@echo off

TITLE SDFix
color 1F
if [%1]==[/second] goto Second
if defined safeboot_option goto os

VER|%systemroot%\system32\find.exe "95" >NUL
IF NOT ERRORLEVEL 1 GOTO End
VER|%systemroot%\system32\find.exe "98">NUL
IF NOT ERRORLEVEL 1 GOTO End
VER|%systemroot%\system32\find.exe "Millennium">NUL
IF NOT ERRORLEVEL 1 GOTO End
VER|%systemroot%\system32\find.exe "Server">NUL
IF NOT ERRORLEVEL 1 GOTO End
VER|%systemroot%\system32\find.exe "Vista">NUL
IF NOT ERRORLEVEL 1 GOTO End

:AVclean
CLS

apps\ISADMIN.EXE>>AdminCheck.txt
%systemroot%\system32\find.exe /i "not"<AdminCheck.txt>nul && .\apps\WINMSG.EXE -t "Please Note:" -m "SDFix Requires Administrator Account Privileges, Please login to an Administrator Account before running SDFix"
IF EXIST AdminCheck.txt DEL /Q AdminCheck.txt >nul
IF NOT EXIST "%cd%\apps\CSweg.exe" COPY /Y "%cd%\apps\swreg.exe" "%cd%\apps\CSweg.exe">nul

echo.
echo                To run the SDFix tool please reboot to Safe Mode
echo        (Reboot, tap the F8 Key and choose Safe Mode from the Advanced Menu)
echo                (SDFix Requires Administrator Account Privileges)
echo.
echo              1. Download/Run a-squared from EMSI Software
echo              2. Download/Run Norman Malware Cleaner from Norman
echo              3. Download/Run SAV32CLI from Sophos
echo              4. Download/Run AVPTool from Kaspersky
echo.
echo              A. Create System Report
echo              B. Create Service/Driver List
echo              C. Create Catchme Log
echo              D. Export SafeBoot Key
echo.
echo              H. Add Windows Default Hosts File
echo              R. Repair SafeBoot Key
echo.
echo              U. Download latest version of SDFix
echo.
echo                     E. EXIT
echo.
echo           (Active Internet Connection Required To Download Files)
set /p Choice=Type A,B,C,D,R,U,1,2,3,4 or E to Exit....
if [%Choice%]==[a] goto SysRep
if [%Choice%]==[A] goto SysRep
if [%Choice%]==[b] goto SVDRCheck
if [%Choice%]==[B] goto SVDRCheck
if [%Choice%]==[c] goto ctchlog
if [%Choice%]==[C] goto ctchlog
if [%Choice%]==[d] goto SafeEx
if [%Choice%]==[D] goto SafeEx
if [%Choice%]==[u] goto SDUpdate
if [%Choice%]==[U] goto SDUpdate
if [%Choice%]==[1] goto ASRun
if [%Choice%]==[2] goto NGen
if [%Choice%]==[3] goto startAV
if [%Choice%]==[4] goto AVPTool
if [%Choice%]==[e] goto End
if [%Choice%]==[E] goto End
if [%Choice%]==[r] goto repairsbk
if [%Choice%]==[R] goto repairsbk
if [%Choice%]==[s] goto os
if [%Choice%]==[S] goto os
if [%Choice%]==[f] goto Second
if [%Choice%]==[F] goto Second
if [%Choice%]==[h] goto rsthosts
if [%Choice%]==[H] goto rsthosts

For %%a in (1,2,3,4,a,A,b,B,c,C,d,D,e,E,f,F,h,H,r,R,s,S,u,U,) do if not [%Choice%]==[%%a] goto End
echo.

:rsthosts

cls
echo.
echo.
echo Saving backup of existing hosts file to:
echo.
echo %cd%\HOSTS.BAK
echo.
echo Restoring Windows default Hosts file
echo.
echo.
echo Note:
echo If any protective Hosts files exist such as MVPS/HP hosts or Spybots
echo Immunizer feature, they should be reapplied after using this option
echo.
echo.
echo.
echo.
echo.
echo.
echo.
echo.
echo.
echo.
echo.
echo.

