Virus(s) Deleated by simple DOS Batch Files?

  • Thread starter Thread starter seekingtko
  • Start date Start date
S

seekingtko

Questions: Is it possible to create Batch File(s) to
delete a "Known Virus Filename(s)" located anywhere on
the drive?

Can Batch File(s) be run at Startup by Autoexec.bat?

Entering the full path of Drive C: in the Batch File
Command Line Instructions, is it possible to locate and
delete the "Known Virus Filename"?

Thank You Very Much
 
In my view this is possible but when its a virus it can
get difficult, you would need to include attrib commands
to remove hidden/read only status etc.. and disable it if
its running as a service like this

@ECHO OFF
cd %windir%
sc config ****** start= disabled
sc stop ******
sc delete ******
attrib -s -r -h ******.exe
del ******.exe
exit

But if it injects into another process such as explorer
then you need to also stop that by including other tools
in the batch folder such as Process.exe then you can call
this to stop what's needed like this:

ECHO OFF

if exist process.exe (
process -k explorer.exe
) ELSE (
cmd /c "echo Process.exe missing. Please unzip
completely and rerun this file.&&pause&&exit"
)
cd %windir%
del /a /f *****.exe

cd %windir%\system32
del /a /f ******.dll

echo REGEDIT4

echo [-HKEY_CURRENT_USER\Software\******]

start explorer.exe
exit

****** Being whatever the files are you need removing but
sometimes they can delete other files so its a hard one
to answer, most removers are based on batch writing so it
is possible but the hard part is always finding the file
names invloved and all the registry changes, once this is
done it is then possible to write a batch to remove them.

Andy
 
Thank You very much Andy for your response. I posted
because its time we get back to basics.

If ALL "DEFINITIONS" are in the command line
instructions of batch files and run "before" the system
starts to load; it may work.

The purpose of batch files as I mentioned is to scan,
move or deleate unwanted files of a known
filename,ie; "DEFINITIONS", before they become active
when the system is loading and running at the desktop.

We have become software dependent and I think its time
to undo that and become software independent.

You sound like you can build batch files Andy and with
the assistance of others working together I'm certain
something quite exciting will come out of this rarely
used or mentioned file [batch].

Nothing comes easy in software development; but
redesigning batch files may prove to be one of the
greatest software tools to combat unwanted files.

Thank You again.
 
You might be interested to know that Microsoft continues to build more and
better command processors and command-line options and utilities into each
new version of Windows.

I'm not subscribing to all of your arguments, but the command line is alive
and well in Windows, and becoming more useful over time, rather than less.
 
No Problem,

Im no programmer but I think alot can be achieved using a
batch script, The first post I did here I used examples
from batches I'd written but there is area's Id deleted
as they were just for an example. I will explain things
in more detail here starting with the basics if you are
interested in writing some yourself:

Batch files are text files with commands that a DOS type
interpreter (like COMMAND.COM, or CMD.EXE) can understand
and use.To anyone who uses DOS, the draw-backs of these
files are obvious as the scope is meant for basic level
tasks. However, the variety of applications you can
create is quite suprising.

example.bat

The suffix 'bat' denotes that this file is a batch file
and any file ending in this will be dealt with as a batch
file. So me.BAT & YOU.bat are acceptable names for Batch
files. Names are not case-sensitive.

Now lets make our first file, open up a basic text
editor. My favourite is Notepad, just click on 'Run' and
type in notepad.

You should have by now a blank page that is opened in a
text editor that does what you actually tell it to do.

Enter the following into the first line of your blank
page.

PAUSE

And click on file > save as and then save the file to an
appropriate space such as desktop under the name wait.bat

Find the file and double click it to execute it (like any
program)

You will recieve the notice "Press any key to
continue . . .", so press any key and the program will
end. This file was opened as a program and followed the
first command there was, which was the command PAUSE,
giving the response you just saw. Since there were no
further commands the file was closed and the program
finished.

Echoing and redirection.

An echo is a computer message, However you can tell it to
say whatever you like. Open your file wait.bat (remember
not to double click on it, just right click and open it
in notepad and move the PAUSE command down a line. On the
newly available first line enter the following.

ECHO

Which will then be followed by the PAUSE command the file
should look like this.

ECHO This is your batch files message.
PAUSE

then save it and run it again, you should see something
like.

C:\Documents and Settings\Andy\Desktop>ECHO This is your
batch files message.
This is your batch files message.

C:\Documents and Settings\Andy\Desktop>PAUSE
Press any key to continue . . .

And the program finishes but instead of just telling you
the responses it also tells you about the working
environment and the commands that are being followed. As
you can see this is exactly what just happened.

