Voila le résultat des test
SauvegardeBDR
Code : Sélectionner tout - Visualiser dans une fenêtre à part
1
2
3
4
5
6
7
8
9
10
11 @echo off Title Sauvegarde de quelques clés de la base de registre Set RunMachine=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Set RunUser=HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Reg export %RunMachine% SauvegardeRunMachine1.reg Pause Start Notepad SauvegardeRunMachine1.reg Pause Reg export %RunUser% SauvegardeRunUser1.reg Pause Start Notepad SauvegardeRunUser1.reg
J'obtiens 2 Fichiers
SauvegardeRunMachine.reg
Code : Sélectionner tout - Visualiser dans une fenêtre à part
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17 Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] @="" "AvastUI.exe"="\"C:\\Program Files\\Avast\\AvastUI.exe\" /nogui" "NvBackend"="\"C:\\Program Files\\NVIDIA Corporation\\Update Core\\NvBackend.exe\"" "AthBtTray"="\"C:\\Program Files\\Bluetooth Suite\\AthBtTray.exe\"" "RtHDVCpl"="C:\\Program Files\\Realtek\\Audio\\HDA\\RtHDVCpl.exe -s" "SunJavaUpdateSched"="\"C:\\Program Files\\Common Files\\Java\\Java Update\\jusched.exe\"" "AtherosBtStack"="\"C:\\Program Files\\Bluetooth Suite\\BtvStack.exe\"" "BCSSync"="\"C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe\" /DelayServices" "DNS7reminder"="\"C:\\Program Files\\Nuance\\NaturallySpeaking12\\Ereg\\Ereg.exe\" -r \"C:\\ProgramData\\Nuance\\NaturallySpeaking12\\Ereg.ini\"" "ETDCtrl"="%ProgramFiles%\\Elantech\\ETDCtrl.exe" "ETDWare"="C:\\Program Files\\Elantech\\ETDCtrl.exe" "ISUSPM"="C:\\ProgramData\\FLEXnet\\Connect\\11\\\\isuspm.exe -scheduler" "snp2uvc"="C:\\Windows\\vsnp2uvc.exe" "StartupDelayer"="\"C:\\Program Files\\Startup Delayer\\Startup Launcher.exe\" /LaunchType=Auto /LaunchApps=Common"
SauvegardeRunUser.reg
Code : Sélectionner tout - Visualiser dans une fenêtre à part
1
2
3
4
5
6
7
8 Windows Registry Editor Version 5.00 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Allway Sync"="\"C:\\Program Files (x86)\\Allway Sync\\Bin\\syncappw.exe\" -m" "GoogleChromeAutoLaunch_AB58178F22DC20C18AD9A75B837A37DB"="\"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" --no-startup-window" "GoogleDriveSync"="\"C:\\Program Files\\Google\\Drive\\googledrivesync.exe\" /autostart" "ISUSPM"="C:\\ProgramData\\FLEXnet\\Connect\\11\\ISUSPM.exe -scheduler" "BitTorrent Sync"="\"C:\\Program Files\\BitTorrent Sync\\BTSync.exe\" /MINIMIZED"
DeleteRegKey
Mes modifications
Code : Sélectionner tout - Visualiser dans une fenêtre à part
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74 Option Explicit Dim WshShell,CleMachine,CleUser,MesValeurs,i CleMachine = "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" MesValeurs = Array("Chrome","sidebar","btsync","isuspm","etdctrl","jusched","vsnp2uvc","vpotray","tv_w32","teamwiewer","teamviewer_service","athbttray") Set WshShell = CreateObject("WScript.Shell") For i = LBound(MesValeurs) To UBound(MesValeurs) If RegExists(CleMachine & MesValeurs(i)) = True Then WshShell.RegDelete(CleMachine & MesValeurs(i)) Msgbox "La clé " & DblQuote(CleMachine & MesValeurs(i)) & " a été bien effacé ! ",VbInformation,DblQuote(MesValeurs(i)) Else Msgbox "ERREUR " & VbTab & Err.Description & VbCrLF & "La clé " & DblQuote(CleMachine & MesValeurs(i)) & " n'existe pas ! ",VbCritical,DblQuote(MesValeurs(i)) End if Next '************************************************************************************************************** CleUser = "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" MesValeurs = Array("Chrome","sidebar","btsync","isuspm","etdctrl","jusched","vsnp2uvc","vpotray","tv_w32","teamwiewer","teamviewer_service","athbttray") For i = LBound(MesValeurs) To UBound(MesValeurs) If RegExists(CleUser & MesValeurs(i)) = True Then WshShell.RegDelete(CleUser & MesValeurs(i)) Msgbox "La clé " & DblQuote(CleUser & MesValeurs(i)) & " a été bien effacé ! ",VbInformation,DblQuote(MesValeurs(i)) Else Msgbox "ERREUR " & VbTab & Err.Description & VbCrLF & "La clé " & DblQuote(CleUser & MesValeurs(i)) & " n'existe pas ! ",VbCritical,DblQuote(MesValeurs(i)) End if Next '************************************************************************************************************** Call StartupCommand() 'Pour voir tous les points de démarrage automatique après l'effacement des cles '************************************************************************************************************** Function