Closing Windows NOW! 3

[Alt255]

I am in "control" of a project designed to prevent unauthorized installation of software on our company's many computers. The OS ranges from Win 3.0 to Win 2000(?). I need to shut them down and make sure they stay shut down if they install a new program. I have developed a system that does the same -- by by-passing DOS -- but I have received only complaints from the compliant users who only had to boot their systems and wait for 5 minutes to do their job. I need a way to "catch" the new installations when they "happen". Using VB 6.0. Thanks in Advance.<br>

 

[MikeLacey]

Ouch! Given the range of OS's this doesn't sound easy.<br>
<br>
My first reaction would be to buy something that can do the job - standardize on NT4 and lock users out of the desktop "in an agressive fashion" then buy a s/w distribution tool. This is not a trivial project. When you say "many" computers - how many is "many"?<br>
<br>
Mike<br>

 

[Alt255]

Sorry Mike. Not many. Only 53 at the target site. It just seems like "many" since most of them aren't networked. NT would be the answer to a dream but the money-men won't let it happen. My cheaper solution has been to change COMSPEC to point to a start-up batch file in a folder Win9.x claims to be non-existent. The BAT calls a program to check or change the LOAD line in WIN.INI, checks for tampering, IF NOT start Windows, IF SO run a full audit of every EXE, COM, DLL, and OV? on the hard drive. The Win component remains unobtrusive, as long as there are no new applications and there wasn't an attempt to by-pass the audit.<br>
I feel bad that my job has expanded to include the coding of Trojans. But, It's a job. It's what my employer wants. Once again, I'm sorry. God help us all.<br>
Alt255<br>

 

[MikeLacey]

For the DOS/Win3 machines there's a product called disklock which I used to use - makes it so users can only read floppy disks that have been approved - if they can't read floppy's they probably can't install from them. Dr Solomon - as I recall.<br>
<br>
The NT boxes - you can probably do a lot with directory permissions and restricted user logins.<br>
<br>
It's difficult for me to stress this enough without being physcially present.<br>
<br>
*DON'T* *WRITE* *THIS* *YOURSELF* -- *BUY* *SOMETHING*<br>
<br>
Life's too short mate - you'll give yourself a hernia and it won't be as good as some cheap thing you can buy.<br>
<br>
Mike<br>

 

[Alt255]

Thanks for the very good advice. My grandfather used to joke "If you want a job done right, hire someone to do it for you. You can get your money back after the first mistake."<br>
<br>

 

[Alt255]

Tried that. The solution isn't for sale. My employer is very firm. I'm in beta now. Any attempt to install unauthorized software shuts down the system.<br>
Any attempt to tamper with the trojan or terminate it shuts down the system.<br>
It's a nice little hook. Bill Gates would throw a fit if he knew what he allowed his programmers to write.<br>
<br>
Thanks again. I'm not sorry anymore... just doing my job.<br>
<br>
Regards

 

[robherc]

Well, I have an idea.....can you make VB copy a file when an install is detected? If so, I can write a batch program for you that will keep the computer from being restarted.<br>
<br>
<br>
-Robherc

 

[Alt255]

Great! My program writes a line to a hidden log and sets a binary marker in a file before it calls the ExitWindowsEX function. It would take a fraction of a second to copy a small file. If I could keep the users from starting their computers again (without an authorized technician on hand to oversee the process) I would be ten miles closer to the final solution.<br>
Catching them is one thing, stopping them has proven somewhat harder. (Short of trashing boot records and wiping the CMOS -- perhaps a touch of overkill.)<br>
I'll be glad to hear from you!!!!!!!!

 

[robherc]

MAN!...I'm REALLY sorry it took me this long to respond...haven't been watching this forum very closely as I know NOTHING about VB...therefore I had briefly forgotten about needing to check back with you.<br>
<br>
Anywise; if you can send me a SIGNED PREFFERABLY e-mail message to:<br>
robherc@netzero.net<br>
I can send you a signed message in return & we can exchange the necessary (somewhat classified) information necessary to complete this project to each other via encrypted communications.<br>
<br>
The batch program that I am thinking of will TEMPORARILY replace the AUTOEXEC.BAT file on the client computer with another file that will set a few variables, & make it HARD (though not QUITE impossible to use the system w/o a high-tech password)<br>
Hope to hear from you again soon and, once again, sorry about the dalay in my response.<br>
<br>
<br>
-Robherc<br>
robherc@netzero.net

 

[Alt255]

I'd give you FIVE TipMasters for this one. But I'm pretty sure the rules allow only one per customer.<br>
Thanks a million. Maybe we'll make one some day.<br>

 

[Alt255]

Sorry about the redundancy... "time out error", bit-bucket existential fear, transmission uncertainty, etc etc etc.<br>
Anyway, you've made my day, maybe you've saved my job. If you have any more thoughts... please share with the community. We all have a need to know. (and don't preface your tips with "I don't know very much about...")<br>
My thanks!<br>

 

[robherc]

Thanks for the gratitude! I'm glad I have been able to help you...after all; that's my basic point in being in here in the first place