Sledgehammer - Windows 10 Update Control

Discussion in 'MDL Projects and Applications' started by pf100, Nov 28, 2016.

  1. Lars220

    Lars220 MDL Novice

    Jun 18, 2018
    38
    56
    0
  2. pf100

    pf100 Duct Tape Coder

    Oct 22, 2010
    2,067
    3,455
    90
  3. Whistler4

    Whistler4 MDL Member

    Jul 30, 2015
    205
    198
    10
    I've finished reading through this thread and many of the other docs on your script and WUMT, and I have a second batch of draft FAQ I'll PM to you soon.
     
  4. Whistler4

    Whistler4 MDL Member

    Jul 30, 2015
    205
    198
    10
  5. pf100

    pf100 Duct Tape Coder

    Oct 22, 2010
    2,067
    3,455
    90
    Thank you!

    Could be the Visual Basic task creation code in the script although it's almost identical code from "module.vbs" in v2.5.2, or the script has been added to MSFT's malicious apps database. I'll look into it. I have smartscreen disabled on all of my computers is why I never noticed this problem, so thanks for letting me know. I'll turn on smartscreen and see if I can find out what's going on.
     
  6. Whistler4

    Whistler4 MDL Member

    Jul 30, 2015
    205
    198
    10
    #708 Whistler4, Sep 17, 2018
    Last edited: Sep 17, 2018
    The WUMT Wrapper Script performs a number of safeguards when booting to keep Windows Update from starting its search and quickly installing new updates, many of them Trojan horses that can cause havoc with your system. The script then allows you to Enable the Windows Update Service then calls WUMT as a tool to ID and hide or install the KB updates you want to. After the updates you asked for are installed, and you close WUMT, the script once again stops the update service and prevents further update activities until run again. There are other bells & whistles. Downloading and installing the WUMT Wrapper Script brings with it a bundle with an installed copy of WUMT, WUB, and the Wrapper Script. In short, the Script sets up a safe environment for its tool, WUMT, to operate, then shuts down update ability after WUMT is closed.
     
  7. So, basically one would need to install first WUMT and then this wrapper?
     
  8. rpo

    rpo MDL Expert

    Jan 3, 2010
    1,479
    1,474
    60
    #710 rpo, Sep 17, 2018
    Last edited: Sep 17, 2018
    Just copy all the components of wumt into the same directory as the wrapper script.
    Edit : the wumt elements are included in the zip of the wrapper script.
     
  9. nghiabros

    nghiabros MDL Novice

    Jul 30, 2015
    33
    9
    0
    No, I need just to download Wrapper Script from #1, then extract the zip file to use.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  10. pf100

    pf100 Duct Tape Coder

    Oct 22, 2010
    2,067
    3,455
    90
    #712 pf100, Sep 18, 2018
    Last edited: Sep 21, 2018
    (OP)
    Edit: I'm not going to use the "short file name" task creation path version of the script. Too many issues with it.

    @Whistler4
    I removed all VB script from the wrapper script. No more virus detections or smartscreen triggering any more. Would you mind trying again? Oh, and it works in folders in any language now. Well, I didn't try every language obviously, but it works in Russian, French and Japanese folder names, so I assume it'll work in any language now. The smartscreen trigger you reported turned out to be a blessing in disguise.
    v2.5.3NoVbWUMTWrapperScript.cmd
     
  11. Whistler4

    Whistler4 MDL Member

    Jul 30, 2015
    205
    198
    10
  12. Whistler4

    Whistler4 MDL Member

    Jul 30, 2015
    205
    198
    10
    #714 Whistler4, Sep 18, 2018
    Last edited: Sep 18, 2018
    @pf100, I tried your 2.5.3NoVB on another machine running 1709 and it triggered SmartScreen also. The SmartScreen filter for apps and browser says it's for apps from the web. I'm wondering whether there's a difference whether it is downloaded in a zip package vs a single file for it to be tagged as from the web. And I have smartscreen set to warn, not block, but it only gives me "Done" option.
     
  13. pf100

    pf100 Duct Tape Coder

    Oct 22, 2010
    2,067
    3,455
    90
    #715 pf100, Sep 18, 2018
    Last edited: Sep 18, 2018
    (OP)
    It seems it's because you're downloading it from pastebin.
    On the pastebin page, select "raw" (It corrupts the file, don't do that). Instead, go to "RAW Paste Data" at the bottom of the page, select all with Ctrl-A, right click and copy, paste into a "2.5.3NoVbWUMTWrapperScript.cmd" file in the script folder on your computer.
     
  14. Whistler4

    Whistler4 MDL Member

    Jul 30, 2015
    205
    198
    10
    Okay, I did it that way and no SmartScreen trigger. (I used download rather than raw/copy/paste before.) It's possible that even the first 2.5.3 might have not triggered smartscreen that way, but I didn't try. Do you want to bundle it as you'd normally distribute and I'll download tomorrow from wherever you want to make it available to see if it triggers smartscreen that way?

    As to cosmetics, I like the first new screen except it's too busy, which makes it difficult to digest, and seems to start repeating itself. Can you make it into 3-4 bullets with a little white space? I mean blue space?
     
  15. pf100

    pf100 Duct Tape Coder

    Oct 22, 2010
    2,067
    3,455
    90
  16. rpo

    rpo MDL Expert

    Jan 3, 2010
    1,479
    1,474
    60
    Dealing with false positive is a never ending story and a waste of time IMO. I wonder why the privilege escalation coding (which includes a vbs file) has not been detected. Just wait and a stupid AV will react...
     
  17. pf100

    pf100 Duct Tape Coder

    Oct 22, 2010
    2,067
    3,455
    90
  18. rpo

    rpo MDL Expert

    Jan 3, 2010
    1,479
    1,474
    60
    FYI it has already be detected on an other forum. Workaround : issue a message and ask the user to rerun the script as admin.
    This is the dir /x of my C: drive :
    Code:
     Le volume dans le lecteur C s’appelle SSD0
     Le numéro de série du volume est 60AE-E230
    
     Répertoire de C:\
    
    03/02/2015  18:51    <DIR>                       Banque
    15/09/2018  16:18    <DIR>                       boot
    23/04/2017  21:14    <DIR>                       CD-ROM
    16/09/2018  12:35    <DIR>                       Clement
    05/09/2018  11:40    <DIR>                       Eglantine
    06/09/2017  17:25    <DIR>                       Etudes
    02/09/2018  11:28    <DIR>                       Impôts
    01/02/2018  10:45    <DIR>                       Jeux DS
    21/01/2018  18:44    <DIR>                       Ma musique
    15/09/2018  01:46    <DIR>                       MCP
    12/04/2018  01:38    <DIR>                       PerfLogs
    18/02/2017  18:36    <DIR>                       Photos
    16/09/2018  13:57    <DIR>          PROGRA~1     Program Files
    17/09/2018  11:22    <DIR>          PROGRA~2     Program Files (x86)
    16/09/2018  11:54    <DIR>                       RPO
    18/02/2017  18:43    <DIR>                       selfhtml_fr
    18/02/2017  18:44    <DIR>                       Site Web JCB
    18/09/2018  18:02    <DIR>                       Temp
    18/09/2018  10:43    <DIR>                       Téléchargements
    06/05/2018  11:41    <DIR>                       Users
    02/08/2018  14:05    <DIR>                       VirtualBox VMs
    18/09/2018  09:50    <DIR>                       Windows
                   0 fichier(s)                0 octets
                  22 Rép(s)  763 338 006 528 octets libres
    No short name for Téléchargements. Mysterious...