API tools faq
paste
Kyxrecon

[BAT] Kyxrecon_Virus_Cleaner.bat

Kyxrecon
Jul 2nd, 2016
141
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
VisualBasic 18.74 KB | None | 0 0
raw download clone embed print report diff
  1. @echo off
  2. Title Kyxrecon Virus Cleaning Tools to remove Worms and Virus by Kyxrecon 2016
  3. Mode con cols=90 lines=5
  4. cls & color 0A & echo.
  5. :::::::::::::::::::::::::::::::::::::::::
  6. :: Automatically check & get admin rights
  7. :::::::::::::::::::::::::::::::::::::::::
  8. Set "TmpLogFile=%Tmp%\TmpLogkey.txt"
  9. Set "LogFile=%UserProfile%\Desktop\Kyxrecon_Virus_Clean_%UserName%_Log.txt"
  10. If Exist %TmpLogFile% Del %TmpLogFile%
  11. If Exist %LogFile% Del %LogFile%
  12. REM  --> Check for permissions
  13. Reg query "HKU\S-1-5-19\Environment" >%TmpLogFile% 2>&1
  14. REM --> If error flag set, we do not have admin.
  15. if '%errorlevel%' NEQ '0' (
  16. Echo.
  17. ECHO                        **************************************
  18. ECHO                         Running Admin shell... Please wait...
  19. ECHO                        **************************************
  20.  
  21.     goto UACPrompt
  22. ) else ( goto gotAdmin )
  23.  
  24. :UACPrompt
  25.     echo Set UAC = CreateObject^("Shell.Application"^) > "%temp%\getadmin.vbs"
  26.     set params = %*:"=""
  27.    echo UAC.ShellExecute "cmd.exe", "/c ""%~s0"" %params%", "", "runas", 1 >> "%temp%\getadmin.vbs"
  28.  
  29.    "%temp%\getadmin.vbs"
  30.    del "%temp%\getadmin.vbs"
  31.    exit /B
  32.  
  33. :gotAdmin
  34. ::::::::::::::::::::::::::::
  35. ::          START         ::
  36. ::::::::::::::::::::::::::::
  37. :menuLOOP
  38. cls
  39. Title Kyxrecon Virus Cleaning Tools to remove Worms and Virus by Kyxrecon 2016
  40. Color 9E & Mode con cols=80 lines=16
  41. echo(
  42. echo(
  43. echo(       ***************************** Menu ******************************
  44. echo(
  45. for /f "tokens=2* delims=_ " %%A in ('"findstr /b /c:":menu_" "%~f0""') do (
  46. echo            %%A  %%B )
  47. echo(
  48. echo(       *****************************************************************
  49. set choice=
  50. echo( & set /p choice=Make a choice or hit ENTER to quit: || GOTO :EOF
  51. echo( & call :menu_[%choice%]
  52. GOTO:menuLOOP
  53. ::*******************************************************************************
  54. :menu_[1] Scan the computer and open the report
  55. Color 9E & Mode con cols=100 lines=5
  56. Set Msg="Kyxrecon Virus Cleaner is Starting Now ... Please wait... Scan is in progress..."
  57. echo(
  58. echo     **********************************************************************************
  59. echo      %Msg%
  60. echo     **********************************************************************************
  61. Call :Speak %Msg%
  62. Call :PS_Sub 'information' 10 '"Kyxrecon Virus Cleaner is Starting Now ... "' "'Please wait... Scan is in progress....'" 'info' 4
  63. cls & Mode con cols=75 lines=5
  64. (
  65.     Echo Kyxrecon_Virus_Cleaner v1.0
  66.     Echo.
  67.     Echo  **************************** General info ****************************
  68.     Echo.
  69.     Echo Running under: %username% on profile: %userprofile%
  70.     Echo Computer name: %computername%
  71.     Echo.
  72.     Echo Operating System:
  73.     wmic os get caption | findstr /v /r /c:"^$" /c:"^Caption"
  74.     Echo Boot Mode:
  75.     wmic COMPUTERSYSTEM GET BootupState | find "boot"
  76.     Echo Antivirus software installed:
  77.     wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName | findstr /v /r /c:"^$" /c:"displayName"
