strAllSettings = strAllSettings & UDate(CGmt(dateLU)) & strDelim & "forgot what this was"

strArr = Split(strAllSettings, strDelim, -1)
        
rsDataList.AddNew
rsDataList("SettingID") = "XPfw"
rsDataList("SettingName") = "Windows XP Firewall"
rsDataList("PolicySetting") = "Enabled"
rsDataList("QueryValue") = "Enabled"
rsDataList("Compliant") = 1
rsDataList("FixIt") = 0
rsDataList.Update

rsDataList.AddNew
rsDataList("SettingID") = "AU"
rsDataList("SettingName") = "Automatic Windows Updates"
rsDataList("PolicySetting") = "Enabled"
rsDataList("QueryValue") = "Enabled"
rsDataList("Compliant") = 1
rsDataList("FixIt") = 0
rsDataList.Update

rsDataList.AddNew
rsDataList("SettingID") = "fpshr"
rsDataList("SettingName") = "File and Print Sharing for MS Networks"
rsDataList("PolicySetting") = "Uninstalled"
rsDataList("QueryValue") = "Uninstalled"
rsDataList("Compliant") = 1
rsDataList("FixIt") = 0
rsDataList.Update

SAVinstalled = True
    
rsDataList.AddNew
rsDataList("SettingID") = "SAVinstld"
rsDataList("SettingName") = "Symantec AV Installed"
rsDataList("PolicySetting") = "Installed or Managed"
rsDataList("QueryValue") = "Version 1000.1000.1000 Installed"
rsDataList("Compliant") = 1
rsDataList("FixIt") = 0
rsDataList.Update

rsDataList.AddNew
rsDataList("SettingID") = "LUen"
rsDataList("SettingName") = "LiveUpdate Enabled"
rsDataList("PolicySetting") = "Enabled"
rsDataList("QueryValue") = "Enabled"
rsDataList("Compliant") = 1
rsDataList("FixIt") = 0
rsDataList.Update

rsDataList.AddNew
rsDataList("SettingID") = "DefVer"
rsDataList("SettingName") = "Virus Definition File Version"
dateOldDef = DateAdd("d", -8, dt)
rsDataList("PolicySetting") = "Oldest Acceptable Date = " & CStr(Month(dateOldDef)) & "-" & CStr(Day(dateOldDef)) & "-" & CStr(Year(dateOldDef))
rsDataList("QueryValue") = "01-01-2020"
rsDataList("Compliant") = 1
rsDataList("FixIt") = 0
rsDataList.Update

rsDataList.AddNew
rsDataList("SettingID") = "DefAge"
rsDataList("SettingName") = "Virus Definition File Age"
rsDataList("PolicySetting") = "8 days or less"
rsDataList("QueryValue") = 1
rsDataList("Compliant") = 1
rsDataList("FixIt") = 0
rsDataList.Update

rsDataList.AddNew
rsDataList("SettingID") = "LUfreq"
rsDataList("SettingName") = "LiveUpdate Schedule Frequency"
rsDataList("PolicySetting") = "Daily"
rsDataList("QueryValue") = "Daily"
rsDataList("Compliant") = 1
rsDataList("FixIt") = 0
rsDataList.Update

rsDataList.AddNew
rsDataList("SettingID") = "AutoProtFS"
rsDataList("SettingName") = "Auto-Protect: Filesystem"
rsDataList("PolicySetting") = "Enabled"
rsDataList("QueryValue") = "Enabled"
rsDataList("Compliant") = 1
rsDataList("FixIt") = 0
rsDataList.Update

'''check if test fail then set to 0
  strAllTests = "1"
  strPasswdTest = "1"


' strAllTests = 1 ----- all tests passed ,    strAllTests = 0  ----- at least 1 test failed
' strPasswdTest = 1 ----  blank passwd test passed ( no blank PWs found), strPasswdTest = 0 ----  blank passwd test failed ( blank PWs were found)


'step through tests table, rsDataList, and see if any tests show "compliant" = 0
'
'***********SHOWING PW TESTS DISABLED*******************************************************
strBlankPasswdAcct = "-1"
strNX = "-1"
strPasswdTest = "-1"
strOtherAcctPwBlank = "-1"
strAdminAcctPwBlank = "-1"
'***********SHOWING PW TESTS DISABLED
'=++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
'=++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
'=++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

