Pour les utilisateurs

Fermer

Bibliothèque
Ma bibliothèque

+ Ajouter à la bibliothèque

Recherche
Recherche

Contacter-nous !
Support 24/24 | Rules regarding submitting

Envoyer un message

Requête à l'aide du formulaire

Nous téléphoner

0 825 300 230

Forum

Vos requêtes

  • Toutes : -
  • Non clôturées : -
  • Dernière : le -
Créer une nouvelle requête

Nous téléphoner

0 825 300 230

Profil

FR

RU CN DE EN ES FR IT JP KZ UZ PL BY
Fermer
Services support
Scanners
Dr.Web vxCube
Démo
Bibliothèque virale
Base documentaire

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Actualités

Trojan.MulDrop9.30818

Added to the Dr.Web virus database: 2019-07-17

Virus description added:

Technical Information

Modifies file system
Creates the following files
  • %TEMP%\sce19479.tmp
  • %TEMP%\sec.log
  • %TEMP%\screensaver.log
  • %TEMP%\adsutilenumall.vbs
  • %TEMP%\regulariisitem.vbs
  • <SYSTEM32>\10.0.67.8_<File name>_chk.xml
Deletes the following files
  • %TEMP%\sce19479.tmp
  • %TEMP%\sec.log
  • %TEMP%\screensaver.log
  • %TEMP%\adsutilenumall.vbs
  • %TEMP%\regulariisitem.vbs
Miscellaneous
Creates and executes the following
  • '<SYSTEM32>\cscript.exe' %TEMP%\RegularIISItem.vbs n MaxConnections
  • '<SYSTEM32>\cscript.exe' //nologo %TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cscript.exe' %TEMP%\RegularIISItem.vbs y ScriptMaps
  • '<SYSTEM32>\cscript.exe' %TEMP%\RegularIISItem.vbs y EnableDirBrowsing
  • '<SYSTEM32>\cscript.exe' %TEMP%\RegularIISItem.vbs y path
  • '<SYSTEM32>\cscript.exe' %TEMP%\RegularIISItem.vbs y AccessFlags
  • '<SYSTEM32>\cmd.exe' /c echo If (Err.Number ^<^> 0) Then Err.Clear>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo For Each ChildObject In IIsObject>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo If (Err.Number ^<^> 0) Then Exit For>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo ChildObjectName = Right(ChildObject.AdsPath, Len(ChildObject.AdsPath) - 6)>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo ChildObjectName = Right(ChildObjectName, Len(ChildObjectName) - InStr(ChildObjectName, "/") + 1)>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo if 1 = RegExpTest("^\/w3svc(\/\d+(\/root)?)?$", ChildObjectName).Count then>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo WScript.Echo "[" ^& ChildObjectName ^& "]">>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo If ChildObjectName ^<^> "" Then EnumCommand = EnumCommand(ChildObjectName)>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo elseif 1 = RegExpTest("^(\/smtpsvc|\/msftpsvc)$", ChildObjectName).Count then>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo bInRoot = LCase(WScript.arguments(0))>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo EnumCommand "">>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo Next>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo AttrName = WScript.arguments(1)>>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo function RegExpTest(pattern, strng)>>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo set regEx = new RegExp>>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo regEx.Pattern = pattern>>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo regEx.IgnoreCase = True>>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo Next>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo end if>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo End If>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo WScript.Echo " """ ^& ValueList(ValueIndex) ^& """">>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo regEx.Global = True>>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo WScript.Echo PropertyName ^& " : " ^& "(" ^& PropertyDataType ^& ") " ^& ValueList>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo Case "INTEGER">>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo WScript.Echo PropertyName ^& Left(Spacer, Len(Spacer) - Len(PropertyName)) ^& ": " ^& "(" ^& PropertyDataType ^& ") " ^& UnsignedIntegerToString(ValueList)>>...' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo WScript.Echo PropertyName ^& " : " ^& "(" ^& PropertyDataType ^& ") " ^& UnsignedIntegerToString(ValueList)>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo Case "BOOLEAN">>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo Case "LIST">>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo WScript.Echo PropertyName ^& Left(Spacer, Len(Spacer) - Len(PropertyName)) ^& ": " ^& "(" ^& PropertyDataType ^& ") (" ^& (UBound (ValueList) + 1) ^& " Items...' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo ValueList = ValueList ^& ValueListArray(ValueIndex) ^& " ">>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo WScript.Echo PropertyName ^& Left(Spacer, Len(Spacer) - Len(PropertyName)) ^& ": " ^& "(" ^& PropertyDataType ^& ") " ^& ValueList>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo WScript.Echo PropertyName ^& " : " ^& "(" ^& PropertyDataType ^& ") (" ^& (UBound (ValueList) + 1) ^& " Items)">>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo Case "IPSEC">>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo WScript.Echo PropertyName ^& Left(Spacer, Len(Spacer) - Len(PropertyName)) ^& ": " ^& "(" ^& PropertyDataType ^& ") " ^& CStr(ValueList)>>%TEMP%\adsutilenuma...' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo WScript.Echo PropertyName ^& " : " ^& "(" ^& PropertyDataType ^& ") " ^& CStr(ValueList)>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo Case Else>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo If 0 = StrComp("MIMEMAP",PropertyName, 1) Then>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo MimeMapGet ObjectPath, MachineName>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo WScript.Echo "DataType: " ^& """" ^& PropertyObject.Syntax ^& """" ^& " Not Yet Supported on property: " ^& PropertyName>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo For ValueIndex = 0 To UBound(ValueList)>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo End Select>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo End If>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo set RegExpTest = regEx.Execute(strng)>>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo set StdIn = WScript.StdIn>>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo loop>>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo if "y" ^<^> bInRoot then>>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo NamePattern = "^\[\/w3svc\/\d+\]">>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo else>>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo NamePattern = "^\[\/w3svc\/\d+\/root\]">>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo end if>>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo for each key in SiteDict>>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo if 1 = RegExpTest(NamePattern, key).Count then>>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo end if>>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo if SiteDict.Item(key).Exists(LCase(AttrName)) then>>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo elseif SiteDict.Item("[/w3svc]").Exists(LCase(AttrName)) then>>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo AttrValue = SiteDict.Item("[/w3svc]").Item(LCase(AttrName))>>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo else>>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo AttrValue = """NotConfig""">>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo if "y" = bInRoot then key = Left(key, Len(key) - 6) + "]">>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo WScript.Echo key ^& "(" ^& SiteDict.Item(key).Item("servercomment") ^& "):" ^& AttrName ^& "=" ^& AttrValue>>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo next>>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c cscript //nologo %TEMP%\adsutilenumall.vbs > %TEMP%\bvs_iis.log' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo AttrValue = SiteDict.Item(key).Item(LCase(AttrName))>>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo end if>>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo SiteDict.Item(CurSite).Item(CurAttr) = SiteDict.Item(CurSite).Item(CurAttr) ^& ";" ^& LTrim(str)>>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo For ValueIndex = 0 To UBound(ValueListArray)>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo CurSite = "">>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo CurAttr = "">>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo ValueList = "0x">>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo do while not StdIn.AtEndOfStream>>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo str = LCase(StdIn.ReadLine)>>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo if 1 = RegExpTest("^\[\/w3svc", str).Count then>>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo set AttrDict = CreateObject("Scripting.Dictionary")>>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo CurSite = str>>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo SiteDict.Add CurSite, AttrDict>>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo elseif "" ^<^> CurSite then>>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo set sections = RegExpTest("(\S+)\s*:\s*\(\S+\)\s*(\S.*)", str)>>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo if 1 = sections.Count then>>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo ColonPos = InStr(1, str, ":", 1)>>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo StrLeft = Left(str, ColonPos - 1)>>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo StrRight = Right(str, Len(str) - ColonPos)>>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo SubMatches0 = Trim(StrLeft)>>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo SubMatches1 = Trim(Right(StrRight, Len(StrRight) - InStr(1, StrRight, ")", 1)))>>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo CurAttr = SubMatches0>>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo if not SiteDict.Item(CurSite).Exists(CurAttr) then SiteDict.Item(CurSite).Add CurAttr, SubMatches1>>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo end function>>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo Set IIsSchemaObject = GetObject(IIsObject.Schema)>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo Case "BINARY">>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo set SiteDict = CreateObject("Scripting.Dictionary")>>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo If not (PropertyAttribObj.IsInherit) Then>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo Set PropertyAttribObj = IIsObject.GetPropertyAttribObj(PropertyName)>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo MimeOutPutStr = "MimeMap : (MimeMapList) ">>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo For MimeEntryIndex = 0 To UBound(MimeMapList)>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo Set MimeEntry = MimeMapList(MimeEntryIndex)>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo MimeOutPutStr = MimeOutPutStr ^& """" ^& MimeEntry.Extension ^& "," ^& MimeEntry.MimeType ^& """ ">>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo Next>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo WScript.Echo MimeOutPutStr>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo Function IsSecureProperty(ObjectParameter,MachineName)>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo Set PropObj = GetObject("IIS://" ^& MachineName ^& "/schema/" ^& ObjectParameter)>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo MimeMapList = MimeMapObject.Get("MimeMap")>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo Attribute = PropObj.Secure>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo IsSecureProperty = True>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo Else>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo IsSecureProperty = False>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo End If>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo Function UnsignedIntegerToString(ValueData)>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo UnsignedIntegerToString = ValueData>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo DataPath = DataPathList(0)>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo UnsignedIntegerToString = CStr(UnsignedIntegerToString)>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo If (Attribute = True) Then>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo If (UBound(DataPathList) ^< 0) Then Exit Function>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo If (UnsignedIntegerToString ^< 0) Then UnsignedIntegerToString = UnsignedIntegerToString + ^4294967296>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c reg query "HKCU\Control Panel\Desktop" /v ScreenSaveTimeout > %TEMP%\screensaver.log' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c reg query "HKCU\Control Panel\Desktop" /v ScreenSaveActive >> %TEMP%\screensaver.log' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c reg query "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v IPEnableRouter >> %TEMP%\screensaver.log' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo Spacer = " ">%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo SpacerSize = Len(Spacer)>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo function RegExpTest(pattern, strng)>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo set regEx = new RegExp>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo regEx.Pattern = pattern>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo regEx.IgnoreCase = True>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo regEx.Global = True>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo Function MimeMapGet(ObjectPath, MachineName)>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo end function>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c reg query "HKCU\Control Panel\Desktop" /v ScreenSaverIsSecure >> %TEMP%\screensaver.log' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo On Error Resume Next>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo MimePath = "IIS://" ^& MachineName>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo If ObjectPath ^<^> "" Then MimePath = MimePath ^& "/" ^& ObjectPath>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo Set MimeMapObject = GetObject(MimePath)>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo If (Err.Number ^<^> 0) Then Exit Function>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo If Err.Number ^<^> 0 Then DataPathList = IIsObject.GetDataPaths(MimeMap, 0)>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo set RegExpTest = regEx.Execute(strng)>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo DataPathList = MimeMapObject.GetDataPaths("MimeMap", 1)>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo Sub SanitizePath(ObjectPath)>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo If (Err.Number ^<^> 0) Then WScript.Echo "Error trying to enumerate the Optional properties (Couldn't Get Property Information): " ^& PropertyObjPath>>%TEMP%\adsutil...' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo Set PropertyObject = GetObject("IIS://" ^& MachineName ^& "/Schema/" ^& PropertyName)>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo If UCase(DataPath) ^<^> UCase(MimePath) Then Exit Function>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo PropertyDataType = UCase(PropertyObject.Syntax)>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo Select Case PropertyDataType>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo Case "STRING">>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo ValueList = IIsObject.Get(PropertyName)>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo If (IsSecureProperty(PropertyName,MachineName) = True) Then>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo WScript.Echo PropertyName ^& Left(Spacer, Len(Spacer) - Len(PropertyName)) ^& ": " ^& "(" ^& PropertyDataType ^& ") " ^& """" ^& "**********" ^& """">>%TEMP%...' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo Else>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo If (Len(PropertyName) ^< SpacerSize) Then>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo WScript.Echo PropertyName ^& Left(Spacer, Len(Spacer) - Len(PropertyName)) ^& ": " ^& "(" ^& PropertyDataType ^& ") """ ^& ValueList ^& """">>%TEMP%\adsu...' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo Else>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo WScript.Echo PropertyName ^& " : " ^& "(" ^& PropertyDataType ^& ")" ^& """" ^& ValueList ^& """">>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo End If>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo End If>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo Case "EXPANDSZ">>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo If (Len(PropertyName) ^< SpacerSize) Then>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo WScript.Echo PropertyName ^& Left(Spacer, Len(Spacer) - Len(PropertyName)) ^& ": " ^& "(" ^& PropertyDataType ^& ") """ ^& ValueList ^& """">>%TEMP%\adsutile...' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo WScript.Echo PropertyName ^& " : " ^& "(" ^& PropertyDataType ^& ") """ ^& ValueList ^& """">>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo elseif 1 = RegExpTest("^\s+", str).Count then>>%TEMP%\RegularIISItem.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo If (Err.Number = 0) Then>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo SanitizePath DataPath>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo Err.Clear>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo If Left(ObjectPath, 1) = "/" Then ObjectPath = Right(ObjectPath, Len(ObjectPath) - 1)>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo If Right(ObjectPath, 1) = "/" Then ObjectPath = Left(ObjectPath, Len(ObjectPath) - 1)>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo End Sub>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo Function EnumCommand(StartPath)>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo ObjectPath = StartPath>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo SanitizePath ObjectPath>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo MachineName = "localhost">>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo IIsObjectPath = "IIS://" ^& MachineName>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo If (ObjectPath ^<^> "") Then IIsObjectPath = IIsObjectPath ^& "/" ^& ObjectPath>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo ValueListArray = IIsObject.Get(PropertyName)>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo Set IIsObject = GetObject(IIsObjectPath)>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo ReDim PropertyListSet(1)>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo PropertyListSet(0) = IIsSchemaObject.MandatoryProperties>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo PropertyListSet(1) = IIsSchemaObject.OptionalProperties>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo If TypeName (PropertyListSet(1)) ^<^> "Variant()" Then>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo WScript.Echo "Warning: The optionalproperties list is of an invalid type">>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo ElseIf (UBound (PropertyListSet(1)) = -1) Then>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo WScript.Echo "Warning: The OptionalProperties list for this node is empty.">>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo For Each PropertyList In PropertyListSet>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo For Each PropertyName In PropertyList>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c echo ObjectPath = Replace(Trim(ObjectPath), "\", "/")>>%TEMP%\adsutilenumall.vbs' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c secedit /export /cfg %TEMP%\sec.log' (with hidden window)
Executes the following
  • '<SYSTEM32>\cmd.exe' /c secedit /export /cfg %TEMP%\sec.log
  • '<SYSTEM32>\cmd.exe' /c echo NamePattern = "^\[\/w3svc\/\d+\/root\]">>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo end if>>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo for each key in SiteDict>>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo if 1 = RegExpTest(NamePattern, key).Count then>>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo if SiteDict.Item(key).Exists(LCase(AttrName)) then>>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo AttrValue = SiteDict.Item(key).Item(LCase(AttrName))>>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo elseif SiteDict.Item("[/w3svc]").Exists(LCase(AttrName)) then>>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo AttrValue = SiteDict.Item("[/w3svc]").Item(LCase(AttrName))>>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo else>>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo AttrValue = """NotConfig""">>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo if "y" = bInRoot then key = Left(key, Len(key) - 6) + "]">>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo WScript.Echo key ^& "(" ^& SiteDict.Item(key).Item("servercomment") ^& "):" ^& AttrName ^& "=" ^& AttrValue>>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo next>>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo CurSite = str>>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c cscript //nologo %TEMP%\adsutilenumall.vbs > %TEMP%\bvs_iis.log
  • '<SYSTEM32>\cmd.exe' /S /D /c" type %TEMP%\sec.log"
  • '<SYSTEM32>\find.exe' /i "AuditProcessTracking"
  • '<SYSTEM32>\cmd.exe' /c type %TEMP%\sec.log|find /i "AuditAccountManage"
  • '<SYSTEM32>\find.exe' /i "AuditAccountManage"
  • '<SYSTEM32>\cmd.exe' /c type %TEMP%\sec.log|find /i "AuditSystemEvents"
  • '<SYSTEM32>\find.exe' /i "AuditSystemEvents"
  • '<SYSTEM32>\cmd.exe' /c type %TEMP%\sec.log|find /i "AuditDSAccess"
  • '<SYSTEM32>\find.exe' /i "AuditDSAccess"
  • '<SYSTEM32>\cmd.exe' /c type %TEMP%\sec.log|find /i "AuditPrivilegeUse"
  • '<SYSTEM32>\find.exe' /i "AuditPrivilegeUse"
  • '<SYSTEM32>\cmd.exe' /c type %TEMP%\sec.log|find /i "AuditObjectAccess"
  • '<SYSTEM32>\find.exe' /i "AuditObjectAccess"
  • '<SYSTEM32>\cmd.exe' /c type %TEMP%\sec.log | find "AuditAccountLogon"
  • '<SYSTEM32>\cmd.exe' /c echo NamePattern = "^\[\/w3svc\/\d+\]">>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo else>>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo if "y" ^<^> bInRoot then>>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo loop>>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo end if>>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo set regEx = new RegExp>>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo regEx.Pattern = pattern>>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo regEx.IgnoreCase = True>>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo regEx.Global = True>>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo set RegExpTest = regEx.Execute(strng)>>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo end function>>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo set SiteDict = CreateObject("Scripting.Dictionary")>>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo CurSite = "">>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo CurAttr = "">>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo set StdIn = WScript.StdIn>>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo do while not StdIn.AtEndOfStream>>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo str = LCase(StdIn.ReadLine)>>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo if 1 = RegExpTest("^\[\/w3svc", str).Count then>>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /S /D /c" type %TEMP%\sec.log "
  • '<SYSTEM32>\cmd.exe' /c type %TEMP%\sec.log|find /i "AuditProcessTracking"
  • '<SYSTEM32>\cmd.exe' /c echo set AttrDict = CreateObject("Scripting.Dictionary")>>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo elseif "" ^<^> CurSite then>>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo set sections = RegExpTest("(\S+)\s*:\s*\(\S+\)\s*(\S.*)", str)>>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo if 1 = sections.Count then>>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo ColonPos = InStr(1, str, ":", 1)>>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo StrLeft = Left(str, ColonPos - 1)>>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo StrRight = Right(str, Len(str) - ColonPos)>>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo SubMatches0 = Trim(StrLeft)>>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo SubMatches1 = Trim(Right(StrRight, Len(StrRight) - InStr(1, StrRight, ")", 1)))>>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo CurAttr = SubMatches0>>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo if not SiteDict.Item(CurSite).Exists(CurAttr) then SiteDict.Item(CurSite).Add CurAttr, SubMatches1>>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo elseif 1 = RegExpTest("^\s+", str).Count then>>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo SiteDict.Item(CurSite).Item(CurAttr) = SiteDict.Item(CurSite).Item(CurAttr) ^& ";" ^& LTrim(str)>>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo end if>>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo function RegExpTest(pattern, strng)>>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo SiteDict.Add CurSite, AttrDict>>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\find.exe' "AuditAccountLogon"
  • '<SYSTEM32>\cmd.exe' /c type %TEMP%\bvs_iis.log | findstr /i "^\[/W3SVC\] \[/W3SVC/[0-9]*\] \[/W3SVC/[0-9]*/ROOT\] servercomment ScriptMaps .idq" | cscript %TEMP%\RegularIISItem.vbs y ScriptMaps
  • '<SYSTEM32>\cmd.exe' /S /D /c" type %TEMP%\bvs_iis.log "
  • '<SYSTEM32>\findstr.exe' /i "^\[/msftpsvc\]"
  • '<SYSTEM32>\cmd.exe' /c type %TEMP%\bvs_iis.log | findstr /i "^\[/W3SVC\] \[/W3SVC/[0-9]*\] \[/W3SVC/[0-9]*/ROOT\] servercomment ScriptMaps .idc" | cscript %TEMP%\RegularIISItem.vbs y ScriptMaps
  • '<SYSTEM32>\findstr.exe' /i "^\[/W3SVC\] \[/W3SVC/[0-9]*\] \[/W3SVC/[0-9]*/ROOT\] servercomment ScriptMaps .idc"
  • '<SYSTEM32>\cmd.exe' /c type %TEMP%\bvs_iis.log | findstr /i "^\[/W3SVC\] \[/W3SVC/[0-9]*\] \[/W3SVC/[0-9]*/ROOT\] servercomment ScriptMaps .stm" | cscript %TEMP%\RegularIISItem.vbs y ScriptMaps
  • '<SYSTEM32>\findstr.exe' /i "^\[/W3SVC\] \[/W3SVC/[0-9]*\] \[/W3SVC/[0-9]*/ROOT\] servercomment ScriptMaps .stm"
  • '<SYSTEM32>\cmd.exe' /c type %TEMP%\bvs_iis.log | findstr /i "^\[/W3SVC\] \[/W3SVC/[0-9]*\] \[/W3SVC/[0-9]*/ROOT\] servercomment ScriptMaps .htw" | cscript %TEMP%\RegularIISItem.vbs y ScriptMaps
