P
PCR
Guest
Re: Bootup - Shutdown logger
Franc Zabkar wrote:
| On Mon, 21 Apr 2008 22:42:49 -0400, "PCR" <pcrrcp@netzero.net> put
| finger to keyboard and composed:
|
|>Another thing: what about your settings at...?...
|>
|>"Control Panel, Internet Options, Security tab, Select Internet (&
|>maybe Local Intranet)"
|>
|>Are you at Default or Custom? If Custom, are the 3 Scripting options
|>enabled? Mine are, (but not all the ActiveX options are enabled).
|
| I'll try to answer everyone's questions here.
|
| These are my security settings:
|
| Local intranet Medium-low
| Trusted sites Low
| Internet Medium
| Restricted sites High
|
| I've tried setting Local intranet to Low but the error remained.
Those settings were good, then. And I see you have solved the problem &
possibly could stop now. Probably, some 3rd-party software renamed your
Scrrun.dll as a security measure to prevent scripts from running, & you
will be fine now that you renamed it back.
| I've been able to successfully run Gary's .vbs script on my other
| Win98SE box. Now I'm trying to find what is different about them.
|
| According to msinfo32.exe, the two boxes are both using IE6SP1 with
| the same build version and same updates.
I'm not seeing that you have taken all the updates, at "IE, Help,
About"...!...
Yours... ;SP1;q240308;q313829;Q330994;Q828750
Mine....
SP1, Q313829, Q328970, Q328389, Q324929, Q810847, Q813951, Q816506,
Q813489, Q330994, Q818529, Q822925, Q828750, Q824145, Q832894,
Q837009, Q831167, Q823353, Q867801, Q833989, Q834707, Q889293,
Q867282, Q891781, Q890923, Q883939, Q896688, Q905915, Q912812,
Q916281 & Q918439.
Although mine is misleading (because the registry key the data comes
from is not cleared of superceded updates, but the later ones are just
added)... you need to go to Windows Update & get at least Q916281 &
Q918439...
http://www.microsoft.com/technet/security/Bulletin/MS06-021.mspx
Microsoft Security Bulletin MS06-021
Cumulative Security Update for Internet Explorer (916281)
http://www.microsoft.com/technet/security/Bulletin/MS06-022.mspx
Microsoft Security Bulletin MS06-022
Vulnerability in ART Image Rendering Could Allow Remote Code Execution
(918439)
REMEMBER... To see the Win98 updates at Windows Update, you must go
there from a Win98 machine. And that MSVCRT.dll you reported earlier
looks suspiciously XP/Vista-irradiated to me...!...
You Me
MSVCRT.dll 6.10.8924.0 6.00.8797.0
Also, your script files...
jscript.dll 5.6.0.8513
vbscript.dll 5.6.0.8515
....are STILL lower than my versions. Jugding from this SFCLog.txt of
mine, you need at least one more update...
[C:\WINDOWS]
wscript.exe Updated 5.6.0.8515 1/14/03 5.6.0.8825 8/9/04 No
[c:\windows\COMMAND]
cscript.exe Updated 5.6.0.8515 1/14/03 5.6.0.8825 8/9/04 No
[C:\WINDOWS\SYSTEM]
jscript.dll Updated 5.6.0.8515 1/14/03 5.6.0.8825 8/9/04 No
scrobj.dll Updated 5.6.0.8515 1/14/03 5.6.0.8825 8/9/04 No
vbscript.dll Updated 5.6.0.8515 1/14/03 5.6.0.8825 8/9/04 No
wshext.dll Updated 5.6.0.8515 1/14/03 5.6.0.8825 8/9/04 No
scrrun.dll Updated 5.6.0.8515 1/14/03 5.6.0.8825 8/9/04 No
wshom.ocx Updated 5.6.0.8515 1/14/03 5.6.0.8825 8/9/04 No
I'm not sure Windows Update will get that done for you. If not, I'll try
harder to recall what it was that I ran (back in '06 says the date in
SFCLog.txt) that got me updated to that.
