Здравствуйте Sergey,
22 Hоя 2015 в 16:54:56, Sergey L Tarasov говорит Sergey Kusnetsov:
SLT> Подозрительный файл в архиве -
SLT> reset.zip__15047_i1753228819_il2161988.exe
SLT> Это точно сабж ?
Это мусор файлообменника, там ниже есть direct download link, а там архив. Если
опасаешься вирусов, то есть скрипт. Для правильной работы скрипта нужна утилита
расчёта контрольной суммы MD5:
http://www.fourmilab.ch/md5/ (положить в папку
рядом со скриптом)
========================= begin 8< =========================
@ECHO OFF &SETLOCAL
ECHO First disable your Agnitum product self-protection in advanced settings
ECHO -If Trial period is over and can't start program to disable
self-protection then run this batch from Safe Mode
ECHO -bacause in normal mode you will not be able to delete registry keys,
which are defended by loaded Agnitum driver
ECHO.
ECHO Close your Agnitum Product (click with right mouse button on Agnitum
product tray icon and select Exit)
ECHO When you done press any key to continue with reset procedure
pause
:: Find 3 old 30-days registry trial keys and delete them
:: For Outpost Firewall Pro use regkeypart=0C53A1C05}
:: For Outpost Antivirus Pro use regkeypart=410FC3880}
SET key=HKCR\CLSID
SET regkeypart=7D62BBB0F}
FOR /F "delims=" %%U IN ('reg query "%key%" /s /f "%regkeypart%" /k /c') DO REG
delete "%%~U" /f
CLS
:: Detect where is op_install.dll located
FOR /F "tokens=2*" %%A IN ('reg query "HKLM\SOFTWARE\Agnitum\Security
Suite\Paths" /v Dir') DO SET "APPPATH=%%B"
:: Finding current date and convert them to YYYYMMDD format
FOR /F "tokens=*" %%Z in ('"wmic path Win32_LocalTime get year,month,day
/value|findstr ="') do @set %%Z
SET /A month = 100 + %month%
SET month=%month:~-2%
SET /A day = 100 + %day%
SET day=%day:~-2%
:: Generating MD5 of "ufyvj%04d%02d%02d%dgvneo" string where %04d%02d%02d is
YYYYMMDD date,
:: %d is number od trial days (30) and "ufyvj"/"gvneo" is some constant part of
string
FOR /F %%C in ('md5 -d"ufyvj%year%%month%%day%30gvneo" -l') do set MD5=%%C
:: Forming final command for reseting Agnitum product (create new 3 registry
keys for new 30-day trial period)
:: if Trial period is over and can't start program to disable self-protection
then run this batch from Safe Mode
:: bacause in normal mode you will not be able to delete registry keys, which
are defended by loaded Agnitum driver
%SYSTEMROOT%\System32\rundll32.exe "%APPPATH%\op_install.dll" opmon %MD5% 30
ECHO Resseting 30-day Trial of Agnitum Product is done!
ECHO Press any key to close this window
pause>nul
========================== end 8< ==========================
Всего хорошего,
Sergey.