Banker - Bloco De Notas

banker @echo off REM Created by: Altieres Rohr and Linha Defensiva Team [www.linhadefensiva.org] REM Database Maintainers: Linha Defensiva Security Incident Response and Analysis Team [ARIS-LD - [email protected]] REM Engine: v3.0a International [VALKYRIE] REM BankerFix uses many modules. The versions in use are stored in the VERSION file. REM For the current definition version, see the BankerFix page at Linha Defensiva, please see: REM http://linhadefensiva.org/bankerfix/v3/current/ REM For copyright and other information, please see the readme.txt file. REM WE DO NOT CLAIM COPYRIGHT ON INCLUDED EXE TOOLS [EXEC package/folder]. REM These tools are either in public domain or owned by their respective copyright holders. See readme.txt. REM Since this tool is not for profit, we use them on good faith. We thank and credit all developers. ver|find "Windows 95">NUL if not errorlevel 1 goto norun if not exist relatorios mkdir relatorios REM Check and creation of the QUArantine folder. if exist QUA\Arquivos goto defprep mkdir QUA mkdir QUA\Arquivos mkdir QUA\Pastas :defprep REM Deletion of downloaded update ZIPs del *.zip > nul REM Definition list cleanup and prepration. if if if if if if if if

exist exist exist exist exist exist exist exist

reflist\reft-startup del reflist\reft-startup RegKeys.txt del RegKeys.txt import.reg del import.reg run-system del run-system nao-removidos del nao-removidos rebootrequired del rebootrequired removidos del removidos webversion.info del webversion.info

if exist md5-hklm.reg del md5-hklm.reg REM Simple backup of Run keys. regedit /a /e RegKeys.txt HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run copy RegKeys.txt QUA\backup.reg > nul REM The presentation is imported from the in-use language setting. cls type lang\bat\opening.txt echo. if not exist auto pause cls if not exist relatorio.txt goto st del relatorio.txt > nul :st Página 1

banker exec\pv -kf iexplore.exe > nul cd reflist type ref-system >> reft-startup echo. >> reft-startup type ref-programfiles >> reft-startup echo. >> reft-startup type ref-wincommon >> reft-startup echo. >> reft-startup type ref-windows >> reft-startup echo. >> reft-startup type ref-system32 >> reft-startup echo. >> reft-startup type ref-sysdrive >> reft-startup echo. >> reft-startup type ref-commonfiles >> reft-startup echo. >> reft-startup type ref-temp >> reft-startup echo. >> reft-startup type ref-startup >> reft-startup cd .. ver|find "Windows if not errorlevel ver|find "Windows if not errorlevel

98">NUL 1 goto runsystem ME">NUL 1 goto runsystem

goto start :runsystem echo TRUE > run-system :start cls type lang\bat\wait.txt CScript bankerfix.vbs //nologo > nul echo.>> relatorio.txt echo.>> relatorio.txt if not exist %WINDIR%\Help\*.exe goto tifclean :helpclean type lang\bat\logremhelp.txt >> relatorio.txt echo.>> relatorio.txt echo ----------------------------------- >> relatorio.txt echo.>> relatorio.txt exec\pv -kf -l"%WINDIR%\Help*" >> relatorio.txt cls echo.>> relatorio.txt echo.>> relatorio.txt dir /b %WINDIR%\Help\*.exe >> relatorio.txt attrib -s -h -r %WINDIR%\Help\*.exe > nul del %WINDIR%\Help\*.exe > nul echo.>> relatorio.txt echo.>> relatorio.txt :tifclean if not exist %WINDIR%\Media\*.tif goto logend Página 2

banker type lang\bat\logremtif.txt >> relatorio.txt echo.>> relatorio.txt echo ----------------------------------- >> relatorio.txt echo.>> relatorio.txt exec\pv -kf -l"%WINDIR%\Media*" >> relatorio.txt cls echo.>> relatorio.txt echo.>> relatorio.txt dir /b %WINDIR%\Media\*.tif >> relatorio.txt attrib -s -h -r %WINDIR%\Media\*.tif > nul del %WINDIR%\Media\*.tif > nul echo.>> relatorio.txt echo.>> relatorio.txt :logend type lang\bat\logend.txt >> relatorio.txt echo.>> relatorio.txt echo.>> relatorio.txt CScript rotinas\arquiva-relatorio.vbs //nologo > nul exec\pv explorer.exe if errorlevel 1 explorer.exe cls if exist rebootrequired goto rebootreq if exist nao-removidos goto NR if exist removidos goto ok type lang\bat\noproblems.txt echo. echo. type lang\bat\seeforum.txt goto end :ok type lang\bat\filesremoved.txt echo. type lang\bat\antivirusnote.txt echo. echo. type lang\bat\changepass.txt echo. type lang\bat\seeforum.txt goto end :NR type lang\bat\error-removing.txt echo. echo. type lang\bat\antivirusnote.txt echo. echo. type lang\bat\seeforum.txt goto end :rebootreq type lang\bat\rebootrequired.txt echo. echo. type lang\bat\seeforum.txt goto end :norun type lang\bat\win95.txt Página 3

banker :end echo. echo. if exist if exist if exist if exist if exist if exist if exist

RegKeys.txt del RegKeys.txt import.reg del import.reg run-system del run-system nao-removidos del nao-removidos removidos del removidos regremove del regremove md5val del md5val

if exist md5-hklm.reg del md5-hklm.reg if exist auto exec\pv -kf -l"*banker.bat*" pause exit

Página 4