[EDITED By NTDOC to remove long lines]
UPDATED WEEKLY SCAN SCRIPT!!!!!!!!!!!
Code:
:start
$nul = ""
$PCNAME = @WKSTA
$NTEventSource = "KiXtart"
$SpybotExists = EXIST("%PROGRAMFILES%\Spybot - Search & Destroy\spybotsd.exe")
$SpybotVer = GetFileVersion("%PROGRAMFILES%\Spybot - Search & Destroy\spybotsd.exe", "ProductVersion")
$install = "Spybot\spybotsd14.exe /verysilent /noicons"
COPY ".\PSKILL.EXE" "C:\"
$process = 'teatimer','180ax','a','actalert','adaware','alchem','alevir','aqadcup','arr','arupdate','asm','av',+
'avserve','avserve2','autoupdate','backweb','bargains','basfipm','belt','biprep','blss','bokja','bootconf','bpc',+
'brasil','bridge','bugsfix','bundle','bvt','cashback','cfd','cmd32','CMEsys','CMEupd','conime','conscorr',+
'datemanager','dcomx','directs','divx','dllreg','dmserver','dpi','dpps2','dssagent','dvdkeyauth','ebatesmoemoneymaker',+
'emsw','exdl','exec','explore','explored','fash','fntldr','fs_4104','fvprotect','game','gator','GMT','goidr','hbinst',+
'hbsrv','hxdl','hxiul','iedll','iedriver','iehost','iexplorer','infus','infwin','intdel','intdel_2','isass',+
'istsvc','jawa32','jdbgmrg','kazza','keenvalue','kernel32','lass','launcher','loader','lssas','mapisvc32',+
'mario','md','mfin32','mmod','mostat','msapp','msbb','msblast','mscache','msccn32','mscman','msdm','msgfix',+
'msiexec16','msinfo','mslagent','mslaugh','msmc','msmgt','msmsgri32','msn','msrexe','mssvc32','mssys','msvxd',+
'mwsoemon','mwsvm','netd32','nls','nssys32','nstask32','nsupdate','omniscient','onsrvr','optimize','p2p',+
'networking','patch','pcsvc','pgmonitr','pib','powerscan','Precisiontime','precpop2','prizesurfer','prmt',+
'prmvr','ray','rb32','rcsync','run32dll','rundll','rundll16','ruxdll32','saap','sahagent','sais','save',+
'savenow','sc','scam32','scrsvr','scvhost','searchupgrader','service','showbehind','slmss','soap','spoler',+
'spoolsvv','spyhunter','srng','start','stcloader','support','svc','svchosts','svshost','sync','system',+
'system32','tb_setup','teekids','trickler','tsadbot','tvm','tvmd','tvtmd','update','updatestats','updmgr',+
'uptodate','viewmgr','virtualbouncer','vvsn','wast','weather','web','webdav','webrebates','webrebates0',+
'win_upd2','win32','win32us','winactive'winad','winadtools','win-bugsfix','windirect','windows','wingo',+
'wininetd','wininit','winlock','winlogin','winmain','winnet','winppr32','winratchet'winservn','winssk32',+
'winstart','winstart001','wintime','wintsk32','winupdate','winxp','wjview'wmon32','wnad','wo','wovax','wsup',+
'wtoolsa','wtoolss','wuamgrd','wupdate','wupdater','wupdmgr','wupdt','y','ytrckrbr'
For each $proc in $process
SHELL "C:\pskill $proc.exe" ;Kills a long list of the most common malware processes if they are running!
Next
DEL "c:\pskill.exe"
SELECT
CASE $SpybotExists = 1 and $SpybotVer >= "1, 4" ;If Spybot 1.4 is already installed rename the old fixes log
IF EXIST("%ALLUSERSPROFILE%\Application Data\Spybot - Search & Destroy\logs\fixe*.txt")
MOVE "%ALLUSERSPROFILE%\Application Data\Spybot - Search & Destroy\logs\fixe*.txt"
"%ALLUSERSPROFILE%\Application Data\Spybot - Search & Destroy\logs\fixe*.old"
ENDIF
CASE $SpybotExists = 1 and $SpybotVer >= "1, 3"
SHELL $install ;Run Spybot 1.4 install silently and do not create shortcut icons!
