RunScanner - Instructions

[Ruby]

Version 1.0 (final)

made by
Geert Moernaut

• Download runscanner.zip from here: www.runscanner.net/download.aspx
  (Download version 1.0 (final) )
• Unzip it (Zip-Tools)
• into its own folder under C:\Program Files
  (Learn here how to create a new folder: Windows Tutorial.)
• Double-Click onto the RunScanner.exe, to istall the program

Deutsch: RunScanner - Anleitung



Welcome to RunScanner
You may want to read the text on this picture.

More Info:
Visit the forum



Have a look to this Options:

• Full scan
• Confirm fixes

Don't change this Options. Click 'Start scan'.



It needs some time until the Full System Scan is done.
You can see what happens below on your Windows Explorer Window.

Now the scan is finished and you get the great Window of the RunScanner
on your desktop with the Autorun and Hijack Items

• - Item: 000 General Info
• - Item: 001 Running processes
• - Item: 002 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run (+ subkeys)
• - Item: 005
• - Item: 010 and so on

Have a look on the left hand: there are 2 and/or 3 icons
Click onto an entry unter 010. Now you find in the header:

Help about Item 010

A Click onto this button takes you to a helppage of the runscanner.net
for 010: Running Services:



Lookup entry online

Click onto any entry and have a look with 'Lookup entry online',
to the database of the runscanner.net to get all information about this file:



Process killer

You can 'Refresh process list'
Use the 'Process killer' to kill unwanted processes (Kill selected processes).
A right click onto an entry gives you more choices:



You can also 'Start "explorer.exe"'

Do you need the 'Host file Editor'



You can set the Hosts file to Default and/or save it.

Functions to recognize and analyse a run logfile



'Save .run file' to get the .run file saved on your system.
You ought to save the run file in the folder of the RunScanner.
Name your first run logfile 1.run.
Exit the Runscanner, go to the folder of the Runscanner,
locate your 1.run logfile.
Double-Click onto 1.run.
Now you will get your 1.run onto your desktop.
Use your left mouse to mark an item.
Use your right mouse to get more choices:

• 'Lookup at RunScanner.net': Information from the Online-Database of runscanner.net' for your marked item
• 'Lookup at Google.com': Information from Google for your marked item
• 'Copy to Clipboard': paste it to notepad to use it later...
• 'Open location': open the folder of that item.
• 'Show file properties': have a look to the properties.
• 'Kill process from the "process killer tab": kill a process
• 'mark item': mark an item
• 'Expand tree': shows you the whole tree
• 'Collapse tree': folds up the whole tree

Use 'mark item': to highlight an item in orange color

• Click onto 'save .run file',
• Save the *.run file as a test.run
• Close down your 1.run
• In the folder of the RunScanners you will find another log, the test.run log.
• Double-Click onto the test.run log - find it back on your desktop.
• Your orange marked items are still there.
• Now you may want to decide, what you want to do with these items:
  analyse or delete them.

• The *.run file can be uploaded by the user.
• The expert or Helper loads down the user's *.run file to his own machine.
• He opens the user's run file with a Double-Click.
• Now the helper can see what happens on a user's machine.
• He gets the view over all files and entries of the user's system.
• The Expert/Helper marks all items
• which ought to become deleted in the user's *.run file
• with 'mark item'.
• These marked items get an orange color.
• Then the Expert/Helper saves the user's*.run Logfile
• He names it, for example, helper.run.
• The helper.run can be uploaded back to the user's thread.
• The user loads it down, opens it on his machine.
• He realises the orange marked items on the treated logfile.
• Now he can delete all these marked items.

Another choice is to: 'Save log file'
Notepad opens with a text logfile.
Please post this txt logfile
Experts and helpers will analyse it for you.

Online Analysis



The function 'Online Analysis' (1) in the header,
takes your logfile to the 'Online Analysis'.
It takes some minutes to get a report back:

'RunScanner malware and spyware report'



Legend

• 'File is safe to use'
• 'File is a certified Microsoft file'
• 'File is not yet rated'
• 'File contains spyware or malware'
• 'Findings are inconclusive'

Filter Results and Quick Scan
two more functions

Here some more Features and Screenshots from the Author of this program:

Click here 1 und Click here 2.

Runscanner is present as version 1.0 (final)

The Author of the
RunScanner
asks all users of this program
to visit

forum.runscanner.net
(http://forum.runscanner.net/default.aspx?g=forum)

for questions, motivations, hints, bugs ect.

***

Many Thanks to
Geert Moernaut

English Instructions of RunScanner
written and illustrated by Ruby for the Users of HijackThis.eu