Scripted reboot and spyware cleanup...

[thunderbolt16]

Hey all,

This my first post on MSFN. This question is very complex and difficult, so im not looking for a one shot solution. Any and all advice that can be provided would be appreciatted.

With that said, I am trying to create a script (right now a .bat, can be a .vbs) for doing the following:

1. Reboot the computer in safe mode

2. Logon to windows with an admin acct

2. Launch Spybot, run a scan and clean up the results

3. Launch Ad-aware, run a scan and clean/ quarantine the results (would prefer clean)

4. (optional) Run a Symantec AV scan

5. Reboot the computer in normal mode

Its a lot of stuff, and very little of it seems to be available on the web. I'll talk about each step separately.

I have a script for rebooting the computer in safe mode, but it requires editing the boot.ini to change the flags. While this is ok, I would prefer to use an alternate method (if there is one). I have had experienced issues in the past with a boot.ini change resulting in having to go and repair the whole OS because I can't remove a flag/ the file gets corrupted due to a system issue partway through the booting process.

I have an admin acct on every computer i will run the script on and the login script i have seems to work reliably. Uses regedit, something im also not fond of using, but it seems to be the best way to do this. If anyone knows of a reliable alternative that would be great.

I have a script for running spybot, everything seems to work with it, but I'm not sure how it will work in safe mode.

I cannot seem to get a working script for the freeware version for Ad-aware. If anyone can provide one I would be most grateful.

The final step is right now the most troublesome. I have a script to rebooting, I have a script for rewriting the boot.ini back to normal boot. However, I cant seem to get the two to work together.

That brings me to my real problem. What is the best way to execute this script as a whole. What syntax do I need to place between these scripts to get them to run sequentially?

Thanks for any help you can provide. Once i finish the testing/fixing of the code for all of these (still some loose ends to tie up) I will post the scripts I have.

-thunder

[NeilBryant]

I've done the first part of this, before, so I will comment only on that. I wrote a script for our help desk to remotely reboot PCs into Safe Mode.

editing the boot.ini file is the only way, as far as I could find out. I looked around; nada -- which makes sense. Windows doesn't decide to hit safe mode until the boot menu, so that's where you tell it to do so.

The safe way of doing it (the one I used) was to stick to minimal changes in the boot.ini, and backup a copy first. Reverting changes is a matter of recopying the original file back, which I did with a PendingFileRaname. That way, your file is replaced at the first available opportunity (before logon).

For the logon, I used the autoadminlogon (yes, by editing the registry) which I have used without a problem many times. I wasn't clear if that was the method you have, but I find it best. Don't be afraid of the registry - just stick to simple, verified changes, and it's pretty reliable.

As far as the last part, getting your second-half script to run is a matter of putting it (or a reference to it) in one of the startup folders, or one of the runkeys in the registry. If you use the HKLM Run key, your script will run before logon completes, but should do fine. If you opt for running it after logon completes, you might be better off putting it in your admin account's Start Menu Startup folder -- as it's easier to write that than try to get into HKCU for a not-logged-in user.

hth

[adamt]

As far as the last part, getting your second-half script to run is a matter of putting it (or a reference to it) in one of the startup folders, or one of the runkeys in the registry.

Safe mode's going to be the problem here. When in Safe Mode, the startup folders and Run keys will be ignored, and only a minimal set of services will be running.

I'm not sure if the Task Scheduler Service will be running in Safe Mode or not (I doubt it). If it is, you could (before the reboot in to safe mode) get the script to add a task to run SpyBot, using the at.exe command.

[NeilBryant]

Safe mode's going to be the problem here. When in Safe Mode, the startup folders and Run keys will be ignored, and only a minimal set of services will be running.

mon faut; I didn't even think about that (the script I wrote didn't need to restart itself). OTOH, you can force a run key to run in Safe Mode by putting an asterisk (*) before the value name:

http://support.microsoft.com/kb/314866

I'm not sure if the Task Scheduler Service will be running in Safe Mode or not (I doubt it). If it is, you could (before the reboot in to safe mode) get the script to add a task to run SpyBot, using the at.exe command.

You can actually get any of the services to run (mostly -- I've had dismal luck getting video drivers to override safemode VGA) if you want them to, with more registry hacks. The remote safe mode tool I wrote needed to run our remote desktop service in safe mode. It's a matter of configuring it under CurrentControlSet\Control\SafeBoot.

[adamt]

Thanks for the note about the * prefix in RunOnce. I never knew about that before - very useful.

[NeilBryant]

Thanks for the note about the * prefix in RunOnce. I never knew about that before - very useful.

np. Note the bang (!) prefix as well . . . handy if you need something to RunOnce repeatedly until it is successful.