@Echo Off Title Adeus, GbPlugin Mode 73,19 If Not "%SafeBoot_Option%"=="" (Goto Pular) Reg Add "HKLM" /F>nul 2>&1 If Not "%ErrorLevel%"=="0" ( Color 6f Echo. & Echo Execute o script como administrador. Echo. & Echo Pressione qualquer tecla para finalizar o script... Pause>nul Exit ) :Pular Color 1f ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: Set "Script-Versao=1.1.0.3" Set "Script-Ano=2016" ::--------------------------------------------------------------------- Set "NUM=6" Set "SG=segundos" ::--------------------------------------------------------------------- If "%~1"=="2" (Goto P2) If "%~1"=="3" (Goto P3) ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :MenuPrincipal Cls Echo. Echo 旼컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Echo � � Este script foi especialmente desenvolvido para facilitar � Echo � � a remo눯o do G-Buster Browser Defense (Gbplugin/Gbpsv.exe). � Echo 쳐컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴쩡쩡컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Echo � � Nome : Adeus, GbPlugin � � � Bancos suportados: � Echo � � Vers�o: %Script-Versao% � 쳐컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Echo � � Ano : %Script-Ano% � � � Banco do Brasil � Echo � � Autor : Humberto Freitas � � � Caixa � Echo 쳐컴쩡컴컴컴컴컴컴컴컴컴컴컴컴컴컴� � � Ita� � Echo � ^> � Menu � � � Santander � Echo 쳐컴탠컴컴컴컴컴컴컴컴컴컴컴컴컴컴� 읕컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Echo � 1 � Come놹r a remo눯o � 旼컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Echo � 2 � Ver o tutorial � � 껑같같 Veja o tutorial 같같굉 � Echo � 3 � Sair � � 껑같 antes de utilizar 같굉 � Echo 憫컴컨컴컴컴컴컴컴컴컴컴컴컴컴컴컴켸 읕컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Set "Menu=" Set /p "Menu=�> " If "%Menu%"=="1" (Goto P1) If "%Menu%"=="2" (Start "" "https://youtu.be/vqXcsMg7FMM") If "%Menu%"=="3" (Exit) Goto MenuPrincipal :P1 Cls ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: Echo. & Echo [...] ::--------------------------------------------------------------------- Bcdedit /set {current} safeboot Network>nul 2>&1 ::--------------------------------------------------------------------- Del /F /Q /A "%SystemDrive%\41646575732c204762506c7567696e.TxT">nul 2>&1 RMDIR /S /Q "%SystemDrive%\[ Adeus, GbPlugin ]">nul 2>&1 MKDIR "%SystemDrive%\[ Adeus, GbPlugin ]">nul 2>&1 If Exist "%Appdata%\unins000.exe" ("%Appdata%\unins000.exe" /Silent) ::--------------------------------------------------------------------- Set "NomeLinha01=kcezbcchdajimudlceavhgiaaviptdzrrjhhfbofyjeimouiytuwpmsszukgzelfcgvyf" Set "NomeLinha02=wtcgbdgywffmrpgeuiaqkldyehpjivcqmjsrjungxhpbahwuugqetxypfxlijtbnvpbju" For /f "delims=" %%l in (' Type "%~f0" ^| Findstr /n /c:"::%NomeLinha01%"' ) do (Set /a "PularLinhas01=2 + %%~l">nul 2>&1) For /f "delims=" %%l in (' Type "%~f0" ^| Findstr /n /c:"::%NomeLinha02%"' ) do (Set /a "PularLinhas02=2 + %%~l">nul 2>&1) ::--------------------------------------------------------------------- If "%P2-A%"=="" (If "%P2-M%"=="N" ( Type nul>"%SystemDrive%\[ Adeus, GbPlugin ]\OK" Type "%~f0" | More +%PularLinhas02%>"%SystemDrive%\[ Adeus, GbPlugin ]\02.reg")) ::--------------------------------------------------------------------- Set /a "PularLinhas02=%PularLinhas02% - %PularLinhas01%" Type "%~f0" | More +%PularLinhas01%>"%SystemDrive%\[ Adeus, GbPlugin ]\01.bat" >"%SystemDrive%\41646575732c204762506c7567696e.TxT" Echo %PularLinhas02% ::--------------------------------------------------------------------- Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" ^ /v "*Adeus, GbPlugin" /d "Cmd.exe /c Call \"%~f0\" \"2"\" /F>nul 2>&1 ::--------------------------------------------------------------------- :P1-R Set /a "NUM=%NUM%-1" If "%NUM%"=="1" (Set "SG=segundo") Echo. & Echo Seu computador ser� reiniciado em %NUM% %SG%... Ping -n 2 