RegExists(value) On Error Resume Next Dim WS Set WS = CreateObject("WScript.Shell") val = WS.RegRead(value) If (Err.number = -2147024893) or (Err.number = -2147024894) Then RegExists = False Else RegExists = True End If End Function '************************************************************************************************************** 'Fonction pour ajouter les doubles quotes dans une variable Function DblQuote(Str) DblQuote = Chr(34) & Str & Chr(34) End Function '************************************************************************************************************** Function StartupCommand() Dim FSO,strComputer,resultat,objWMIService,colStartupCommands,objStartupCommand Dim WS,NomFichierLog,PathNomFichierLog,OutPut,temp strComputer = "." resultat="" Set FSO = WScript.CreateObject("Scripting.FileSystemObject") Set Ws = CreateObject("WScript.Shell") NomFichierLog="Startup.txt" temp = Ws.ExpandEnvironmentStrings("%temp%") PathNomFichierLog = temp & "\" & NomFichierLog Set OutPut = fso.CreateTextFile(temp & "\" & NomFichierLog,2) Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2") Set colStartupCommands = objWMIService.ExecQuery ("Select * from Win32_StartupCommand") For Each objStartupCommand in colStartupCommands resultat=resultat & "Nom: " & objStartupCommand.Name & vbNewline resultat=resultat & "Description: " & objStartupCommand.Description & vbNewline resultat=resultat & "Emplacement: " & objStartupCommand.Location & vbNewline resultat=resultat & "Commande: " & objStartupCommand.Command & vbNewline resultat=resultat & "Utilisateur: " & objStartupCommand.User & vbNewline resultat=resultat & String(120,"*") & vbNewline Next OutPut.WriteLine String(50,"*") &" Les éléments à démarrage automatique "& String(50,"*") OutPut.WriteLine resultat OutPut.Close Set OutPut = Nothing ws.run PathNomFichierLog set ws = Nothing end Function '**************************************************************************************************************
J'obtiens les erreurs suivantes
et au final le message suivant
Code : Sélectionner tout - Visualiser dans une fenêtre à part
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139 ************************************************** Les éléments à démarrage automatique ************************************************** Nom: Welcome Center Description: Welcome Center Emplacement: HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Commande: C:\Windows\system32\rundll32.exe C:\Windows\system32\OobeFldr.dll,ShowWelcomeCenter LaunchedBy_StartMenuShortcut Utilisateur: AUTORITE NT\Système ************************************************************************************************************************ Nom: Sidebar Description: Sidebar Emplacement: HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Commande: C:\Program Files\Windows Sidebar\sidebar.exe /autoRun Utilisateur: AUTORITE NT\Système ************************************************************************************************************************ Nom: Sidebar Description: Sidebar Emplacement: HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Commande: %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun Utilisateur: AUTORITE NT\SERVICE LOCAL ************************************************************************************************************************ Nom: Sidebar Description: Sidebar Emplacement: HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Commande: %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun Utilisateur: AUTORITE NT\SERVICE RÉSEAU ************************************************************************************************************************ Nom: Dragon NaturallySpeaking Description: Dragon NaturallySpeaking Emplacement: Startup Commande: C:\PROGRA~1\Nuance\NATURA~1\Program\natspeak.exe /Quick Utilisateur: GADENSEB\SEBASTIEN GADEN ************************************************************************************************************************ Nom: Allway Sync Description: Allway Sync Emplacement: HKU\S-1-5-21-3324116130-3700305473-466047179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Commande: "C:\Program Files (x86)\Allway Sync\Bin\syncappw.exe" -m Utilisateur: GADENSEB\SEBASTIEN GADEN ************************************************************************************************************************ Nom: GoogleChromeAutoLaunch_AB58178F22DC20C18AD9A75B837A37DB