Обзор Furtivex Malware Removal Script 4.8.5

[furtivex]

furtivex updated Furtivex Malware Removal Script with a new update entry:

Bug fix

• Bug fix related to console font being changed after a powershell command is executed. Thanks Dragokas
• Updated Language for Russian operating systems -- Thanks Dragokas Regist Sandor

Read the rest of this update entry...

 

[Phoenix]

# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ #
# Furtivex Malware Removal Script v4.5.8
# Furtivex – Furtivex Computer Solutions
# ?????????? Windows 10 Pro x64 22H2 0419 // 65001 // 65001

 

[Dragokas]

У меня яндекс-браузер кеширует тоже (версия 4.4.6).
Firefox нормально: версия 4.5.8

 

[furtivex]

# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ #
# Furtivex Malware Removal Script v4.5.8
# Furtivex – Furtivex Computer Solutions
# ?????????? Windows 10 Pro x64 22H2 0419 // 65001 // 65001

Thank you, will try to fix that. It's not showing the Microsoft translated.

 

[Dragokas]

@Phoenix, кодировку файла правильно определило? Остальная часть отчета на русском?
У меня слово Microsoft на 10-ке на английском языке.

 

[Phoenix]

@Phoenix, кодировку файла правильно определило? Остальная часть отчета на русском?
У меня слово Microsoft на 10-ке на английском языке.

Да, остальное на русском.

# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ #
# Furtivex Malware Removal Script v4.6.1
# Furtivex – Furtivex Computer Solutions
# ?????????? Windows 10 Pro x64 22H2 0419 // 65001 // 65001

Осталось..
...
как то мало задач.

# Задачи:

CreateExplorerShellUnelevatedTask
Microsoft\Windows\WindowsUpdate\Scheduled Start
Mozilla\Firefox Background Update S-1-5-21-565558927-2074111502-1451416940-1001 308046B0AF4A39CB
Mozilla\Firefox Default Browser Agent 308046B0AF4A39CB
Восстановление сервиса обновлений Яндекс Браузера
Системное обновление Браузера Яндекс

# Реестр:

# Другое:

 

[Phoenix]

:License
А этот блок у кого то выдаёт инфу ? У меня пусто

Documents\APPX.sqsea8jx7jvjxqrpbw2ybdelh>slmgr.vbs /dli>lic.txt
не выводит ничего

 

[Phoenix]

а с этой переменной всё правильно ? %SYS32%

 

[furtivex]

:License
А этот блок у кого то выдаёт инфу ? У меня пусто

Documents\APPX.sqsea8jx7jvjxqrpbw2ybdelh>slmgr.vbs /dli>lic.txt
не выводит ничего

I'm noticing that too on different operating systems. It's empty? It should only report 1 line from the file.
You should either see: "Licensed", "Notification", or "Grace".
This is here because some malware helpers are checking on this, and some help forums refuse to continue to help if they see Windows is not yet activated. I'm not so strict on this myself, but it's there to save some time from checking on this through other methods. e.g. a FRST fix including the CMD:

Is there something wrong with %sys32% on your end? On English OS it should be C:\Windows\system32. I'm unsure how it looks on different language OS.

Thanks for letting me know of the problems with the tool.

 

[furtivex]

Да, остальное на русском.

# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ #
# ?????????? Windows 10 Pro x64 22H2 0419 // 65001 // 65001

[/CODE]

Hi,
It should be fixed in v4.6.4 (available)

# Майкрософт Windows 11 Pro x64 23H2 0419 // 1252 // 65001

Thanks for reporting this issue.

 

[Phoenix]

Hi,
It should be fixed in v4.6.4 (available)

# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ #
# Furtivex Malware Removal Script v4.6.4
# https://furtivex.net
# Майкрософт Windows 10 Pro x64 22H2 0419 // 65001 // 65001
# 2025_01_08__09_08_08 - XenOS -
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ #

C:\Windows\system32>cscript /nologo slmgr.vbs -xpr
Windows(R), Professional edition:
    Постоянная активация прошла успешно.


C:\Windows\system32>cscript /nologo slmgr.vbs -dli

Имя: Windows(R), Professional edition
Описание: Windows(R) Operating System, RETAIL channel
Частичный ключ продукта: 3V66T
Состояние лицензии: имеет лицензию

System activate

Is there something wrong with %sys32% on your end? On English OS it should be C:\Windows\system32. I'm unsure how it looks on different language OS.

C:\Windows\system32>echo %sys32%
%sys32%

C:\Windows\system32>echo %__appdir__%
C:\Windows\system32\

IF EXIST %WINDIR%\Sysnative\cmd.exe (SET "SYS32=%WINDIR%\Sysnative") else (SET "SYS32=%WINDIR%\System32") - it's ok

 

[furtivex]

C:\Windows\system32>cscript /nologo slmgr.vbs -dli
I see the problem with this . Trying to fix

 

[Phoenix]

C:\Windows\system32>cscript /nologo slmgr.vbs -dli
I see the problem with this . Trying to fix

"^License Status" это существует только в на английском интерфейсе и при выводе на английском в cmd

 

[furtivex]

"^License Status" это существует только в на английском интерфейсе и при выводе на английском в cmd

v4.6.5 is available, any better?

 

[Phoenix]

v4.6.5 is available, any better?

# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ #
# Furtivex Malware Removal Script v4.6.5
# https://furtivex.net
# Майкрософт Windows 10 Pro x64 22H2 0419 // 65001 // 65001
# 2025_01_08__12_50_12 - XenOS - имеет // RP Created
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ #

 

[furtivex]

Is missing the word 'Activated' yes? I was only capturing one word. I've updated again (v4.6.6)
I appreciate you testing

 

[furtivex]

furtivex updated Furtivex Malware Removal Script with a new update entry:

Some improvements

+ Rules update
+ Log header now includes whether or not a Restore Point (RP) was created. You'll see these as 'RP Failed' or 'RP Created'. Language support coming soon.
+ Additional Language support for Windows Licensing information in the header
+ ScreenConnect cleanup routine is a bit more robust now.
+ Cache cleanup for Stream Labs OBS users.
- Removed some of the functionality of the 'Restore' module until further testing is complete. For now, the tool will only report if an...

Read the rest of this update entry...

 

[furtivex]

furtivex updated Furtivex Malware Removal Script with a new update entry:

Log adjustments + NEW AV information

+ The log has been 'improved'
-- I moved the state of whether or not a system restore point was created in the Miscellaneous section of the log instead of the header.
-- The tool will now attempts to show information about which antivirus is installed. This line is above the System Restore point line.

• Definitions updates
• False positives I've seen out in the wild have been fixed
• Bug fixes, mostly pertaining to Registry trace cleanup
• Aggressive RunOnce Registry cleaning...

Read the rest of this update entry...