  78.     Echo.
  79.     Echo Executed on: %date% @ %time%
  80.     Echo.
  81.     Echo **************************** Drive info *******************************
  82.     Echo.
  83.     Echo Listing currently attached drives:
  84.     wmic logicaldisk get caption,description,volumename | find /v ""
  85.     Echo.
  86.     Echo Physical drives information:
  87.     for /F "tokens=1-3" %%A in ('fltmc volumes^|find ":"') do echo %%A %%B %%C
  88.     Echo.
  89.     Echo ************************ Disinfection info ****************************
  90.     Echo.
  91. )>"%TmpLogFile%"
  92.  
  93. echo                       "Deleting BronCoder.wsf Virus"
  94. echo "Deleting BronCoder.wsf Virus" >>"%TmpLogFile%"
  95. Del /s /f /q "%Temp%\BronCoder.wsf" >>"%TmpLogFile%" 2>&1
  96.  
  97. set process="cscript.exe" "wscript.exe" "rundll32.exe" ^
  98. ^ "explorar.exe" "AutoIt3.exe" "compiled.exe" "MozillaFirefox.exe" "GoogleChrome.exe" ^
  99. ^ "srvicas.exe" "servicas.exe" "njw0rm.exe" "njrat.exe" "Intel(R)TCP.exe" ^
  100. ^ "Intel(TM)SD.exe" "mshta.exe" "Intel(R)B1.exe" "Intel(R)P15.exe"
  101.  
  102. For %%a in (%process%) Do ( Call :KillMyProcess %%a )
  103.  
  104. Set Pattern="\.vbs"^
  105. ^ "\.vbe"^
  106. ^ "\.wsf"^
  107. ^ "\.a3x"^
  108. ^ "\winlogon\.bat"
  109.  
  110. Set Key="HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"^
  111. ^ "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"^
  112. ^ "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"^
  113. ^ "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options"
  114.  
  115. Color 9E & Mode con cols=100 lines=5
  116. For %%P in (%Pattern%) Do (
  117.         For %%K in (%Key%) Do (    
  118.             Cls
  119.             echo(
  120.             echo(
  121.             echo(
  122.             Echo             ***************************** Scanning in progress *****************************
  123.             echo                %%K
  124.             Echo             ********************************************************************************
  125.             Rem Call :PS_Sub 'Warning' 1 '"Scanning Registry Key for %%P... "' ""%%K"" 'Warning' 2
  126.             Call :Delete_Virus_Key %%K %%P "%TmpLogFile%"
  127.         )
  128. )
  129.  
  130. Cmd /U /C Type "%TmpLogFile%" > "%LogFile%"
  131. Cls
  132. echo(
  133. echo(
  134. Echo(
  135. ECHO                 **********************************************
  136. ECHO                   Please wait..... We generate the report.....
  137. ECHO                 **********************************************
  138. Call :Speak "Please wait . . . We generate the report !"
  139. Call :PS_Sub 'Warning' 100 '"Please wait . . . "' "'Please wait . . . We generate the report !'" 'Warning' 5
  140. For %%K in (%key%) Do Call :Check_Key %%K %TmpLogFile%
  141.  
  142. (
  143.     Echo.
  144.     Echo ******************************************************************************
  145.     echo "%ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup"
  146.     Dir /b "%ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup"
  147.     Echo.
  148.     Echo ******************************************************************************
  149.     Echo.
  150.     TASKLIST /V /FO List
  151.     Echo.
  152.     Echo ******************************************************************************
  153. )>>%TmpLogFile% 2>&1
  154.  