'THE MOST UGLY-ASS KLUDGE IN THE WORLD
'This is the continuation of strAllSettings
' settings after slot #44 will have to be dealt with and tacked on post slot #44
'           0-43                  44              45            46
strAllSettings = strAllSettings & strDelim & strAllTests & strDelim & strNX & strDelim & strPasswdTest _
           & strDelim & strAdminAcctPwBlank & strDelim & strOtherAcctPwBlank & strDelim & "1"
'                    47                    48                       49

SendResults strAllSettings

'close the progress dialog
   '* and resize the main window

   'Call self.Focus
   'self.ResizeTo 670, 550
   'self.MoveTo 200, 200

'=++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
'=++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Function AcctDisabled(strAcctNo, strComputer, strUser)
End Function

Function AuditStrSelect(intSetting)
End Function

Function ShowRow(rsDataList)
End Function

Function ShowTableHeader(strTblName, strStyle)
End Function

Function ShowTableFooter()
End Function

Function ShowLMhash(strArrLMhashAcct, LongLMhashSZ, strStyle)
End Function

Function ShowBlankPW(strArrBlankPasswdAcct, LongBlankPasswdSZ, strStyle, strXPHome)
End Function



Function IsFwOn()
IsFwOn = True
End Function

Sub XPfwFixIt()
End Sub

Sub AUFixIt()
End Sub

Sub LUenFixIt()
End Sub


Sub LUfreqFixIt()
End Sub

Sub AutoProtEmailFixIt()
End Sub

Sub AutoProtFSFixIt()
End Sub

Sub Window_Onunload()
End Sub

Sub fpshrFixIt()
End Sub

Function HandleAnonEnum(Setting)
End Function

Function GetLUrevDate()
    GetLUrevDate = DateSerial(2010, 1, 1)
End Function

Function DefRevAge(dateDefRev)
    Const strInterval = "d"

    Dim dateToday
    Dim longLastLU

    dateToday = Now
    longLastLU = DateDiff(strInterval, dateDefRev, dateToday)

    DefRevAge = longLastLU
End Function

Function GetRegs(strOS)
    Const HKEY_LOCAL_MACHINE = &H80000002
    Const strComputer = "."

    Dim strOut
    Dim objReg
    Dim strKeyPath
    Dim strValName
    Dim strVal
    Dim varVal

    Set objReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\default:StdRegProv")
    
    strKeyPath = "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\"
    strValName = "WUServer"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strVal
    strValName = "WUStatusServer"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strOut & strDelim & strVal
    

    strKeyPath = "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\"
    strValName = "NoAutoUpdate"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strOut & strDelim & strVal
    strValName = "AUOptions"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strOut & strDelim & strVal
    strValName = "ScheduledInstallDay"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strOut & strDelim & strVal
    strValName = "ScheduledInstallTime"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strOut & strDelim & strVal
    strValName = "UseWUServer"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strOut & strDelim & strVal
    strValName = "NoAutoRebootWithLoggedOnUsers"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strOut & strDelim & strVal
    strValName = "RescheduleWaitTime"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strOut & strDelim & strVal

'SAV LU settings
    strKeyPath = "SOFTWARE\INTEL\LANDESK\VIRUSPROTECT6\CURRENTVERSION\PATTERNMANAGER\SCHEDULE\"
    strValName = "Enabled"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strOut & strDelim & strVal
    strValName = "Type"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strOut & strDelim & strVal
    strValName = "MinOfDay"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strOut & strDelim & strVal
    strValName = "MissedEventEnabled"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strOut & strDelim & strVal
    strValName = "RandomizeDayRange"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strOut & strDelim & strVal
    strValName = "TimeWindowDaily"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strOut & strDelim & strVal

'SAV RealTime scan settings
    'filesystem
    strKeyPath = "SOFTWARE\INTEL\LANDESK\VIRUSPROTECT6\CURRENTVERSION\STORAGES\FILESYSTEM\REALTIMESCAN\"
    strValName = "OnOff"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strOut & strDelim & strVal
    strValName = "Heuristics"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strOut & strDelim & strVal
    strValName = "HeuristicsLevel"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strOut & strDelim & strVal
    'InternetMail
    strKeyPath = "SOFTWARE\INTEL\LANDESK\VIRUSPROTECT6\CURRENTVERSION\STORAGES\INTERNETMAIL\REALTIMESCAN\"
    strValName = "OnOff"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strOut & strDelim & strVal
    strValName = "FileType"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strOut & strDelim & strVal

    strKeyPath = "SOFTWARE\INTEL\LANDESK\VIRUSPROTECT6\CURRENTVERSION\"
    strValName = "PatternFileRevision"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strOut & strDelim & strVal
    strValName = "ProductVersion"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strOut & strDelim & strVal

    strKeyPath = "SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\"
    strValName = "AUOptions"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strOut & strDelim & strVal
'MsgBox "End GetREGS" & strOut
    GetRegs = strOut
End Function