127.0.0.1>nul 2>&1 If Not "%NUM%"=="1" Goto P1-R ::--------------------------------------------------------------------- Ver | Findstr /c:"5\.1\.">nul 2>&1 If "%ErrorLevel%"=="0" (Set "Vers=-8") Ver | Findstr /c:"5\.2\.">nul 2>&1 If "%ErrorLevel%"=="0" (Set "Vers=-8") Ver | Findstr /c:"6\.0\.">nul 2>&1 If "%ErrorLevel%"=="0" (Set "Vers=-8") Ver | Findstr /c:"6\.1\.">nul 2>&1 If "%ErrorLevel%"=="0" (Set "Vers=-8") If "%Vers%"=="-8" ( Reagentc /disable>nul 2>&1 Reagentc /enable>nul 2>&1 Shutdown -r -f -t 00>nul 2>&1 ) Else (Shutdown /r /o /t 00>nul 2>&1) ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: Exit :P2 Cls ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: If /i Not "%SafeBoot_Option%"=="Network" (Set "P2-M=N") If Not Exist "%SystemDrive%\[ Adeus, GbPlugin ]\OK" (Set "P2-A=N") If "%P2-M%"=="N" (Goto P2-Erro) If "%P2-A%"=="N" (Goto P2-Erro) ::--------------------------------------------------------------------- Echo. & Echo [...] ::--------------------------------------------------------------------- Regedit /S "%SystemDrive%\[ Adeus, GbPlugin ]\02.reg">nul 2>&1 RMDIR /S /Q "%ProgramData%\GbPlugin">nul 2>&1 RMDIR /S /Q "%ProgramData%\GAS Tecnologia">nul 2>&1 NETSH advfirewall firewall delete rule name="Diebold">nul 2>&1 NETSH advfirewall firewall delete rule name="Warsaww">nul 2>&1 NETSH advfirewall firewall delete rule name="Diebold - Warsaw">nul 2>&1 Reg delete "HKLM\SYSTEM\CurrentControlSet\services\GbpKm" /F>nul 2>&1 Reg delete "HKLM\SYSTEM\CurrentControlSet\services\GbpSv" /F>nul 2>&1 Reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{20E60725-16C8-4FB9-8BC2-AF92C5F8D06D}_is1" /F>nul 2>&1 ::--------------------------------------------------------------------- Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" ^ /v "*Adeus, GbPlugin" /d "Cmd.exe /c Call \"%~f0\" \"3"\" /F>nul 2>&1 ::--------------------------------------------------------------------- :P2-R Set /a "NUM=%NUM%-1" If "%NUM%"=="1" (Set "SG=segundo") Echo. & Echo Seu computador ser� reiniciado em %NUM% %SG%... Ping -n 2 127.0.0.1>nul 2>&1 If Not "%NUM%"=="1" (Goto P2-R) ::--------------------------------------------------------------------- Shutdown -r -f -t 00>nul 2>&1 ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: Exit :P3 Cls ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: Echo. & Echo [...] ::--------------------------------------------------------------------- Sc delete "GbpSv">nul 2>&1 Sc delete "Warsaw Technology">nul 2>&1 ::--------------------------------------------------------------------- Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" ^ /v "*Conex�es" /d "Control.exe NetConnections" /F>nul 2>&1 ::--------------------------------------------------------------------- :P2-Erro-2 ::--------------------------------------------------------------------- If "%P2-Erro%"=="S" (Cls & Echo. & Echo [...]) ::--------------------------------------------------------------------- Bcdedit /deletevalue {current} safeboot>nul 2>&1 Del /F /Q /A "%SystemDrive%\41646575732c204762506c7567696e.TxT">nul 2>&1 RMDIR /S /Q "%SystemDrive%\[ Adeus, GbPlugin ]">nul 2>&1 ::--------------------------------------------------------------------- :P3-R Set /a "NUM=%NUM%-1" If "%NUM%"=="1" (Set "SG=segundo") Echo. & Echo Seu computador ser� reiniciado em %NUM% %SG%... Ping -n 2 127.0.0.1>nul 2>&1 If Not "%NUM%"=="1" (Goto P3-R) ::--------------------------------------------------------------------- Shutdown -r -f -t 00>nul 2>&1 ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: Exit :P2-Erro Cls Echo. Echo 旼컴컴컴컴� Echo � Erro(s) � Echo 旼컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴좔컴컴컴컴� If "%P2-A%"=="N" (Echo � � Voc� n�o removeu os arquivos no modo de recupera눯o. �) If "%P2-M%"=="N" (Echo � � O Windows n�o est� em modo de