Well... wait a minute... I am seeing those files with those dates in my
version of that file you mentioned... Scr56en.exe. Its Properties says
my version is 5.50.4134.600. (Not sure where I got it from.)
| The above security settings
| are also identical.
|
| These are the IE data for the good box:
| http://www.users.on.net/~fzabkar/VBS_problem/xp2500IE.txt
|
| These are the IE data for the bad box:
| http://www.users.on.net/~fzabkar/VBS_problem/xp2500IE.txt
|
| This is the difference between the two data sets:
| http://www.users.on.net/~fzabkar/VBS_problem/diff_ie.txt
|
| I can find only one real difference and that is that the good box has
| a later version of vbscript.dll. However using this version on the bad
| box doesn't make the error go away.
|
| The good box also has Opera installed on it, although it is a much
| earlier version.
|
| The same versions of wscript.exe are installed on both boxes.
|
| This a Filemon record up until the error box appears:
| http://www.users.on.net/~fzabkar/VBS_problem/vbs_filemon.txt
|
| The Filemon output screen isn't mousable, but holding down the
| Ctrl-Shift key plus Home/End/PgUp/PgDown and then selecting Edit >
| Copy enables one to copy and paste the output into Notepad. Thanks to
| MEB.
|
| As for TweakUI's IE settings, all but the following boxes are checked:
|
| Clear document, run, typed-URL history on exit
| Show Favorites on Start Menu
|
| If I use Opera to open a .vbs file, it merely displays its contents.
| Under Tools > Preferences > Advanced > Downloads there is no VBS file
| type.
|
| ===============================================================
|
| While writing the above and trying things as I went, I finally got the
| script to work. Unfortunately I lost track of what I did. :-(
|
| However, if I now rename scrrun.dll in the Windows\System directory to
| scrrun.dl_, then the VB script breaks as before. Renaming other files
| in the scr56en.exe package either has no effect, or produces other
| errors. I notice that scrrun.dll appears in MEB's Filemon output
| screen (thank you MEB) soon after mine errors out. Maybe that was the
| problem all along.
|
| The following URL may offer an explanation for what happened:
| http://www.auditmypc.com/process/scrrun.asp
|
| "The file, scrrun.dll, is used by windows when running scripts such as
| those written with JScript or VBScript. If scrrun.dll is unavailable,
| windows will not be able to execute scripts. If you do not use any
| scripting on your computer you may be able to remove this file."
|
| Anyway I suspect that something broke my IE6 or WSH installation. I
| hate installing updates and patches because this sort of thing seems
| to happen to me a lot.
|
| Thanks to all for your help.
|
| - Franc Zabkar
| --
| Please remove one 'i' from my address when replying by email.
--
Thanks or Good Luck,
There may be humor in this post, and,
Naturally, you will not sue,
Should things get worse after this,
PCR
pcrrcp@netzero.net
Franc Zabkar wrote:
| On Mon, 21 Apr 2008 22:42:49 -0400, "PCR" <pcrrcp@netzero.net> put
| finger to keyboard and composed:
|
|>Another thing: what about your settings at...?...
|>
|>"Control Panel, Internet Options, Security tab, Select Internet (&
|>maybe Local Intranet)"
|>
|>Are you at Default or Custom? If Custom, are the 3 Scripting options
|>enabled? Mine are, (but not all the ActiveX options are enabled).
|
| I'll try to answer everyone's questions here.
|
| These are my security settings:
|
| Local intranet Medium-low
| Trusted sites Low
| Internet Medium
| Restricted sites High
|
| I've tried setting Local intranet to Low but the error remained.
Those settings were good, then. And I see you have solved the problem &
possibly could stop now. Probably, some 3rd-party software renamed your
Scrrun.dll as a security measure to prevent scripts from running, & you
will be fine now that you renamed it back.
| I've been able to successfully run Gary's .vbs script on my other
| Win98SE box. Now I'm trying to find what is different about them.
|
| According to msinfo32.exe, the two boxes are both using IE6SP1 with
| the same build version and same updates.
I'm not seeing that you have taken all the updates, at "IE, Help,
About"...!...
Yours... ;SP1;q240308;q313829;Q330994;Q828750
Mine....
SP1, Q313829, Q328970, Q328389, Q324929, Q810847, Q813951, Q816506,
Q813489, Q330994, Q818529, Q822925, Q828750, Q824145, Q832894,
Q837009, Q831167, Q823353, Q867801, Q833989, Q834707, Q889293,
Q867282, Q891781, Q890923, Q883939, Q896688, Q905915, Q912812,
Q916281 & Q918439.
Although mine is misleading (because the registry key the data comes
from is not cleared of superceded updates, but the later ones are just
added)... you need to go to Windows Update & get at least Q916281 &
Q918439...
http://www.microsoft.com/technet/security/Bulletin/MS06-021.mspx
Microsoft Security Bulletin MS06-021
Cumulative Security Update for Internet Explorer (916281)
http://www.microsoft.com/technet/security/Bulletin/MS06-022.mspx
Microsoft Security Bulletin MS06-022
Vulnerability in ART Image Rendering Could Allow Remote Code Execution
(918439)
REMEMBER... To see the Win98 updates at Windows Update, you must go
there from a Win98 machine. And that MSVCRT.dll you reported earlier
looks suspiciously XP/Vista-irradiated to me...!...
