--------------------------------------------------------------------
' Script VBS d'éradication de GATOR (spyware installé avec DivX V5)
'
' JC BELLAMY © 2002
' --------------------------------------------------------------------
Const  HKEY_CLASSES_ROOT  = &H80000000  
Const  HKEY_CURRENT_USER  = &H80000001  
Const  HKEY_LOCAL_MACHINE = &H80000002  
Const  HKEY_USERS         = &H80000003  
Const  SW_SHOWNORMAL=1  
 
Dim net, shell, user, computer, args, fso, objRegistry
Dim StdIn, StdOut
Set StdIn  = WScript.StdIn
Set StdOut = WScript.StdOut
Set net    = Wscript.CreateObject("WScript.Network" )
Set shell  = WScript.CreateObject("WScript.Shell" )
Set fso    = WScript.CreateObject("Scripting.FileSystemObject" )
Set args   = Wscript.Arguments
Set objRegistry = GetObject("winmgmts:root\default:StdRegProv" )
 
TestHost
'
message=          "Eradication du spyware GATOR"  & VBCRLF
message=message & "JCB © 2002"  & VBCRLF
message=message & "----------------------------" & VBCRLF
message=message & "Ce script va détecter l'existence de GATOR" & VBCRLF
message=message & "et le désinstaller le cas échéant" & VBCRLF
wscript.echo message
StdOut.Write "Voulez-vous continuer (O/N) ? : "
rep = StdIn.ReadLine
If len(rep)=0 then rep="N"
rep=ucase(left(rep,1))
If (rep<>"O" ) and (rep<>"Y" ) Then WScript.Quit
 
message=""
 
' Test d'existence du processus initial de Gator
On Error Resume Next
trickler=shell.RegRead("HKEY_LOCAL_MACHINE\software\Gator.com\Trickler\AppPath" )
If Err.Number=0 Then
 p=InstrRev(trickler,"\" )
 ProcessName=mid(trickler,p+1)
 KillProcess ProcessName
 DelFile trickler
 end if
 
KillProcess "GMT.exe"
KillProcess "CMESys.exe"
 
delkey HKEY_CLASSES_ROOT,  "clsid\{21ffb6c0-0da1-11d5-a9d5-00500413153c}\"
delkey HKEY_LOCAL_MACHINE, "software\Gator.com\"
delkey HKEY_LOCAL_MACHINE, "software\GatorTest\"
delkey HKEY_LOCAL_MACHINE, "software\microsoft\windows\currentversion\stashedgef"
delkey HKEY_LOCAL_MACHINE, "software\microsoft\windows\currentversion\stashedgmg"
delkey HKEY_LOCAL_MACHINE, "software\microsoft\windows\currentversion\ru
n\cmesys"
 
dir1=shell.ExpandEnvironmentStrings("%ALLUSERSPRO
FILE%" )
dir2=shell.ExpandEnvironmentStrings("%USERPROFILE
%" )
GatorFolder="GAIN"
 
trouve=false
explore dir1
trouve=false
explore dir2
If not trouve Then AddMessage "Dossier de démarrage de GATOR non trouvé"
 
DelFolder shell.ExpandEnvironmentStrings("%TEMP%" ) & "\fsg_tmp"
DelFolder shell.ExpandEnvironmentStrings("%CommonProgramFiles%" ) & "\CMEII"
DelFolder shell.ExpandEnvironmentStrings("%CommonProgramFiles%" ) & "\GMT"
 
DelFile shell.ExpandEnvironmentStrings("%windir%" ) & "\GatorPatch.log"
DelFile shell.ExpandEnvironmentStrings("%windir%" ) & "\GatorPdpSetup.log"
 
