'Silent Runners.vbs – find out what programs start up with Windows! ’ 'DO NOT REMOVE THIS HEADER! ’ 'Copyright Andrew ARONOFF 19 June 2006, http://www.silentrunners.org/ 'This script is provided without any warranty, either expressed or implied 'It may not be copied or distributed without permission ’ '** YOU RUN THIS SCRIPT AT YOUR OWN RISK! ** 'HEADER ENDS HERE Option Explicit Dim strRevNo : strRevNo = “46” Public flagTest : flagTest = False 'True if testing 'flagTest = True 'Uncomment to test 'This script is divided into 28 sections. 'malware launch points: ’ registry keys (I-XII, XV) ’ INI/INF-files (XVI-XVIII) ’ folders (XIX) ’ enabled scheduled tasks (XX) ’ Winsock2 service provider DLLs (XXI) ’ IE toolbars, explorer bars, extensions (XXII) ’ started services (XXVI) ’ keyboard driver filters (XXVII) ’ printer monitors (XXVIII) 'hijack points: ’ System/Group Policies (XIV) ’ prefixes for IE URLs (XXIII) ’ misc IE points (XXIV) ’ HOSTS file (XXV) 'Output is suppressed if deemed normal unless the -all parameter is used 'Sections XVIII & XXII-dormant Explorer Bars are skipped unless the -supp/-all ’ parameters are used or the first message box is answered “No” ’ I. HKCU/HKLM… Run/RunOnce/RunOnce\Setup ’ HKLM… RunOnceEx/RunServices/RunServicesOnce ’ HKCU/HKLM… Policies\Explorer\Run ’ II. HKLM… Active Setup\Installed Components\ ’ HKCU… Active Setup\Installed Components\ ’ (StubPath <> “” And HKLM version # > HKCU version #) ’ III. HKLM… Explorer\Browser Helper Objects\ ’ IV. HKLM… Shell Extensions\Approved\ ’ V. HKLM… Explorer\SharedTaskScheduler/ShellExecuteHooks ’ VI. HKCU/HKLM… ShellServiceObjectDelayLoad\ ’ VII. HKCU… Command Processor\AutoRun ((default) <> “”) ’ HKCU… Policies\System\Shell (W2K & WXP only) ’ HKCU… Windows\load & run ((default) <> “”) ’ HKCU… Command Processor\AutoRun ((default) <> “”) ’ HKLM… Windows\AppInit_DLLs ((default) <> “”) ’ HKLM… Winlogon\Shell/Userinit/System/Ginadll/Taskman ’ ((default) <> explorer.exe, userinit.exe, “”, “”, “”) ’ HKLM… Control\SafeBoot\Option\UseAlternateShell ’ HKLM… Control\Session Manager\BootExecute ’ HKLM… Control\Session Manager\WOW\cmdline, wowcmdline ’ VIII. HKLM… Winlogon\Notify\ (subkey names/DLLName values <> O/S-specific dictionary data) ’ IX. HKLM… Image File Execution Options\ (subkeys with name = “Debugger”) ’ X. HKCU/HKLM… Policies… Startup/Shutdown, Logon/Logoff ’ XI. HKCU/HKLM Protocols\Filter ’ XII. Context menu shell extensions ’ XIII. HKCR executable file type (bat/cmd/com/exe/hta/pif/scr) ’ (shell\open\command data <> “%1” %*; hta <> mshta.exe “%1” %*; scr <> “%1” /S) ’ XIV. System/Group Policies ’ XV. Enabled Wallpaper & Screen Saver ’ XVI. WIN.INI (load/run <> “”), SYSTEM.INI (shell <> explorer.exe, scrnsave.exe), WINSTART.BAT ’ XVII. AUTORUN.INF in root of fixed drive (open/shellexecute <> “”) ’ XVIII. DESKTOP.INI in any local fixed disk directory (section skipped by default) ’ XIX. %WINDIR%… Startup & All Users… Startup (W98/WME) or ’ %USERNAME%… Startup & All Users… Startup folder contents ’ XX. Scheduled Tasks ’ XXI. Winsock2 Service Provider DLLs ’ XXII. Internet Explorer Toolbars, Explorer Bars, Extensions (dormant ’ Explorer Bars section skipped by default) ’ XXIII. Internet Explorer URL Prefixes ’ XXIV. Misc. IE Hijack Points ’ XXV. HOSTS file ’ XXVI. Started Services ’ XXVII. Keyboard Driver Filters 'XXVIII. Printer Monitors Dim Wshso : Set Wshso = WScript.CreateObject(“WScript.Shell”) Dim WshoArgs : Set WshoArgs = WScript.Arguments Dim intErrNum, intMB 'Err.Number, MsgBox return value Dim strflagTest : strflagTest = “” If flagTest Then strflagTest = “TEST " Wshso.Popup “Silent Runners is in testing mode.”,1, _ “Testing, testing, 1-2-3…”, vbOKOnly + vbExclamation End If 'Configuration Detection Section ’ FileSystemObject creation error (112) ’ CScript/WScript (147) ’ Dim (161) ’ GetFileVersion(WinVer.exe) (VBScript 5.1) (182) ’ OS version (223) ’ WMI (279) ’ Dim (364) ’ command line arguments (440) ’ supplementary search MsgBox (532) ’ startup MsgBox (557) ’ CreateTextFile error (583) ’ output file header (625) ’ WXP SP2 (629) On Error Resume Next Dim Fso : Set Fso = CreateObject(“Scripting.FileSystemObject”) intErrNum = Err.Number : Err.Clear On Error Goto 0 If intErrNum <> 0 Then strURL = “http://tinyurl.com/7nn6” intMB = MsgBox (Chr(34) & “Silent Runners” & Chr(34) &_ " cannot access file services critical to” & vbCRLF &_ “proper script operation.” & vbCRLF & vbCRLF &_ “If you are running Windows XP, make sure that the” &_ vbCRLF & Chr(34) & “Cryptographic Services” & Chr(34) &_ " service is started." & vbCRLF & vbCRLF &_ “You can also try reinstalling the latest version of the MS” &_ vbCRLF & “Windows Script Host.” & vbCRLF & vbCRLF &_ “Press " & Chr(34) & “OK” & Chr(34) & " to direct your browser to " &_ “the download site or” & vbCRLF & Space(10) & Chr(34) & “Cancel” &_ Chr(34) & " to quit.”, vbOKCancel + vbCritical, _ “Can’t access the FileSystemObject!”) 'if dl wanted now, send browser to dl site If intMB = 1 Then Wshso.Run strURL WScript.Quit End If Dim oNetwk : Set oNetwk = WScript.CreateObject(“WScript.Network”) Const HKLM = &H80000002, HKCU = &H80000001 Const REG_SZ=1, REG_EXPAND_SZ=2, REG_BINARY=3, REG_DWORD=4, REG_MULTI_SZ=7 Const MS = " [MS]" Const DQ = “”"" 'determine whether output is via MsgBox/PopUp or Echo Dim flagOut If InStr(LCase(WScript.FullName),“wscript.exe”) > 0 Then flagOut = “W” 'WScript ElseIf InStr(LCase(WScript.FullName),“cscript.exe”) > 0 Then flagOut = “C” 'CScript Else 'echo and continue if it works flagOut = “C” 'assume CScript-compatible WScript.Echo “Neither " & Chr(34) & “WSCRIPT.EXE” & Chr(34) & " nor " &_ Chr(34) & “CSCRIPT.EXE” & Chr(34) & " was detected as " &_ “the script host.” & vbCRLF & Chr(34) & “Silent Runners” & Chr(34) &_ " will assume that the script host is CSCRIPT-compatible and will” & vbCRLF &_ “use WScript.Echo for all messages.” End If 'script host Const SysFolder = 1 : Const WinFolder = 0 Dim strOS : strOS = “Unknown” Dim strOSLong : strOSLong = “Unknown” Dim strOSXP : strOSXP = “Windows XP Home” 'XP Home or Pro Public strFPSF : strFPSF = Fso.GetSpecialFolder(SysFolder).Path 'FullPathSystemFolder Public strFPWF : strFPWF = Fso.GetSpecialFolder(WinFolder).Path 'FullPathWindowsFolder Public strExeBareName 'bare file name w/o windows or system folder prefixes Dim strSysVer 'Winver.exe version number Dim intErrNum1, intErrNum2, intErrNum3, intErrNum4, intErrNum5, intErrNum6 'error number Dim intLenValue 'value length Dim strURL 'download URL Dim flagGP : flagGP = False 'assume Group Policies cannot be set in the O/S Dim intCLL : intCLL = 1 'CLSID Lower Limit, default is for O/S <= NT4 'Winver.exe is in \Windows under W98, but in \System32 for other O/S’s 'trap GetFileVersion error for VBScript version < 5.1 On Error Resume Next If Fso.FileExists (strFPSF & “\Winver.exe”) Then strSysVer = Fso.GetFileVersion(strFPSF & “\Winver.exe”) Else strSysVer = Fso.GetFileVersion(strFPWF & “\Winver.exe”) End If intErrNum = Err.Number : Err.Clear On Error Goto 0 'if old VBScript version If intErrNum <> 0 Then 'store dl URL strURL = “http://tinyurl.com/7zh0” 'if using WScript If flagOut = “W” Then 'explain the problem intMB = MsgBox ("This script requires VBScript 5.1 or higher " &_ “to run.” & vbCRLF & vbCRLF & "The latest version of VBScript can " &_ "be downloaded at: " & strURL & vbCRLF & vbCRLF &_ "Press " & Chr(34) & “OK” & Chr(34) & " to direct your browser to " &_ “the download site or " & Chr(34) & “Cancel” & Chr(34) &_ " to quit.” & vbCRLF & vbCRLF & “(WMI is also required. If it’s " &_ “missing, download instructions will appear later.)”, _ vbOKCancel + vbExclamation,“Unsupported VBScript Version!”) 