  • '<SYSTEM32>\findstr.exe' /i "^\[/W3SVC\] \[/W3SVC/[0-9]*\] \[/W3SVC/[0-9]*/ROOT\] servercomment ScriptMaps .htw"
  • '<SYSTEM32>\cmd.exe' /c type %TEMP%\bvs_iis.log | findstr /i "^\[/W3SVC\] \[/W3SVC/[0-9]*\] \[/W3SVC/[0-9]*/ROOT\] servercomment ScriptMaps .htr" | cscript %TEMP%\RegularIISItem.vbs y ScriptMaps
  • '<SYSTEM32>\findstr.exe' /i "^\[/W3SVC\] \[/W3SVC/[0-9]*\] \[/W3SVC/[0-9]*/ROOT\] servercomment ScriptMaps .htr"
  • '<SYSTEM32>\cmd.exe' /c type %TEMP%\bvs_iis.log | findstr /i "^\[ HttpErrors"
  • '<SYSTEM32>\findstr.exe' /i "^\[ HttpErrors"
  • '<SYSTEM32>\cmd.exe' /c type %TEMP%\sec.log|find /i "MinimumPasswordLength"
  • '<SYSTEM32>\find.exe' /i "MinimumPasswordLength"
  • '<SYSTEM32>\cmd.exe' /c type %TEMP%\sec.log|find /i "PasswordComplexity"
  • '<SYSTEM32>\cmd.exe' /c cmd /c wmic useraccount where "Disabled=FALSE and Domain='xrfvbnv'" get name | find /v /i "name" | find /i /v /n ""
  • '<SYSTEM32>\cmd.exe' /c echo AttrName = WScript.arguments(1)>>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c wmic useraccount where "Disabled=FALSE and Domain='xrfvbnv'" get name
  • '<SYSTEM32>\find.exe' /v /i "name"
  • '<SYSTEM32>\find.exe' /i /v /n ""
  • '<SYSTEM32>\wbem\wmic.exe' useraccount where "Disabled=FALSE and Domain='xrfvbnv'" get name
  • '<SYSTEM32>\cmd.exe' /c type <SYSTEM32>\inetsrv\metabase.xml | find /i "WebDAV"
  • '<SYSTEM32>\find.exe' /i "WebDAV"
  • '<SYSTEM32>\cmd.exe' /c (if not exist %TEMP%\sec.log secedit /export /cfg %TEMP%\sec.log) && type %TEMP%\sec.log | find /i "EnableGuestAccount"
  • '<SYSTEM32>\find.exe' /i "EnableGuestAccount"
  • '<SYSTEM32>\cmd.exe' /c wmic os get version, ServicePackMajorVersion | find /i /v "Version"
  • '<SYSTEM32>\wbem\wmic.exe' os get version, ServicePackMajorVersion
  • '<SYSTEM32>\find.exe' /i /v "Version"
  • '<SYSTEM32>\cmd.exe' /c wmic qfe get hotfixid | find /i /v "hotfixid" | find /i /v /n "" | find "[10]" && echo yes
  • '<SYSTEM32>\wbem\wmic.exe' qfe get hotfixid
  • '<SYSTEM32>\find.exe' /i /v "hotfixid"
  • '<SYSTEM32>\cmd.exe' /c type %TEMP%\bvs_iis.log | findstr /i "^\[/msftpsvc\]" || echo NotInstalled
  • '<SYSTEM32>\find.exe' /i "1,%WINDIR%\Microsoft.NET\"
  • '<SYSTEM32>\findstr.exe' /i "^\[/smtpsvc\]"
  • '<SYSTEM32>\cmd.exe' /c type <SYSTEM32>\inetsrv\metabase.xml | find /i "1,%WINDIR%\Microsoft.NET\"
  • '<SYSTEM32>\findstr.exe' /i "^\[/W3SVC\] \[/W3SVC/[0-9]*\] \[/W3SVC/[0-9]*/ROOT\] servercomment ScriptMaps .idq"
  • '<SYSTEM32>\cmd.exe' /c type %TEMP%\sec.log | find "AuditLogonEvents"
  • '<SYSTEM32>\find.exe' "AuditLogonEvents"
  • '<SYSTEM32>\cmd.exe' /c type %TEMP%\sec.log | find "AuditPolicyChange"
  • '<SYSTEM32>\find.exe' "AuditPolicyChange"
  • '<SYSTEM32>\cmd.exe' /c type %TEMP%\sec.log
  • '<SYSTEM32>\cmd.exe' /c if exist "<SYSTEM32>\inetsrv\iisadmpwd" (echo exist) else (echo noexist)
  • '<SYSTEM32>\cmd.exe' /c type %TEMP%\bvs_iis.log | findstr /i "^\[/W3SVC\] \[/W3SVC/[0-9]*\] \[/W3SVC/[0-9]*/ROOT\] servercomment AccessFlags" | cscript %TEMP%\RegularIISItem.vbs y AccessFlags
  • '<SYSTEM32>\findstr.exe' /i "^\[/W3SVC\] \[/W3SVC/[0-9]*\] \[/W3SVC/[0-9]*/ROOT\] servercomment AccessFlags"
  • '<SYSTEM32>\cmd.exe' /c type %TEMP%\bvs_iis.log | findstr /i "^\[/W3SVC\] \[/W3SVC/[0-9]*\] \[/W3SVC/[0-9]*/ROOT\] servercomment path" | cscript %TEMP%\RegularIISItem.vbs y path
  • '<SYSTEM32>\findstr.exe' /i "^\[/W3SVC\] \[/W3SVC/[0-9]*\] \[/W3SVC/[0-9]*/ROOT\] servercomment path"
  • '<SYSTEM32>\cmd.exe' /c type <SYSTEM32>\inetsrv\metabase.xml | find /i "accesssslflags="
  • '<SYSTEM32>\cmd.exe' /S /D /c" type <SYSTEM32>\inetsrv\metabase.xml "
  • '<SYSTEM32>\find.exe' /i "accesssslflags="
  • '<SYSTEM32>\find.exe' "[10]"
  • '<SYSTEM32>\findstr.exe' /i "^\[/W3SVC\] \[/W3SVC/[0-9]*\] \[/W3SVC/[0-9]*/ROOT\] servercomment ScriptMaps .printer"
  • '<SYSTEM32>\cmd.exe' /c type %TEMP%\bvs_iis.log | findstr /i "^\[/W3SVC\] \[/W3SVC/[0-9]*\] \[/W3SVC/[0-9]*/ROOT\] servercomment EnableDirBrowsing" | cscript %TEMP%\RegularIISItem.vbs y EnableDirBrowsing
  • '<SYSTEM32>\findstr.exe' /i "^\[/W3SVC\] \[/W3SVC/[0-9]*\] \[/W3SVC/[0-9]*/ROOT\] servercomment EnableDirBrowsing"
  • '<SYSTEM32>\cmd.exe' /c if exist "<SYSTEM32>\inetsrv\iisadmin" (echo exist) else (echo noexist)
  • '<SYSTEM32>\cmd.exe' /c if exist "%CommonProgramFiles%\System\msadc\Samples" (echo exist) else (echo noexist)
  • '<SYSTEM32>\cmd.exe' /c if exist "<SYSTEM32>\inetsrv\adminsamples" (echo exist) else (echo noexist)
  • '<SYSTEM32>\cmd.exe' /c if exist "C:\inetpub\iissamples" (echo exist) else (echo noexist)
  • '<SYSTEM32>\cmd.exe' /c if exist "C:\inetpub\AdminScripts" (echo exist) else (echo noexist)
  • '<SYSTEM32>\cmd.exe' /c type %TEMP%\bvs_iis.log | findstr /i "^\[/W3SVC\] \[/W3SVC/[0-9]*\] \[/W3SVC/[0-9]*/ROOT\] servercomment ScriptMaps .shtml" | cscript %TEMP%\RegularIISItem.vbs y ScriptMaps
  • '<SYSTEM32>\findstr.exe' /i "^\[/W3SVC\] \[/W3SVC/[0-9]*\] \[/W3SVC/[0-9]*/ROOT\] servercomment ScriptMaps .shtml"
  • '<SYSTEM32>\cmd.exe' /c type %TEMP%\bvs_iis.log | findstr /i "^\[/W3SVC\] \[/W3SVC/[0-9]*\] \[/W3SVC/[0-9]*/ROOT\] servercomment ScriptMaps .ida" | cscript %TEMP%\RegularIISItem.vbs y ScriptMaps
  • '<SYSTEM32>\findstr.exe' /i "^\[/W3SVC\] \[/W3SVC/[0-9]*\] \[/W3SVC/[0-9]*/ROOT\] servercomment ScriptMaps .ida"
  • '<SYSTEM32>\cmd.exe' /c type %TEMP%\bvs_iis.log | findstr /i "^\[/W3SVC\] \[/W3SVC/[0-9]*\] servercomment MaxConnections" | cscript %TEMP%\RegularIISItem.vbs n MaxConnections
  • '<SYSTEM32>\findstr.exe' /i "^\[/W3SVC\] \[/W3SVC/[0-9]*\] servercomment MaxConnections"
  • '<SYSTEM32>\cmd.exe' /c type %TEMP%\bvs_iis.log | findstr /i "^\[/W3SVC\] \[/W3SVC/[0-9]*\] \[/W3SVC/[0-9]*/ROOT\] servercomment ScriptMaps .printer" | cscript %TEMP%\RegularIISItem.vbs y ScriptMaps
  • '<SYSTEM32>\cmd.exe' /c type %TEMP%\bvs_iis.log | findstr /i "^\[/smtpsvc\]" || echo NotInstalled
  • '<SYSTEM32>\find.exe' /i "PasswordComplexity"
  • '<SYSTEM32>\cmd.exe' /c echo bInRoot = LCase(WScript.arguments(0))>%TEMP%\RegularIISItem.vbs