ATTRIB -h -s -r -a "%windir%\SYSTEM32\DRIVERS\ETC\HOSTS" >NUL
COPY /Y "%windir%\SYSTEM32\DRIVERS\ETC\HOSTS" "%CD%\HOSTS.BAK" >NUL
DEL /Q "%windir%\SYSTEM32\DRIVERS\ETC\HOSTS" >nul 2>&1

>%windir%\SYSTEM32\DRIVERS\ETC\HOSTS (
echo # Copyright © 1993-1999 Microsoft Corp.
echo #
echo # This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
echo #
echo # This file contains the mappings of IP addresses to host names. Each
echo # entry should be kept on an individual line. The IP address should
echo # be placed in the first column followed by the corresponding host name.
echo # The IP address and the host name should be separated by at least one
echo # space.
echo #
echo # Additionally, comments ^(such as these^) may be inserted on individual
echo # lines or following the machine name denoted by a "#" symbol.
echo #
echo # For example:
echo #
echo # 102.54.94.97 rhino.acme.com # source server
echo # 38.25.63.10 x.acme.com # x client host
echo #
echo 127.0.0.1 localhost
	)

pause
goto AVclean

exit

:repairsbk

apps\Csweg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System" /v DisableRegistryTools >nul
apps\Csweg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System" /v DisableRegistryTools >nul
apps\Csweg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System" /v DisableTaskMgr >nul
apps\Csweg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System" /v DisableTaskMgr >nul

ver|%systemroot%\system32\find.exe "Windows XP">nul && (
apps\Csweg QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CSDVersion|find.exe /i "Service Pack 2">NUL && apps\Csweg IMPORT apps\Restore_SafeBoot_WindowsXP_SP2.reg >nul && GOTO AVclean
apps\Csweg QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CSDVersion|find.exe /i "Service Pack 3">NUL && apps\Csweg IMPORT apps\Restore_SafeBoot_WindowsXP_SP3.reg >nul && GOTO AVclean
apps\Csweg IMPORT apps\Restore_SafeBoot_WindowsXP.reg
	)

ver|%systemroot%\system32\find.exe "Windows 2000">nul && apps\Csweg IMPORT apps\Restore_SafeBoot_Windows2000_SP4.reg >nul

goto AVclean

exit

:ctchlog
CLS
echo.
echo Running Catchme
echo.
echo Please wait...
echo.
echo Catchme log will open when the scan has finished
echo.
echo|apps\Cghtme.exe -xqpsrf "%systemroot%" "%programfiles%" "%userprofile%" >Catchme.log

Start notepad Catchme.log

exit

:SVDRCheck

CLS
echo.
echo Creating List, Please Wait...
echo.

IF EXIST Service_Driver.txt DEL /Q Service_Driver.txt
IF EXIST .\apps\Rec*.txt Del /q .\apps\Rec*.txt

time /t>CurrentT.txt 2>NUL
For /f "tokens=*" %%b in (CurrentT.txt) do Call Set cctime=%%b
del /q CurrentT.txt >NUL

echo.
>> Service_Driver.txt (
echo.
echo [b]Service/Driver List[/b]:
echo *******************
echo.
echo Run on %date% at %cctime%
ver
echo.
echo [b]Drivers[/b]:
echo.
apps\sc query type= driver|find.exe /I /V "WIN32_EXIT_CODE"|find.exe /I /V "SERVICE_EXIT_CODE"|find.exe /I /V "CHECKPOINT   "|find.exe /I /V " WAIT_HINT"|find.exe /I /V "IGNORES_SHUTDOWN"
echo.
echo.
echo [b]Services[/b]:
apps\psservice config|find.exe /I /V "ewer/cont"|find.exe /I /V "ssinovic"|find.exe /I /V "rnals - www."|find.exe /I /V "SERVICE_START_NAME"|find.exe /I /V "DEPENDENCIES	  :"|find.exe /I /V "LOAD_ORDER_GROUP  :"|find.exe /I /V "ERROR_CONTROL	  :"|find.exe /I /V "TYPE		  :"|find.exe /I /V "TAG		  :"|find.exe /I /V ": Restart	DELAY:"|find.exe /I /V "FAIL_RESET_PERIOD :"|find.exe /I /V "FAILURE_ACTIONS	  :"|find.exe /I /V "			  : "   
echo.
echo Finished!
echo. )

IF EXIST apps\Rec*.txt Del /q apps\Rec*.txt

Start notepad Service_Driver.txt

exit


:SafeEx

cls
IF EXIST SafeBoot.txt del /q SafeBoot.txt
apps\Csweg export "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot" SafeBoot.txt
Start notepad SafeBoot.txt && goto AVClean

exit

:SysRep

CLS
echo.
echo Creating List, Please Wait...
echo.
echo Please Be Patient As This Scan May Take Up To 10 Minutes
echo.

