[VBS] Shortcutremover, outil pour supprimer automatiquement les raccourcis infectés par un virus sur une clé USB

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
'Les éléments à démarrage automatique + ListProcessCmdLine.vbs © Hackoo © 2011
Set fso = CreateObject("Scripting.FileSystemObject")
Set Ws = CreateObject("WScript.Shell")
Set ProcessEnv = Ws.Environment("Process")
NomMachine = ProcessEnv("COMPUTERNAME") 
NomUtilisateur = ProcessEnv("USERNAME") 
NomFichierLog="Liste_Processus.txt"
temp = Ws.ExpandEnvironmentStrings("%temp%")
PathNomFichierLog = temp & "\" & NomFichierLog
Set OutPut = fso.CreateTextFile(temp & "\" & NomFichierLog,2)
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" _ 
& strComputer & "\root\cimv2") 
Set colProcesses = objWMIService.ExecQuery ("Select * from Win32_Process")
count=0 
'Dim StartTime : StartTime = Timer
Call Infosys
OutPut.WriteLine String(14,"*")& "Liste des Processus en cours d'exécution le " & date & " à " & time & " sur Le PC "& NomMachine &" connecté en tant que " & NomUtilisateur & String(14,"*")& vbNewline & String(143,"*")
For Each objProcess in colProcesses
ProcessName = objProcess.Name
ProcessID = objProcess.ProcessID
CommandLine = objProcess.CommandLine	
count=count+1
Texte = "Numéro PID = "& objProcess.ProcessID & VbNewLine & "Nom du Processus = " & objProcess.Name & VbNewLine &"Ligne de Commande = "& objProcess.CommandLine &_
VbNewLine & String(120,"*")
OutPut.WriteLine Texte
Next

OutPut.WriteLine  "Il y a "& Count &" Processus en cours d'exécution le " & date & " à " & time & " sur Le PC "& NomMachine &" connecté en tant que " & NomUtilisateur & vbNewline
Call StartupCommand
'OutPut.WriteLine FormatNumber(Timer - StartTime, 0) & " seconds."
Function StartupCommand()
strComputer = "."
resultat=""
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set colStartupCommands = objWMIService.ExecQuery ("Select * from Win32_StartupCommand")

For Each objStartupCommand in colStartupCommands
resultat=resultat & "Nom: " & objStartupCommand.Name & vbNewline
resultat=resultat & "Description: " & objStartupCommand.Description & vbNewline
resultat=resultat & "Emplacement: " & objStartupCommand.Location & vbNewline
resultat=resultat & "Commande: " & objStartupCommand.Command & vbNewline
resultat=resultat & "Utilisateur: " & objStartupCommand.User & vbNewline
resultat=resultat & String(120,"*") & vbNewline 
Next
OutPut.WriteLine String(50,"*") &" Les éléments à démarrage automatique "& String(50,"*")
OutPut.WriteLine resultat
end Function

Explorer(PathNomFichierLog)
 
Function Explorer(File)
    Set ws=CreateObject("wscript.shell")
    ws.run "Explorer "& File,0,True
end Function

Function InfoSys
strComputer = "."
strMessage=""
Set objWMIService = GetObject("winmgmts:"  & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colSettings = objWMIService.ExecQuery  ("Select * from Win32_ComputerSystem")
Set colSettings2 = objWMIService.ExecQuery ("Select * from Win32_BIOS")
Set colSettings3 = objWMIService.ExecQuery ("Select * from Win32_OperatingSystem")
For Each objBIOS in colSettings2 
      strMessage=strMessage & "BIOS " & objBIOS.Version & vbNewline & vbNewline
Next
For Each objComputer in colSettings 
      strMessage=strMessage & "Nom de l'ordinateur : " & objComputer.Name & vbNewline & "Fabriquant: " & objComputer.Manufacturer & vbNewline & "Modèle : " & objComputer.Model & vbNewline & vbNewline

Next
For Each objOperatingSystem in colSettings3
      strMessage=strMessage &  objOperatingSystem.Name & vbNewline
      strMessage=strMessage &  "Version " & objOperatingSystem.Version & vbNewline
      strMessage=strMessage &  "Service Pack " & objOperatingSystem.ServicePackMajorVersion & "." & objOperatingSystem.ServicePackMinorVersion &vbNewline
      strMessage=strMessage &  "Dossier de Windows: " & objOperatingSystem.WindowsDirectory &vbNewline
Next
OutPut.WriteLine strMessage
end Function