Malicious Autoit v3 shortcuts - autoit

My pc got infected from an external usb and a lot of files with the extension of .lnk got into my hard drive as a shortcuts with that target
C:\Windows\system32\cmd.exe /c start ..\Microsoft\MicrosoftSecurity.exe /AutoIt3ExecuteScript ..\Microsoft\Microsoft.a3x explorer String("%") & ChrW(10+57) & String("D") & String("%") & exit
I just want to know what does this do and means.
Thanks in advance.

Related

How to launch .exe file with run

I tried to launch a program with Run & Runwait but the program don't appear
Run & Runwait command
Run('R:\Windows\Bureau\Hoop Bot\lib\scrcpy-win64\scrcpy-noconsole.exe')
Or
Run('#Scriptdir\lib\scrcpy-win64\scrcpy-noconsole.exe')
same with runwait
No error messages
Try setting the working dir for the program.
Run('R:\Windows\Bureau\Hoop Bot\lib\scrcpy-win64\scrcpy-noconsole.exe', 'R:\Windows\Bureau\Hoop Bot\lib\scrcpy-win64\')
And if you are using #ScriptDir it should go like this:
Run(#Scriptdir & '\lib\scrcpy-win64\scrcpy-noconsole.exe', 'R:\Windows\Bureau\Hoop Bot\lib\scrcpy-win64\')

Force terminate WIA or TWAIN driver (scanner)

I'm having a pretty annoying issue. When I try to silent install a program, that program depends on the WIA or TWAIN driver (for scanners) NOT being "in use". The problem is that driver can be "in use" even after the scanner is unplugged from the computer (if it was plugged in before, the driver is used and doesn't stop being in use after unplugging)
My question is, to your knowledge, what controls this WIA / TWAIN driver? Is it a service I can force close or a process?
I have found these 2 services for WIA :
stisvc
WiaRpc
but nothing regarding TWAIN.
My goal would be to add that force close in the installation script so it makes SURE that WIA or TWAIN cannot be in use whatsoever before installing.
I found the solution, might be useful for any other people having problems with these drivers. First download ListDlls by SysInternals : https://learn.microsoft.com/en-us/sysinternals/downloads/listdlls
Then with PowerShell:
Stop-Service -Name stisvc -Force
[string]$twain_utilise = C:\TEMP\Listdlls.exe -d TwainDSM.dll | select-string "pid"
if ($twain_utilise) {
$processus = ($twain_utilise -Split(": "))[1]
}
Stop-Process -id $processus -Force
Explanation :
-Stop the service STISVC which is in charge of WIA (Windows Image Acquisition (WIA))
-Run ListDlls.exe on TWAINDSM.DLL to find out what is using the dll by selecting the PID of found program.
-IF the command was successful (in other terms, if the PID was found, meaning a program IS using that DLL), split the content so you can isolate the PID number only.
-Stop the process with it's PID so TWAIN isn't in use anymore
You now have stopped any use of WIA or TWAIN and can proceed to install drivers or software that require these drivers not to be in use! Cheers.

Autoit launches batchfile passing variable

I'm currently trying to create an installation tool. I have a a batch file calling some sqlcmd commands and I'd like to trigger it from Autoit. It works.
Now, I'd like to set a variable in Autoit (by getting it from a GUI) and pass it to the batch file when calling it. It should be something like this :
RunWait('path_of_file\mybat.bat' & %myVar%)
I read a lot from the Autoit community without finding the answer. I got things like :
RunWait('path_of_file\mybat.bat' & " " & $myVar) <- This solution didn't work for me
or
RunWait(#ComSpec & " /k "...) <- This one didn't suit what I'd like to do, as I'm
launching a batchfile and not a cmd command.
If anyone has an idea !
Thanks in advance :)
This should work:
Autoit works
Local $myVar = "ipconfig"
RunWait('mybat.bat ' & $myVar)
Autoit works too
ShellExecute("mybat.bat", $myVar)
mybat.bat
#echo off
echo %1
%1
ping 127.0.0.1 -n 6 > nul

command prompt, opening a csv file?

how do i open a file csv ? with the last command here vi
it open it the command prompt, but how do i open it on csv file normarlly
without open it on the command prompt?
[#dc1-ora rci]$ ls
backup diamond20130306.csv
diamond2012_04_30_dev.csv diamond_points_20120820.csv
diamond20120801.csv diamond_points_20120827.csv
diamond20120802.csv diamond_points_20120828.csv
diamond20120803.csv diamond_points_20121217.csv
diamond20120804.csv diamond_points_20130129.csv
diamond20120806.csv diamond_points_20130130.csv
diamond20120807.csv diamond_points_20130205.csv
diamond20120808.csv diamond_points_20130306.csv
diamond20120828.csv diamond_points_20130326.csv
diamond20120906.csv diamond_points_20130410.csv
diamond20121025.csv diamond_rental_20121219.csv
diamond20121029.csv diamond_rental_20121220.csv
diamond20121218.csv diamond_rental_20121221.csv
diamond20130128.csv ilx_final_lead_merge.csv
diamond20130129.csv test_diamond20120820.csv
diamond20130130.csv test_diamond20120827.csv
diamond20130131.csv test_diamond20120828.csv
diamond20130205.csv test.txt
diamond20130219.csv THH_RCT_RCI_EDM_FILE_01_28_13.csv
[#dc1-ora rci]$ vi test_diamond20120820.c
sv
( opens file here on the command prompt)
On windows/cmd you should do:
start notepad++ test_diamond20120820.csv
in your case:
start Excel.exe test_diamond20120820.csv
or for the default application associated with it use :
start test_diamond20120820.csv
(didn't test I am using linux maybe I will test it later if I reboot)
But I suspect you don't mean command prompt but a linux terminal (because of your tags):
you can use any of those:
gedit test_diamond20120820.csv &
nedit test_diamond20120820.csv &
etc depending on the programs you have installed
or for the default application associated with it use :
xdg-open test_diamond20120820.csv
if you are remotely logged in using ssh make sure you have X enabled

Why does SendKeys produce an error in Windows 7?

I am trying to run this code:
SendKeys "copy /b /y " & outputfile & " " & printerid & "{Enter}", 1.
It runs fine in Windows XP but in Windows 7 it gives an error.
I am trying to copy a string into cmd and execute it.
The "{Enter}" part is giving error.
Please help.
A quick test on Windows 7 gives me:
'sendkeys' is not recognized as an internal or external command,
operable program or batch file.
If that's the same error that you're getting, it means you don't have the program. Try copying it over from XP and see if that works.
If you've already copied it, it might not be in your PATH. Try this:
set PATH=%PATH%;C:\Path\to\SendKeys\
where C:\Path\to\SendKeys is the folder that contains SendKeys.exe.

Resources