On the first line.

ECHO ON
Ensures the environment is (like normal) fully responsive
and echoes to the user all valid information like prompts
and commands that are followed.

ECHO OFF
Switches off all echoing except for responses to commands.

The @ sign.
At the beginning of a statement disables the echo of that
line only.

I mention this because

ECHO OFF

Alone produces an echo confirming the command before the
actual command is followed.

@ECHO OFF

At the beginning of a file will change the file so that
no needless information is shown. This is pretty much
standard procedure amongst those who regularly use Batch
Files.

Now your file should be looking like this:

@echo off
echo This is your batch files message
pause

which should return:

This is your batch files message
Press any key to continue . . .


pause > nul

This is an example of redirection; The echo is taken off-
course by the > symbol and put into something called nul.
nul is a general computer term for nothing, the echo
effectively disappears.

pause > CON

However, effectively 'hardwires' the echo to the display,
or CONsole.

The other main purpose of this is to redirect a commands
output to a file, maybe to make a log file recording the
initiation of a computer through autoexec.bat or maybe
just to check maintenance performed by a batch file.

Open up wait.bat in the editor again and alter the file
to read:

@echo off
echo This is your batch files message > message.txt
pause

Run the file again and check your desktop or where you
saved Wait.bat and you will now see a text file called
message.txt

the change means the ECHO command is redirected into a
file called message.txt, open the text file and you will
see This is your batch files message written into it.

(remember the pause command?). So why didn't the ECHO
message appear?
If a command output is redirected to a file or the device
name 'nul', the output never goes to the console (the bit
you see). Remember it is one command with one output that
can only go to one location, take a look at message.txt
to see where this one went.

If a specified file does not exist, one is created to
store the output under the specified name(message.txt)

It is a repetetive task, but if you want an output to go
to both the console and a file then (barring more
advanced methods) you will have to 'double up' the
commands With echoes heading to your file and to the
console. A primitive response to the problem but other
ways can be found with experience, I'll keep to the
basics to make things easier to follow.

Another way is to use >> it appends to the end of the
file. Simply, it adds a new line and puts the new info
there.

Here the first message is sent to the console the second
message is sent to the file,

So it would then look like this :

@echo off
echo This is your batch files message
echo This is your batch files 2nd message >> message.txt
pause

Save and run this, You will see it in the console and
also the second line created on the text file

Another usefull command while learning is HELP which will
display a list of commands you can use,type help into the
command prompt this part is very usefull because then you
can type help ****** . ****** being one of the commands
in the list to then get detailed info on the entries.


GOTO, IF and Ctrl-C


Ctrl-C

Is something you will have to know about, it's a break
character which allows you to quit processes in the DOS
environment. So if your batch file starts running out of
control or won't end, holding down the keys Ctrl and C
will ask for confirmation to quit.

Terminate batch job? (Y/N)?

and enter 'y' to quit.

GOTO

If the batch files you have run were straight roads with
the occasional 'jam' (the pause command), recursive batch
files are more like systems of roundabouts, with IF
statements as intersections with alternative roads to
follow.

The nature of a DOS type interpreter is to follow
commands, if it isn't told otherwise it will run to the
end of the script and terminate the program. There is a
way, however, to make the file be read in a more dynamic
pattern.

Clear the text of your batch file and enter the following.

@echo off
:1
goto 1

and run it, you will need to manually shutdown the
program with Ctrl-C

This is because the program is stuck in a loop; The
programs cursor reads normally until it finds the command

goto 1
It then is redirected to the label 1

:1
and it reads down again and is looped back.

edit the program again to read as the following

@echo off
:1
time /t
pause > nul
goto 1

Now study this program, it is designed to echo the time
and then pause (which echoes to nul, giving no prompt)
every time you press a key the pause is broken and the
program loops back to the label 1 and repeats itself.

You can just open the DOS Command Prompt and just type in

help time

And you will be given an explanation of its use and
syntax.

IF

Is a conditional statement; An understanding of this can
lead to elegant and powerful script designs.

IF exist readme.txt; echo readme.txt exists

Study this command; the two situations that could arise
from this statement are if the local file readme.txt
(local because no folder is stated, so the interpretter
remains working within the batch files folder) exists or
not. If it does exist the the message is echoed

readme.txt exists

If the files doesn't exist no action is taken. Read the
following command

IF NOT exist readme.txt; echo readme.txt does not exist

This performs a similar job, in the case that the file
does not exist the message is echoed

readme.txt does not exist

In the case that it does exist, no action is taken.