Function GetSAVParent()
GetSAVParent = "something"
End Function

Function FandPS(strAction, strOS)

End Function

Function LmServer(strAction)
End Function


Sub CleanUp()
End Sub

Sub HandleError(objDialogWindow)
End Sub

Sub cmdSendErr()
End Sub

Function ckVersion()
    ckVersion = 1
End Function

Sub LoadNewVersion()
End Sub

Function GetIf()
GetIf = "127.0.0.1" & strDelim & "X" & strDelim & "X" & strDelim & "X" & strDelim & "X" & strDelim & "X" & strDelim & "1"
End Function

Function webIP()
End Function


Function Base64Encode(inData)
  'rfc1521
  '2001 Antonin Foller, Motobit Software, [url="http://Motobit.cz"]http://Motobit.cz[/url]
  Const Base64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
  Dim cOut, sOut, I
  
  'For each group of 3 bytes
  For I = 1 To Len(inData) Step 3
    Dim nGroup, pOut, sGroup
    
    'Create one long from this 3 bytes.
    nGroup = &H10000 * Asc(Mid(inData, I, 1)) + _
      &H100 * MyASC(Mid(inData, I + 1, 1)) + MyASC(Mid(inData, I + 2, 1))
    
    'Oct splits the long To 8 groups with 3 bits
    nGroup = Oct(nGroup)
    
    'Add leading zeros
    nGroup = String(8 - Len(nGroup), "0") & nGroup
    
    'Convert To base64
    pOut = Mid(Base64, CLng("&o" & Mid(nGroup, 1, 2)) + 1, 1) + _
      Mid(Base64, CLng("&o" & Mid(nGroup, 3, 2)) + 1, 1) + _
      Mid(Base64, CLng("&o" & Mid(nGroup, 5, 2)) + 1, 1) + _
      Mid(Base64, CLng("&o" & Mid(nGroup, 7, 2)) + 1, 1)
    
    'Add the part To OutPut string
    sOut = sOut + pOut
    
    'Add a new line For Each 76 chars In dest (76*3/4 = 57)
    'If (I + 2) Mod 57 = 0 Then sOut = sOut + vbCrLf
  Next
  Select Case Len(inData) Mod 3
    Case 1: '8 bit final
      sOut = Left(sOut, Len(sOut) - 2) + "=="
    Case 2: '16 bit final
      sOut = Left(sOut, Len(sOut) - 1) + "="
  End Select
  Base64Encode = sOut
End Function

Function MyASC(OneChar)
  If OneChar = "" Then MyASC = 0 Else MyASC = Asc(OneChar)
End Function


Sub SendResults(strResults)
    Dim objShell
    Dim objFSO
    Dim strUploadCmd
    Dim strLinks
    Dim strResultsEnc

    strResultsEnc = Base64Encode(strResults)
    strSendResultsUrl2 = strSendResultsUrl & strResultsEnc

    strLinks = ".\links.exe -dump "
    strUploadCmd = strLinks & strSendResultsUrl2
    Set objFSO = CreateObject("Scripting.FileSystemObject")
    Set objShell = CreateObject("WScript.Shell")
    
    If MsgBox("Can I run the following command?" & vbNewLine & strUploadCmd, vbYesNo, "uploading results...somewhere") = vbYes Then
        objShell.Run strUploadCmd, 2, 1
    End If
End Sub



Function makeUnixTime(strTime, mode)
End Function
Function CGmt(dateLocalTime)
'Given a time in the type date, returns the time of type date in timezone GMT
    Dim strComputer
    Dim objWMIService
    Dim colItems
    Dim objItem
    Dim intTimeBias

    strComputer = "."
    Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
    Set colItems = objWMIService.ExecQuery("Select * from Win32_TimeZone", , 48)
    For Each objItem In colItems
            intTimeBias = -(objItem.Bias)
    Next
    CGmt = DateAdd("n", intTimeBias, dateLocalTime)
    