  • '<SYSTEM32>\cmd.exe' /c echo If 0 = StrComp("MIMEMAP",PropertyName, 1) Then>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo Next>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo WScript.Echo MimeOutPutStr>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo Function IsSecureProperty(ObjectParameter,MachineName)>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo Set PropObj = GetObject("IIS://" ^& MachineName ^& "/schema/" ^& ObjectParameter)>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo Attribute = PropObj.Secure>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo If (Attribute = True) Then>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo IsSecureProperty = True>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo Else>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo IsSecureProperty = False>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo End If>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo Function UnsignedIntegerToString(ValueData)>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo UnsignedIntegerToString = ValueData>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo If (UnsignedIntegerToString ^< 0) Then UnsignedIntegerToString = UnsignedIntegerToString + ^4294967296>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo regEx.Global = True>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo UnsignedIntegerToString = CStr(UnsignedIntegerToString)>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo ObjectPath = Replace(Trim(ObjectPath), "\", "/")>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo If Left(ObjectPath, 1) = "/" Then ObjectPath = Right(ObjectPath, Len(ObjectPath) - 1)>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo If Right(ObjectPath, 1) = "/" Then ObjectPath = Left(ObjectPath, Len(ObjectPath) - 1)>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo End Sub>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo Function EnumCommand(StartPath)>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo ObjectPath = StartPath>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo SanitizePath ObjectPath>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo MachineName = "localhost">>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo IIsObjectPath = "IIS://" ^& MachineName>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo If (ObjectPath ^<^> "") Then IIsObjectPath = IIsObjectPath ^& "/" ^& ObjectPath>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo Set IIsObject = GetObject(IIsObjectPath)>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo Set IIsSchemaObject = GetObject(IIsObject.Schema)>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo ReDim PropertyListSet(1)>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo Set MimeEntry = MimeMapList(MimeEntryIndex)>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo MimeOutPutStr = MimeOutPutStr ^& """" ^& MimeEntry.Extension ^& "," ^& MimeEntry.MimeType ^& """ ">>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo For MimeEntryIndex = 0 To UBound(MimeMapList)>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo MimeOutPutStr = "MimeMap : (MimeMapList) ">>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo MimeMapList = MimeMapObject.Get("MimeMap")>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c reg query "HKCU\Control Panel\Desktop" /v ScreenSaveTimeout > %TEMP%\screensaver.log
  • '<SYSTEM32>\reg.exe' query "HKCU\Control Panel\Desktop" /v ScreenSaveTimeout
  • '<SYSTEM32>\cmd.exe' /c reg query "HKCU\Control Panel\Desktop" /v ScreenSaverIsSecure >> %TEMP%\screensaver.log
  • '<SYSTEM32>\reg.exe' query "HKCU\Control Panel\Desktop" /v ScreenSaverIsSecure
  • '<SYSTEM32>\cmd.exe' /c reg query "HKCU\Control Panel\Desktop" /v ScreenSaveActive >> %TEMP%\screensaver.log
  • '<SYSTEM32>\reg.exe' query "HKCU\Control Panel\Desktop" /v ScreenSaveActive
  • '<SYSTEM32>\cmd.exe' /c reg query "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v IPEnableRouter >> %TEMP%\screensaver.log
  • '<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v IPEnableRouter
  • '<SYSTEM32>\cmd.exe' /c echo Spacer = " ">%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo SpacerSize = Len(Spacer)>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo function RegExpTest(pattern, strng)>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo set regEx = new RegExp>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo regEx.Pattern = pattern>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo PropertyListSet(0) = IIsSchemaObject.MandatoryProperties>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo Sub SanitizePath(ObjectPath)>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo regEx.IgnoreCase = True>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo end function>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo Function MimeMapGet(ObjectPath, MachineName)>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo On Error Resume Next>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo MimePath = "IIS://" ^& MachineName>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo If ObjectPath ^<^> "" Then MimePath = MimePath ^& "/" ^& ObjectPath>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo Set MimeMapObject = GetObject(MimePath)>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo If (Err.Number ^<^> 0) Then Exit Function>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo DataPathList = MimeMapObject.GetDataPaths("MimeMap", 1)>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo If Err.Number ^<^> 0 Then DataPathList = IIsObject.GetDataPaths(MimeMap, 0)>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo If (UBound(DataPathList) ^< 0) Then Exit Function>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo DataPath = DataPathList(0)>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo SanitizePath DataPath>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo If UCase(DataPath) ^<^> UCase(MimePath) Then Exit Function>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\secedit.exe' /export /cfg %TEMP%\sec.log
  • '<SYSTEM32>\cmd.exe' /c echo set RegExpTest = regEx.Execute(strng)>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo PropertyListSet(1) = IIsSchemaObject.OptionalProperties>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo If TypeName (PropertyListSet(1)) ^<^> "Variant()" Then>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo WScript.Echo "Warning: The optionalproperties list is of an invalid type">>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo WScript.Echo PropertyName ^& " : " ^& "(" ^& PropertyDataType ^& ") " ^& ValueList>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo Case "INTEGER">>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo WScript.Echo PropertyName ^& Left(Spacer, Len(Spacer) - Len(PropertyName)) ^& ": " ^& "(" ^& PropertyDataType ^& ") " ^& UnsignedIntegerToString(ValueList)>>...
  • '<SYSTEM32>\cmd.exe' /c echo WScript.Echo PropertyName ^& " : " ^& "(" ^& PropertyDataType ^& ") " ^& UnsignedIntegerToString(ValueList)>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo Case "BOOLEAN">>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo Case "LIST">>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo WScript.Echo PropertyName ^& Left(Spacer, Len(Spacer) - Len(PropertyName)) ^& ": " ^& "(" ^& PropertyDataType ^& ") (" ^& (UBound (ValueList) + 1) ^& " Items...