ARGUMENTS

set /p

is of great use in batchfiles, creating a chance for real
user interactivity.

An example is

set /p Vname=username:

This will make the batch prompt the user for input with

username:

and the entered data is assigned to the prompts variable,
Vname.

A example of interactivity is in this batch:

@echo off
set /p answer="knock knock! "
echo.
set /p who=Luke.
echo.
echo Luke through the keyhole and you'll find out!
pause

Commands

The cls command will clear the screen. It doesn't take
any arguments and is mainly used to clear the screen
before displaying any longer output to the user

Echo again can be used to print messages on the screen.
By default MS-DOS will echo all command output in the
batch script on the screen, which can be handy in
debugging situations. If you want to get rid of command-
echoing, though, it's done with the following: @echo off
The at sign is needed to supress the message "echo is
off". Command-echoing can also be turned on at any time
by typing echo on.

The pause command prints a generic prompt and waits for
some user keyboard input (a bit like getting a one
character in C and other languages). It can be useful if
you want to be interactive, but in most batch scripts
that are ment to run unattended, it's rarely used.

The goto command will jump to a specified label in the
batch file and continue execution from there. goto foo
would jump to a lable titled :foo. Label names always
start with a colon and the first eight characters of a
label name must be unique inside a batch file. Goto is
mainly useful in breaking up batches into clear,
managable parts and is of special interest when used with
the if command. It also provides the basis for proper,
finite looping when we get to NT-specific batch commands.

The if command does simple conditional processing. If the
condition is true the following command is executed. Only
one command may be specified after if and there's no easy
way of specifying an else-clause but if does support not
(if not conditions). Normally one would use the goto
command after an if to workaround the single-command
limitation.

The shift command shifts command-line variables %0 to %9
around replacing %n with %n+1. %9 is replaced by the 10th
command-line argument (it can be a real argument or the
variable is empty if there's no argument).

Call will call another batch file inside the one you are
currently in and return execution when the called batch
file terminates. If you use a batch file name without
call, execution will not return to the caller afterwords!
Calling a batch file is simple:: call dostuff.bat and it
is also a great way to modularize and reuse batch code


More command details before writing batch

http://www.microsoft.com/resources/documentation/windows/x
p/all/proddocs/en-us/ntcmds.mspx

http://www.microsoft.com/resources/documentation/windows/x
p/all/proddocs/en-us/redirection.mspx

http://www.computerhope.com/batch.htm#02




Example Batches:

This will ask the users name and print it on the screen.

@echo off
set /p _name=Enter your name:
echo Hello %_name%!.
set _name=
Pause


This will count from 0 to 99:

@echo off
set _number=0
set _max=100
:Start
if %_number%==%_max% goto end
echo %_number%
set /a _number=_number + 1
goto start

:end
set _number=
set _max=
pause

Note the pause is just so you can view this before the
screen dissapears its not required in most batches.

This is a calculater batch use * for multiply

@echo off
echo Type exit when done.
:start
set /p _string="> "
if /i "%_string%"=="exit" goto end
set /a _result=%_string%
echo %_result%
goto start

:end
echo Bye.
echo.

set _string=
set _result=


The Else clause

Although the changes are not as revolutionary as in set,
the if command has also acquired some new features in
Windows 2000 and XP. One of the handiest is the else-
clause. Here's a simple example:


IF EXIST filename. (
del filename.
echo deleted
) ELSE (
echo filename. missing.
echo try again.
)


Because of DOS legacy the parser is really picky about
the syntax, the format:
if condition (
do stuff
) else (
do something else
)
helps to minimize errors and avoids most of the common
pitfalls.


The following example program keeps asking for passwords
until both are the same:


@echo off
set _original=a
set _retry=b

:start
set /p _original="Type in your new password: "
set /p _retry="Retype the password, please: "
if %_original% equ %_retry% (
echo password changed succesfully.
goto end
) else (
echo The passwords don't match, please try again.
echo.
goto start
)

:end
set _original=
set _retry=


And Finally This will search the registry Run keys and
display the results in text form :

regedit /e
HKCURun.txt "HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Run"
regedit /e
HKLMRun.txt "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
\CurrentVersion\Run"
copy HKLMRun.txt + HKCURun.txt = Output.txt
del /q HKLMRun.txt
del /q HKCURun.txt
notepad Output.txt
del /q Output.txt

This code opens Notepad with the Registry contents of
both the HKLM and HKCU branches of the Run key.