End Function

Function UDate(dateMs)
  UDate = DateDiff("s", "01/01/1970 00:00:00", dateMs)
End Function




Function isLsassCrashable()
isLsassCrashable = False
End Function


Function PwdCk(objFSO, strComputerName)
PwdCk = ""
End Function

Function SavOk(rsDataList)
SavOk = "1"
End Function

Sub cmdNoSend()
End Sub


Sub RunPrint()
    'window.Print
End Sub

[Mr. Apol]

Dima, on Aug 22 2008, 12:25 PM, said:

Hi,

someone posted a link to this thread on thedailywtf.com and being a good samaritan I thought I'd help. Unfortunately I only have a 20 minutes right now and I'll be away for the weekend so this is probably a time saver for whoever ends up helping you properly.

Here's the gutted version of the script which basically answers yes to all the checks. For the symantec bull it looks up versions which I don't know.

To run this script create a file something.vbs and paste it in there. Probably create the file in the same location as links.exe

If their back end doesn't do too many checks this ought to work.

This is all I can do in 20 min...

Regards

D

'_________________________Begin Global Vars________________________________________________

'#########Begin Version#########
Const intVersionMajor = 1
Const intVersionMinor = 1
Const intVerisonSub = 35
'#########End Version###########

Const strDelim = ";"

'########################Begin Urls###############################################
Dim strCmdSendErrUrl
Dim strCkVersionUrl
Dim strLoadNewVersionUrl
Dim strWebIpUrl
Dim strSendResultsUrl
Dim strSendResultsUrl2

'Production Web Destination
Const strURLBase = "http://yogi.d.umn.edu"

'#########################End Urls############################################

Dim boolFirstRun
Dim objDialogWindow
Dim strAllSettings
Dim strErrLine
Dim strArr
Dim strOS
Dim strAdminAcctPwBlank
Dim strOtherAcctPwBlank
'_________________________End Global Vars________________________________________________

strCmdSendErrUrl = strURLBase & "/cgi-bin/qs/senderr-qsbasic.cgi?"
strCkVersionUrl = strURLBase & "/qs/qsbasic.txt"
strLoadNewVersionUrl = strURLBase & "/qs/qsbasic.exe"
strWebIpUrl = strURLBase & "/cgi-bin/qs/addr.cgi"
strSendResultsUrl = strURLBase & "/cgi-bin/qs/qs.cgi?"


Const adVarChar = 200
Const MaxCharacters = 255
Const adInteger = 3
Const adBoolean = 11
Const strXP = "Windows XP"
Const str2k = "Windows 2000"

Dim strHTML
Dim objRun
Dim GetSettingsCMD
Dim objFile
Dim objFSO
Dim objShell
Dim strCompliant
Dim strSDB
Dim rsDataList
Dim strMaxpasswdLen
Dim strMaxpasswdAge
Dim strComputer
Dim objNetwork
Dim strUserName
Dim strDomain
Dim strComputerName
Dim strDy
Dim strTme
Dim intQVal
Dim strHexQVal
Dim dt
Dim strTimeStamp
Dim strSdbLog
Dim str2kanalyzeCMD
Dim strXPanalyzeCMD
Dim strSysPath
Dim oRegExp, colMatches, oMatch
Dim objLogFile
Dim strPattern
Dim strOut
Dim strLog
Dim strCharacters
Dim strClump
Dim strBuff
Dim strLogMismatch
Dim longStrPosition
Dim strStyle
Dim strRegSettings
Dim lngQVal
Dim strOSfriendly
Dim objWMIService
Dim colOperatingSystems
Dim objOperatingSystem
Dim varTQVal
Dim intFileAndPrintSh
Dim intSuccess
Dim intLMServer
Dim intNoPw
Dim strTest
Dim strErrAdmin
Dim objSdbLog
Dim strFileSharingIndicator
Dim strFWIndicator
Dim strAccum
Dim SAVinstalled
Dim longDefTodayDiff
Dim dateOldDef
Dim dateLU
Dim strAcctDelim
Dim strBlankPasswdAcct
Dim strLMhashAcct
Dim strArrBlankPasswdAcct
Dim strArrLMhashAcct
Dim LongBlankPasswdSZ
Dim LongLMhashSZ
Dim strBlnkNTLMhash
Dim strBlankLMhash
Dim boolBailOut
Dim intDecision
Dim strPlaceHolder
Dim intOS_VerSP
Dim strAllTests
Dim strNX
Dim strPasswdTest
Dim strXPHome
Dim objMySAV
Dim boolNoAUfix
Dim strNoSP2mesg
Dim intVerSP

