Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

TrojanDownloader:win32/Unruy.H


  • Please log in to reply

#76
RKinner

RKinner

    Malware Expert

  • Expert
  • 19,797 posts
  • MVP
We could make the bat file loop:


cls
:start
net start dhcp
%errorlevel%
goto start



Hate to leave it running tho. Need to figure out how to detect that dhcp is running. Go ahead and try this one tho just to see if it will work. You can call it "test.bat" and put it on your desktop. To stop it just hit Ctrl + C then Y. When I run it on my Win 7 it tells me the errorlevel is 2. I would think you would get a 0 when it finally works for the first time then a 2 after that. The question is do you get a 1 or some other number when it fails to start.
  • 0

Advertisements


#77
Steven Gottlieb

Steven Gottlieb

    Member

  • Topic Starter
  • Member
  • PipPip
  • 59 posts
Ron,
Where do I put cls :start net start dhcp %errorlevel% goto start??
Steven
  • 0

#78
RKinner

RKinner

    Malware Expert

  • Expert
  • 19,797 posts
  • MVP
Just like we did the dhcp.bat

Copy

cls
:start
net start dhcp
%errorlevel%
goto start

Open notepad and paste it in (make sure there is an Enter after the last line and then file save as "test.bat"

Then reboot boot and when you see the desktop, double click test.bat and it should start running.

Does the internet start working without you having to do anything? Hit Ctrl + C to stop the test.bat or just X it to kill the whole thing.
  • 0

#79
Steven Gottlieb

Steven Gottlieb

    Member

  • Topic Starter
  • Member
  • PipPip
  • 59 posts
Ron,
You are certainly getting closer to putting this puzzle together. OK, here goes--clicking on the test.bat files just bring up the command prompt with net start dhcp and nothing else UNLESS you wait the infamous 2 minutes and then if I click on it it runs.
Thank you,
Steven
  • 0

#80
Steven Gottlieb

Steven Gottlieb

    Member

  • Topic Starter
  • Member
  • PipPip
  • 59 posts
Ron,
It's been a few days since I've heard from you.
Thanks,
Steven
  • 0

#81
RKinner

RKinner

    Malware Expert

  • Expert
  • 19,797 posts
  • MVP
What errorlevel are you getting when you run the bat command?

I am going on a trip today for four days. Expect delays.
  • 0

#82
Steven Gottlieb

Steven Gottlieb

    Member

  • Topic Starter
  • Member
  • PipPip
  • 59 posts
Ron,
Error 2
Steven

Edited by Steven Gottlieb, 19 March 2012 - 08:19 AM.

  • 0

#83
RKinner

RKinner

    Malware Expert

  • Expert
  • 19,797 posts
  • MVP
Download Process Monitor http://live.sysinter...com/Procmon.exe

Save it to your desktop. Run Process Monitor.


Click on Options,

check Enable Boot Logging. Click on Generate profiling events (every second). OK. Then close Process Monitor and restart. As soon as the desktop returns, start up Process Monitor again. It should tell you that there was a boot time log and ask if you want to process it. Say yes. Then once it finishes, save the log (call it: boot)

This is going to be huge. Mine is 232 MB. We will need to compress this. WinRAR is the best but you have to buy it or jump through too many hoops so get 7-zip
http://downloads.sou...enzip/7z920.msi

Once you install it you right click on boot.pml and hover over 7Zip and then click on Add to boot.7z. This will take a minute or two. The file will be in the same folder as boot.pml. Send it to me via Email as an attachment.

I will send you a PM with my email address in case I haven't done so already.

Ron
  • 0

#84
RKinner

RKinner

    Malware Expert

  • Expert
  • 19,797 posts
  • MVP
Disable the network then start Process Explorer and enable the network. Once the network icon appears click on File, uncheck Capture Events. Save the file as before, 7zip it and send it to me.
  • 0

#85
Steven Gottlieb

Steven Gottlieb

    Member

  • Topic Starter
  • Member
  • PipPip
  • 59 posts
Ron,
I really do not understand these steps. If my computer is online, yes I can disable the internet. I do not know however how to start Process Explorer--unless I restart my computer. Now if I need to restart my computer I don't understand why you ask me to disable my network (network=internet??) since you know that it is off when I start my computer up. So I am assuming that I can run Process Explorer without restarting my computer. I looked at the option on Process Explorer and do not see a way to get it to run. Can you please explain in a different way what it is that you are asking me to do?
Thank you,
Steven
  • 0

Advertisements


#86
RKinner

RKinner

    Malware Expert

  • Expert
  • 19,797 posts
  • MVP
I meant Process Monitor. Sorry.

First disable the network:

http://compnetworkin...nndisenable.htm

Then Start Process Monitor

Then go back in and enable the network.

When you see the network icon pop up.

File, uncheck Capture Events. Save the file as before, 7zip it and send it to me.
  • 0

#87
Steven Gottlieb

Steven Gottlieb

    Member

  • Topic Starter
  • Member
  • PipPip
  • 59 posts
Ron,
I sent the file to your email address.
Thank you
  • 0

#88
RKinner

RKinner

    Malware Expert

  • Expert
  • 19,797 posts
  • MVP
Do post #83 again but this time wait until after you do
net start dhcp

before starting Process Explorer.
  • 0

#89
Steven Gottlieb

Steven Gottlieb

    Member

  • Topic Starter
  • Member
  • PipPip
  • 59 posts
net start dhcp on the command prompt starts automatically. Do you mean to wait until dhcp actually starts???
Steven

Edited by Steven Gottlieb, 30 March 2012 - 09:14 PM.

  • 0

#90
RKinner

RKinner

    Malware Expert

  • Expert
  • 19,797 posts
  • MVP
I thought you were having to redo it after afd came up so I want to see everything that happens until it starts working.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP