;Package script for SDO
;Created by
;11/12/03
;
;Spybot Search & Destroy v1.3 SCAN ONLY!
;
;**WARNING** - This is a silent script! Spybot will automatically scan and remove any 
;detected spyware/adware ;without asking for confirmation! Do NOT use this script unless 
;you are ok with Spybot removing all entries ;without confirmation from the user. 
;
;MODIFIED - 12/9/03 - Added section to verify version of Spybot, check if fixes existed 
;previously move them ;to old folder, kill common spyware processes, delete runonce 
;value so Spybot will not start at boot, and ;verify that Spybot created a fixes log
; after scan.
;
;MODIFIED - 1/13/04 - Added line to Spybot scan section to copy tools.dll to Spybot 
;programs folder.
;
;MODIFIED - 1/16/04 - Added a butt-load of processes to kill before running a scan.
;
;MODIFIED - 11/22/04 - Updated list of processes to kill before scan
;
;MODIFIED - 4/7/05 - Added COPY command to copy exclude list to local system due 
;to a problem with Spybot deleting ;HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\
;{2093C8E0-3811-11D0-A6BE-0040052A64D9} from the registry and causing ;ViewNow to 
;try and repair itself on RMD systems.


:start

$nul = ""
$PCNAME = @WKSTA
$NTEventSource = "KiXtart"
$SpybotExists = EXIST("C:\Program Files\Spybot - Search & Destroy\spybotsd.exe")
$SpybotVer = GetFileVersion("C:\Program Files\Spybot - Search & Destroy\spybotsd.exe",
 "FileVersion")
 
  goto "SpybotExists"

;***************************************************************************
;****************
;Check to see if Spybot is already installed!
;**************************************************************************
;*****************

:SpybotExists

IF $SpybotExists = 1
	goto "CheckVer"
else
	goto "report2"

Endif

;*************************************************************************
;******************
;Check to see if Spybot is version 1.3 or greater!
;*************************************************************************
;******************

:CheckVer

IF $SpybotVer >= "1, 3, 0, 12"
	goto "OldFixes"
    else
	goto "report3"

;*************************************************************************
;******************
;If Spybot existed previously move the old fix logs to a folder named Old!
;************************************************************************
;*******************

:OldFixes

IF EXIST("%ALLUSERSPROFILE%\Application Data\Spybot - Search & Destroy\logs\fixe*.txt")
	MOVE "%ALLUSERSPROFILE%\Application Data\Spybot - Search & Destroy\logs
	\fixe*.txt" "%ALLUSERSPROFILE%\Application Data\Spybot - Search & 
	Destroy\logs\fixe*.old"
	goto "SpybotScan"
    else
	goto "SpybotScan"

;***************************************************************************
;***************
;Run an autoupdate to download the latest detections.
;**************************************************************************
;****************

:SpybotScan

MD "%ALLUSERSPROFILE%\Application Data\Spybot - Search & Destroy\logs"
COPY "\\\Spybot\SPYBOT\Excludes\*.*" "%ALLUSERSPROFILE%\Application Data\
Spybot - Search & Destroy\Excludes" /c /h /r /s

;$mbox = Messagebox ("		    !!!!!WEEKLY SPYWARE SCAN NOTIFICATION!!!!!
;
;	- Spybot will begin scanning for known spyware and adware in 10 minutes.
;	- Click the OK button to start the scan immediately.
;	- There is no need to reboot after the scan.
;	- If you have any issues or concerns please contact the.
;	- We apologize for any inconvenience this may cause.
;
;				 Thank You,
;				 , "WEEKLY SPYBOT SCAN!!!!", 4096, 600)
				 
SHELL "C:\Program Files\Spybot - Search & Destroy\spybotsd.exe /taskbarhide 
/autoupdate /autoclose"


;***************************************************************************
;***************
;Kill some of the most common spyware/adware processes so that they can be 
;"fixed" without a reboot and then ;run a silent check on the system and 
;remove anything Spybot finds.  The default configuration.ini file(copied 
;to local pc above) is set to Confirmation=0 which tells Spybot not to prompt 
;the user to removed selected ;items after a scan.  In this same file the 
;Legals= option has been set to 1 so that Spybot will not prompt the ;user 
;with a legal notice the first time the program runs.
;*************************************************************************
;*****************