strAcctDelim = ":"
strXPHome = "0"
strAdminAcctPwBlank = "0"
strOtherAcctPwBlank = "0"
strNX = "0"


boolFirstRun = True
'version ck
boolBailOut = False

On Error Resume Next
strComputer = "."
strOS = "XP"
strXPHome = "1"
intVerSP = 3
strDy = FormatDateTime(Now, vbLongDate)
strTme = FormatDateTime(Now, vbLongTime)
strComputer = "."
strSysPath = objFSO.GetSpecialFolder(0).Path   'same as %systemRoot%
dt = Now
strTimeStamp = CStr(Year(dt)) & CStr(Month(dt)) & CStr(Day(dt)) & CStr(Hour(dt)) & CStr(Second(dt))
strSdbLog = strSysPath & "\security\logs\OITSEC_ck" & strTimeStamp & ".txt"
intFileAndPrintSh = 1 '1=off , 0=on


Set rsDataList = CreateObject("ADODB.Recordset")
rsDataList.Fields.Append "SettingID", adVarChar, MaxCharacters
rsDataList.Fields.Append "SettingName", adVarChar, MaxCharacters
rsDataList.Fields.Append "PolicySetting", adVarChar, MaxCharacters
rsDataList.Fields.Append "QueryValue", adVarChar, MaxCharacters
rsDataList.Fields.Append "Compliant", adInteger    '0 = not compliant, 1 = compliant -1 = error reading
rsDataList.Fields.Append "FixIt", adInteger    '0 = not fixable, 1 = fixable,  -1 = error reading
rsDataList.open


strFWIndicator = "1"


strRegSettings = GetRegs(strOS)


strArr = Split(strRegSettings, strDelim, -1)

    SAVinstalled = True

    dateLU = GetLUrevDate()

    longDefTodayDiff = DefRevAge(dateLU)
    '**********         0                    1               2-24
    strAllSettings = intFileAndPrintSh & strDelim & strFWIndicator & strDelim & strRegSettings & strDelim
    '**********                   25                            26                    27
    strAllSettings = strAllSettings & CStr(DatePart("yyyy", dateLU)) & strDelim & CStr(DatePart("m", dateLU)) & strDelim & CStr(DatePart("d", dateLU)) & strDelim
    '**********                28
    strAllSettings = strAllSettings & CStr(longDefTodayDiff) & strDelim
    '**********                29
    strAllSettings = strAllSettings & GetSAVParent & strDelim
    '**********               30-36
    strAllSettings = strAllSettings & GetIf() & strDelim
    '**********                37
    strAllSettings = strAllSettings & UDate(dt) & strDelim
    '**********                38                39              40
    strAllSettings = strAllSettings & intVersionMajor & strDelim & intVersionMinor & strDelim & intVerisonSub & strDelim
    '**********                41                 42,43
    strAllSettings = strAllSettings & UDate(CGmt(dateLU)) & strDelim & "forgot what this was"

strArr = Split(strAllSettings, strDelim, -1)
        
rsDataList.AddNew
rsDataList("SettingID") = "XPfw"
rsDataList("SettingName") = "Windows XP Firewall"
rsDataList("PolicySetting") = "Enabled"
rsDataList("QueryValue") = "Enabled"
rsDataList("Compliant") = 1
rsDataList("FixIt") = 0
rsDataList.Update

rsDataList.AddNew
rsDataList("SettingID") = "AU"
rsDataList("SettingName") = "Automatic Windows Updates"
rsDataList("PolicySetting") = "Enabled"
rsDataList("QueryValue") = "Enabled"
rsDataList("Compliant") = 1
rsDataList("FixIt") = 0
rsDataList.Update

rsDataList.AddNew
rsDataList("SettingID") = "fpshr"
rsDataList("SettingName") = "File and Print Sharing for MS Networks"
rsDataList("PolicySetting") = "Uninstalled"
rsDataList("QueryValue") = "Uninstalled"
rsDataList("Compliant") = 1
rsDataList("FixIt") = 0
rsDataList.Update

