@ECHO OFF
ECHO.
ECHO  ###########################################################
ECHO #                                                           #
ECHO #      Conficker Scheduled Task network removal tool        #
ECHO #                   *  by Labsy  *                          #
ECHO # (C)Copyright or (C)Copyleft or (C)CopyPaste no problemo   #
ECHO #                                                           #
ECHO  ###########################################################
ECHO.

REM # Let's include some colors, too
SETLOCAL DisableDelayedExpansion
FOR /F "tokens=1,2 delims=#" %%a IN ('"prompt #$H#$E# & ECHO ON & FOR %%b IN (1) DO REM"') DO (
  SET "DEL=%%a"
)

IF NOT "%1"=="" GOTO SINGLESCAN
  REM # Ask for IP range for scanning
  ECHO Please, enter start and end IP for scanning:
  ECHO.
IF "%XSubnetStart%"=="" GOTO INPUTVALUES
  ECHO Previous settings were set to scan the following range:
  ECHO.
  CALL :ColorText 0a "%XSubnetStart%%XScanStart% - %XSubnetStop%%XScanStop%"
  ECHO.
  CHOICE /C YN /M "Accept this range?"
  IF NOT ERRORLEVEL 2 GOTO SKIPINPUT
:INPUTVALUES
ECHO Enter new values:
ECHO.
SET /P XSubnetStart=Start IP : 
SET /P XSubnetStop=Stop  IP : 

ECHO.
FOR /f "tokens=1,2,3,4 delims=." %%a IN ("%XSubnetStart%") DO SET xa=%%a&SET xb=%%b&SET xc=%%c&SET XScanStart=%%d
SET "XSubnetStart=%xa%.%xb%.%xc%."
FOR /f "tokens=1,2,3,4 delims=." %%a IN ("%XSubnetStop%") DO SET xa=%%a&SET xb=%%b&SET xc=%%c&SET XScanStop=%%d
SET "XSubnetStop=%xa%.%xb%.%xc%."

:SKIPINPUT
IF NOT "%XSubnetStart%"=="%XSubnetStop%" CALL :ColorText 0C "Wrong start or stop IP! Both must be in same subnet C Class." && GOTO FIN
REM # By default, scan whole network. 

  ECHO.
  ECHO Scanning range %XSubnetStart%%XScanStart% - %XSubnetStop%%XScanStop% for unwanted Scheduled
  ECHO Task created by Conficker virus. Scaning can take more than an 
  ECHO hour, depending of how many machines are off-line.
  ECHO.
  ECHO For each computer you have 10 seconds to review the task
  ECHO and to cancel deletion, otherwise it will be deleted
  ECHO automatically (recommended).
  ECHO.  
  CHOICE /C YN /M "Should I begin?"
  IF ERRORLEVEL 2 GOTO FIN
  REM # Set looping for Class C subnet (first IP, step, last IP)
  FOR /L %%A IN (%XScanStart%,1,%XScanStop%) DO (
    SET XComputer=%XSubnetStart%%%A
    CALL rct1.bat
  )
  GOTO FIN

REM # Else, scan single computer 
:SINGLESCAN
  ECHO.
  SET XComputer=%1
  CALL rct1.bat
  ECHO.
  ECHO Finished!
PAUSE

:FIN
SET XSubnet=
SET XComputer=
SET xa=
SET xb=
SET xc=
SET XYes=
SET x=
GOTO :EOF

:ColorText
ECHO OFF
<nul SET /p .=. > "%~2"
FINDSTR /v /a:%1 /R "^$" "%~2" nul
ECHO(%DEL%%DEL%%DEL%
del "%~2" > nul 2>&1
GOTO :EOF

Select allOpen in new window

@ECHO OFF
SET XYes=0

  ECHO -------------------------------------------------------------
  ECHO Testing computer %XComputer% for unwanted Task Schedule...

REM # Let's first see if machine is alive...
  PING -n 1 -r 2 -s 2 -4 -i 1 %XComputer% | find "TTL=" > nul
  IF ERRORLEVEL 1 ECHO %XComputer% not responding to ping. Next... && GOTO SKIP
REM # OK, so let's scan it...
  ECHO Ping OK. Scanning...
  AT \\%XComputer%|FIND /I "rundll32.exe" > rctTemp.txt
  IF NOT ERRORLEVEL 1 ( CALL :ColorText 0C "WARNING! Probably infected with Conficker!!!"
    ECHO.
    CALL rct2.bat
    AT \\%XComputer%|FIND /I "rundll32.exe"
    IF ERRORLEVEL 1 CALL :ColorText 0a "Deleted!"
    ECHO.
    GOTO SKIP
  )
  CALL :ColorText 0a "OK. Computer seems healthy!"
  ECHO.
  :SKIP

:END
SET XComputer=
GOTO :EOF

:ColorText
ECHO OFF
<nul SET /p .=. > "%~2"
FINDSTR /v /a:%1 /R "^$" "%~2" nul
ECHO(%DEL%%DEL%%DEL%
del "%~2" > nul 2>&1
GOTO :EOF

Select allOpen in new window

SET XFileContents=
copy SetFile.bat + rctTemp.txt $tmp$.bat > nul
call $tmp$.bat
del $tmp$.bat
set XTask=%XFileContents:~7%
ECHO %XTask%
ECHO.
CHOICE /T 10 /C YN /D y /M "Remove task?"
IF ERRORLEVEL 2 GOTO END
set XFileContents=%XFileContents:~0,10%
set XFileContents=%XFileContents: =%
ECHO Deleting Task ID %XFileContents% from %XComputer%...
AT \\%XComputer% %XFileContents% /DELETE /YES
:END
SET XFileContents=
SET XComputer=

Select allOpen in new window

set XFileContents=

Select allOpen in new window