Description: GoogleChromeAutoLaunch_AB58178F22DC20C18AD9A75B837A37DB Emplacement: HKU\S-1-5-21-3324116130-3700305473-466047179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Commande: "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-startup-window Utilisateur: GADENSEB\SEBASTIEN GADEN ************************************************************************************************************************ Nom: GoogleDriveSync Description: GoogleDriveSync Emplacement: HKU\S-1-5-21-3324116130-3700305473-466047179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Commande: "C:\Program Files\Google\Drive\googledrivesync.exe" /autostart Utilisateur: GADENSEB\SEBASTIEN GADEN ************************************************************************************************************************ Nom: BitTorrent Sync Description: BitTorrent Sync Emplacement: HKU\S-1-5-21-3324116130-3700305473-466047179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Commande: "C:\Program Files\BitTorrent Sync\BTSync.exe" /MINIMIZED Utilisateur: GADENSEB\SEBASTIEN GADEN ************************************************************************************************************************ Nom: Welcome Center Description: Welcome Center Emplacement: HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Commande: C:\Windows\system32\rundll32.exe C:\Windows\system32\OobeFldr.dll,ShowWelcomeCenter LaunchedBy_StartMenuShortcut Utilisateur: .DEFAULT ************************************************************************************************************************ Nom: Sidebar Description: Sidebar Emplacement: HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Commande: C:\Program Files\Windows Sidebar\sidebar.exe /autoRun Utilisateur: .DEFAULT ************************************************************************************************************************ Nom: Little transparency Description: Little transparency Emplacement: Common Startup Commande: Little transparency.exe Utilisateur: Public ************************************************************************************************************************ Nom: Description: Emplacement: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Commande: Utilisateur: Public ************************************************************************************************************************ Nom: AvastUI.exe Description: AvastUI.exe Emplacement: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Commande: "C:\Program Files\Avast\AvastUI.exe" /nogui Utilisateur: Public ************************************************************************************************************************ Nom: NvBackend Description: NvBackend Emplacement: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Commande: "C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe" Utilisateur: Public ************************************************************************************************************************ Nom: RtHDVCpl Description: RtHDVCpl Emplacement: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Commande: C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s Utilisateur: Public ************************************************************************************************************************ Nom: SunJavaUpdateSched Description: SunJavaUpdateSched Emplacement: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Commande: "C:\Program Files\Common Files\Java\Java Update\jusched.exe" Utilisateur: Public ************************************************************************************************************************ Nom: AtherosBtStack Description: AtherosBtStack Emplacement: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Commande: "C:\Program Files\Bluetooth Suite\BtvStack.exe" Utilisateur: Public ************************************************************************************************************************ Nom: BCSSync Description: BCSSync Emplacement: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Commande: "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices Utilisateur: Public ************************************************************************************************************************ Nom: DNS7reminder Description: DNS7reminder Emplacement: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Commande: "C:\Program