SAVinstalled = True
    
rsDataList.AddNew
rsDataList("SettingID") = "SAVinstld"
rsDataList("SettingName") = "Symantec AV Installed"
rsDataList("PolicySetting") = "Installed or Managed"
rsDataList("QueryValue") = "Version 1000.1000.1000 Installed"
rsDataList("Compliant") = 1
rsDataList("FixIt") = 0
rsDataList.Update

rsDataList.AddNew
rsDataList("SettingID") = "LUen"
rsDataList("SettingName") = "LiveUpdate Enabled"
rsDataList("PolicySetting") = "Enabled"
rsDataList("QueryValue") = "Enabled"
rsDataList("Compliant") = 1
rsDataList("FixIt") = 0
rsDataList.Update

rsDataList.AddNew
rsDataList("SettingID") = "DefVer"
rsDataList("SettingName") = "Virus Definition File Version"
dateOldDef = DateAdd("d", -8, dt)
rsDataList("PolicySetting") = "Oldest Acceptable Date = " & CStr(Month(dateOldDef)) & "-" & CStr(Day(dateOldDef)) & "-" & CStr(Year(dateOldDef))
rsDataList("QueryValue") = "01-01-2020"
rsDataList("Compliant") = 1
rsDataList("FixIt") = 0
rsDataList.Update

rsDataList.AddNew
rsDataList("SettingID") = "DefAge"
rsDataList("SettingName") = "Virus Definition File Age"
rsDataList("PolicySetting") = "8 days or less"
rsDataList("QueryValue") = 1
rsDataList("Compliant") = 1
rsDataList("FixIt") = 0
rsDataList.Update

rsDataList.AddNew
rsDataList("SettingID") = "LUfreq"
rsDataList("SettingName") = "LiveUpdate Schedule Frequency"
rsDataList("PolicySetting") = "Daily"
rsDataList("QueryValue") = "Daily"
rsDataList("Compliant") = 1
rsDataList("FixIt") = 0
rsDataList.Update

rsDataList.AddNew
rsDataList("SettingID") = "AutoProtFS"
rsDataList("SettingName") = "Auto-Protect: Filesystem"
rsDataList("PolicySetting") = "Enabled"
rsDataList("QueryValue") = "Enabled"
rsDataList("Compliant") = 1
rsDataList("FixIt") = 0
rsDataList.Update

'''check if test fail then set to 0
  strAllTests = "1"
  strPasswdTest = "1"


' strAllTests = 1 ----- all tests passed ,    strAllTests = 0  ----- at least 1 test failed
' strPasswdTest = 1 ----  blank passwd test passed ( no blank PWs found), strPasswdTest = 0 ----  blank passwd test failed ( blank PWs were found)


'step through tests table, rsDataList, and see if any tests show "compliant" = 0
'
'***********SHOWING PW TESTS DISABLED*******************************************************
strBlankPasswdAcct = "-1"
strNX = "-1"
strPasswdTest = "-1"
strOtherAcctPwBlank = "-1"
strAdminAcctPwBlank = "-1"
'***********SHOWING PW TESTS DISABLED
'=++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
'=++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
'=++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

'THE MOST UGLY-ASS KLUDGE IN THE WORLD
'This is the continuation of strAllSettings
' settings after slot #44 will have to be dealt with and tacked on post slot #44
'           0-43                  44              45            46
strAllSettings = strAllSettings & strDelim & strAllTests & strDelim & strNX & strDelim & strPasswdTest _
           & strDelim & strAdminAcctPwBlank & strDelim & strOtherAcctPwBlank & strDelim & "1"
'                    47                    48                       49

SendResults strAllSettings

'close the progress dialog
   '* and resize the main window

   'Call self.Focus
   'self.ResizeTo 670, 550
   'self.MoveTo 200, 200

'=++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
'=++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Function AcctDisabled(strAcctNo, strComputer, strUser)
End Function

Function AuditStrSelect(intSetting)
End Function

Function ShowRow(rsDataList)
End Function

Function ShowTableHeader(strTblName, strStyle)
End Function

Function ShowTableFooter()
End Function

Function ShowLMhash(strArrLMhashAcct, LongLMhashSZ, strStyle)
End Function

Function ShowBlankPW(strArrBlankPasswdAcct, LongBlankPasswdSZ, strStyle, strXPHome)
End Function



