poetje
Topic Starter
hallo everybody,
please help,
since last monday my computer is infected with Win32.HLLM.Beagle and trojan.pws.nerf
I first noticed that something was wrong when i found out that my firewall was not functioning anymore. Then i saw that antivirus has also seized working.
I tried to go back to an earlier point through System Restore Point but this is not working anymore.
Also booting with safe mode is down.
Trying to reinstall antivirus of firewall does not work.
I tryed to install HiJackThis_v2.exe but it says that it is not a proper win32 application.
With Dr.Web i saw that my computer is infected with Win32.HLLM.Beagle and trojan.pws.nerf. Dr.Web has deleted some infected files, I then reboted but all of the problems mentioned above are still present (windows complains that NOD, Sygate and HiJackThis_v2 are not valid win32 applications).
I managed to make a report with reglooks.exe though.
The following is the report i got:
Any help will be highly appreciated
REGLOOKS logfile
version 0.977
Fri 01/25/2008 19:45:43.59
running from: "J:\Documents and Settings\Assil\Desktop"
— SSODL regkeys —
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
only standard or legit regkeys found
— STS regkeys —
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
only standard or legit regkeys found
— USERINIT regkey —
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
"Userinit"="J:\\WINDOWS\\system32\\userinit.exe,"
— SHELL regkey —
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
"Shell"="Explorer.exe"
— SYSTEM regkey —
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
"System"=""
— APPINIT_DLLS regkey —
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows
"AppInit_DLLs"=""
— NOTIFY regkeys —
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
only standard or legit regkeys found
— RUN / LOAD regkeys —
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
"load"=""
— BOOTEXECUTE regkey —
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
BootExecute= autocheck autochk *\0\0
— SHELLEXECUTEHOOKS regkey —
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"="Groove GFS Stub Execution Hook"
— AUTORUN regkeys —
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor
"AutoRun"=""
— HKLM\Run regkeys —
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"NvCplDaemon"="RUNDLL32.EXE J:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /install"
"anvshell"="anvshell.exe"
"LiveNote"="livenote.exe"
"CTSysVol"="J:\\Program Files\\Creative\\SBAudigy2\\Surround Mixer\\CTSysVol.exe"
"CTDVDDet"="J:\\Program Files\\Creative\\SBAudigy2\\DVDAudio\\CTDVDDet.EXE"
"CTHelper"="CTHELPER.EXE"
"AsioReg"="REGSVR32.EXE /S CTASIO.DLL"
"SBDrvDet"="J:\\Program Files\\Creative\\SB Drive Det\\SBDrvDet.exe /r"
"UpdReg"="J:\\WINDOWS\\UpdReg.EXE"
"nod32kui"="\"J:\\Program Files\\Eset\\nod32kui.exe\" /WAITSERVICE"
"LanguageShortcut"="F:\\2007\\Multimedia\\CyberLink\\PowerDVD\\Language\\Language.exe"
"Remote Master for RC105"="f:\\2007\\multimedia\\Remote Master for RC105\\Remote Master.exe"
"PtiuPbmd"="Rundll32.exe ulutil2.dll,SetWriteBack"
"RemoteControl"="J:\\WINDOWS\\system32\\rmctrl.exe"
"QuickTime Task"="\"J:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"GrooveMonitor"="\"F:\\2007\\Microsoft Office 2007\\Office12\\GrooveMonitor.exe\""
"WinampAgent"="F:\\2007\\Multimedia\\Winamp\\winampa.exe"
"NeroFilterCheck"="J:\\WINDOWS\\system32\\NeroCheck.exe"
"Acrobat Assistant 8.0"="\"G:\\Program Files\\Adobe\\Acrobat 8.0\\Acrobat\\Acrotray.exe\""
@=""
"Adobe_ID0EYTHM"="J:\\PROGRA~1\\COMMON~1\\Adobe\\ADOBEV~1\\Server\\bin\\VERSIO~2.EXE"
— HKLM\RunOnce regkeys —
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
no HKLM RunOnce keys found
— HKLM\RunOnceEx regkeys —
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
no HKLM RunOnceEx keys found
— HKLM\RunServices regkeys —
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
regkey does not exist