Files\Nuance\NaturallySpeaking12\Ereg\Ereg.exe" -r "C:\ProgramData\Nuance\NaturallySpeaking12\Ereg.ini" Utilisateur: Public ************************************************************************************************************************ Nom: ETDWare Description: ETDWare Emplacement: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Commande: C:\Program Files\Elantech\ETDCtrl.exe Utilisateur: Public ************************************************************************************************************************ Nom: snp2uvc Description: snp2uvc Emplacement: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Commande: C:\Windows\vsnp2uvc.exe Utilisateur: Public ************************************************************************************************************************ Nom: Norton Ghost 15.0 Description: Norton Ghost 15.0 Emplacement: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Commande: "C:\Program Files\Norton Ghost\Agent\VProTray.exe" Utilisateur: Public ************************************************************************************************************************
GADENSEB_Killer
Code : Sélectionner tout - Visualiser dans une fenêtre à part
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70 Option Explicit Dim Ws,fso,Var1,Var2,Var3,Var4,Var5,Var6,Var7,Var8,Var9,Var10,Var11,Var12,MainArray,LogFile,i,OutPut,count Set Ws = CreateObject("Wscript.Shell") Set fso = CreateObject("Scripting.FileSystemObject") Var1 = "Chrome.exe" Var2 = "sidebar.exe" Var3 = "BTSync.exe" Var4 = "ISUSPM.exe" Var5 = "ETDCtrl.exe" Var6 = "jusched.exe" Var7 = "vsnp2uvc.exe" Var8 = "VProTray.exe" Var9 = "tv_w32.exe" Var10 = "TeamViewer.exe" Var11 = "TeamViewer_Service.exe" Var12 = "AthBtTray.exe" MainArray = Array(Var1,Var2,Var3,Var4,Var5,Var6,Var7,Var8,Var9,Var10,Var11,Var12) LogFile = Left(Wscript.ScriptFullName,InstrRev(Wscript.ScriptFullName, ".")) & "log" count = 0 If fso.FileExists(LogFile) Then fso.DeleteFile LogFile Set OutPut = fso.OpenTextFile(LogFile,8,True) For i = LBound(MainArray) To UBound(MainArray) Call Kill(MainArray(i)) Next End if 'Stopper le Service TeamViewer 'Call MyService("TeamViewer9","Stop") 'OutPut.WriteLine String(50,"*") 'OutPut.WriteLine count & " Process were killed !" 'OutPut.WriteLine String(50,"*") 'If fso.FileExists(LogFile) Then ' ws.run LogFile 'To show the LogFile '*********************************************************************************************** Sub Kill(MyProcess) On Error Resume Next Dim colItems,objItem Set colItems = GetObject("winmgmts:").ExecQuery("Select * from Win32_Process " _ & "Where Name like '%"& MyProcess &"%' AND NOT commandline like '%" & wsh.scriptname & "%'",,48) For Each objItem in colItems count= count + 1 OutPut.WriteLine Mid(objItem.CommandLine,InStr(objItem.CommandLine,""" """) + 2) objItem.Terminate(0) If Err <> 0 Then OutPut.WriteLine Err.Description End If Next End Sub '*********************************************************************************************** Sub MyService(strServiceName,State) Dim objWMIService,colListOfServices,objService Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2") Set colListOfServices = objWMIService.ExecQuery("Select * from Win32_Service Where Name ='" & strServiceName & "'") If State = "Start" Then For Each objService in colListOfServices If objService.state = "Stopped" Then objService.StartService() OutPut.WriteLine VbCrLF & String(50,"*") & VbCrLF & "Le Service : " & strServiceName & " a été demarré avec succés !" End If Next ElseIF State = "Stop" Then For Each objService in colListOfServices If Not objService.state = "Stopped" Then objService.StopService() OutPut.WriteLine VbCrLF & String(50,"*") & VbCrLF &"Le Service : " & strServiceName & " a été arrêté avec succés !" End If Next End if End Sub '***********************************************************************************************
Et le résultat suivant
Code : Sélectionner tout - Visualiser dans une fenêtre à part
1
2
3
4
5
6 C:\Program Files\TeamViewer\Version9\tv_w32.exe" --action hooks --log C:\Program Files\TeamViewer\Version9\TeamViewer9_Logfile.log C:\Program Files\TeamViewer\Version9\TeamViewer.exe" C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe" ************************************************** 3 Process were killed ! **************************************************
Les messages d'erreur sont ils normaux ?
Partager