'if dl wanted now, send browser to dl site If intMB = 1 Then Wshso.Run strURL 'if using CScript Else 'flagOut = “C” 'explain the problem WScript.Echo Chr(34) & “Silent Runners” & Chr(34) & " requires " &_ “VBScript 5.1 or higher to run.” & vbCRLF & vbCRLF &_ “It can be downloaded at: " & strURL End If 'WScript or CScript? 'quit the script WScript.Quit End If 'VBScript version error encountered? 'use WINVER.EXE file version to determine O/S If Instr(Left(strSysVer,3),“4.1”) > 0 Then strOS = “W98” : strOSLong = “Windows 98” ElseIf Instr(Left(strSysVer,5),“4.0.1”) > 0 Then strOS = “NT4” : strOSLong = “Windows NT 4.0” ElseIf Instr(Left(strSysVer,8),“4.0.0.95”) > 0 Then strOS = “W98” : strOSLong = “Windows 95” ElseIf Instr(Left(strSysVer,8),“4.0.0.11”) > 0 Then strOS = “W98” : strOSLong = “Windows 95 SR2 (OEM)” ElseIf Instr(Left(strSysVer,3),“5.0”) > 0 Then strOS = “W2K” : strOSLong = “Windows 2000” : : intCLL = 0 : flagGP = True ElseIf Instr(Left(strSysVer,3),“5.1”) > 0 Then 'SP0 & SP1 = 5.1.2600.0, SP2 = 5.1.2600.2180 strOS = “WXP” : strOSLong = “Windows XP” : intCLL = 0 If Instr(strSysVer,”.2180”) > 0 Then strOSLong = “Windows XP SP2” ElseIf Instr(Left(strSysVer,3),“4.9”) > 0 Then strOS = “WME” : strOSLong = “Windows Me (Millennium Edition)” ElseIf Instr(Left(strSysVer,3),“5.2”) > 0 Then strOS = “WXP” : strOSLong = “Windows Server 2003 (interpreted as Windows XP)” flagGP = True : intCLL = 0 Else 'unknown strSysVer If flagOut = “W” Then intMB = MsgBox (“The " & Chr(34) & “Silent Runners” & Chr(34) &_ " script cannot determine the operating system.” & vbCRLF & vbCRLF &_ "Click " & Chr(34) & “OK” & Chr(34) & " to send an e-mail to the " &_ “author, providing the following information:” & vbCRLF & vbCRLF &_ "WINVER.EXE file version = " & strSysVer & vbCRLF & vbCRLF &_ “or click " & Chr(34) & “Cancel” & Chr(34) & " to quit.”, _ 49,“O/S Unknown!”) If intMB = 1 Then Wshso.Run “mailto:Andrew%20Aronoff%20” &_ “<%73%72.%6F%73.%76%65%72.%65%72%72%6F%72@%61%61%72%6F%6E%6F%66%66.%63%6F%6D>?” &_ “subject=Silent%20Runners%20OS%20Version%20Error&body=WINVER.EXE” &_ “%20file%20version%20=%20” & strSysVer Else 'flagOut = “C” WScript.Echo Chr(34) & “Silent Runners” & Chr(34) & " cannot " &_ “determine the operating system.” & vbCRLF & vbCRLF & “This script will exit.” End If 'flagOut? WScript.Quit End If 'OS id’d from strSysVer? 'use WMI to connect to the registry On Error Resume Next Dim oReg : Set oReg = GetObject(“winmgmts:\root\default:StdRegProv”) intErrNum = Err.Number : Err.Clear On Error Goto 0 'detect WMI connection error If intErrNum <> 0 Then strURL = “” 'for W98/NT4, assume WMI not installed and direct to d/l URL If strOS = “W98” Or strOS = “NT4” Then If strOS = “W98” Then strURL = “http://tinyurl.com/jbxe” If strOS = “NT4” Then strURL = “http://tinyurl.com/7wd7” 'invite user to download WMI & quit If flagOut = “W” Then intMB = MsgBox ("This script requires " & Chr(34) & “WMI” &_ Chr(34) & “, Windows Management Instrumentation, to run.” &_ vbCRLF & vbCRLF & "It can be downloaded at: " & strURL &_ vbCRLF & vbCRLF & “Press " & Chr(34) & “OK” & Chr(34) &_ " to direct your browser to the download