  155. (
  156.     Echo ******************************************************************************
  157.     Echo                              STARTUP List
  158.     Echo ******************************************************************************
  159. )>>%TmpLogFile% 2>&1
  160. REM Command suggested by FreeBooter
  161. wmic /APPEND:%TmpLogFile% STARTUP get /format:list>Nul
  162. (
  163.     Echo.
  164.     Echo ******************************************************************************
  165.     Echo                               Process List
  166.     Echo ******************************************************************************
  167. )>>%TmpLogFile% 2>&1
  168. rem WMIC /APPEND:%TmpLogFile% PROCESS GET Caption,CommandLine>Nul
  169. powershell.exe Get-WmiObject Win32_Process ^| select ProcessID,ProcessName,Handle,commandline,ExecutablePath ^| Out-File -Append %TmpLogFile% -Encoding ascii
  170. (
  171.     Echo.
  172.     Echo ******************************************************************************
  173.     Echo                            Scheduled task list
  174.     Echo ******************************************************************************
  175. Schtasks /query /fo LIST
  176. )>>%TmpLogFile% 2>&1
  177. echo **************************************************NetWork Connections***************************************************************** >> %TmpLogFile%
  178. echo *********************************************** Toutes les connexions **************************************************************** >> %TmpLogFile%
  179. Netstat -abnov >> %TmpLogFile%
  180. echo *********************************************** Les connexions etablies ************************************************************** >> %TmpLogFile%
  181. Netstat -ab |find /i "established" >> %TmpLogFile%
  182. echo *********************************************** Les connexions en ecoute *************************************************************  >> %TmpLogFile%
  183. Netstat -ab |find /i "listening" >> %TmpLogFile%
  184. echo *********************************************** Les connexions etablies **************************************************************  >> %TmpLogFile%
  185. Netstat -abnov |find /i "established" >> %TmpLogFile%
  186. echo *********************************************** Les connexions en ecoute ************************************************************* >> %TmpLogFile%
  187. Netstat -abnov |find /i "listening" >> %TmpLogFile%
  188. echo ************************************************************************************************************************************** >> %TmpLogFile%
  189. echo le contenu du fichier Hosts >> %TmpLogFile%
  190. echo ************************************************************************************************************************************** >> %TmpLogFile%
  191. Type %Windir%\System32\drivers\etc\hosts >> %TmpLogFile%
  192. echo *************************************************************************************************************************************** >> %TmpLogFile%
  193. Cmd /U /C Type %TmpLogFile% > %LogFile%
  194. Start "" %LogFile%
  195. Goto:MenuLoop
  196. ::*************************************************************************
  197. :Delete_Virus_Key <Key> <Pattern> <LogFile>
  198. Setlocal enabledelayedexpansion
  199. for /f "delims=REG_SZ" %%I in (
  200.     'reg query "%~1" /s^|findstr /ic:"%~2"'
  201.     )   Do  (
  202.                 If %ErrorLevel% NEQ 1 (
  203.                     Set KeyName="%%~I"
  204.                     (
  205.                         Call:Trim !keyName!
  206.                         Title Deleting Run key: "!keyName!"
  207.                         echo(
  208.                         echo Deleting Run key: "!keyName!"
  209.                         echo reg delete "%~1" /v "!keyName!" /f
  210.                         echo(
  211.                         echo *****************************
  212.                         reg delete "%~1" /v "!keyName!" /f
  213.                         echo *****************************
  214.                         echo(
  215.                     )>>"%~3"
  216.                         Call :Speak "A Virus was found : !KeyName! on "%~1" "
  217.                         Call :PS_Sub 'Warning' 1 '"A Virus was found : !KeyName!"' "'A Virus was found : !KeyName! on "%~1"'" 'Warning' 3
  218.                 )      
  219.    