Here's a more complicated one designed to remove Elitebar
variants:

@echo off

VER|find "Windows 2000">NUL
IF NOT ERRORLEVEL 1 GOTO NT

VER|find "Windows XP">NUL
IF NOT ERRORLEVEL 1 GOTO NT

VER|find "Windows 95">NUL
IF NOT ERRORLEVEL 1 GOTO win

VER|find "Windows 98">NUL
IF NOT ERRORLEVEL 1 GOTO win

VER|find "Windows Millennium">NUL
IF NOT ERRORLEVEL 1 GOTO win

VER|find "Windows 2003">NUL
IF NOT ERRORLEVEL 1 GOTO NT

echo Unsupported Version
goto last

:NT
%systemdrive%
cd %WinDir%\system32
attrib -r -s -h kalv*32.exe
if exist kalv*32.exe del kalv*32.exe
attrib -r -s -h elite*32.exe
if exist elite*32.exe del elite*32.exe
attrib -r -s -h elite*.dat
if exist elite*.dat del elite*.dat
attrib -r -s -h kalv*.dat
if exist kalv*.dat del kalv*.dat
attrib -r -s -h temperror32.dat
if exist temperror32.dat del temperror32.dat

cd %WinDir%
attrib -r -s -h EliteToolbar
if exist EliteToolbar rd /q /s EliteToolbar
attrib -r -s -h EliteSidebar
if exist EliteSidebar rd /q /s EliteSidebar

echo Merging registry....
echo REGEDIT4>clear.reg
echo.>>clear.reg
echo [-HKEY_CURRENT_USER\Software\LQ]>>clear.reg
echo.>>clear.reg
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\ohbbackup]>>clear.reg
echo.>>clear.reg
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Elitum]>>clear.reg
echo.>>clear.reg
echo [-HKEY_USERS\.DEFAULT\Software\LQ]>>clear.reg
echo.>>clear.reg
echo [-
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersi
on\Explorer\Browser Helper Objects\{28CAEFF3-0F18-4036-
B504-51D73BD81ABC}]>>clear.reg
echo.>>clear.reg
echo [-
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersi
on\Explorer\Browser Helper Objects\{ED103D9F-3070-4580-
AB1E-E5C179C1AE41}]>>clear.reg
echo.>>clear.reg
echo [-
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersi
on\Explorer\Browser Helper Objects\{BE8D0059-D24D-4919-
B76F-99F4A2203647}]>>clear.reg
echo.>>clear.reg
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet
Explorer\Toolbar]>>clear.reg
echo "{825CF5BD-8862-4430-B771-0C15C5CA8DEF}"=->>clear.reg
echo.>>clear.reg
echo [-HKEY_CLASSES_ROOT\CLSID\{825CF5BD-8862-4430-B771-
0C15C5CA8DEF}]>>clear.reg
echo.>>clear.reg
echo [-HKEY_CLASSES_ROOT\CLSID\{ED103D9F-3070-4580-AB1E-
E5C179C1AE41}]>>clear.reg
echo.>>clear.reg
echo [-HKEY_CLASSES_ROOT\CLSID\{28CAEFF3-0F18-4036-B504-
51D73BD81ABC}]>>clear.reg
echo.>>clear.reg
echo [-HKEY_CLASSES_ROOT\CLSID\{BE8D0059-D24D-4919-B76F-
99F4A2203647}]>>clear.reg
echo.>>clear.reg
echo
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVers
ion\Run]>>clear.reg
echo "kalvsys"=->>clear.reg
echo "antiware"=->>clear.reg
echo "etbrun"=->>clear.reg
echo "checkrun"=->>clear.reg
echo "farkle-checkrun"=->>clear.reg

regedit /s clear.reg
del clear.reg

goto end

:win
%systemdrive%
cd %WinDir%\system
attrib -r -s -h kalv*32.exe
if exist kalv*32.exe del kalv*32.exe
attrib -r -s -h elite*32.exe
if exist elite*32.exe del elite*32.exe
attrib -r -s -h elite*.dat
if exist elite*.dat del elite*.dat
attrib -r -s -h kalv*.dat
if exist kalv*.dat del kalv*.dat
attrib -r -s -h temperror32.dat
if exist temperror32.dat del temperror32.dat

cd %WinDir%
attrib -r -s -h EliteToolbar
deltree /y EliteToolbar
attrib -r -s -h EliteSidebar
deltree /y EliteSidebar