site or " &_ Chr(34) & “Cancel” & Chr(34) & " to quit.”,_ vbOKCancel + vbCritical,“WMI Not Installed!”) If intMB = 1 Then Wshso.Run strURL 'at command line, explain & quit Else 'flagOut = “C” WScript.Echo Chr(34) & “Silent Runners” & Chr(34) & " requires " &_ Chr(34) & “WMI” & Chr(34) & ", Windows Management Instrumentation, " &_ “to run.” & vbCRLF & vbCRLF & "It can be downloaded at: " & strURL End If 'for W2K Or WXP, explain how to start the WMI service ElseIf strOS = “W2K” Or strOS = “WXP” Then If strOS = “W2K” Then strLine = “Settings, " 'explain how to turn on WMI service If flagOut = “W” Then MsgBox “This script requires Windows Management Instrumentation” &_ " to run.” & vbCRLF & vbCRLF & "Click on Start, " & strLine &_ “Control Panel, Administrative Tools, Services,” & vbCRLF &_ “and start the " & Chr(34) & “Windows Management Instrumentation” &_ Chr(34) & " service.”,vbOKOnly + vbCritical,“WMI Service not running!” 'at command line, explain & quit Else 'flagOut = “C” WScript.Echo Chr(34) & “Silent Runners” & Chr(34) & " requires " &_ “Windows Management Instrumentation to run.” & vbCRLF & vbCRLF &_ “Click on Start, " & strLine & “Control Panel, Administrative " &_ " Tools, Services,” & vbCRLF & “and start the " & Chr(34) &_ “Windows Management Instrumentation” & Chr(34) & " service.” End If 'flagOut? Else 'WME 'say there’s a WMI problem If flagOut = “W” Then MsgBox “This script requires WMI (Windows Management Instrumentation)” &_ " to run,” & vbCRLF & “but WMI is not running correctly.”, _ vbOKOnly + vbCritical,“WMI problem!” 'at command line, explain & quit Else 'flagOut = “C” WScript.Echo Chr(34) & “Silent Runners” & Chr(34) & " requires " &_ “WMI (Windows Management Instrumentation) to run,” & vbCRLF &_ “but WMI is not running correctly.” End If 'flagOut? End If 'which O/S? WScript.Quit End If 'WMI execution error 'array of Run keys, counter x 5, hive member, startup folder file, 'startup file shortcut, IERESET.INF file Dim arRunKeys, i, ii, j, k, l, oHiveElmt, oSUFi, oSUSC 'dictionary, keys, items, hard disk collection Dim arSK, arSKk, arSKi, colDisks 'arrays: Run key names, keys, sub-keys, value type, Protocol filters Dim arNames(), arKeys(), arSubKeys(), arType, arFilter() 'Sub-Directory DeskTop.Ini array, Sub-Directory Error array Public arSDDTI(), arSDErr() 'DeskTop.Ini counter, Error counter, Classes data Hive counter Public ctrArDTI, ctrArErr, ctrCH Public ctrFo : ctrFo = 0 'folder counter 'name member, key array member x 4, O/S, drive root directory, work file Dim oName, oKey, oKey2, strMemKey, strMemSubKey, oOS, oRoot, oFileWk 'values x 7 Dim strValue, strValue1, strValue2, strValue3, strValue4, strValue5, strValue6, intValue 'name, single character, startup folder name, startup folder, array member, temp var Dim strName, strChr, arSUFN, oSUF, strArMember, strTmp 'output string x 3 Public strOut, strOut1, strOut2 'output file msg x 2, warning string, title line Dim strLine, strLine1, strLine2, strWarn, strTitleLine Dim strKey, strKey1, strKey2, strKey3, strSubKey 'register key x 4, sub-key 'output file name string (incl. path), file name (wo path), 'PIF path string, single binary character Dim strFN, strFNNP, strPIFTgt, bin1C Public datLaunch : datLaunch = Now 'script launch time Public intCnt 'counter 'ref time, time taken by 2 pop-up boxes Public datRef : datRef = 0 Public datPUB1 : datPUB1 = 0 : Public datPUB2 : datPUB2 = 0 'TRUE if show all output (default values not filtered) Public flagShowAll : flagShowAll = False Dim strRptOutput : strRptOutput = "Output limited to non-default values, " &_ "except where