Function IsFwOn()
IsFwOn = True
End Function

Sub XPfwFixIt()
End Sub

Sub AUFixIt()
End Sub

Sub LUenFixIt()
End Sub


Sub LUfreqFixIt()
End Sub

Sub AutoProtEmailFixIt()
End Sub

Sub AutoProtFSFixIt()
End Sub

Sub Window_Onunload()
End Sub

Sub fpshrFixIt()
End Sub

Function HandleAnonEnum(Setting)
End Function

Function GetLUrevDate()
    GetLUrevDate = DateSerial(2010, 1, 1)
End Function

Function DefRevAge(dateDefRev)
    Const strInterval = "d"

    Dim dateToday
    Dim longLastLU

    dateToday = Now
    longLastLU = DateDiff(strInterval, dateDefRev, dateToday)

    DefRevAge = longLastLU
End Function

Function GetRegs(strOS)
    Const HKEY_LOCAL_MACHINE = &H80000002
    Const strComputer = "."

    Dim strOut
    Dim objReg
    Dim strKeyPath
    Dim strValName
    Dim strVal
    Dim varVal

    Set objReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\default:StdRegProv")
    
    strKeyPath = "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\"
    strValName = "WUServer"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strVal
    strValName = "WUStatusServer"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strOut & strDelim & strVal
    

    strKeyPath = "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\"
    strValName = "NoAutoUpdate"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strOut & strDelim & strVal
    strValName = "AUOptions"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strOut & strDelim & strVal
    strValName = "ScheduledInstallDay"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strOut & strDelim & strVal
    strValName = "ScheduledInstallTime"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strOut & strDelim & strVal
    strValName = "UseWUServer"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strOut & strDelim & strVal
    strValName = "NoAutoRebootWithLoggedOnUsers"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strOut & strDelim & strVal
    strValName = "RescheduleWaitTime"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strOut & strDelim & strVal

'SAV LU settings
    strKeyPath = "SOFTWARE\INTEL\LANDESK\VIRUSPROTECT6\CURRENTVERSION\PATTERNMANAGER\SCHEDULE\"
    strValName = "Enabled"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strOut & strDelim & strVal
    strValName = "Type"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strOut & strDelim & strVal
    strValName = "MinOfDay"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strOut & strDelim & strVal
    strValName = "MissedEventEnabled"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strOut & strDelim & strVal
    strValName = "RandomizeDayRange"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strOut & strDelim & strVal
    strValName = "TimeWindowDaily"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strOut & strDelim & strVal

'SAV RealTime scan settings
    'filesystem
    strKeyPath = "SOFTWARE\INTEL\LANDESK\VIRUSPROTECT6\CURRENTVERSION\STORAGES\FILESYSTEM\REALTIMESCAN\"
    strValName = "OnOff"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strOut & strDelim & strVal
    strValName = "Heuristics"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strOut & strDelim & strVal
    strValName = "HeuristicsLevel"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strOut & strDelim & strVal
    'InternetMail
    strKeyPath = "SOFTWARE\INTEL\LANDESK\VIRUSPROTECT6\CURRENTVERSION\STORAGES\INTERNETMAIL\REALTIMESCAN\"
    strValName = "OnOff"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strOut & strDelim & strVal
    strValName = "FileType"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strOut & strDelim & strVal

    strKeyPath = "SOFTWARE\INTEL\LANDESK\VIRUSPROTECT6\CURRENTVERSION\"
    strValName = "PatternFileRevision"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strOut & strDelim & strVal
    strValName = "ProductVersion"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strOut & strDelim & strVal

    strKeyPath = "SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\"
    strValName = "AUOptions"
    objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValName, strVal
    strOut = strOut & strDelim & strVal
'MsgBox "End GetREGS" & strOut
    GetRegs = strOut
End Function

Function GetSAVParent()
GetSAVParent = "something"
End Function

Function FandPS(strAction, strOS)

End Function

Function LmServer(strAction)
End Function


Sub CleanUp()
End Sub

Sub HandleError(objDialogWindow)
End Sub

Sub cmdSendErr()
End Sub

Function ckVersion()
    ckVersion = 1
End Function

Sub LoadNewVersion()
End Sub

Function GetIf()
GetIf = "127.0.0.1" & strDelim & "X" & strDelim & "X" & strDelim & "X" & strDelim & "X" & strDelim & "X" & strDelim & "1"
End Function

Function webIP()
End Function


Function Base64Encode(inData)
  'rfc1521
  '2001 Antonin Foller, Motobit Software, [url="http://Motobit.cz"]http://Motobit.cz[/url]
  Const Base64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
  Dim cOut, sOut, I
  