— HKLM\RunServicesOnce regkeys —
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce
regkey does not exist
— HKCU\Run regkeys —
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"CTFMON.EXE"="J:\\WINDOWS\\system32\\ctfmon.exe"
"NvMediaCenter"="RUNDLL32.EXE J:\\WINDOWS\\system32\\NVMCTRAY.DLL,NvTaskbarInit"
"ASUS SmartDoctor"="J:\\Program Files\\ASUS\\SmartDoctor\\\\SmartDoctor.exe /start"
"Creative MediaSource Go"="J:\\Program Files\\Creative\\MediaSource\\GO\\CTCMSGo.exe /SCB"
"Skype"="\"J:\\Program Files\\Skype\\Phone\\Skype.exe\" /nosplash /minimized"
"DU Meter"="F:\\2007\\internet\\DU Meter\\DUMeter.exe"
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="\"J:\\Program Files\\Common Files\\Ahead\\lib\\NMBgMonitor.exe\""
"MSMSGS"="\"J:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"drvsyskit"="J:\\WINDOWS\\system32\\drivers\\hldrrr.exe"
"german.exe"="J:\\WINDOWS\\system32\\wintems.exe"
[Run\AdobeUpdater]
@=""
— HKCU\RunOnce regkeys —
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
no HKCU RunOnce keys found
— HKCU\RunOnceEx regkeys —
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
regkey does not exist
— HKCU\RunServices regkeys —
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
regkey does not exist
— HKCU\RunServicesOnce regkeys —
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce
regkey does not exist
— HKU\.DEFAULT\Run regkeys - Default user —
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"CTFMON.EXE"="J:\\WINDOWS\\system32\\CTFMON.EXE"
— HKU\S-1-5-18\Run regkeys - user SYSTEM —
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"CTFMON.EXE"="J:\\WINDOWS\\system32\\CTFMON.EXE"
— HKU\S-1-5-19\Run regkeys - User Lokale service —
HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"CTFMON.EXE"="J:\\WINDOWS\\system32\\CTFMON.EXE"
— HKU\S-1-5-20\Run regkeys - User Netwerkservice —
HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"CTFMON.EXE"="J:\\WINDOWS\\system32\\CTFMON.EXE"
— HKLM\Explorer\Run regkeys —
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
regkey does not exist
— HKCU\Explorer\Run regkeys —
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
regkey does not exist
— Image File Execution regkeys —
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
no debuggers found
— BROWSER HELPER OBJECTS regkeys —
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
"{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}" regkey not found (ERROR)
"{074C1DC5-9320-4A9A-947D-C042949C6216}" FILE ="G:\\Program Files\\Adobe\\/Adobe Contribute CS3/contributeieplugin.dll"
"{72853161-30C5-4D22-B7F9-0BBC1D38A37E}" FILE ="F:\\2007\\MICROS~1\\Office12\\GRA8E1~1.DLL"
"{AE7CD045-E861-484f-8273-0445EE161910}" regkey not found (ERROR)
— TOOLBAR regkeys —
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar
"{47833539-D0C5-4125-9FA8-0819E2EAAC93}" regkey not found
"{517BDDE4-E3A7-4570-B21E-2B52B6139FC7}" FILE ="G:\\Program Files\\Adobe\\/Adobe Contribute CS3/contributeieplugin.dll"
— URLSEARCHHOOKS regkeys —
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks
only standard regkeys found
— CONTEXTMENUHANDLERS regkeys —
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers
"Adobe.Acrobat.ContextMenu" CLSID ={D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802} FILE ="G:\\Program Files\\Adobe\\Acrobat 8.0\\Acrobat Elements\\ContextMenu.dll"
"BestSyncMenu" CLSID ={F8294CEF-C1E1-462d-9709-C90C7B67DCEE} FILE ="F:\\2007\\Tools\\BestSync 3.1.12\\BestSyncExt.dll"
"NOD32 Context Menu Shell Extension" CLSID ={B089FE88-FB52-11D3-BDF1-0050DA34150D} FILE ="J:\\Program Files\\Eset\\nodshex.dll"
"Offline Files" CLSID ={750fdf0e-2a26-11d1-a3ea-080036587f03} FILE =%SystemRoot%\System32\cscui.dll
"Open With" CLSID ={09799AFB-AD67-11d1-ABCD-00C04FC30936} FILE =%SystemRoot%\system32\SHELL32.dll
"Open With EncryptionMenu" CLSID ={A470F8CF-A1E8-4f65-8335-227475AA5C46} FILE =%SystemRoot%\system32\SHELL32.dll