seguran놹 com rede. �) Echo 쳐컴쩡컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Echo � ^> � Menu � Echo 쳐컴탠컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Echo � 1 � Tentar novamente � Echo � 2 � Desistir � Echo 憫컴컨컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴켸 Set "Menu=" Set /p "Menu=�> " If "%Menu%"=="1" (Goto P1) If "%Menu%"=="2" (Set "P2-Erro=S" & Goto P2-Erro-2) Goto P2-Erro ::kcezbcchdajimudlceavhgiaaviptdzrrjhhfbofyjeimouiytuwpmsszukgzelfcgvyf @Echo Off Title 01 - Adeus, GbPlugin Color 1f CD /D "%~dp0" ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: Echo. & Echo [...] ::--------------------------------------------------------------------- RMDIR /S /Q "..\Program Files\Warsaw">nul 2>&1 RMDIR /S /Q "..\Program Files\Diebold">nul 2>&1 RMDIR /S /Q "..\Program Files\GbPlugin">nul 2>&1 RMDIR /S /Q "..\Program Files\GAS Tecnologia">nul 2>&1 ::--------------------------------------------------------------------- RMDIR /S /Q "..\Program Files (x86)\Warsaw">nul 2>&1 RMDIR /S /Q "..\Program Files (x86)\Diebold">nul 2>&1 RMDIR /S /Q "..\Program Files (x86)\GbPlugin">nul 2>&1 RMDIR /S /Q "..\Program Files (x86)\GAS Tecnologia">nul 2>&1 ::--------------------------------------------------------------------- Del /F /Q /A "..\Windows\System32\drivers\gbpddreg32.sys">nul 2>&1 Del /F /Q /A "..\Windows\System32\drivers\gbpddreg86.sys">nul 2>&1 Del /F /Q /A "..\Windows\System32\drivers\gbpddreg64.sys">nul 2>&1 Del /F /Q /A "..\Windows\System32\drivers\gbpndisrdn.sys">nul 2>&1 Del /F /Q /A "..\Windows\System32\drivers\GbpKm.sys">nul 2>&1 Del /F /Q /A "..\Windows\System32\drivers\wsddpp.sys">nul 2>&1 Del /F /Q /A "..\Windows\System32\drivers\wsddfac.sys">nul 2>&1 ::--------------------------------------------------------------------- Del /F /Q /A "..\Windows\SysWOW64\drivers\gbpddreg32.sys">nul 2>&1 Del /F /Q /A "..\Windows\SysWOW64\drivers\gbpddreg86.sys">nul 2>&1 Del /F /Q /A "..\Windows\SysWOW64\drivers\gbpddreg64.sys">nul 2>&1 Del /F /Q /A "..\Windows\SysWOW64\drivers\gbpndisrdn.sys">nul 2>&1 Del /F /Q /A "..\Windows\SysWOW64\drivers\GbpKm.sys">nul 2>&1 Del /F /Q /A "..\Windows\SysWOW64\drivers\wsddfac.sys">nul 2>&1 Del /F /Q /A "..\Windows\SysWOW64\drivers\wsddpp.sys">nul 2>&1 ::--------------------------------------------------------------------- Set /p PularLinhas=<"..\41646575732c204762506c7567696e.TxT" Type "%~f0" | More +%PularLinhas%>"02.reg" Regedit /S "02.reg">nul 2>&1 Type nul>"OK" ::--------------------------------------------------------------------- Echo. & Echo Conclu죆o. Echo. & Echo Pressione qualquer tecla para finalizar o script... Pause>nul ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: Exit ::wtcgbdgywffmrpgeuiaqkldyehpjivcqmjsrjungxhpbahwuugqetxypfxlijtbnvpbju Windows Registry Editor Version 5.00 ;==================================================== [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Diebold"=- "Warsaw"=- "Diebold - Warsaw"=- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Diebold"=- "Warsaw"=- "Diebold - Warsaw"=- [HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run] "Diebold"=- "Warsaw"=- "Diebold - Warsaw"=- ;==================================================== [-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\LowRegistry\Software\GAS Tecnologia] [-HKEY_LOCAL_MACHINE\SOFTWARE\GbPlugin] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\LowRegistry\Software\GAS Tecnologia] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{20E60725-16C8-4FB9-8BC2-AF92C5F8D06D}_is1] [-HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\GbPlugin] [-HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\LowRegistry\Software\GAS