Is this running malicious software from a System.Shell.execute? - jscript

I have downloaded a Window Gadget and found this function from the javascript.
What this function does? Is it malicious?
Before I run the Widget, I commented out first the function call and it seems this function is not necessary to run the widget.
function LaunchPowerApplet()
{
System.Shell.execute(System.Environment.getEnvironmentVariable("SystemRoot") + "\\system32\\mblctr.exe");
}


System.Shell.execute is a method from the Windows Sidebar API that is used to launch an application.
%WINDIR%\system32\mblctr.exe is the executable for the Windows Mobility Center, a tool that «puts commonly used laptop settings in one spot so you can access them easily on the go».
Whether it's necessary or not is hard to say without knowing what the gadget needs to accomplish. The function is called LaunchPowerApplet and Windows Mobility Center allows to configure the battery usage settings. It makes sense if the gadget is a battery level meter, it doesn't if it's a solitaire.
BTW, a gadget is «a collection of XML, HTML, Microsoft JScript, and Cascading Style Sheets (CSS) files» so it's technically not JavaScript but JScript (Microsoft's ECMAScript implementation)


Thia is just a windows mobility center exe it will help your gadget to run correctly. it will not harm your computer.


I wouldn't say it was malicious since the application it is trying to launch is a standard windows component.
Why it wants to launch the Mobility Center is a bit of a mystery, but without further context about what this widget is supposed to be able to do we can't comment.

Related

Demystifying the Virtual Keyboard and Touchpad in Windows 10

I'm new to Windows development, and am looking for assistance on where to get started for a particular project.
In short, I want to create a windowed application that allows a user to send keyboard and mouse inputs to another application, by interacting with various UI controls via touch. Essentially a custom on-screen keyboard/touchpad that can be used for sending keyboard-shortcuts to other applications.
There are two applications in Windows 10 that perform exactly the way I would want my new app to - the On-Screen Keyboard and Touchpad:
https://support.microsoft.com/en-us/help/4337906/windows-10-open-the-on-screen-touchpad
https://support.microsoft.com/en-us/help/10762/windows-use-on-screen-keyboard
At the most basic level, I want to define my own interface (or allow the end user to define their own), and use the same code that the onscreen keyboard/touchpad are using for handling touch events and injecting inputs into the system.
I'm uncertain at what level I would need to start to get the functionality I need - UWP? WPF? C++?
If anyone has any insight into how the on-screen utilities were built, I think that would give me an excellent head start.

Select printer serverside in web application

I have a webapp with "print invoice" and "print receipt" functions.
How could I accomplish to print in the thermal printer for printing receipts but using the laser printer for invoices 100% silently?
I understand this isn't possible without any client side software previously loaded installed, this functionality is needed just for certain computers. It doesn't matter if the solution is browser specific or OS specific. Also I understand "kiosk mode" allows me to print silently to the default printer.
I have no idea what could be a good solution but was thinking about a Chrome extension or Firefox addon with a custom printing function where I could trigger from javascript like
my_custom_print('printer_b')
or
my_custom_print('printer_a')
Still I have no idea if that is even possible with extensions/addons or need something like NPAPI, PPAPI, java applets, etc...
Any ideas about this?

I'm about 90% sure that you can't silently print to a printer using any technology built into the browser; since NPAPI doesn't work in Chrome anymore (as of version 45) and PPAPI was never something you could use to call native APIs unless you want to pass in special command line flags to enable your plugin, Native Messaging is most likely what you'd need to use for this.

Complete WebBrowser Control On All OSes?

I want to create a new application (which I will sell) that uses web browser control to automatically post things on the internet etc.
I did some research, and it looks like the primary choice for most people is .NET webbrowser control (via an instance of IE).
I don't want to do this because I want customers that own a Mac and Linux to be able to use my software.
With that said, are there any web browser control classes or toolkits available that can work on all OSes (e.g. something that uses Java?)
Thanks in advance!
UPDATE:
Web browser control is basically the ability for a program to act like a human and open a web browser and go to websites, fill out forms, check email (lol) etc.

Firefox, Chrome, Safari. I think virutally everything but IE works on all the OS's. Not suprising really when you think it's made by microsoft.

Selenium libraries let you create scripts (with a GUI or one of the supported languages [it has got most of the popular ones like Java, Python etc.]) for browser automation on all popular browsers (including chrome, which works on all OSes like mentioned by other answers).

Can I embed a browser inside a screensaver? On both Windows and Macs?