  • '<SYSTEM32>\cmd.exe' /c echo WScript.Echo PropertyName ^& " : " ^& "(" ^& PropertyDataType ^& ") (" ^& (UBound (ValueList) + 1) ^& " Items)">>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo For ValueIndex = 0 To UBound(ValueList)>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo WScript.Echo " """ ^& ValueList(ValueIndex) ^& """">>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo Case "IPSEC">>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo WScript.Echo PropertyName ^& Left(Spacer, Len(Spacer) - Len(PropertyName)) ^& ": " ^& "(" ^& PropertyDataType ^& ") " ^& CStr(ValueList)>>%TEMP%\adsutilenuma...
  • '<SYSTEM32>\cmd.exe' /c echo WScript.Echo PropertyName ^& " : " ^& "(" ^& PropertyDataType ^& ") " ^& CStr(ValueList)>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo Case Else>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo MimeMapGet ObjectPath, MachineName>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo EnumCommand "">>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo WScript.Echo "DataType: " ^& """" ^& PropertyObject.Syntax ^& """" ^& " Not Yet Supported on property: " ^& PropertyName>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo End Select>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo End If>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo End If>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo Next>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo If (Err.Number ^<^> 0) Then Err.Clear>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo For Each ChildObject In IIsObject>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo If (Err.Number ^<^> 0) Then Exit For>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo ChildObjectName = Right(ChildObject.AdsPath, Len(ChildObject.AdsPath) - 6)>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo ChildObjectName = Right(ChildObjectName, Len(ChildObjectName) - InStr(ChildObjectName, "/") + 1)>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo if 1 = RegExpTest("^\/w3svc(\/\d+(\/root)?)?$", ChildObjectName).Count then>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo WScript.Echo "[" ^& ChildObjectName ^& "]">>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo If ChildObjectName ^<^> "" Then EnumCommand = EnumCommand(ChildObjectName)>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo elseif 1 = RegExpTest("^(\/smtpsvc|\/msftpsvc)$", ChildObjectName).Count then>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo WScript.Echo PropertyName ^& Left(Spacer, Len(Spacer) - Len(PropertyName)) ^& ": " ^& "(" ^& PropertyDataType ^& ") " ^& ValueList>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo WScript.Echo PropertyName ^& Left(Spacer, Len(Spacer) - Len(PropertyName)) ^& ": " ^& "(" ^& PropertyDataType ^& ") " ^& """" ^& "**********" ^& """">>%TEMP%...
  • '<SYSTEM32>\cmd.exe' /c echo Next>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo If (IsSecureProperty(PropertyName,MachineName) = True) Then>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo ElseIf (UBound (PropertyListSet(1)) = -1) Then>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo WScript.Echo "Warning: The OptionalProperties list for this node is empty.">>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo For Each PropertyList In PropertyListSet>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo For Each PropertyName In PropertyList>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo Err.Clear>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo Set PropertyAttribObj = IIsObject.GetPropertyAttribObj(PropertyName)>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo If (Err.Number = 0) Then>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo If not (PropertyAttribObj.IsInherit) Then>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo Set PropertyObject = GetObject("IIS://" ^& MachineName ^& "/Schema/" ^& PropertyName)>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo If (Err.Number ^<^> 0) Then WScript.Echo "Error trying to enumerate the Optional properties (Couldn't Get Property Information): " ^& PropertyObjPath>>%TEMP%\adsutil...
  • '<SYSTEM32>\cmd.exe' /c echo PropertyDataType = UCase(PropertyObject.Syntax)>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo Select Case PropertyDataType>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo Case "STRING">>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo ValueList = IIsObject.Get(PropertyName)>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo end if>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo For ValueIndex = 0 To UBound(ValueListArray)>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo Else>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo If (Len(PropertyName) ^< SpacerSize) Then>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo WScript.Echo PropertyName ^& Left(Spacer, Len(Spacer) - Len(PropertyName)) ^& ": " ^& "(" ^& PropertyDataType ^& ") """ ^& ValueList ^& """">>%TEMP%\adsu...
  • '<SYSTEM32>\cmd.exe' /c echo Else>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo WScript.Echo PropertyName ^& " : " ^& "(" ^& PropertyDataType ^& ")" ^& """" ^& ValueList ^& """">>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo End If>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo End If>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo Case "EXPANDSZ">>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo If (Len(PropertyName) ^< SpacerSize) Then>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo WScript.Echo PropertyName ^& Left(Spacer, Len(Spacer) - Len(PropertyName)) ^& ": " ^& "(" ^& PropertyDataType ^& ") """ ^& ValueList ^& """">>%TEMP%\adsutile...
  • '<SYSTEM32>\cmd.exe' /c echo WScript.Echo PropertyName ^& " : " ^& "(" ^& PropertyDataType ^& ") """ ^& ValueList ^& """">>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo Case "BINARY">>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo ValueListArray = IIsObject.Get(PropertyName)>>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo ValueList = "0x">>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c echo ValueList = ValueList ^& ValueListArray(ValueIndex) ^& " ">>%TEMP%\adsutilenumall.vbs
  • '<SYSTEM32>\cmd.exe' /c del /f/s/q %TEMP%\sec.log && del /f/s/q %TEMP%\screensaver.log && del /f/s/q %TEMP%\adsutilenumall.vbs && del /f/s/q %TEMP%\RegularIISItem.vbs && del /f/s/q %TEMP%\bvs_iis.log

