Verye

Don't know what to tell you guys. It would auto-run if I clicked "open folder," and after a data slurp put a picture on it, it asked me how it wanted to handle pictures on CDs (though, this applies to any removable disk) from now on. I said to have it auto-open them, and it does. It's possible that the open folder/auto-open picture thing has nothing to do with auto-running, and auto-running is just, for some reason, enabled my default on my computer. I really don't know, sorry. :(

Leeeaaapooooo Any ideas on how to make the payload more...compatible...with Vista?

Which payload? PocketKnife self-starts for me. I put a picture on it, told Vista to auto-run all picture CDs, and boom, it auto-runs just fine. Before that, it would simply ask me what to do with the removable disk, and if I clicked "open folder," it would also auto-run.

Everyone gets that error, myself included. I'm too lazy to edit GO.vbs and re-customize the flash drive though, and clicking the U3 icon in My Computer does the same job. If you ever want to run it manually, just click the U3 CD-ROM icon.

Oh, it fixes this error too? Perfect then. Slurping all the .txt files would probably work. Also, another quick question...I put the SwitchBlade into a friend's computer today, to show him its capabilities, and his AVG detected it as soon as I put it in. I did not have any installers enabled; it was just LSA secrets, PWDUMP, Application Info slurping, and FF/IE/Chrome password grabbing. Everytime AVG popped up with a message saying "unwanted program/virus/whatever detected," I'd always click Ignore. When I got the logs though, it said "Access denied" under all the categories. I guess AVG blocks Firefox/IE/Chrome passwords, and LSA Secrets?? Or is it just that it blocked all those parts of PocketKnife, and since they couldn't run, it displayed "Access denied"? Note, I was not running with AVKill enabled. Alex told me that the AVKill program itself is detected by many AVs. So, I'm wondering, when IS it useful to have it enabled? Does it stop AVG? Thanks.

Hey, I have (another) question, and also an idea. The question...when I put the flash drive in computers with Windows 2000, 9 times out of 10 a message will pop up saying there's some sort of error with "wscript.exe," and it says to "please ensure that a floppy is drive A:." Now, this may be a problem due to the fact that these are being used on computers which previously had floppy drives, but were removed and disabled in the BIOS. Not sure why PocketKnife would cause an error having anything to do with floppies though, and I do not know what "wscript.exe" specifically means. This isn't a very big problem, since the payload still runs fine, just...I have to exit the error every time I put it in one of their computers, except for like 1 or 2 computers. Second, the suggestion. The slurp application info is a very nice idea. I know it can take time, but slurping little bits and pieces of info like that is just helpful. However, what would make it even better is if it would also capture Notepad and possibly Word files that don't have much text in them. People often put passwords or private pieces of information in Notepad files. So, maybe it should capture all Notepad files that have, say, fewer than 40 words in them, or X amount of characters, or whatever. I'm not sure if this would be hard to code, and also, I'm thinking that if it has to search the whole computer for them it may take a long time to run, so maybe it could just search the Desktop and Documents folders.

I understand what you're saying. However, I personally find it confusing if people go through the trouble to make an edit to his payload, then upload it, then ask other people to download it. I've seen a few things like that here. Recommendations or writing bits of code to improve it make sense, it's just that going through the trouble of essentially releasing another version of it, with or without Leapo's permission, in his thread, seems odd. But whatever. I'm not really complaining. It's just that I see cool edits and additions in this thread, and I think to myself, "hmmm, should I download/add this, or should I just wait for Leapo to implement it?" I'm just eagerly anticipating Leapo's next update.

Well, it works, just it doesn't do it automatically. If I want it to work right I simply have to click "view folder." I can exit it and it works fine. But are you saying this problem occurs on Vista universally? If so, then okay, I understand.

Ok, here's the problem. If I put the flash drive in and just X out the little AutoPlay Window that pops up, the log writing gets messed up really, really badly. Here's a picture: If I click "Open folder to view files," then it does everything normally. However, this means that I have to open the folder in order for it to run and write the logs properly, which is obviously bad. How do I fix this? How do I get it to just autorun automatically, without that stupid window popping up? (For those who are confused, I explained the window that popped up in my previous post.) The worst part is that if I exit out of the window, the logs do not write correctly. If I click "open folder," it writes correctly, but this is a hassle for me, and also, if it's on someone else's computer, quite suspicious, as they see all the PocketKnife folders.

Ah, I see. And sorry with all the questions, but oooone last thing: When I put the flash drive in computers, a little window named AutoPlay pops up. Here's a picture of it: For my Vista computer, it does this whether or not safety.txt is on the C: drive. This kind of defeats the purpose of running silently... Thankfully, it doesn't do that on most computers. However, it doesn't really say how to change the settings of removable disks (USB flash drives) in the Control Panel. So, first off, how do I make it so it doesn't come up with that window when I put it in my Vista computer? Second...is there a way to make it so it doesn't pop up like that on any computer? Thanks.

I'm not familiar with the "old method," sorry. What folder icon?? Also, I have another question, though this one isn't support-related: How do I get someone's Windows login password? I got a bunch of hashes, and I'm presuming these are what I need...but how do I decrypt them? And finally, I'd just like to speak up about the method of payload development that's been going on in this thread. It is very, very confusing that multiple people are making multiple updates to Leapo's payload. A GUI, bug fixes, etc. It's impossible for anyone to keep up. In fact, I personally believe having independent payloads in general is bad. Leapo had the right idea; a payload with just about everything. People have been working with Leapo on this payload to make it a fusion of the best ideas and features, and that's been working, but I understand that he's been inactive for a while and people are taking it upon themselves to edit it and add/edit things to make it better. I know that he hasn't been on in a while, but I feel that things would be simpler and better for everyone if they simply collaborated with Leapo and worked on it with him, so there's only one version of Leapo's payload. Unless he does not plan on updating it any time in the next 2 months, or has quit, then people should just be working with him.

According to the manual that came with my Cruzer Titanium Plus, it says that if you forget your password you must format the drive. There is no service to restore passwords, and there really is no way to view them, as far as I know. I think you should keep trying to remember the password. If you really can't, your only option is to format and try and remember the Word document you wrote, then write it again.

Well, I'm saying the flaw is that auto-play was disabled by default. Meaning, the person would be immune from attacks without even knowing what auto-play WAS. Also, what's with that GO.vbs error I kept getting?

Thanks, the auto-play thing did the trick. The thing is though, it appears that auto-play was disabled by default. Isn't this kind of a big flaw, if it's supposed to run automatically and silently on computers? Also, when I tried to run it manually either by clicking GO.vbs, it gave an error saying something was wrong with GO.vbs. This is the full error: It does this if I click GO.vbs on any of my 3 computers. I'm assuming there's a known error in GO.vbs that is causing this to happen if you try to run PocketKnife manually. If this isn't a known error, then...why is it happening to me?

Haha, disregard all that, I'm an idiot. I accidentally named the file safety.txt, not safety. Thus, the file was called safety.txt.txt, and that was the problem. I got kind of confused and didn't notice the file extension was already part of it. Problem solved in that regard. The only other problem left is the fact that the payload is not doing anything to one of my other target computers. It's got no safety.txt on it, and the anti-virus has been disabled. I have 2 computers. They're both laptops, and both have XP 32-bit. They both have McAfee as an anti-virus. When I put the USB drive in one of them, it captures all of its passwords and such fine. In the other, it does nothing and does not create a log for it in the LOGS folder. As in, the computer name doesn't even appear there.