COPY ".\PSKILL.EXE" "C:\"
SHELL "c:\PSKILL.EXE 180ax.exe"
SHELL "c:\PSKILL.EXE a.exe"
SHELL "c:\PSKILL.EXE actalert.exe"
SHELL "c:\PSKILL.EXE adaware.exe"
SHELL "c:\PSKILL.EXE alchem.exe"
SHELL "c:\PSKILL.EXE alevir.exe"
SHELL "c:\PSKILL.EXE aqadcup.exe"
SHELL "c:\PSKILL.EXE arr.exe"
SHELL "c:\PSKILL.EXE arupdate.exe"
SHELL "c:\PSKILL.EXE asm.exe"
SHELL "c:\PSKILL.EXE av.exe"
SHELL "c:\PSKILL.EXE avserve.exe"
SHELL "c:\PSKILL.EXE avserve2.exe"
SHELL "c:\PSKILL.EXE autoupdate.exe"
SHELL "c:\PSKILL.EXE backweb.exe"
SHELL "c:\PSKILL.EXE bargains.exe"
SHELL "c:\PSKILL.EXE basfipm.exe"
SHELL "c:\PSKILL.EXE belt.exe"
SHELL "c:\PSKILL.EXE biprep.exe"
SHELL "c:\PSKILL.EXE blss.exe"
SHELL "c:\PSKILL.EXE bokja.exe"
SHELL "c:\PSKILL.EXE bootconf.exe"
SHELL "c:\PSKILL.EXE bpc.exe"
SHELL "c:\PSKILL.EXE brasil.exe"
SHELL "c:\PSKILL.EXE bridge.dll"
SHELL "c:\PSKILL.EXE bugsfix.exe"
SHELL "c:\PSKILL.EXE bundle.exe"
SHELL "c:\PSKILL.EXE bvt.exe"
SHELL "c:\PSKILL.EXE cashback.exe"
SHELL "c:\PSKILL.EXE cfd.exe"
SHELL "c:\PSKILL.EXE cmd32.exe"
SHELL "c:\PSKILL.EXE CMEsys.exe"
SHELL "c:\PSKILL.EXE CMEupd.exe"
SHELL "c:\PSKILL.EXE conime.exe"
SHELL "c:\PSKILL.EXE conscorr.exe"
SHELL "c:\PSKILL.EXE datemanager.exe"
SHELL "c:\PSKILL.EXE dcomx.exe"
SHELL "c:\PSKILL.EXE directs.exe"
SHELL "c:\PSKILL.EXE divx.exe"
SHELL "c:\PSKILL.EXE dllreg.exe"
SHELL "c:\PSKILL.EXE dmserver.exe"
SHELL "c:\PSKILL.EXE dpi.exe"
SHELL "c:\PSKILL.EXE dpps2.exe"
SHELL "c:\PSKILL.EXE dssagent.exe"
SHELL "c:\PSKILL.EXE dvdkeyauth.exe"
SHELL "c:\PSKILL.EXE ebatesmoemoneymaker.exe"
SHELL "c:\PSKILL.EXE emsw.exe"
SHELL "c:\PSKILL.EXE exdl.exe"
SHELL "c:\PSKILL.EXE exec.exe"
SHELL "c:\PSKILL.EXE explore.exe"
SHELL "c:\PSKILL.EXE explored.exe"
SHELL "c:\PSKILL.EXE fash.exe"
SHELL "c:\PSKILL.EXE fntldr.exe"
SHELL "c:\PSKILL.EXE fs_4104.exe"
SHELL "c:\PSKILL.EXE fvprotect.exe"
SHELL "c:\PSKILL.EXE game.exe"
SHELL "c:\PSKILL.EXE gator.exe"
SHELL "c:\PSKILL.EXE GMT.exe"
SHELL "c:\PSKILL.EXE goidr.exe"
SHELL "c:\PSKILL.EXE hbinst.exe"
SHELL "c:\PSKILL.EXE hbsrv.exe"
SHELL "c:\PSKILL.EXE hxdl.exe"
SHELL "c:\PSKILL.EXE hxiul.exe"
SHELL "c:\PSKILL.EXE iedll.exe"
SHELL "c:\PSKILL.EXE iedriver.exe"
SHELL "c:\PSKILL.EXE iehost.exe"
SHELL "c:\PSKILL.EXE iexplorer.exe"
SHELL "c:\PSKILL.EXE infus.exe"
SHELL "c:\PSKILL.EXE infwin.exe"
SHELL "c:\PSKILL.EXE intdel.exe"
SHELL "c:\PSKILL.EXE intdel_2.exe"
SHELL "c:\PSKILL.EXE isass.exe"
SHELL "c:\PSKILL.EXE istsvc.exe"
SHELL "c:\PSKILL.EXE jawa32.exe"
SHELL "c:\PSKILL.EXE jdbgmrg.exe"