indicated by " & Chr(34) & “{++}” & Chr(34) 'output file string Public strTitle : strTitle = “” Public strSubTitle : strSubTitle = “” Public strSubSubTitle : strSubSubTitle = “” Public flagNVP : flagNVP = False 'existence of name/value pairs in a key Public flagInfect : flagInfect = False 'flag infected condition Dim flagMatch 'flag matching keys Dim flagAllow 'flag key on approved list Dim flagFound 'flag key that exists in Registry Dim flagDirArg : flagDirArg = False 'presence of output directory argument Dim flagIsCLSID : flagIsCLSID = False 'true if argument in CLSID format Dim flagTitle 'True if title has already been written Dim flagAllArg : flagAllArg = False 'presence of all output argument Dim flagArray 'flag array containing elements Public flagSupp : flagSupp = False 'do *not* check for DESKTOP.INI in all 'directories of local fixed disks 'or for dormant Explorer Bars Dim intLBSP 'Last BackSlash Position in path string Dim intSS 'lowest sort subscript Dim intType 'value type Dim strDLL, strCN 'DLL name, company name 'string to signal all output by default Public strAllOutDefault : strAllOutDefault = “” Dim ScrPath : ScrPath = Fso.GetParentFolderName(WScript.ScriptFullName) If Right(ScrPath,1) <> “” Then ScrPath = ScrPath & “” 'initialize Path of Output File Folder to script path Dim strPathOFFo : strPathOFFo = ScrPath 'hive array Public arHives(1,1) arHives(0,0) = “HKCU” : arHives(1,0) = “HKLM” arHives(0,1) = &H80000001 : arHives(1,1) = &H80000002 'set up argument usage message string Dim strLSp, strCSp 'Leading Spaces, Centering Spaces strLSp = Space(4) : strCSp = Space(33) 'WScript spacing If flagOut = “C” Then 'CScript spacing strLsp = Space(3) : strCSp = Space(28) End If Dim strMsg : strMsg = “Only two arguments are permitted:” &_ vbCRLF & vbCRLF &_ “1. the name of an existing directory for the output report” &_ vbCRLF & strLSp & “(embed in quotes if it contains spaces)” &_ vbCRLF & vbCRLF & strCSp & “AND:” & vbCRLF & vbCRLF &_ "2. " & Chr(34) & “-supp” & Chr(34) & " to search " &_ “all directories for DESKTOP.INI DLL” & vbCRLF &_ strLSp & “launch points and all Registry CLSIDs for dormant” &_ vbCRLF & strLSp & “Explorer Bars” &_ vbCRLF & vbCRLF & strCSp & “-OR-” & vbCRLF & vbCRLF &_ "3. " & Chr(34) & “-all” & Chr(34) & " to output all non-empty " &_ “values and all launch” & vbCRLF & strLSp & “points checked” 'check if output directory or “-all” or “-supp” was supplied as argument If WshoArgs.length > 0 And WshoArgs.length <= 2 Then For i = 0 To WshoArgs.length-1 'if directory arg not already passed and arg directory exists If Not flagDirArg And Fso.FolderExists(WshoArgs(i)) Then 'get the path & toggle the directory arg flag Dim oOFFo : Set oOFFo = Fso.GetFolder(WshoArgs(i)) strPathOFFo = oOFFo.Path : flagDirArg = True If Right(strPathOFFo,1) <> “” Then strPathOFFo = strPathOFFo & “” Set oOFFo=Nothing 'if -all arg not already passed and is this arg ElseIf Not flagAllArg And LCase(WshoArgs(i)) = “-all” Then 'toggle ShowAll flag, toggle the all arg flag, fill report string flagShowAll = True : flagAllArg = True strRptOutput = “Output of all locations checked and all values found.” 'if -all arg not already passed and is this arg ElseIf Not flagAllArg And LCase(WshoArgs(i)) = “-supp” Then flagSupp = True : flagAllArg = True strRptOutput = "Search enabled of all directories on local fixed " &_ “drives for DESKTOP.INI” & vbCRLF & " DLL launch points and of " &_ “all Registry CLSIDs for dormant Explorer Bars” & vbCRLF & strRptOutput 'argument can’t be interpreted, so explain & quit Else If flagOut = “W” Then 'pop up a message window
