StappleCommander
2007-02-08, 20:48
Hi antispy people! I have written a script to distribute the latest version of spybot, create a scheduled task, and generate log files based on every computer within my network. The task Run command is set up as followed:
"C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"" /taskbarhide /autoupdate /autocheck /autofix /autoclose
Now when the task is run you can see it with the task manager and from looking at the log files it is detecting things. I infected a vmware install with sharebear and some other known problems to see if it would fix them. This is what the logs are saying:
Bearshare: Uninstall settings (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BearShare
Microsoft.Windows.Security.InternetExplorer: Settings (Registry change, nothing done)
HKEY_USERS\S-1-5-21-1386414855-1143633948-1237804090-3250\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\iexplore.exe!=W=1
WhenU.Search: Root class (Registry key, nothing done)
HKEY_LOCAL_MACHINE\Software\Classes\WUSE.1
etc...
If i run this line:
"C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autoupdate /autocheck /autofix
It will fix the selected problems. If i run it manually it will find the problems and (obviously) fix them when i tell it to. Keep in mind, with both lines there is no user interaction with the program (plus i went afk when i set it to run :P ).
I was wondering if this was a known problem that people have heard of before, or if it might have something to do with running spybot as a scheduled task. I am create the task with windows AT, not the task scheduler.
"C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"" /taskbarhide /autoupdate /autocheck /autofix /autoclose
Now when the task is run you can see it with the task manager and from looking at the log files it is detecting things. I infected a vmware install with sharebear and some other known problems to see if it would fix them. This is what the logs are saying:
Bearshare: Uninstall settings (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BearShare
Microsoft.Windows.Security.InternetExplorer: Settings (Registry change, nothing done)
HKEY_USERS\S-1-5-21-1386414855-1143633948-1237804090-3250\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\iexplore.exe!=W=1
WhenU.Search: Root class (Registry key, nothing done)
HKEY_LOCAL_MACHINE\Software\Classes\WUSE.1
etc...
If i run this line:
"C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autoupdate /autocheck /autofix
It will fix the selected problems. If i run it manually it will find the problems and (obviously) fix them when i tell it to. Keep in mind, with both lines there is no user interaction with the program (plus i went afk when i set it to run :P ).
I was wondering if this was a known problem that people have heard of before, or if it might have something to do with running spybot as a scheduled task. I am create the task with windows AT, not the task scheduler.