You Me
MSVCRT.dll 6.10.8924.0 6.00.8797.0
Also, your script files...
jscript.dll 5.6.0.8513
vbscript.dll 5.6.0.8515
....are STILL lower than my versions. Jugding from this SFCLog.txt of
mine, you need at least one more update...
[C:\WINDOWS]
wscript.exe Updated 5.6.0.8515 1/14/03 5.6.0.8825 8/9/04 No
[c:\windows\COMMAND]
cscript.exe Updated 5.6.0.8515 1/14/03 5.6.0.8825 8/9/04 No
[C:\WINDOWS\SYSTEM]
jscript.dll Updated 5.6.0.8515 1/14/03 5.6.0.8825 8/9/04 No
scrobj.dll Updated 5.6.0.8515 1/14/03 5.6.0.8825 8/9/04 No
vbscript.dll Updated 5.6.0.8515 1/14/03 5.6.0.8825 8/9/04 No
wshext.dll Updated 5.6.0.8515 1/14/03 5.6.0.8825 8/9/04 No
scrrun.dll Updated 5.6.0.8515 1/14/03 5.6.0.8825 8/9/04 No
wshom.ocx Updated 5.6.0.8515 1/14/03 5.6.0.8825 8/9/04 No
I'm not sure Windows Update will get that done for you. If not, I'll try
harder to recall what it was that I ran (back in '06 says the date in
SFCLog.txt) that got me updated to that.
Well... wait a minute... I am seeing those files with those dates in my
version of that file you mentioned... Scr56en.exe. Its Properties says
my version is 5.50.4134.600. (Not sure where I got it from.)
| The above security settings
| are also identical.
|
| These are the IE data for the good box:
| http://www.users.on.net/~fzabkar/VBS_problem/xp2500IE.txt
|
| These are the IE data for the bad box:
| http://www.users.on.net/~fzabkar/VBS_problem/xp2500IE.txt
|
| This is the difference between the two data sets:
| http://www.users.on.net/~fzabkar/VBS_problem/diff_ie.txt
|
| I can find only one real difference and that is that the good box has
| a later version of vbscript.dll. However using this version on the bad
| box doesn't make the error go away.
|
| The good box also has Opera installed on it, although it is a much
| earlier version.
|
| The same versions of wscript.exe are installed on both boxes.
|
| This a Filemon record up until the error box appears:
| http://www.users.on.net/~fzabkar/VBS_problem/vbs_filemon.txt
|
| The Filemon output screen isn't mousable, but holding down the
| Ctrl-Shift key plus Home/End/PgUp/PgDown and then selecting Edit >
| Copy enables one to copy and paste the output into Notepad. Thanks to
| MEB.
|
| As for TweakUI's IE settings, all but the following boxes are checked:
|
| Clear document, run, typed-URL history on exit
| Show Favorites on Start Menu
|
| If I use Opera to open a .vbs file, it merely displays its contents.
| Under Tools > Preferences > Advanced > Downloads there is no VBS file
| type.
|
| ===============================================================
|
| While writing the above and trying things as I went, I finally got the
| script to work. Unfortunately I lost track of what I did. :-(
|
| However, if I now rename scrrun.dll in the Windows\System directory to
| scrrun.dl_, then the VB script breaks as before. Renaming other files
| in the scr56en.exe package either has no effect, or produces other
| errors. I notice that scrrun.dll appears in MEB's Filemon output
| screen (thank you MEB) soon after mine errors out. Maybe that was the
| problem all along.
|
| The following URL may offer an explanation for what happened:
| http://www.auditmypc.com/process/scrrun.asp
|
| "The file, scrrun.dll, is used by windows when running scripts such as
| those written with JScript or VBScript. If scrrun.dll is unavailable,
| windows will not be able to execute scripts. If you do not use any
| scripting on your computer you may be able to remove this file."
|
| Anyway I suspect that something broke my IE6 or WSH installation. I
| hate installing updates and patches because this sort of thing seems
| to happen to me a lot.
|
| Thanks to all for your help.
|
| - Franc Zabkar
| --
| Please remove one 'i' from my address when replying by email.
--
Thanks or Good Luck,
There may be humor in this post, and,
Naturally, you will not sue,
Should things get worse after this,
PCR
pcrrcp@netzero.net