SHELL "c:\PSKILL.EXE kazza.exe"
SHELL "c:\PSKILL.EXE keenvalue.exe"
SHELL "c:\PSKILL.EXE kernel32.exe"
SHELL "c:\PSKILL.EXE lass.exe"
SHELL "c:\PSKILL.EXE launcher.exe"
SHELL "c:\PSKILL.EXE loader.exe"
SHELL "c:\PSKILL.EXE lssas.exe"
SHELL "c:\PSKILL.EXE mapisvc32.exe"
SHELL "c:\PSKILL.EXE mario.exe"
SHELL "c:\PSKILL.EXE md.exe"
SHELL "c:\PSKILL.EXE mfin32.exe"
SHELL "c:\PSKILL.EXE mmod.exe"
SHELL "c:\PSKILL.EXE mostat.exe"
SHELL "c:\PSKILL.EXE msapp.exe"
SHELL "c:\PSKILL.EXE msbb.exe"
SHELL "c:\PSKILL.EXE msblast.exe"
SHELL "c:\PSKILL.EXE mscache.exe"
SHELL "c:\PSKILL.EXE msccn32.exe"
SHELL "c:\PSKILL.EXE mscman.exe"
SHELL "c:\PSKILL.EXE msdm.exe"
SHELL "c:\PSKILL.EXE msgfix.exe"
SHELL "c:\PSKILL.EXE msiexec16.exe"
SHELL "c:\PSKILL.EXE msinfo.exe"
SHELL "c:\PSKILL.EXE mslagent.exe"
SHELL "c:\PSKILL.EXE mslaugh.exe"
SHELL "c:\PSKILL.EXE msmc.exe"
SHELL "c:\PSKILL.EXE msmgt.exe"
SHELL "c:\PSKILL.EXE msmsgri32.exe"
SHELL "c:\PSKILL.EXE msn.exe"
SHELL "c:\PSKILL.EXE msrexe.exe"
SHELL "c:\PSKILL.EXE mssvc32.exe"
SHELL "c:\PSKILL.EXE mssys.exe"
SHELL "c:\PSKILL.EXE msvxd.exe"
SHELL "c:\PSKILL.EXE mwsoemon.exe"
SHELL "c:\PSKILL.EXE mwsvm.exe"
SHELL "c:\PSKILL.EXE netd32.exe"
SHELL "c:\PSKILL.EXE nls.exe"
SHELL "c:\PSKILL.EXE nssys32.exe"
SHELL "c:\PSKILL.EXE nstask32.exe"
SHELL "c:\PSKILL.EXE nsupdate.exe"
SHELL "c:\PSKILL.EXE omniscient.exe"
SHELL "c:\PSKILL.EXE onsrvr.exe"
SHELL "c:\PSKILL.EXE optimize.exe"
SHELL "c:\PSKILL.EXE p2p networking.exe"
SHELL "c:\PSKILL.EXE patch.exe"
SHELL "c:\PSKILL.EXE pcsvc.exe"
SHELL "c:\PSKILL.EXE pgmonitr.exe"
SHELL "c:\PSKILL.EXE pib.exe"
SHELL "c:\PSKILL.EXE powerscan.exe"
SHELL "c:\PSKILL.EXE Precisiontime.exe"
SHELL "c:\PSKILL.EXE precpop2.exe"
SHELL "c:\PSKILL.EXE prizesurfer.exe"
SHELL "c:\PSKILL.EXE prmt.exe"
SHELL "c:\PSKILL.EXE prmvr.exe"
SHELL "c:\PSKILL.EXE ray.exe"
SHELL "c:\PSKILL.EXE rb32.exe"
SHELL "c:\PSKILL.EXE rcsync.exe"
SHELL "c:\PSKILL.EXE run32dll.exe"
SHELL "c:\PSKILL.EXE rundll.exe"
SHELL "c:\PSKILL.EXE rundll16.exe"
SHELL "c:\PSKILL.EXE ruxdll32.exe"
SHELL "c:\PSKILL.EXE saap.exe"
SHELL "c:\PSKILL.EXE sahagent.exe"
SHELL "c:\PSKILL.EXE sais.exe"
SHELL "c:\PSKILL.EXE save.exe"
SHELL "c:\PSKILL.EXE savenow.exe"
SHELL "c:\PSKILL.EXE sc.exe"
SHELL "c:\PSKILL.EXE scam32.exe"
SHELL "c:\PSKILL.EXE scrsvr.exe"
SHELL "c:\PSKILL.EXE scvhost.exe"
SHELL "c:\PSKILL.EXE searchupgrader.exe"
SHELL "c:\PSKILL.EXE service.exe"
SHELL "c:\PSKILL.EXE showbehind.exe"
SHELL "c:\PSKILL.EXE slmss.exe"
SHELL "c:\PSKILL.EXE soap.exe"
