@echo off
REM ====================
set BWSCRDRV=%~d0
set BWSAFETT=0
REM ====================
cls
echo.
echo.
echo.
echo.
echo.
echo Hey there!
echo.
echo It's me, Dan!
echo.
echo I'm going to fix your computer!
echo.
echo Before I do anything though, I'm going to need some bits
echo of information from you.
echo.
:BWENTDRV
echo Enter the DRIVE LETTER where Windows is installed
echo (C, D, etc.) and then press Enter/Return on your keyboard.
echo Please make sure to enter ONLY THE DRIVE LETTER! If you
REM ====================
set /p BWDRVLTR="are not sure, just say "C": "
REM ====================
echo.
IF NOT EXIST %BWDRVLTR%:. (
echo Drive %BWDRVLTR%: can't be accessed!
echo.
echo Did you build this computer yourself or know you are running
echo SATA hard drives? If so, then you may need to load Vista
echo drivers for your motherboard's SATA controller. You can do
echo this by loading the .inf files before you get to the Command
echo Prompt by clicking on the "Load Drivers..." button that you
echo skipped originally on that tiny window.
echo.
echo However, if you don't understand what I just said, please try
echo another drive letter.
echo.
echo If you are sure that %BWDRVLTR% is the correct drive letter,
echo reboot the Vista Recovery Disc and try again.
echo.
CALL :BWENTDRV
)
echo When you're normally in Windows, is the DRIVE LETTER that
echo Windows is running off of not C:? If you have NO IDEA what
echo I'm talking about, enter "C". Otherwise, enter your
REM ====================
set /p BWCDRV="DRIVE LETTER now: "
REM ====================
echo.
:BWENTDIR
echo Enter the FOLDER where Windows is installed
echo (WINDOWS, WINNT, etc.) and then press Enter/Return on your
echo keyboard. Please make sure to enter ONLY THE FOLDER! If you
REM ====================
set /p BWWINDIR="are not sure, just say "WINDOWS": "
REM ====================
echo.
IF NOT EXIST %BWDRVLTR%:\%BWWINDIR%\system32\eula.txt. (
echo %BWWINDIR% is not where Windows XP is installed!
echo Please try another folder.
echo.
echo If you are sure that %BWWINDIR% is the correct folder,
echo reboot the Vista Recovery Disc and try another drive
echo letter.
echo.
CALL :BWENTDIR
)
REM ====================
set BWREG=%BWWINDIR%
set BWWINDIR=%BWDRVLTR%:\%BWWINDIR%
set BWDOCSFOLD=%BWDRVLTR%:\Documents and Settings
set BWPROGFILE=%BWDRVLTR%:\Program Files
REM ====================
echo Enter the number of your Service Pack (0, 1, 2 or 3) and
REM ====================
set /p BWSRVPCK="then press Enter/Return on your keyboard: "
REM ====================
echo.
IF %BWSRVPCK%==0 (
echo Got it! You're running RTM/Gold Windows XP!
) ELSE (
echo Got it! You're running Windows XP Service Pack %BWSRVPCK%!
)
echo.
echo Lastly, do you want to see the results of a Spybot:
echo Search ^& Destory scan? If you want to help me out, enter
REM ====================
set /p BWSPBANS=""y". Otherwise, enter "n": "
REM ====================
echo.
IF %BWSPBANS%==y (
set BWSPBANS=SpybotSD.exe /allhives /autocheck /autofix
) ELSE (
set BWSPBANS=SpybotSD.exe /allhives /autocheck /autofix /autoclose
)
cls
echo.
echo Thanks for the info!
echo.
echo Checking hard drive...
echo.
IF %BWSAFETT%==0 (
chkdsk %BWDRVLTR%: /x
) ELSE (
pause
)
cls
echo.
echo Deleting bad files... This next part might take a bit.
echo (1-2 minutes) If it looks frozen, don't worry! :-)
echo.
echo Please wait...
echo.
IF %BWSAFETT%==0 (
@del /f /q %BWWINDIR%\system32\wsaupdater.exe
@del /f /q %BWWINDIR%\system32\wsupdater.exe
@del /f /q %BWWINDIR%\system32\svchostw.exe
@del /f /q %BWWINDIR%\system32\scvhost.exe
@del /f /q %BWWINDIR%\scvhost.exe
@del /f /q %BWWINDIR%\system32\ntos.exe
@del /f /q %BWWINDIR%\system\ntos.exe
@del /f /q %BWWINDIR%\Tasks\At???.job
@del /f /q %BWWINDIR%\krln32.exe
@del /f /q %BWWINDIR%\system32\scvh0st.exe
@del /f /q "%BWPROGFILE%\Common Files\trjdwnl.dll"
@del /f /q %BWWINDIR%\shlext32.exe
@del /f /s /q %BWDRVLTR%:\temp
@del /f /s /q %BWWINDIR%\Temp
@rmdir /s /q "%BWDOCSFOLD%\All Users\Application Data\CrucialSoft Ltd"
@rmdir /s /q "%BWDOCSFOLD%\All Users\Application Data\Secure Solutions"
@rmdir /s /q %BWWINDIR%\system32\tp2
@rmdir /s /q %BWWINDIR%\system32\enUZ
@rmdir /s /q "%BWPROGFILE%\Advantage"
@rmdir /s /q "%BWPROGFILE%\XPAntivirus"
@rmdir /s /q "%BWPROGFILE%\XP Antivirus"
@rmdir /s /q "%BWPROGFILE%\PCHealthCenter"
@rmdir /s /q "%BWPROGFILE%\VAV"
) ELSE (
pause
)
echo.