  220.             )      
  221. )
  222. EndLocal
  223. Exit /b
  224. ::*************************************************************************
  225. :Trim <String>
  226. (
  227.     echo Wscript.echo Trim("%~1"^)
  228. )>"%tmp%\%~n0.vbs"
  229. for /f "delims=" %%a in ('Cscript /nologo "%tmp%\%~n0.vbs"') do (
  230.     set "KeyName=%%a"
  231. )
  232. exit /b
  233. ::**************************************************************************
  234. :PS_Sub $notifyicon $time $title $text $icon $Timeout
  235. PowerShell  ^
  236.   [reflection.assembly]::loadwithpartialname('System.Windows.Forms') ^| Out-Null; ^
  237.  [reflection.assembly]::loadwithpartialname('System.Drawing') ^| Out-Null; ^
  238.  $notify = new-object system.windows.forms.notifyicon; ^
  239.   $notify.icon = [System.Drawing.SystemIcons]::%1; ^
  240.   $notify.visible = $true; ^
  241.   $notify.showballoontip(%2,%3,%4,%5); ^
  242.   Start-Sleep -s %6; ^
  243.   $notify.Dispose()
  244. %End PowerShell%
  245. exit /B
  246. ::*************************************************************************
  247. :menu_[2] Clean USB Drive and restore hidden files
  248. for /f "tokens=2" %%i in ('wmic logicaldisk where "drivetype=2" ^|find /i ":"') do (Set MyUSB=%%i)
  249. cls
  250. setlocal ENABLEDELAYEDEXPANSION
  251. set _drive=%MyUSB%
  252. If Exist !_drive! (
  253. cls
  254. echo.
  255. echo           #########################################################
  256. echo                        Your usb key is connected as !_drive!
  257. echo           #########################################################
  258. echo.
  259. pause
  260. Cls
  261. echo(
  262. Echo Removing malicious files/unhiding files... Please wait, this may take a while...
  263. del /s /f /q !_drive!\*.lnk>>"%TmpLogFile%"2>&1
  264. Cmd /U /C Type "%TmpLogFile%" > "%LogFile%"
  265. Start "" %LogFile%
  266. attrib -s -h -a -r /s /d !_drive!\*.*
  267. Explorer "!_drive!\"
  268. ) ELSE (
  269. cls
  270. color 0C
  271. echo.
  272. echo           #########################################################
  273. echo                         Your usb key is not detected
  274. echo           #########################################################
  275. echo.
  276. pause
  277. )
  278. Goto:MenuLoop
  279. ::**********************************************
  280. :menu_[3] Download and Scan with Kaspersky Virus Removal Tool
  281. Cls
  282. Mode con cols=100 lines=5 & color 9E
  283. echo(
  284. Set "URL=http://devbuilds.kaspersky-labs.com/devbuilds/KVRT/latest/full/KVRT.exe"
  285. Set "Location=%userprofile%\Desktop\KVRT.exe
  286.     Title Downloading Kaspersky Virus Removal Tool ...
  287.     Call :Speak "Please wait... Downloading Kaspersky Virus Removal Tool...."
  288.     Call :PS_Sub 'information' 10 '"Downloading Kaspersky Virus Removal Tool ... "' "'Please wait... Downloading Kaspersky Virus Removal Tool....'" 'info' 4
  289.     Call :Download "%URL%" "%Location%"
  290.     Start "" "%Location%"
  291. Goto:MenuLoop
  292. ::**********************************************
  293. :menu_[4] Download and Scan with Microsoft Safety Scanner Tool
  294. Cls
  295. Mode con cols=100 lines=5 & color 9E
  296. echo(
  297. Set "URL32=http://definitionupdates.microsoft.com/download/definitionupdates/safetyscanner/x86/msert.exe"
  298. Set "URL64=http://definitionupdates.microsoft.com/download/definitionupdates/safetyscanner/amd64/msert.exe"
  299. Set "Location=%userprofile%\Desktop\msert.exe
  300. Set RegQry=HKLM\Hardware\Description\System\CentralProcessor\0
  301. REG Query %RegQry% > checkOS.txt
  302. Find /i "x86" < CheckOS.txt > StringCheck.txt
  303. If %ErrorLevel% EQU 0 (
  304.    Echo "This is 32 Bit Operating system"
  305.     pause
  306.     Title Downloading Microsoft Safety Scanner ...
  307.     Call :PS_Sub 'information' 10 '"Downloading Microsoft Safety Scanner ... "' "'Please wait... Downloading Microsoft Safety Scanner....'" 'info' 4