  'For each group of 3 bytes
  For I = 1 To Len(inData) Step 3
    Dim nGroup, pOut, sGroup
    
    'Create one long from this 3 bytes.
    nGroup = &H10000 * Asc(Mid(inData, I, 1)) + _
      &H100 * MyASC(Mid(inData, I + 1, 1)) + MyASC(Mid(inData, I + 2, 1))
    
    'Oct splits the long To 8 groups with 3 bits
    nGroup = Oct(nGroup)
    
    'Add leading zeros
    nGroup = String(8 - Len(nGroup), "0") & nGroup
    
    'Convert To base64
    pOut = Mid(Base64, CLng("&o" & Mid(nGroup, 1, 2)) + 1, 1) + _
      Mid(Base64, CLng("&o" & Mid(nGroup, 3, 2)) + 1, 1) + _
      Mid(Base64, CLng("&o" & Mid(nGroup, 5, 2)) + 1, 1) + _
      Mid(Base64, CLng("&o" & Mid(nGroup, 7, 2)) + 1, 1)
    
    'Add the part To OutPut string
    sOut = sOut + pOut
    
    'Add a new line For Each 76 chars In dest (76*3/4 = 57)
    'If (I + 2) Mod 57 = 0 Then sOut = sOut + vbCrLf
  Next
  Select Case Len(inData) Mod 3
    Case 1: '8 bit final
      sOut = Left(sOut, Len(sOut) - 2) + "=="
    Case 2: '16 bit final
      sOut = Left(sOut, Len(sOut) - 1) + "="
  End Select
  Base64Encode = sOut
End Function

Function MyASC(OneChar)
  If OneChar = "" Then MyASC = 0 Else MyASC = Asc(OneChar)
End Function


Sub SendResults(strResults)
    Dim objShell
    Dim objFSO
    Dim strUploadCmd
    Dim strLinks
    Dim strResultsEnc

    strResultsEnc = Base64Encode(strResults)
    strSendResultsUrl2 = strSendResultsUrl & strResultsEnc

    strLinks = ".\links.exe -dump "
    strUploadCmd = strLinks & strSendResultsUrl2
    Set objFSO = CreateObject("Scripting.FileSystemObject")
    Set objShell = CreateObject("WScript.Shell")
    
    If MsgBox("Can I run the following command?" & vbNewLine & strUploadCmd, vbYesNo, "uploading results...somewhere") = vbYes Then
        objShell.Run strUploadCmd, 2, 1
    End If
End Sub



Function makeUnixTime(strTime, mode)
End Function
Function CGmt(dateLocalTime)
'Given a time in the type date, returns the time of type date in timezone GMT
    Dim strComputer
    Dim objWMIService
    Dim colItems
    Dim objItem
    Dim intTimeBias

    strComputer = "."
    Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
    Set colItems = objWMIService.ExecQuery("Select * from Win32_TimeZone", , 48)
    For Each objItem In colItems
            intTimeBias = -(objItem.Bias)
    Next
    CGmt = DateAdd("n", intTimeBias, dateLocalTime)
    
End Function

Function UDate(dateMs)
  UDate = DateDiff("s", "01/01/1970 00:00:00", dateMs)
End Function




Function isLsassCrashable()
isLsassCrashable = False
End Function


Function PwdCk(objFSO, strComputerName)
PwdCk = ""
End Function

Function SavOk(rsDataList)
SavOk = "1"
End Function

Sub cmdNoSend()
End Sub


Sub RunPrint()
    'window.Print
End Sub

whoa

[weasel]

Wow, now that's service!

[Pyro1588]

quite! i'll have to bring that up as a simple exploit. i also would like some details on what it changes without asking. for instance, what does it do with wget.exe? i'm assuming that it's after winget, which is a perfectly legitimate download accelerator.

[ajs]

It'll probably just be GNU wget. I know I used it at lot at uni to leech files while I wasn't at my desk, maybe a disgruntled sysadmin got sick of people using it (wget --continue --timeout=0 --tries=0 ftw) and hacked the script to delete it automatically? Who knows.

--ajs.

[mac404]

Really not sure how helpful it will be to you now, but I've found that simply using the User Agent Switcher add-on for Firefox to trick Resnet into thinking you are on some linux platform bypasses the need for this program to begin with (which is good, as it randomly seems to crash for me). SO helpful.