echo Copying clean files over...
echo.
IF %BWSAFETT%==0 (
@copy %BWSCRDRV%\sp%BWSRVPCK%\userinit.exe %BWWINDIR%\system32 /v /b /y
@copy %BWSCRDRV%\sp%BWSRVPCK%\userinit.exe %BWWINDIR%\system32\dllcache /v /b /y
@copy %BWSCRDRV%\sp%BWSRVPCK%\rundll32.exe %BWWINDIR%\system32 /v /b /y
@copy %BWSCRDRV%\sp%BWSRVPCK%\rundll32.exe %BWWINDIR%\system32\dllcache /v /b /y
@copy %BWSCRDRV%\sp%BWSRVPCK%\explorer.exe %BWWINDIR% /v /b /y
@copy %BWSCRDRV%\sp%BWSRVPCK%\explorer.exe %BWWINDIR%\system32\dllcache /v /b /y
@copy %BWSCRDRV%\sp%BWSRVPCK%\regedit.exe %BWWINDIR% /v /b /y
@copy %BWSCRDRV%\sp%BWSRVPCK%\regedit.exe %BWWINDIR%\system32\dllcache /v /b /y
@copy %BWSCRDRV%\sp%BWSRVPCK%\cmd.exe %BWWINDIR%\system32 /v /b /y
@copy %BWSCRDRV%\sp%BWSRVPCK%\cmd.exe %BWWINDIR%\system32\dllcache /v /b /y
@copy %BWSCRDRV%\sp%BWSRVPCK%\logoff.exe %BWWINDIR%\system32 /v /b /y
@copy %BWSCRDRV%\sp%BWSRVPCK%\logoff.exe %BWWINDIR%\system32\dllcache /v /b /y
@copy %BWSCRDRV%\sp%BWSRVPCK%\logonui.exe %BWWINDIR%\system32 /v /b /y
@copy %BWSCRDRV%\sp%BWSRVPCK%\logonui.exe %BWWINDIR%\system32\dllcache /v /b /y
@copy %BWSCRDRV%\sp%BWSRVPCK%\lsass.exe %BWWINDIR%\system32 /v /b /y
@copy %BWSCRDRV%\sp%BWSRVPCK%\lsass.exe %BWWINDIR%\system32\dllcache /v /b /y
@copy %BWSCRDRV%\sp%BWSRVPCK%\mmc.exe %BWWINDIR%\system32 /v /b /y
@copy %BWSCRDRV%\sp%BWSRVPCK%\mmc.exe %BWWINDIR%\system32\dllcache /v /b /y
@copy %BWSCRDRV%\sp%BWSRVPCK%\services.exe %BWWINDIR%\system32 /v /b /y
@copy %BWSCRDRV%\sp%BWSRVPCK%\services.exe %BWWINDIR%\system32\dllcache /v /b /y
@copy %BWSCRDRV%\sp%BWSRVPCK%\svchost.exe %BWWINDIR%\system32 /v /b /y
@copy %BWSCRDRV%\sp%BWSRVPCK%\svchost.exe %BWWINDIR%\system32\dllcache /v /b /y
@copy %BWSCRDRV%\sp%BWSRVPCK%\winlogon.exe %BWWINDIR%\system32 /v /b /y
@copy %BWSCRDRV%\sp%BWSRVPCK%\winlogon.exe %BWWINDIR%\system32\dllcache /v /b /y
@copy %BWSCRDRV%\sp%BWSRVPCK%\msconfig.exe %BWWINDIR%\pchealth\helpctr\binaries /v /b /y
@copy %BWSCRDRV%\sp%BWSRVPCK%\msconfig.exe %BWWINDIR%\system32\dllcache /v /b /y
) ELSE (
pause
)
echo.
echo Clearing your temp files...
echo.