"UltraEdit-32" CLSID ={b5eedee0-c06e-11cf-8c56-444553540000} FILE ="F:\\2007\\UltraEdit\\ue32ctmn.dll"
"WinMerge" CLSID ={4E716236-AA30-4C65-B225-D68BBA81E9C2} FILE ="F:\\2007\\Study\\WinMerge\\ShellExtension.dll"
"WinRAR" CLSID ={B41DB860-8EE4-11D2-9906-E49FADC173CA} FILE ="F:\\2007\\Tools\\WinAmp\\rarext.dll"
"XXX Groove GFS Context Menu Handler XXX" CLSID ={6C467336-8281-4E60-8204-430CED96822D} FILE ="F:\\2007\\MICROS~1\\Office12\\GRA8E1~1.DLL"
"{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}" Start Menu Pin FILE =%SystemRoot%\system32\SHELL32.dll
HKEY_CLASSES_ROOT\Directory\shellex\ContextMenuHandlers
"EncryptionMenu" CLSID ={A470F8CF-A1E8-4f65-8335-227475AA5C46} FILE =%SystemRoot%\system32\SHELL32.dll
"Offline Files" CLSID ={750fdf0e-2a26-11d1-a3ea-080036587f03} FILE =%SystemRoot%\System32\cscui.dll
"Sharing" CLSID ={f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} FILE ="ntshrui.dll"
"WinMerge" CLSID ={4E716236-AA30-4C65-B225-D68BBA81E9C2} FILE ="F:\\2007\\Study\\WinMerge\\ShellExtension.dll"
"WinRAR" CLSID ={B41DB860-8EE4-11D2-9906-E49FADC173CA} FILE ="F:\\2007\\Tools\\WinAmp\\rarext.dll"
"XXX Groove GFS Context Menu Handler XXX" CLSID ={6C467336-8281-4E60-8204-430CED96822D} FILE ="F:\\2007\\MICROS~1\\Office12\\GRA8E1~1.DLL"
HKEY_CLASSES_ROOT\Folder\shellex\ContextMenuHandlers
"Adobe.Acrobat.ContextMenu" CLSID ={D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802} FILE ="G:\\Program Files\\Adobe\\Acrobat 8.0\\Acrobat Elements\\ContextMenu.dll"
"BestSyncMenu" CLSID ={F8294CEF-C1E1-462d-9709-C90C7B67DCEE} FILE ="F:\\2007\\Tools\\BestSync 3.1.12\\BestSyncExt.dll"
"NOD32 Context Menu Shell Extension" CLSID ={B089FE88-FB52-11D3-BDF1-0050DA34150D} FILE ="J:\\Program Files\\Eset\\nodshex.dll"
"WinRAR" CLSID ={B41DB860-8EE4-11D2-9906-E49FADC173CA} FILE ="F:\\2007\\Tools\\WinAmp\\rarext.dll"
"XXX Groove GFS Context Menu Handler XXX" CLSID ={6C467336-8281-4E60-8204-430CED96822D} FILE ="F:\\2007\\MICROS~1\\Office12\\GRA8E1~1.DLL"
— SAFEBOOT MINIMAL SERVICES —
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal
no unknown services found
— SAFEBOOT NETWORK SERVICES —
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network
no unknown services found
— SERVICES —
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\acap2000
no imagepath value found
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Adobe Version Cue CS3
"DisplayName"="Adobe Version Cue CS3"
"J:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe" -win32service
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\asuskbnt
system32\DRIVERS\asuskbnt.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bb-run
"DisplayName"="Promise driver accelerator"
system32\DRIVERS\bb-run.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cinemsup
"DisplayName"="Cinemsup"
no imagepath value found
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ctac32k
"DisplayName"="Creative AC3 Software Decoder"
System32\drivers\ctac32k.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ctaud2k
"DisplayName"="Creative Audio Driver (WDM)"
system32\drivers\ctaud2k.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ctdvda2k
"DisplayName"="Creative DVD-Audio Device Driver"
system32\drivers\ctdvda2k.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ctgame
"DisplayName"="Game Port"
system32\DRIVERS\ctgame.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ctprxy2k
"DisplayName"="Creative Proxy Driver"
System32\drivers\ctprxy2k.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ctsfm2k
"DisplayName"="Creative SoundFont Management Device Driver"
System32\drivers\ctsfm2k.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dontgo
"DisplayName"="Promise Removable Disk Control Driver"
system32\DRIVERS\DontGo.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DUMeterSvc
"DisplayName"="DU Meter Service"
F:\2007\internet\DU Meter\DUMeterSvc.exe /startedbyscm:E1F6D4BE-40E33354-DUMeterService
