Martin Zugec

That log looks clear... Using PFR to remove infected files is quite effective way - I and Dman are working on tool that will automate this process for removing spyware infection from PC.

If you just want to access data, you can use admin shares (do you have VPN connection?). Like \\computer\c$ etc...

It is little bit complicated - I am storing it to HKLM\Software\ExecutionCheck - in every GUID I am also including date+time of creation, so sometime (when I need) I can make time based rules, e.g. run every 3 hours or once per day etc...

If it is MSI based, I like to use WMI Class Win32_Product... Otherwise method MHz mentioned...

2brian: It depends For example I am creating GUID values... If you want to use per user installations, you must make it to HKCU, if per-computer, you must make it in HKLM... 2ravashaak: For example I am using this method when I want to make per-computer settings, that will occur only once (yesterday I deployed collector from Application Compatibility Toolkit using this method)

Ah, I see... Well, it is simple, I am using something GUID for applications. You must just use REG QUERY and REG ADD commands - they returns errorlevels. If you want help, just let me know

2darph: What program? You can modify bart/winPE to register libraries you need... If it is something for your customers, have a look at Windows XP Embedded

Sorry, I dont know where is your problem - here it is working as I expected

Sorry, I think I didnt understand question... You want to know what apps have user installed?

2trouble: OEAcces or OEAccess... Could you please post you winnt.sif [Components] section?

This is directly from my unattend.txt: [Components] OEAccess = off All my customers are using Outlook, not OE...

Yep, I got it on all workstations...

Hi, is it normal when detection of NIC is extremely slow (few minutes)? I tried it on few computers and same result, also in VirtualPC it is extremely lazy. I thought about using NetCard in Winbom.ini to define what NIC to detect, but isnt there any other solution?

Using unattend you can remove Outlook Express, if you specify in [Components] OEAccess=Off Well, it will not exactly remove it, just remove every shortcut from computer - which is better, because sometime you use OE objects

Try WBAT instead...

In that case look here: http://www.tek-tips.com/faqs.cfm?fid=5798

Strange, here it is working quite well... What cscript version do you have? I use 5.6

Ah Right now I am using net use i: \\server\share /user:domain\user password But I wanted to make full domain-compatible PE environment

2Coocy: I cant see that log... WHere did you post it???

First post your HijackThis log (2moderators: shouldnt this be added to rules, if someone got problem with malware to post a log and ask?)...

Sorry - now I see... I am just getting little bit angry when I see news like "Microsoft is spying on you!" "Microsoft want to take control over their users" "Secret places to hide informations about you" This persons hear this from one of their friends, so it must be true! BTW about AskStrider - it is looking really great, I am watching it since few news leaked from MS about using Computer Genomics contept... Also I am looking forward when Gatekeeper will be released

Is there any way to join BartPE to domain? I would like to use it, but without access to domain resources it is almost useless for me Any advice?

About Dell systems - download DCCU (Dell Client Configuration Utility) for changing registry settings. Dont know if HP/IBM provide with something similar EDIT: Sorry, of course I mean not registry settings, but BIOS settings + version

Because you build your ROE at T-12 and I am not sure (maybe you could test it?) if WSH is available at the moment. Building stuff based on computer name isnt hard from cmd - just use pipe and find command. For example: echo %computername% | find /i "wks_01" && If %errorlevel% EQU 0 Call wks_adm.bat

2DigeratiPrime: Oh my, not another myth What they are talking about is called AskStrider from Microsoft Research - it is because administrators (including me) wanted to have tool like this, so you could say which file came from where, which patch caused the problem you are encountering etc...