SHELL "c:\PSKILL.EXE spoler.exe"
SHELL "c:\PSKILL.EXE spoolsvv.exe"
SHELL "c:\PSKILL.EXE spyhunter.exe"
SHELL "c:\PSKILL.EXE srng.exe"
SHELL "c:\PSKILL.EXE start.exe"
SHELL "c:\PSKILL.EXE stcloader.exe"
SHELL "c:\PSKILL.EXE support.exe"
SHELL "c:\PSKILL.EXE svc.exe"
SHELL "c:\PSKILL.EXE svchosts.exe"
SHELL "c:\PSKILL.EXE svshost.exe"
SHELL "c:\PSKILL.EXE sync.exe"
SHELL "c:\PSKILL.EXE system.exe"
SHELL "c:\PSKILL.EXE system32.exe"
SHELL "c:\PSKILL.EXE tb_setup.exe"
SHELL "c:\PSKILL.EXE teekids.exe"
SHELL "c:\PSKILL.EXE trickler.exe"
SHELL "c:\PSKILL.EXE tsadbot.exe"
SHELL "c:\PSKILL.EXE tvm.exe"
SHELL "c:\PSKILL.EXE tvmd.exe"
SHELL "c:\PSKILL.EXE tvtmd.exe"
SHELL "c:\PSKILL.EXE update.exe"
SHELL "c:\PSKILL.EXE updatestats.exe"
SHELL "c:\PSKILL.EXE updmgr.exe"
SHELL "c:\PSKILL.EXE uptodate.exe"
SHELL "c:\PSKILL.EXE viewmgr.exe"
SHELL "c:\PSKILL.EXE virtualbouncer.exe"
SHELL "c:\PSKILL.EXE vvsn.exe"
SHELL "c:\PSKILL.EXE wast.exe"
SHELL "c:\PSKILL.EXE weather.exe"
SHELL "c:\PSKILL.EXE web.exe"
SHELL "c:\PSKILL.EXE webdav.exe"
SHELL "c:\PSKILL.EXE webrebates.exe"
SHELL "c:\PSKILL.EXE webrebates0.exe"
SHELL "c:\PSKILL.EXE win_upd2.exe"
SHELL "c:\PSKILL.EXE win32.exe"
SHELL "c:\PSKILL.EXE win32us.exe"
SHELL "c:\PSKILL.EXE winactive.exe"
SHELL "c:\PSKILL.EXE winad.exe"
SHELL "c:\PSKILL.EXE winadtools.exe"
SHELL "c:\PSKILL.EXE win-bugsfix.exe"
SHELL "c:\PSKILL.EXE windirect.exe"
SHELL "c:\PSKILL.EXE windows.exe"
SHELL "c:\PSKILL.EXE wingo.exe"
SHELL "c:\PSKILL.EXE wininetd.exe"
SHELL "c:\PSKILL.EXE wininit.exe"
SHELL "c:\PSKILL.EXE winlock.exe"
SHELL "c:\PSKILL.EXE winlogin.exe"
SHELL "c:\PSKILL.EXE winmain.exe"
SHELL "c:\PSKILL.EXE winnet.exe"
SHELL "c:\PSKILL.EXE winppr32.exe"
SHELL "c:\PSKILL.EXE winratchet.exe"
SHELL "c:\PSKILL.EXE winservn.exe"
SHELL "c:\PSKILL.EXE winssk32.exe"
SHELL "c:\PSKILL.EXE winstart.exe"
SHELL "c:\PSKILL.EXE winstart001.exe"
SHELL "c:\PSKILL.EXE wintime.exe"
SHELL "c:\PSKILL.EXE wintsk32.exe"
SHELL "c:\PSKILL.EXE winupdate.exe"
SHELL "c:\PSKILL.EXE winxp.exe"
SHELL "c:\PSKILL.EXE wjview.exe"
SHELL "c:\PSKILL.EXE wmon32.exe"
SHELL "c:\PSKILL.EXE wnad.exe"
SHELL "c:\PSKILL.EXE wo.exe"
SHELL "c:\PSKILL.EXE wovax.exe"
SHELL "c:\PSKILL.EXE wsup.exe"
SHELL "c:\PSKILL.EXE wtoolsa.exe"
SHELL "c:\PSKILL.EXE wtoolss.exe"
SHELL "c:\PSKILL.EXE wuamgrd.exe"
SHELL "c:\PSKILL.EXE wupdate.exe"
SHELL "c:\PSKILL.EXE wupdater.exe"
SHELL "c:\PSKILL.EXE wupdmgr.exe"
SHELL "c:\PSKILL.EXE wupdt.exe"
SHELL "c:\PSKILL.EXE y.exe"
SHELL "c:\PSKILL.EXE ytrckrbr.exe"
DEL "c:\pskill.exe"