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EIO
"DisplayName"="EIO"
\??\J:\WINDOWS\system32\drivers\EIO.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\emupia
"DisplayName"="E-mu Plug-in Architecture Driver"
system32\drivers\emupia2k.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ha10kx2k
"DisplayName"="Creative Hardware Abstract Layer Driver"
system32\drivers\ha10kx2k.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hap16v2k
"DisplayName"="Creative P16V HAL Driver"
System32\drivers\hap16v2k.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ossrv
"DisplayName"="Creative OS Services Driver"
system32\drivers\ctoss2k.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PfModNT
\??\J:\WINDOWS\system32\PfModNT.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ulsata2
system32\DRIVERS\ulsata2.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UTDpcService
"DisplayName"="ULEVTBDG"
\??\J:\Program Files\Promise\Promise Disk Controller Manager\ULEVTBDG.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UtMsgSvc
"DisplayName"="UtMsgAgt"
"J:\Program Files\Promise\Promise Disk Controller Manager\UtMsgAgt.exe"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMDM PMSP Service
"DisplayName"="WMDM PMSP Service"
J:\WINDOWS\system32\MsPMSPSv.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\yukonwxp
"DisplayName"="NDIS5.1 Miniport Driver for Marvell Yukon Gigabit Ethernet Adapter"
system32\DRIVERS\yukonwxp.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{1EE8FA8B-F332-4EB2-867B-392B7DED01B4}
no imagepath value found
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{787F420D-E54A-47E5-8DCF-B0124AA433AA}
no imagepath value found
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{95808DC4-FA4A-4C74-92FE-5B863F82066B}
"DisplayName"="{95808DC4-FA4A-4C74-92FE-5B863F82066B}"
\??\F:\2007\Multimedia\CyberLink\PowerDVD\000.fcl
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{DC4897D9-537D-43A1-8DEB-1685C4775EE2}
no imagepath value found
— SECURITYPROVIDERS regkey —
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
— SVCHOST regkey —
HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost
HTTPFilter: HTTPFilter\0\0
LocalService: Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService: DnsCache\0\0
netsvcs: 6to4\0AppMgmt\0AudioSrv\0Browser\0CryptSvc\0DMServer\0DHCP\0ERSvc\0EventSystem\0FastUserSwitchingCompatibility\0HidServ\0Ias\0Iprip\0Irmon\0LanmanServer\0LanmanWorkstation\0Messenger\0Netman\0Nla\0Ntmssvc\0NWCWorkstation\0Nwsapagent\0Rasauto\0Rasman\0Remoteaccess\0Schedule\0Seclogon\0SENS\0Sharedaccess\0SRService\0Tapisrv\0Themes\0TrkWks\0W32Time\0WZCSVC\0Wmi\0WmdmPmSp\0winmgmt\0wscsvc\0xmlprov\0BITS\0wuauserv\0ShellHWDetection\0helpsvc\0WmdmPmSN\0\0
DcomLaunch: DcomLaunch\0TermService\0\0
rpcss: RpcSs\0\0
imgsvc: StiSvc\0\0
termsvcs: TermService\0\0
— WOW-CMDLINE regkeys —
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WOW
"cmdline" = %SystemRoot%\system32\ntvdm.exe
"wowcmdline" = %SystemRoot%\system32\ntvdm.exe -a %SystemRoot%\system32\krnl386
— DNS SERVER regkeys —
no "NameServer" values found
— STARTUP FOLDERS —
J:\Documents and Settings\Assil\Start Menu\Programs\Startup\desktop.ini
J:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini
J:\Documents and Settings\All Users\Start Menu\Programs\Startup\Sonic CinePlayer Quick Launch.lnk
— TASK SCHEDULER JOBS —
no .job files found
— File associations —
.BAT files: ("%1" %*)
.COM files: ("%1" %*)
.EXE files: ("%1" %*)
.HLP files: (%SystemRoot%\System32\winhlp32.exe %1)
.INF files: (%SystemRoot%\System32\NOTEPAD.EXE %1)
.INI files: (%SystemRoot%\System32\NOTEPAD.EXE %1)
.JS files: (%SystemRoot%\System32\WScript.exe "%1" %*)
.PIF files: ("%1" %*)
.REG files: (regedit.exe "%1")
.SCR files: ("%1" /S)
.TXT files: (%SystemRoot%\system32\NOTEPAD.EXE %1)
.VBS files: (%SystemRoot%\System32\WScript.exe "%1" %*)
FINISHED