AddMessage VBCRLF & "*** GATOR éradiqué ***"
wscript.echo Message
 
Wscript.quit
'------------------------------------------------
----------------------
Sub DelKey(hive,key)
KeyName=HiveName(hive) & key
Dim lRC
lRC = objRegistry.DeleteKey(Hive,key)
If lRC<>0 Then lRC=DelAllSubkey(hive,key)
If lRC<>0 Then
 AddMessage "Clef non trouvée ou impossible à supprimer :" & VBCRLF & "  " & KeyName  
else
 AddMessage "Clef supprimée :" & VBCRLF & "  " & KeyName
 End If
end sub
' -------------------------------------
Function DelAllSubkey(hive,key)
Dim lRC,sNames
On Error Resume Next
lRC = objRegistry.EnumKey(hive,key,sNames)
For Each sKeyName In sNames
 If Err.Number <> 0 Then Exit For
 lRC = DelAllSubkey(hive,key & "\" & sKeyName)
 Next
On Error Goto 0
DelAllSubkey=objRegistry.DeleteKey(Hive,key)
End Function
'----------------------------------------------------------------------
Sub DelFile(filespec)
On Error Resume Next
if fso.FileExists(filespec) then  
 fso.DeleteFile filespec,true
 If Err.Number<>0 Then
  AddMessage Err.description & " dans la suppression du fichier" & vbcrlf & "  " & filespec
 else
  AddMessage "Fichier supprimé : " & vbcrlf & "  " & filespec
  end if
else
 AddMessage "Fichier " & filespec & " inexistant"
 end if
end sub
'----------------------------------------------------------------------
Function HiveName(hive)
Select Case hive
 Case HKEY_CLASSES_ROOT  
  HiveName="HKEY_CLASSES_ROOT\"
 Case HKEY_CURRENT_USER
  HiveName="HKEY_CURRENT_USER\"
 Case HKEY_LOCAL_MACHINE
  HiveName="HKEY_LOCAL_MACHINE\"
 Case HKEY_USERS
  HiveName="HKEY_USERS\"
 Case else
  HiveName="?\"
 End Select
End Function
'----------------------------------------------------------------------
Sub DelFolder(folderspec)
Dim fd,collf
if fso.FolderExists(folderspec) then  
 On Error Resume Next
 fso.DeleteFolder folderspec,true  
 If err.Number<>0 Then
  AddMessage Err.description & " dans la suppression du dossier" & vbcrlf & "  " & folderspec
 else
  AddMessage "Dossier supprimé : " & vbcrlf & "  " & folderspec
  end if
 On error Goto 0    
else
 AddMessage "Dossier " & folderspec & " inexistant"
 end if
end sub
'----------------------------------------------------------------------
Sub Explore(dir)  
If trouve then exit sub
dim f, collf, subf
set f=fso.getfolder(dir)
If ucase(f.name)=ucase(GatorFolder) Then  
 trouve=true
 DelFolder f.path
Else
 set collf=f.SubFolders  
 For each subf in collf
  Explore subf.path
  Next
 End If
End Sub
'----------------------------------------------------------------------
Sub AddMessage(msg)  
Message=Message & VBCRLF & msg
End Sub
'----------------------------------------------------------------------
Sub KillProcess(ProcessName)
On Error Resume Next
Dim ProcessSet, Process
Set ProcessSet=GetObject("winmgmts:{impersonationLevel=impersonate}" ).InstancesOf _
 ("Win32_process" )
for each Process in ProcessSet
 If ucase(Process.Name)=uCase(ProcessName) Then
  result=Process.terminate(0)
  If result<>0 Then  
   AddMessage "Erreur terminaison processus " & ProcessName & " code " & result
  Else
   AddMessage "Processus " & ProcessName & " correctement terminé"
   End if
  End If
 Next
End Sub
'----------------------------------------------------------------------
'Sous-programme de test du moteur
'Vu les sorties générées, c'est CSCRIPT (et non pas WSCRIPT)
'qui doit être utilisé de préférence
Sub TestHost
dim rep
strappli=lcase(Wscript.ScriptFullName)
strFullName =lcase(WScript.FullName)
i=InStr(1,strFullName,".exe",1)
j=InStrRev(strFullName,"\",i,1)
strCommand=Mid(strFullName,j+1,i-j-1)
if strCommand<>"cscript" then
 rep=MsgBox( _
 "Ce script doit être lancé avec CSCRIPT" & VBCRLF & _  
 "Cela peut être rendu permanent avec la commande" & VBCRLF & _
 "cscript //H:CScript //S /Nologo" & VBCRLF & _
 "Voulez-vous que ce soit fait automatiquement?", _
 vbYesNo + vbQuestion,strappli)
 if rep=vbYes  then  
  nomcmd="setscript.bat"
  Set ficcmd = fso.CreateTextFile(nomcmd)
  ficcmd.writeline "@echo off"
  ficcmd.writeline "cscript //H:CScript //S /Nologo"
  ficcmd.writeline "pause"
  ficcmd.writeline strappli
  ficcmd.writeline "pause"
  ficcmd.close
  shell.Run nomcmd, SW_SHOWNORMAL,true
  end if
    WScript.Quit
 end if
end sub
'--------------------------------------------------------------------