  308.     Call :Download "%URL32%" "%Location%"
  309.     Del checkOS.txt & del StringCheck.txt
  310. ) ELSE (
  311.     Title Downloading Microsoft Safety Scanner ...
  312.     Call :PS_Sub 'information' 10 '"Downloading Microsoft Safety Scanner ... "' "'Please wait... Downloading Microsoft Safety Scanner....'" 'info' 4
  313.    Echo "This is 64 Bit Operating System"
  314.     pause
  315.     Call :Download "%URL64%" "%Location%"
  316.     Del checkOS.txt & del StringCheck.txt
  317. )
  318. Goto:MenuLoop
  319. ::**********************************************
  320. :menu_[5] Download and Scan with RogueKiller Removal Tool
  321. Cls
  322. Mode con cols=100 lines=5 & color 9E
  323. echo(
  324. Set "URL=http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe"
  325. Set "Location=%userprofile%\Desktop\RogueKiller.exe
  326.     Title Downloading RogueKiller Virus Removal Tool ...
  327.     Call :Speak "Please wait... Downloading RogueKiller Virus Removal Tool...."
  328.     Call :PS_Sub 'information' 10 '"Downloading RogueKiller Virus Removal Tool ... "' "'Please wait... Downloading RogueKiller Virus Removal Tool....'" 'info' 4
  329.     Call :Download "%URL%" "%Location%"
  330.     Start "" "%Location%"
  331. Goto:MenuLoop
  332. ::**********************************************
  333. :menu_[6] Download and Scan with McAfee Stinger Scanner Tool
  334. Cls
  335. Mode con cols=100 lines=5 & color 9E
  336. echo(
  337. Set "URL32=http://downloadcenter.mcafee.com/products/mcafee-avert/stinger/stinger32.exe"
  338. Set "URL64=http://downloadcenter.mcafee.com/products/mcafee-avert/stinger/stinger64.exe"
  339. Set "Location=%userprofile%\Desktop\stinger32.exe
  340. Set RegQry=HKLM\Hardware\Description\System\CentralProcessor\0
  341. REG Query %RegQry% > checkOS.txt
  342. Find /i "x86" < CheckOS.txt > StringCheck.txt
  343. If %ErrorLevel% EQU 0 (
  344.    Echo "This is 32 Bit Operating system"
  345.     pause
  346.     Title Downloading McAfee Stinger Scanner Tool ...
  347.     Call :PS_Sub 'information' 10 '"Downloading McAfee Stinger Scanner Tool ... "' "'Please wait... Downloading McAfee Stinger Scanner Tool....'" 'info' 4
  348.     Call :Download "%URL32%" "%Location%"
  349.     Del checkOS.txt & del StringCheck.txt
  350. ) ELSE (
  351.     Set "Location=%userprofile%\Desktop\stinger64.exe
  352.     Title Downloading McAfee Stinger Scanner Tool ...
  353.     Call :PS_Sub 'information' 10 '"Downloading McAfee Stinger Scanner Tool ... "' "'Please wait... McAfee Stinger Scanner Tool....'" 'info' 4
  354.    Echo "This is 64 Bit Operating System"
  355.     pause
  356.     Call :Download "%URL64%" "%Location%"
  357.     Del checkOS.txt & del StringCheck.txt
  358. )
  359. Goto:MenuLoop
  360. ::**********************************************
  361. :menu_[7] Download and Scan with Emsisoft Emergency Kit Tool
  362. Cls
  363. Mode con cols=100 lines=5 & color 9E
  364. echo(
  365. Set "URL=http://dl.emsisoft.com/EmsisoftEmergencyKit.exe"
  366. Set "Location=%userprofile%\Desktop\EmsisoftEmergencyKit.exe
  367.     Title Downloading Emsisoft Emergency Kit Tool ...
  368.     Call :Speak "Please wait... Downloading Emsisoft Emergency Kit Tool...."
  369.     Call :PS_Sub 'information' 10 '"Downloading Emsisoft Emergency Kit Tool ... "' "'Please wait... Downloading Emsisoft Emergency Kit Tool....'" 'info' 4
