Jump to content

Virus Cleaning Tool - Debugger


ripdad
 Share

Recommended Posts

Virus Cleaning Tool - Debugger - v2.01

This Tool undoes the damage caused by a virus that modifies the registry with "Debugger Values" under:

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options"

which cause programs not to run.

-EDIT-

I've re-written this tool to accommodate for the different ways these viruses are writing to the registry.

The count is now over 750 entries.

No restrictions with this version, with the exception of #RequireAdmin.

; Virus Cleaning Tool - Debugger - v2.01
#RequireAdmin

Global $title = 'Virus Cleaning Tool - Debugger'

Local $number = _Debugger(0); 0 = check if Debugger entries are present

If $number = 0 Then
    MsgBox(8256, $title, 'Nothing Found')
    Exit
EndIf

If MsgBox(8228, $title, $number & ' Entries Found' & @CRLF & @CRLF & 'Clean?') = 7 Then Exit

_Debugger(1); 1 = Delete Debugger ValueNames
_DebuggerEx();    Delete Empty Keys

MsgBox(8256, $title, 'Finished - Check DebuggerLog.txt for more info')

Exit

Func _Debugger($mode)
    Local $MainKey = 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options'
    Local $ImageName, $ValueName = 'Debugger', $sCount = 0, $eCount = 0
    Local $Logfile = @ScriptDir & '\DebuggerLog.txt'
    For $i = 1 To 10000
        $ImageName = RegEnumKey($MainKey, $i)
        If @error <> 0 Then ExitLoop
        If $ImageName = 'Your Image File Name Here without a path' Then ContinueLoop
        RegRead($MainKey & '\' & $ImageName, $ValueName)
        If @error <> 0 Then ContinueLoop
        $sCount += 1
        If $mode = 1 Then
            If RegDelete($MainKey & '\' & $ImageName, $ValueName) Then
                FileWriteLine($Logfile, 'Debugger Deleted: ' & $MainKey & '\' & $ImageName)
                ToolTip('Deleted: ' & $ImageName & '\' & $ValueName, 0, 0, $title, 1)
                Sleep(20)
                $i -= 1
            Else
                $eCount += 1
                FileWriteLine($Logfile, 'Error Deleting Debugger: ' & $MainKey & '\' & $ImageName)
                ToolTip('Error Deleting: ' & $ImageName & '\' & $ValueName, 0, 0, $title, 1)
                Sleep(20)
            EndIf
        EndIf
    Next
    ToolTip('')
    If $mode = 0 Then Return $sCount
    If RegRead($MainKey, $ValueName) Then RegDelete($MainKey, $ValueName)
    FileWriteLine($Logfile, 'Debugger Entries Cleaned: ' & $sCount - $eCount & @CRLF & 'Errors: ' & $eCount)
EndFunc

Func _DebuggerEx()
    Local $MainKey = 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options'
    Local $ImageName, $sCount = 0, $eCount = 0, $Logfile = @ScriptDir & '\DebuggerLog.txt'
    For $i = 1 To 10000
        $ImageName = RegEnumKey($MainKey, $i)
        If @error <> 0 Then ExitLoop
        If RegEnumVal($MainKey & '\' & $ImageName, 1) Then ContinueLoop
        If RegDelete($MainKey & '\' & $ImageName) Then
            $sCount += 1
            ToolTip('Deleted Key: ' & $ImageName, 0, 0, $title, 1)
            Sleep(20)
            $i -= 1
        Else
            $eCount += 1
            ToolTip('Error Deleting Key: ' & $ImageName, 0, 0, $title, 1)
            Sleep(20)
        EndIf
    Next
    ToolTip('')
    FileWriteLine($Logfile, 'Empty Keys Deleted: ' & $sCount & @CRLF & 'Errors: ' & $eCount)
EndFunc

-Edit2-

Below is minicode of above -- it has no prompts, no counting, no logging and no frills.

It just does it, no questions asked ... except UAC of course. <grin>

#RequireAdmin
Local $k = 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options'
Local $n, $v = 'Debugger', $p = 'Your Image File Name Here without a path'
If RegRead($k, $v) Then RegDelete($k, $v)
For $i = 1 To 10000
    $n = RegEnumKey($k, $i)
    If @error <> 0 Then ExitLoop
    If $n = $p Then ContinueLoop
    If RegRead($k & '\' & $n, $v) Then
        RegDelete($k & '\' & $n, $v)
        $i -= 1
    EndIf
    If Not RegEnumVal($k & '\' & $n, 1) Then RegDelete($k & '\' & $n)
Next
Edited by ripdad

"The mediocre teacher tells. The Good teacher explains. The superior teacher demonstrates. The great teacher inspires." -William Arthur Ward

Link to comment
Share on other sites

  • 1 month later...

Hi ripdad.

Really this is awesome idea.

5 starts from me for great idea.

BTW i create GUI programm it is based on your idea.

Here is: (I`m sorry it is not English language based because my English very awfull and i create this programm for my native.

Anyway I want to say THANK YOU MAN for great idea.

Posted Image

Binary & src can be found here for GUI:

Download Binary (src included)

edit: correction on url

Reuploaded:(Contains all src again)

http://qovluq.biz/uploads/1f30.rar
MD5 SUM:
http://qovluq.biz/uploads/1f301.md5
Edited by Fire
[size="5"] [/size]
Link to comment
Share on other sites

Hi Sh3llC043r

Thats a lot of code for such a small task.

Nice gui and sound effects.

And ... you're welcome.

"The mediocre teacher tells. The Good teacher explains. The superior teacher demonstrates. The great teacher inspires." -William Arthur Ward

Link to comment
Share on other sites

  • 8 months later...

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...