I wasn't aware of hitman pro. Thanks for the script and thanks for the tip.

If it keeps a log that we can upload and parse, then this will be *very* useful.


Legacy Forum Name: Spyware Scripts,
Legacy Posted By Username: expertcomp

I was very interested in this script so I did a few things that I want to document here.

I mean just imagine being able to say to a client that we not only defend you against spyware we use 7 different programs every night to clean your machines to ensure your system is spy ware free.

So I created a virtual machine (xp pro) and ran this script on it. A few things to note about my environment, the user was logged in and the script ran fine. It creates an html page at the end with some display results about the scans that just happened.

On a fresh install that never went on the internet in a virtual machine thishitman ran great. But when I then decided to run it on 2 machines that are real and have been on the internet and may havehad some spy ware, it didn’t go as well.I ran hit man on these 2 computers withthe default reg file, which has allot invoked. I may try and tone hit man down a little and take out a few spywares and only use maybe 4 instead of a whooping 7.

Any thougths or trials?








Legacy Forum Name: Spyware Scripts,
Legacy Posted By Username: seangoss

I worked on the script a little bit, but have run into a problem. It seems that Hitman uses the HKEY_CURRENT_USER. When you import the .reg file as the system, does that mean that the .reg file settings for Hitman will be applied to the system and not the currently logged on user? If so, and we switch to run the command as the local user, are we going to have problems when the user is not allowed to run regedit?


Attached is my updated script.

Adam



Legacy Forum Name: Spyware Scripts,
Legacy Posted By Username: adamsteinhoff

I was just wondring if you have tried running this software with the user logged off and also have you tried any regstry tweak like only running 3 spyware softwares. instead of the default 7-10

Legacy Forum Name: Spyware Scripts,
Legacy Posted By Username: seangoss

Haven't done that much extensive testing. I have been testing my script with all logged on users. Looks like I might have been wrong about the registry import.

I have tested on two of my own production boxes and it seems to work. Because the program doesn't run silent, I think I may put a message to the user about 5 minutes before it runs just to warn them and to let them know that it's OK that their computer is driving itself.

Things I wish I could overcome:

1) Log file has a different name each time. I'd like to be able to grab it from the box for parsing.

2) Supression of the log file so that the user doesn't see it.

3) Different name. It doesn't sound very professional.

Adam


Legacy Forum Name: Spyware Scripts,
Legacy Posted By Username: adamsteinhoff

I may have found something for the log file capture. I found a registry key called "Last Report" with a value of "C:\Program Files\Hitman Pro\Logs\Hitman_Pro_2006-03-17_16-47-34.htm".

I can use that key to set a variable and then grab the file with the variable. I will make the change to the script and repost in a bit after testing it.

Adam


Legacy Forum Name: Spyware Scripts,
Legacy Posted By Username: adamsteinhoff

Heres what I have found from working on this last week and this morning:
- on slow computers, it takes forever. Being a lot of my machines are older and slower, it would take a lot of processing time.
- In your V2 of the script: you can add a recursive call to he script. This way it will run either way....aka it runs if installed and it runs if needs to be installed first.
- No reporting. A big thing for us is to show what we are doing on their computers/network.
- In v2 of your script, I like how you changed the location to the VSA server.


My conclusions -

Hitman is an excellent program. There is large ammount of overhead needed on the machine level. This is not fully transparent to the user. There are prompts and whatnot that come up. Basically Hitman Pro is not something I want to persue at this time for all of my mnaged clients.


I am currently going to stick with SpyBot and Ad-Aware scans.


Legacy Forum Name: Spyware Scripts,
Legacy Posted By Username: rodbibeau

After playing with it, I tend to agree. What we may do is have this run if we get a call from a user who is completely infected as a first line of defense.

Adam


Legacy Forum Name: Spyware Scripts,
Legacy Posted By Username: adamsteinhoff