IF %BWSAFETT%==0 (
REM Code found here: http://harrycoal.co.uk/2008/08/20/delete-temp-files-for-each-user-profile
@cd /D %BWDOCSFOLD%
REM —-Clean Temp Folder—
@for /D %%a in (*.*) do DEL /F /Q "%%a\Local Settings\Temp\*.*"
@for /D %%a in (*.*) do FOR /D %%b IN ("%%a\Local Settings\Temp\*.*") DO RMDIR /S /Q "%%b"
REM —-Clean IE Cache—
@for /D %%a in (*.*) do DEL /F /Q "%%a\Local Settings\Temporary Internet Files\*.*"
@for /D %%a in (*.*) do FOR /D %%b IN ("%%a\Local Settings\Temporary Internet Files\*.*") DO RMDIR /S /Q "%%b"
@CD /D %BWSCRDRV%
) ELSE (
pause
)
echo.
echo Editing registry...
IF %BWSAFETT%==0 (
@CD /D %BWSCRDRV%\RS
@RunScanner.exe /t 0 /ac /sd /m+ /y regedit.exe /s %BWSCRDRV%\RG\saveme.reg
echo.
echo Waiting 10 seconds...
@..\sleep 10
@RunScanner.exe /t 0 /ac /sd /m+ /y REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /d "%BWCDRV%:\%BWREG%\system32\userinit.exe," /f
echo.
echo Waiting 10 more seconds...
@..\sleep 10
) ELSE (
pause
)
cls
echo.
echo Running Spybot: Search ^& Destroy...
echo.
echo THIS WILL TAKE A LONG TIME! (It will not under normal
echo circumstances, but the Vista Recovery Disc is a special
echo case.)
echo.
echo If you chose to display the scan results: (answered "y")
echo ========================================================
echo When Spybot: Search ^& Destroy is done the scan, it will
echo display the results. Right click on the scan results and
echo save the report to your hard drive or a USB flash drive.
echo !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
echo ^>^>^>Make sure that you DO NOT save it to the X: drive!^<^<^<
echo !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
echo Email me the scan log. (see first page of the guide for
echo contact info)
echo ========================================================
echo.
echo When the scan is done, please close the Spybot: Search
echo ^& Destroy window if it is open, click in this Command
echo Prompt window and press Enter/Return on your keyboard
echo to continue.
IF %BWSAFETT%==0 (
@CD /D %BWSCRDRV%\SB
@%BWSPBANS%
) ELSE (
pause
)
cls
echo.
echo Running HiJackThis!...
echo.
echo This part is very quick and completely automated! :-)
echo.
echo If you get an error message below, don't worry!
echo It's a failsafe.
echo.
echo ========================================================
echo Save the report to your hard drive or a USB flash drive.
echo !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
echo ^>^>^>Make sure that you DO NOT save it to the X: drive!^<^<^<
echo !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
echo Email me the scan log. (see first page of the guide for
echo contact info)
echo ========================================================
echo.
echo When the scan is done, all of the windows should close
echo automatically. click in this Command Prompt window and
echo press Enter/Return on your keyboard to continue.
IF %BWSAFETT%==0 (
@CD /D %BWSCRDRV%\RS
REM Clear...
@rmdir /s /q %BWDRVLTR%:\BWHT202
@RunScanner.exe /t 0 /ac /sd /m+ /y regedit.exe /s %BWSCRDRV%\HT\rm.reg
REM Copy...
@MKDIR %BWDRVLTR%:\BWHT202
@ROBOCOPY /E /ZB /MIR /COPY:DAT /DCOPY:T /NP /NS /NC /NFL /NDL /NJH /NJS %BWSCRDRV%\HT %BWDRVLTR%:\BWHT202 *.*
REM Run...
@START %BWSCRDRV%\autohjt.exe
@RunScanner.exe /t 0 /ac /sd /m+ /y %BWDRVLTR%:\BWHT202\HiJackThis.exe
REM Clear...
@rmdir /s /q %BWDRVLTR%:\BWHT202
@RunScanner.exe /t 0 /ac /sd /m+ /y regedit.exe /s %BWSCRDRV%\HT\rm.reg
) ELSE (
pause
)
echo.
pause
cls
echo.
echo I'm done!
echo.
echo Please take the CD, DVD or USB flash drive out of your
echo CD/DVD drive or your USB port.
echo.
echo If used, make sure to close the tray of the CD/DVD
echo drive after opening it.
echo.
echo Then, hold down the power button on your computer for
echo about 5 seconds to power it off. After it's off, press
echo the power button on your computer to power it back on
echo and try booting into Safe Mode with the F8 key.
echo.
echo               !   !   !IMPORTANT!   !   !
echo If you are able to get into Safe Mode, do not forget
echo to GO ONTO THE NEXT PAGE of the guide to help protect
echo your system from future attacks!
echo.
echo However, if you're still not able to get in, see the
echo first page of the guide for contact info.
echo.
echo Good Luck! :-)
echo.
REM End like nothing happened... ;-)
@CD /D X:\Sources
:EOF