IF EXIST SystemReport.txt DEL /Q SystemReport.txt >NUL
IF EXIST apps\Rec*.txt Del /q apps\Rec*.txt >NUL

apps\Csweg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System" /v DisableRegistryTools >nul
apps\Csweg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System" /v DisableRegistryTools >nul
apps\Csweg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System" /v DisableTaskMgr >nul
apps\Csweg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System" /v DisableTaskMgr >nul

apps\LOCATE.COM "%systemdrive%\" /x:bat,com,dat,dll,exe,htm,reg,sys,tmp,zip /D- /NR /D:T-2M /O:"&1 &2 &5 &B     &W"|find.exe /I ":">>apps\RecRB0.txt
apps\LOCATE.COM "%systemroot%\" /x:bat,com,dat,dll,exe,htm,reg,sys,tmp,zip /D- /D:T-2M /O:"&1 &2 &5 &B     &W"|find.exe /I ":"|find.exe /I /V "\Prefetch"|find.exe /I /V "\SoftwareDistribution\"|find.exe /I /V "\ie7\reg"|find.exe /I /V "Perflib_Perfdata"|find.exe /I /V "\DataColl\"|find.exe /I /V "\SDFIX"|find.exe /I /V "\Repository\"|find.exe /I /V "\CryptnetUrlCache\"|find.exe /I /V "\CatRoot2\"|find.exe /I /V "\config\"|find.exe /I /V "\Protect\S-1-5-18\"|find.exe /I /V "\wbem\Performance\"|find.exe /I /V "\wbem\Logs\"|find.exe /I /V "WINDOWS\Installer\"|find.exe /I /V "WINDOWS\assembly\"|find.exe /I /V "$NtUninstallKB"|find.exe /I /V "WINDOWS\ie7updates"|find.exe /I /V "$hf_mig$"|find.exe /I /V "system32\CatRoot\"|find.exe /I /V "helpctr\System\"|find.exe /I /V "\DRVSTORE\">>apps\RecRB2.txt
apps\LOCATE.COM "%programfiles%\" /x:bat,com,dat,dll,exe,htm,reg,sys,tmp,zip /D:T-2M /O:"&1 &2 &5 &B     &W"|find.exe /I ":"|find.exe /I /V "\Symantec Shared\"|find.exe /I /V "QuickTime\"|find.exe /I /V " HP\">>apps\RecRB6.txt