  370.     Call :Download "%URL%" "%Location%"
  371.     Start "" "%Location%"
  372. Goto:MenuLoop
  373. ::**********************************************
  374. :menu_[8] Download and Scan with SUPERAntiSpyware Pro Tool
  375. Cls
  376. Mode con cols=100 lines=5 & color 9E
  377. echo(
  378. Set "URL=http://cdn.superantispyware.com/SUPERAntiSpywarePro.exe"
  379. Set "Location=%userprofile%\Desktop\SUPERAntiSpywarePro.exe
  380.     Title Downloading SUPERAntiSpyware Pro Tool ...
  381.     Call :Speak "Please wait... Downloading SUPERAntiSpyware Pro Tool...."
  382.     Call :PS_Sub 'information' 10 '"Downloading SUPERAntiSpyware Pro Tool ... "' "'Please wait... Downloading SUPERAntiSpyware Pro Tool....'" 'info' 4
  383.     Call :Download "%URL%" "%Location%"
  384.     Start "" "%Location%"
  385. Goto:MenuLoop
  386. ::**********************************************
  387. :Check_Key
  388. reg QUERY %1 >nul 2>&1
  389. (
  390.     if %errorlevel% equ 0 ( reg QUERY %1 /s
  391.         ) else ( echo %1 ===^> Not found
  392.     )
  393. ) >>%2 2>&1
  394. Exit /b
  395. ::**********************************************
  396. :KillMyProcess
  397. cls
  398. Taskkill /IM "%~1" /F >>"%TmpLogFile%" 2>&1
  399. echo(
  400. echo(
  401. echo               **********************************************
  402. echo                        Try Killing "%~1"
  403. echo               **********************************************
  404. Timeout /T 1 /Nobreak>nul
  405. Rem Call :PS_Sub 'Warning' 1 '"Killing "%~1""' "'Try Killing "%~1"'" 'Warning' 2
  406. Exit /b
  407. ::**********************************************
  408. :Speak <msg>
  409. Cls
  410. echo(
  411. (
  412. echo  WScript.StdOut.Write +vbTab+"******************************************************************************" + vbcrlf
  413. echo strText=wscript.arguments(0^)
  414. echo intTextLen = Len(strText^)
  415. echo intPause = 100
  416. echo WScript.StdOut.Write vbTab
  417. echo For x = 1 to intTextLen
  418. echo     strTempText = Mid(strText,x,1^)
  419. echo     WScript.StdOut.Write strTempText
  420. echo     WScript.Sleep intPause
  421. echo Next
  422. echo wscript.echo vbcrlf +vbTab+ "******************************************************************************"
  423. echo Set Voice=CreateObject("SAPI.SpVoice"^)
  424. echo voice.speak strText
  425. )>%tmp%\%~n0.vbs
  426. @cscript.EXE /noLogo "%tmp%\%~n0.vbs" "%~1"
  427. Exit /B
  428. ::**************************************************************
  429. :Download <URL> <Location>
  430. Set URL="%~1"
  431. Set Location="%~2"
  432. If Exist "%~2" Del "%~2"
  433. Bitsadmin /transfer "Download" "%~1" "%~2"
  434. If Exist "%~2" Start "" "%~2"
  435. If %ErrorLevel% GTR 0 (
  436.     Call :PSDownload "%~1" "%~2"
  437. )      
  438. Goto:MenuLoop
  439. ::**************************************************************
  440. Rem Function in Powershell for Downloading file
  441. :PSDownload <url> <file>
  442. Set PSFile=%Tmp%\PSFile.ps1
  443. (
  444.     echo $down = New-Object System.Net.WebClient;
  445.     echo $url  = "%~1";
  446.     echo $file = "%~2";
  447.     echo $down.DownloadFile($url,$file^);
  448.     echo $exec = New-Object -com shell.application;
  449.     echo $exec.shellexecute($file^);
  450. )>%PSFile%
  451. If Exist "%~2" Del "%~2"
  452. Call :Speak "Please Wait... Downloading file "%~2" is in Progress..."
  453. Powershell.exe -ExecutionPolicy bypass -file %PSFile%
  454. If Exist "%~2" Start "" "%~2"
  455. Del %PSFile%
  456. Goto:MenuLoop
  457. ::*********************************************************************
  458. :EOF
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!