Recommandations pour le traitement

  1. Si le système d'exploitation peut être démarré (en mode normal ou en mode sans échec), téléchargez Dr.Web Security Space et lancez un scan complet de votre ordinateur et de tous les supports amovibles que vous utilisez. En savoir plus sur Dr.Web Security Space.
  2. Si le démarrage du système d'exploitation est impossible, veuillez modifier les paramètres du BIOS de votre ordinateur pour démarrer votre ordinateur via CD/DVD ou clé USB. Téléchargez l'image du disque de secours de restauration du système Dr.Web® LiveDisk ou l'utilitaire pour enregistrer Dr.Web® LiveDisk sur une clé USB, puis préparez la clé USB appropriée. Démarrez l'ordinateur à l'aide de cette clé et lancez le scan complet et le traitement des menaces détectées.
Version démo gratuite

 

Télécharger Dr.Web

Par le numéro de série

Veuillez lancer le scan complet du système à l'aide de Dr.Web Antivirus pour Mac OS.

Version démo gratuite

 

Télécharger Dr.Web sur le site

Par le numéro de série

Télécharger Dr.Web sur l'Apple Store

Veuillez lancer le scan complet de toutes les partitions du disque à l'aide de Dr.Web Antivirus pour Linux.

Version démo gratuite

 

Télécharger Dr.Web

Par le numéro de série

  1. Si votre appareil mobile fonctionne correctement, veuillez télécharger et installer sur votre appareil mobile Dr.Web pour Android. Lancez un scan complet et suivez les recommandations sur la neutralisation des menaces détectées.
  2. Si l'appareil mobile est bloqué par le Trojan de la famille Android.Locker (un message sur la violation grave de la loi ou la demande d'une rançon est affiché sur l'écran de l'appareil mobile), procédez comme suit:
    • démarrez votre Smartphone ou votre tablette en mode sans échec (si vous ne savez pas comment faire, consultez la documentation de l'appareil mobile ou contactez le fabricant) ;
    • puis téléchargez et installez sur votre appareil mobile Dr.Web pour Android et lancez un scan complet puis suivez les recommandations sur la neutralisation des menaces détectées ;
    • Débranchez votre appareil et rebranchez-le.

En savoir plus sur Dr.Web pour Android

Free trial

14 days

Download now
Get it on Google Play