SHELL "C:\Program Files\Spybot - Search & Destroy\spybotsd.exe /taskbarhide
 /autocheck /autofix /autoclose"

;Below I remove the value to run Spybot at next reboot one time because
; most of the users in the domain do not ;have local admin priv.

$RunOnce = DelValue("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\RunOnce", "SpybotSnD")
	goto "VerifyFix"

;Verify that Spybot actually fixed the Spyware that was found on 
;the local computer.  If so log an event to the ;Application log.

:VerifyFix

$Filename = Dir("%AllUSERSPROFILE%\Application Data\
Spybot - Search & Destroy\logs\Fixes*.txt")
COPY "%AllUSERSPROFILE%\Application Data\Spybot - 
Search & Destroy\logs\$Filename" "\\\spybot13\Weekly\@WKSTA_@YDAYNO.log"

LOGEVENT( 4 , 1001 , "Spybot has scanned and removed spyware on this computer!" 
, "$PCNAME", "$NTEventSource")
    goto "report"
Endif


;**********************************************************************
;**********************
;Write Reports
;*********************************************************************
;***********************

:report
OPEN (1, "\\\Spybot13\Spybotscan.log", 5)
WRITELINE (1, @DATE + " " + @TIME + " Spybot has scanned and fixed 
spyware on " + $PCNAME + chr(13) + chr(10))
goto "end"

:report2
OPEN (1, "\\\Spybot13\Spybotnotinstalled.log", 5)
WRITELINE (1, @DATE + " " + @TIME + " Spybot is not installed on " 
+ $PCNAME + chr(13) + chr(10))
goto "end"

:report3
OPEN (1, "\\\Spybot13\Spybotv13notinst.log", 5)
WRITELINE (1, @DATE + " " + @TIME + " An older version of Spybot is 
installed on " + $PCNAME + chr(13) + chr(10))
goto "end"

:report4
OPEN (1, "\\\Spybot13\Spybotnofix.log", 5)
WRITELINE (1, @DATE + " " + @TIME + " Spybot scanned and did not find 
any problems on " + $PCNAME + chr(13) + chr(10))

:end
Exit