time /t>CurrentT.txt 2>NUL
For /f "tokens=*" %%b in (CurrentT.txt) do Call Set cctime=%%b
del /q CurrentT.txt >NUL
> SystemReport.txt (
echo.
echo [b]System Report[/b]
echo *************
echo.
echo Run on %date% at %cctime%
ver
echo.
apps\ISADMIN.EXE
echo.
echo [b]Running Processes[/b]:
echo.
apps\procs.exe -l|find.exe /I "["|find.exe /I /V "SDFix\"|find.exe /I /V "system32\cmd.exe"|find.exe /I /V "system32\find.exe"|find.exe /I /V "system32\ntvdm.exe"|find.exe /I /V "WINDOWS\regedit.exe"
echo.
echo.
echo [b]Drivers - Running[/b]:
echo.
apps\sc query type= driver | findstr.exe -i "service_name">apps\recdrv1.txt
For /f "tokens=2 delims=: " %%G in (apps\recdrv1.txt) do echo %%G
echo.
echo.
echo [b]Drivers - Stopped[/b]:
echo.
apps\sc query type= driver state= inactive | findstr.exe -i "service_name">apps\recdrv2.txt
For /f "tokens=2 delims=: " %%G in (apps\recdrv2.txt) do echo %%G
echo.
echo.
echo [b]Services - Running[/b]:
echo.
apps\sc query | findstr.exe -i "service_name">apps\recdrv3.txt
For /f "tokens=2 delims=: " %%G in (apps\recdrv3.txt) do echo %%G
echo.
echo.
echo [b]Services - Stopped[/b]:
echo.
apps\sc query state= inactive | findstr.exe -i "service_name">apps\recdrv4.txt
For /f "tokens=2 delims=: " %%G in (apps\recdrv4.txt) do echo %%G
echo.
echo.
echo [b]Files Created/Modified - 60 Days[/b]:
echo.
echo.
echo %systemdrive%\
echo.
IF EXIST apps\RecRB0.txt TYPE apps\RecRB0.txt
echo.
echo.
echo %systemroot%\
echo.
IF EXIST apps\RecRB2.txt TYPE apps\RecRB2.txt
echo.
echo.
echo %programfiles%\
echo.
IF EXIST apps\RecRB6.txt TYPE apps\RecRB6.txt
echo.
echo.
echo [b]Files with hidden attributes[/b]:
echo.
apps\locate "%systemdrive%\" /A:D-H+ /x:bak,com,dll,exe,pif,reg,sys,tmp,zip /UK /O:"&4 &1 &5 &B --- &W"|find.exe /I ":"|find.exe /V /I ".manifest"|find.exe /V /I "IO.SYS"|find.exe /V /I "pagefile.sys"|find.exe /V /I "MSDOS.SYS"|find.exe /V /I "NTDETECT.COM"|find.exe /V /I "hiberfil.sys"|find.exe /V /I "CONFIG.SYS"|find.exe /V /I "arcsetup.exe"|find.exe /V /I "arcldr.exe"|find.exe /V /I "SDFix\"|find.exe /V /I "default.tmp.LOG"|find.exe /V /I "software.tmp.LOG"|find.exe /V /I "system.tmp.LOG"
echo.
echo.
echo [b]Program Folders[/b]:
echo.
echo %programfiles%\
echo.
dir /b/a:d/o:n "%programfiles%\" 2>nul
echo.
echo %commonprogramfiles%\
echo.
dir /b/a:d/o:n "%commonprogramfiles%\" 2>nul
echo.
echo 25%% Checked >CON
echo.
echo [b]Add/Remove Programs[/b]:
echo.
apps\Csweg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"|find.exe /I "\Uninstall\">>apps\Rec7.txt
apps\Csweg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"|find.exe /I "\Uninstall\">>apps\Rec8.txt
For /f "tokens=7 delims=\" %%G in (apps\Rec7.txt) do apps\Csweg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%%G" /v "DisplayName"|find.exe /I "DisplayName"|find.exe /I /V "Error"|find.exe /I /V "WebFldrs XP">>apps\Rec9.txt
For /f "tokens=7 delims=\" %%G in (apps\Rec8.txt) do apps\Csweg.exe QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%%G" /v "DisplayName"|find.exe /I "DisplayName"|find.exe /I /V "Error">>apps\Rec9.txt
For /f "tokens=3 delims=	" %%G in (apps\Rec9.txt) do echo %%G
echo.
echo.
echo [b]Run Values[/b]:
apps\Csweg export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" apps\Rec10.txt
apps\Csweg export "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" apps\Rec11.txt
apps\Csweg export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" apps\Rec12.txt
apps\Csweg export "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" apps\Rec13.txt
apps\Csweg export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx" apps\Rec12B.txt
apps\Csweg export "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx" apps\Rec13B.txt
apps\Csweg export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices" apps\Rec14.txt