Tecnologia] ;==================================================== [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Diebold] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\gbpddreg] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\GbpKm] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\GbpSv] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ndisrd] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Warsaw Technology] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Warsaw] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Warsaw_PP] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\wsddfac] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\wsddpp] ;==================================================== [-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ GbPluginBb] [-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ GbPluginCef] [-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ GbPluginUni] ;==================================================== [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ GbPluginBb] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ GbPluginCef] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ GbPluginUni] ;==================================================== [-HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ GbPluginBb] [-HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ GbPluginCef] [-HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ GbPluginUni] ;==================================================== [-HKEY_CLASSES_ROOT\gas.events.abn] [-HKEY_CLASSES_ROOT\gas.events.abn.0] [-HKEY_CLASSES_ROOT\gas.events.abn.1] [-HKEY_CLASSES_ROOT\gas.events.abn.2] [-HKEY_CLASSES_ROOT\gas.events.abn.3] [-HKEY_CLASSES_ROOT\gas.events.abn.4] [-HKEY_CLASSES_ROOT\gas.events.abn.5] [-HKEY_CLASSES_ROOT\gas.events.abn.6] [-HKEY_CLASSES_ROOT\gas.events.abn.7] [-HKEY_CLASSES_ROOT\gas.events.abn.8] [-HKEY_CLASSES_ROOT\gas.events.abn.9] [-HKEY_CLASSES_ROOT\gas.ibh.abn] [-HKEY_CLASSES_ROOT\gas.ibh.abn.0] [-HKEY_CLASSES_ROOT\gas.ibh.abn.1] [-HKEY_CLASSES_ROOT\gas.ibh.abn.2] [-HKEY_CLASSES_ROOT\gas.ibh.abn.3] [-HKEY_CLASSES_ROOT\gas.ibh.abn.4] [-HKEY_CLASSES_ROOT\gas.ibh.abn.5] [-HKEY_CLASSES_ROOT\gas.ibh.abn.6] [-HKEY_CLASSES_ROOT\gas.ibh.abn.7] [-HKEY_CLASSES_ROOT\gas.ibh.abn.8] [-HKEY_CLASSES_ROOT\gas.ibh.abn.9] ;==================================================== [-HKEY_CLASSES_ROOT\CLSID\{C41A1C0E-EA6C-11D4-B1B8-444553540000}] [-HKEY_CLASSES_ROOT\CLSID\{C41A1C0E-EA6C-11D4-B1B8-444553540001}] [-HKEY_CLASSES_ROOT\CLSID\{C41A1C0E-EA6C-11D4-B1B8-444553540002}] [-HKEY_CLASSES_ROOT\CLSID\{C41A1C0E-EA6C-11D4-B1B8-444553540003}] [-HKEY_CLASSES_ROOT\CLSID\{C41A1C0E-EA6C-11D4-B1B8-444553540004}] [-HKEY_CLASSES_ROOT\CLSID\{C41A1C0E-EA6C-11D4-B1B8-444553540005}] [-HKEY_CLASSES_ROOT\CLSID\{C41A1C0E-EA6C-11D4-B1B8-444553540006}] [-HKEY_CLASSES_ROOT\CLSID\{C41A1C0E-EA6C-11D4-B1B8-444553540007}] [-HKEY_CLASSES_ROOT\CLSID\{C41A1C0E-EA6C-11D4-B1B8-444553540008}] [-HKEY_CLASSES_ROOT\CLSID\{C41A1C0E-EA6C-11D4-B1B8-444553540009}] ;==================================================== [-HKEY_CLASSES_ROOT\WOW6432Node\CLSID\{C41A1C0E-EA6C-11D4-B1B8-444553540000}] [-HKEY_CLASSES_ROOT\WOW6432Node\CLSID\{C41A1C0E-EA6C-11D4-B1B8-444553540001}] [-HKEY_CLASSES_ROOT\WOW6432Node\CLSID\{C41A1C0E-EA6C-11D4-B1B8-444553540002}] [-HKEY_CLASSES_ROOT\WOW6432Node\CLSID\{C41A1C0E-EA6C-11D4-B1B8-444553540003}] [-HKEY_CLASSES_ROOT\WOW6432Node\CLSID\{C41A1C0E-EA6C-11D4-B1B8-444553540004}] [-HKEY_CLASSES_ROOT\WOW6432Node\CLSID\{C41A1C0E-EA6C-11D4-B1B8-444553540005}] [-HKEY_CLASSES_ROOT\WOW6432Node\CLSID\{C41A1C0E-EA6C-11D4-B1B8-444553540006}] [-HKEY_CLASSES_ROOT\WOW6432Node\CLSID\{C41A1C0E-EA6C-11D4-B1B8-444553540007}] [-HKEY_CLASSES_ROOT\WOW6432Node\CLSID\{C41A1C0E-EA6C-11D4-B1B8-444553540008}] [-HKEY_CLASSES_ROOT\WOW6432Node\CLSID\{C41A1C0E-EA6C-11D4-B1B8-444553540009}] ;====================================================