echo Merging registry....
echo REGEDIT4>clear.reg
echo.>>clear.reg
echo [-HKEY_CURRENT_USER\Software\LQ]>>clear.reg
echo.>>clear.reg
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\ohbbackup]>>clear.reg
echo.>>clear.reg
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Elitum]>>clear.reg
echo.>>clear.reg
echo [-HKEY_USERS\.DEFAULT\Software\LQ]>>clear.reg
echo.>>clear.reg
echo [-
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersi
on\Explorer\Browser Helper Objects\{28CAEFF3-0F18-4036-
B504-51D73BD81ABC}]>>clear.reg
echo.>>clear.reg
echo [-
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersi
on\Explorer\Browser Helper Objects\{ED103D9F-3070-4580-
AB1E-E5C179C1AE41}]>>clear.reg
echo.>>clear.reg
echo [-
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersi
on\Explorer\Browser Helper Objects\{BE8D0059-D24D-4919-
B76F-99F4A2203647}]>>clear.reg
echo.>>clear.reg
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet
Explorer\Toolbar]>>clear.reg
echo "{825CF5BD-8862-4430-B771-0C15C5CA8DEF}"=->>clear.reg
echo.>>clear.reg
echo [-HKEY_CLASSES_ROOT\CLSID\{825CF5BD-8862-4430-B771-
0C15C5CA8DEF}]>>clear.reg
echo.>>clear.reg
echo [-HKEY_CLASSES_ROOT\CLSID\{ED103D9F-3070-4580-AB1E-
E5C179C1AE41}]>>clear.reg
echo.>>clear.reg
echo [-HKEY_CLASSES_ROOT\CLSID\{28CAEFF3-0F18-4036-B504-
51D73BD81ABC}]>>clear.reg
echo.>>clear.reg
echo [-HKEY_CLASSES_ROOT\CLSID\{BE8D0059-D24D-4919-B76F-
99F4A2203647}]>>clear.reg
echo.>>clear.reg
echo
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVers
ion\Run]>>clear.reg
echo "kalvsys"=->>clear.reg
echo "antiware"=->>clear.reg
echo "etbrun"=->>clear.reg
echo "checkrun"=->>clear.reg
echo "farkle-checkrun"=->>clear.reg

regedit /s clear.reg
del clear.reg

goto end

:end

echo Done!!

:last


Of course these batches can also be used for malicious
reasons but I will not give any examples of them but its
possible to write batches that are encrypted to avoid AV
detection and then when run they Kill the AV, login to
ftp server's and download and then run the trojan's but
all the user will see is the uncrypted message so this is
why running unknown batches can be very dangerous

Ive ran out of examples ;) even though these are pretty
basic and not exclusive to Virus writing I hope it gives
a good basic understanding of Batch file writing


Regards Andy
 
Thank You Andy for the posted information. I have
created batch files; Thousands of them mainly using
the "copy con method". Although they were small they
worked very fast. I copied them to select locations and
edited them later in e.exe; Old DOS.

The main file was called Run.bat which resided in the
root directory. Run.bat executed 1.bat. 1.bat ran and
when finished executed 2.bat. 2.bat executed and ran
3.bat and so on.

Autoexec.bat executed the main file Run.bat.

I'm working on a project that maybe usefull later on
for Windows OS by myself and it may be a breakthrough.

I have partitioned my drive Andy and have 2 opposite
OS's on 1 drive. I boot to the Non-Windows OS and open
the drive Windows resides on with something simular to
Explorer.exe.

I'm creating batches and copying them to the Windows
drive from the Non-Windows Boot OS.

The batches will be the only programs running on
the "Idol Drive".

This may prove to be of Value to Microsoft Corp. AND
ALL because of the accumulated problem files Windows is
subject to on a daily basis.

If this sounds like something that you maybe
interested in, let me know.

Thank You Andy.
 
Hi Again

Sorry about that I didnt realize so hope my post didnt
sound condescending at all, Im sure it may help other's
though who are just starting out. I thought explaining
the basics would be a good start then the rest is mainly
trial and error and mostly just running tests, I do all
my testing of batches on a virtual machine incase I make
mistakes then move on to my other system when Im sure
they perform the right way.It sounds though like you
could teach me a few tricks ;)

I do not represent Microsoft in anyway, Im not a MVP just
a helper on here and some other sites so I think you
would be best explaining your idea's to Bill Sanderson
and other MVP's on here as they will be able to help you
out more than I can if they feel its something MS could
benefit from.

I only write Batches to remove malware so have a one
sided view of things so although I've tried to give alot
of examples in my last post its not something I normally
do myself except for the two final batches one to search
the registry and output to notepad and the batch for
elitebar

I think you should polish up the batches so you know
exactly what they can do and how they can perform better
than any of the existant methods then maybe repost on
here as a new topic and get some feedback from the MVP's
on this. Im sure if they can help you they will,

Regards Andy
 
Back
Top