Here's the deal. I've animated + coded a variety of 'screensavers' in Actionscript3/Flash. They make extensive use of the timeline, AS3 code, the TweenLite library, and embedded fonts. That's the limit of my programming knowledge. I've tried, to no avail, to convert my .SWFs into screensaver files using a variety of software, such as InstantStorm. Somehow it never works, the code never executes properly, it's a disaster.
So, I'm wondering if it's possible to make a screensaver that simply contains an embedded browser, and have it point to my .SWF file, hosted on my web-server. Basically, imagine a full-screen website acting as a screensaver.
If this is possible, what is the EASIEST and FASTEST way for me to whip up a solution for both PCs and Macs? Language, etc. I'm hoping something that has a library I can simply draw from to embed the browser view :)

My startup is developing a product to do exactly this, it's called Screensaver Ninja and you can find it at https://Screensaver.Ninja.
You can set many different web pages with different timers. The configuration tool allows you log in and navigate to the page you want to display:
It uses WebKit, on Mac OS X it uses Safari's and on Windows it uses Chrome's and in both cases it has a separate session from any other browser installed on the computer.

Here's a small Windows-only solution:
https://github.com/cwc/web-page-screensaver/releases

You could modify this open-source one for the Mac so that it's hard-coded to your URL:
http://www.liquidx.net/blog/2010/11/13/webviewscreensaver-for-mac/
Modify hasConfigureSheet() to return NO and change the URL in kScreenSaverDefaultURL. And change the name!

Overriding the right-click context menu in web browsers - pros and cons

We are programming a web application (not 'just' a web site, but functionality-wise a real application), and have the following discussion for the next release:
our UI designer wants to replace the browser's right-click context menu (showing our own menu where appropriate, or no menu at all) because he wants the web app to be more like our (existing) Windows app
our developers (and I) strongly object because this is bad practice, and simply something you do not do in a web application
Thus, I'm looking for "more solid" arguments - like best practice guidelines, any statements from reputable sources, coding arguments etc. - for the pros and cons of this issue, which I can hopefully use to resolve it once and for all...

You can't do that reliably anyway. In Firefox, go to Settings, Contents, JavaScript/Advanced (I'm guessing the captions, no English Firefox (; ) to override context menu behaviour and bang, your app doesn't work anymore. My online-banking application did this in their old version, so I couldn't do copy & paste with the mouse. I hated it, so I enabled the protection in Firefox and it worked. Kind of. Their new version doesn't do such bad things anymore.
Instead, use a little drop-down arrow where a context menu is needed, that can either be clicked or just hovered over to show the menu. JetBrains' TeamCity web app does that very well.

If your application is to run in an intranet, maybe the UI designer arguments are valid: as long as all of the users of the application are well known and you want to emulate some Windows application, I think it's ok to restrict the right-click or any other input, because it's just the requirements of this application, as it would be to any other app.
But if your application is to run in the internet, disabling or replacing right-click is a very bad idea, and these are only some of the arguments I reminded of:
First of all, changing the behavior of the user interface is aggressive and annoying -- no one wants to get used to "new controls" just to access your site, and generally people hate to leave their comfort area. I mean, I know what my right click does and I want it to do always the same thing.
People can understand the difference between Windows apps and web apps, so there's no need to "emulate Windows app behavior".
Not everyone uses Windows :-)
Also, this is innefective, sice there are several ways to overwrite this behavior, such as settings in Firefox or even plugins that disable specific javascript instructions, such as this one.

depending on your audience you stand a very good chance your users do not even KNOW there's a right click menu. So please don't make this the only alternative

I personally believe you should leave browser's default behaviors alone... users are used to them, so no need to get them used to your way of doing things.
However, if you're building an intranet (instead of a public site), then I'm for tweaking as much as possible to improve usability.

An argument I would use (in quotes for dramatic effect):
Lack of consistency & reduced
functionality compared to other
unhindered web interfaces will lead to
a loss of user confidence - which
is undesirable to say the least.
Of course, if many or most of the web application users are already familiar with or regular users of the Windows app, the UI designer could be on the right track and the consistency with the Windows app could be a winner.
That said, in my opinion it's hard to make a custom context-menu within a web page intuitive, and while some users might warm to it, I'm guessing most will probably never use it.

because he wants the web app to be more like our (existing) Windows app
I think right-click in a Windows app is a bad idea.
In a web browser it's a UI disaster because nobody will be expecting it.

I think it depends on whether you perceive the context-menu as part of the browsers chrome or not. If you do (and I ascribe to this view), then it should be off target, but otherwise it is a good place for adding some usability to your application.

Replacing the browser right-click context menu for specific areas of your GUI from your web application can be quite useful. Doing this just to disable the context menu will annoy your users, who may try to find a way around it. Also, removing or replacing the browser right-click context menu from the entire area of your application will usually be annoying and can make it more difficult to debug.
Unfortunately, I cannot offer any more solid arguments, and I'm not exactly taking either side of the argument, but I thought I would share my experience both as a developer of a web application and as a web user.

Resources