IF @ERROR <> 0
$err = @ERROR
$serr = @SERROR
OPEN (1, ".\Spybot\Spybot14_failed.log", 5)
WRITELINE (1, @DATE + " " + @TIME + " Spybot v1.4 failed to install on " + $PCNAME +
" with error code " + $err + " " + $serr + @CRLF)
CLOSE(1)
ENDIF
CASE $SpybotExists = 1 and $SpybotVer < "1, 3"
OPEN (1, ".\Spybot\Spybot_OldVer.log", 5)
WRITELINE (1, @DATE + " " + @TIME + " An older version of Spybot is installed on " + $PCNAME + @CRLF)
CLOSE(1)
exit
CASE other
SHELL $install ;Run Spybot 1.4 install silently and do not create shortcut icons!
IF @ERROR <> 0
$err = @ERROR
$serr = @SERROR
OPEN (1, ".\Spybot\Spybot14_failed.log", 5)
WRITELINE (1, @DATE + " " + @TIME + " Spybot v1.4 failed to install on " + $PCNAME +
" with error code " + $err + " " + $serr + @CRLF)
CLOSE(1)
ENDIF
ENDSELECT
MD "%ALLUSERSPROFILE%\Application Data\Spybot - Search & Destroy\logs"
;Logs directory must be created manually for silent installs. Normally this directory is created when Spybot
;is ran and an update is done from within the program!
COPY ".\Spybot\SPYBOT\Excludes\*.*" "%ALLUSERSPROFILE%\Application Data\Spybot - Search & Destroy\Excludes" /c /h /r /s
;Copy exclude files to prevent Spybot from removing some needed Apropos entries!
COPY ".\Spybot\SPYBOT\config\configuration.ini" "%ALLUSERSPROFILE%\Application Data\Spybot - Search & Destroy" /c /h /r /s
;Copy the config file to set running priority!
SHELL "C:\Program Files\Spybot - Search & Destroy\spybotsd.exe /taskbarhide /autoupdate /autoclose"
;Run a silent autoupdate and then close the program!
IF @ERROR <> 0
$err = @ERROR
$serr = @SERROR
OPEN (1, ".\Spybot\Spybot14_UpdateFail.log", 5)
WRITELINE (1, @DATE + " " + @TIME + " Spybot v1.4 failed to update definitions on " + $PCNAME +
" with error code " + $err + " " + $serr + @CRLF)
CLOSE(1)
ENDIF
SHELL "C:\Program Files\Spybot - Search & Destroy\spybotsd.exe /taskbarhide /autocheck /autofix /autoclose"
;Run a silent check, fix any problems found and then close the program!
IF @ERROR <> 0
$err = @ERROR
$serr = @SERROR
OPEN (1, ".\Spybot\Spybot14_UpdateFail.log", 5)
WRITELINE (1, @DATE + " " + @TIME + " Spybot v1.4 failed to update definitions on " + $PCNAME +
" with error code " + $err + " " + $serr + @CRLF)
CLOSE(1)
ELSE
$RunOnce = DelValue("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce", "SpybotSnD")
;remove the value to run Spybot at next reboot one time because most of the users in the domain do
;not have local admin priv.
$Filename = Dir("%AllUSERSPROFILE%\Application Data\Spybot - Search & Destroy\logs\Fixes*.txt")
;set variable for the fix log.
COPY "%AllUSERSPROFILE%\Application Data\Spybot - Search & Destroy\logs\$Filename"
".\Spybot\Weekly\@WKSTA_@YDAYNO.log"
;Copy the fixes log to smslogs weekly folder.
LOGEVENT( 4 , 1001 , "Spybot has scanned and removed spyware on this computer!" , "$PCNAME", "$NTEventSource")
;Log an event in the application log.
OPEN (1, ".\Spybot\Spybot14_Scan.log", 5)
WRITELINE (1, @DATE + " " + @TIME + " Spybot 1.4 has scanned and fixed spyware on " +
$PCNAME + chr(13) + chr(10))
CLOSE(1)
ENDIF
:end
Exit
Server paths' removed for obvious reasons......