apps\Csweg export "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices" apps\Rec15.txt
apps\Csweg export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" apps\Rec16.txt
apps\Csweg export "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" apps\Rec17.txt
apps\Csweg export "HKEY_USERS\.DEFAULT\Microsoft\Windows\CurrentVersion\Run" apps\Rec17a.txt
apps\Csweg export "HKEY_USERS\.DEFAULT\Microsoft\Windows\CurrentVersion\RunOnce" apps\Rec17b.txt
apps\Csweg export "HKEY_USERS\.DEFAULT\Microsoft\Windows\CurrentVersion\RunServices" apps\Rec17c.txt
IF EXIST apps\Rec10.txt find.exe /I "="<apps\Rec10.txt>nul && TYPE apps\Rec10.txt|find.exe /I /V "Registry Editor"
IF EXIST apps\Rec11.txt find.exe /I "="<apps\Rec11.txt>nul && TYPE apps\Rec11.txt|find.exe /I /V "Registry Editor"
IF EXIST apps\Rec12.txt find.exe /I "="<apps\Rec12.txt>nul && TYPE apps\Rec12.txt|find.exe /I /V "Registry Editor"
IF EXIST apps\Rec13.txt find.exe /I "="<apps\Rec13.txt>nul && TYPE apps\Rec13.txt|find.exe /I /V "Registry Editor"
IF EXIST apps\Rec12B.txt find.exe /I "="<apps\Rec12B.txt>nul && TYPE apps\Rec12B.txt|find.exe /I /V "Registry Editor"
IF EXIST apps\Rec13B.txt find.exe /I "="<apps\Rec13B.txt>nul && TYPE apps\Rec13B.txt|find.exe /I /V "Registry Editor"
IF EXIST apps\Rec14.txt find.exe /I "="<apps\Rec14.txt>nul && TYPE apps\Rec14.txt|find.exe /I /V "Registry Editor"
IF EXIST apps\Rec15.txt find.exe /I "="<apps\Rec15.txt>nul && TYPE apps\Rec15.txt|find.exe /I /V "Registry Editor"
IF EXIST apps\Rec16.txt find.exe /I "="<apps\Rec16.txt>nul && TYPE apps\Rec16.txt|find.exe /I /V "Registry Editor"
IF EXIST apps\Rec17.txt find.exe /I "="<apps\Rec17.txt>nul && TYPE apps\Rec17.txt|find.exe /I /V "Registry Editor"
IF EXIST apps\Rec17a.txt find.exe /I "="<apps\Rec17a.txt>nul && TYPE apps\Rec17a.txt|find.exe /I /V "Registry Editor"
IF EXIST apps\Rec17b.txt find.exe /I "="<apps\Rec17b.txt>nul && TYPE apps\Rec17b.txt|find.exe /I /V "Registry Editor"
IF EXIST apps\Rec17c.txt find.exe /I "="<apps\Rec17c.txt>nul && TYPE apps\Rec17c.txt|find.exe /I /V "Registry Editor"
echo.
echo.
echo [b]Bot Check[/b]:
echo.
apps\sc qc "wscsvc" >>apps\RecR1.txt
IF EXIST apps\RecR1.txt find.exe /I "START_TYPE"<apps\RecR1.txt>NUL && (
find.exe /I "SERVICE_NAME"<apps\RecR1.txt
find.exe /I "DISPLAY_NAME"<apps\RecR1.txt
find.exe /I "START_TYPE"<apps\RecR1.txt
echo. )
apps\sc qc "sharedaccess" >>apps\RecR2.txt
IF EXIST apps\RecR2.txt find.exe /I "START_TYPE"<apps\RecR2.txt>NUL && (
find.exe /I "SERVICE_NAME"<apps\RecR2.txt
find.exe /I "DISPLAY_NAME"<apps\RecR2.txt
find.exe /I "START_TYPE"<apps\RecR2.txt
echo. )
apps\sc qc "wuauserv" >>apps\RecR3.txt
IF EXIST apps\RecR3.txt find.exe /I "START_TYPE"<apps\RecR3.txt>NUL && (
find.exe /I "SERVICE_NAME"<apps\RecR3.txt
find.exe /I "DISPLAY_NAME"<apps\RecR3.txt
find.exe /I "START_TYPE"<apps\RecR3.txt
echo. )
apps\sc qc "srservice" >>apps\RecR33c.txt
IF EXIST apps\RecR33c.txt find.exe /I "START_TYPE"<apps\RecR33c.txt>NUL && (
find.exe /I "SERVICE_NAME"<apps\RecR33c.txt
find.exe /I "DISPLAY_NAME"<apps\RecR33c.txt
find.exe /I "START_TYPE"<apps\RecR33c.txt
echo. )
echo 50%% Checked >CON
apps\Csweg export "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" apps\RecR6.txt
IF EXIST apps\RecR6.txt find.exe /I "DoNotAllow"<apps\RecR6.txt>NUL && (
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]
find.exe /I "DoNotAllow"<apps\RecR6.txt
echo. )
apps\Csweg export "HKLM\SOFTWARE\Microsoft\Ole" apps\RecR7.txt
IF EXIST apps\RecR7.txt find.exe /I "EnableDCOM"<apps\RecR7.txt>NUL && (
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole]
find.exe /I "EnableDCOM"<apps\RecR7.txt
find.exe /I "EnableRemoteConnect"<apps\RecR7.txt
echo. )
apps\Csweg export "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" apps\RecRA1.txt
IF EXIST apps\RecRA1.txt find.exe /I "No"<apps\RecRA1.txt>NUL && (
echo [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop]
find.exe /I "No"<apps\RecRA1.txt
echo. )
apps\Csweg export "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" apps\RecREE1.txt
IF EXIST apps\RecREE1.txt find.exe /I "ClassicShell"<apps\RecREE1.txt>NUL && (
echo [HKEY_CURRENT_USER\\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
find.exe /I "ClassicShell"<apps\RecREE1.txt
find.exe /I "No"<apps\RecREE1.txt
find.exe /I "Force"<apps\RecREE1.txt
echo. )
apps\Csweg export "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" apps\RecR8A.txt
IF EXIST apps\RecR8A.txt find.exe /I "Disable"<apps\RecR8A.txt>NUL && (
echo [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
find.exe /I "Disable"<apps\RecR8A.txt
find.exe /I "Wallpaper"<apps\RecR8A.txt
echo. )
apps\Csweg export "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" apps\RecR8B.txt
IF EXIST apps\RecR8B.txt find.exe /I "Disable"<apps\RecR8B.txt>NUL && (
echo [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
find.exe /I "Disable"<apps\RecR8B.txt
find.exe /I "Wallpaper"<apps\RecR8B.txt
echo. )
apps\Csweg export "HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System" apps\RecR8C.txt
IF EXIST apps\RecR8C.txt find.exe /I "Disable"<apps\RecR8C.txt>NUL && (
echo [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System]
find.exe /I "Disable"<apps\RecR8C.txt
find.exe /I "Wallpaper"<apps\RecR8C.txt
echo. )
apps\Csweg export "HKCU\Software\Microsoft\OLE" apps\RecR9.txt
IF EXIST apps\RecR9.txt find.exe /I ".exe"<apps\RecR9.txt>NUL && (
echo [HKEY_CURRENT_USER\Software\Microsoft\OLE]
find.exe /I ".exe"<apps\RecR9.txt
echo. )
apps\Csweg export "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" apps\RecR11.txt
IF EXIST apps\RecR11.txt find.exe /I "restrictanonymous"<apps\RecR11.txt>NUL && (
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
find.exe /I "restrictanonymous"<apps\RecR11.txt|find.exe /I /V "restrictanonymoussam"
echo. )
apps\Csweg export "HKLM\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" apps\RecR12.txt
IF EXIST apps\RecR12.txt find.exe /I "AUOptions"<apps\RecR12.txt>NUL && (
echo [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update]
find.exe /I "AUOptions"<apps\RecR12.txt
echo. )
apps\Csweg export "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" apps\RecR13.txt
IF EXIST apps\RecR13.txt find.exe /I "DisallowRun"<apps\RecR13.txt|find.exe /I /V "]">NUL && (
echo [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
find.exe /I "DisallowRun"<apps\RecR13.txt|find.exe /I /V "]"
echo. )
apps\Csweg export "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" apps\RecR15.txt
IF EXIST apps\RecR15.txt find.exe /I "Protected system"<apps\RecR15.txt>NUL && (
echo [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun]
find.exe /I "Protected system"<apps\RecR15.txt
echo. )
apps\Csweg export "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile" apps\RecR17.txt
IF EXIST apps\RecR17.txt find.exe /I "EnableFirewall"<apps\RecR17.txt>NUL && (
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
find.exe /I "EnableFirewall"<apps\RecR17.txt
echo. )
apps\Csweg export "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile" apps\RecR19.txt
IF EXIST apps\RecR19.txt find.exe /I "EnableFirewall"<apps\RecR19.txt>NUL && (
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
find.exe /I "EnableFirewall"<apps\RecR19.txt
echo. )
apps\Csweg export "HKLM\SOFTWARE\Microsoft\Security Center" apps\RecR21.txt
IF EXIST apps\RecR21.txt find.exe /I "DisableNotify"<apps\RecR21.txt>NUL && (
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
find.exe /I "DisableNotify"<apps\RecR21.txt
find.exe /I "Override"<apps\RecR21.txt
echo. )
apps\Csweg query "HKLM\SYSTEM\CurrentControlSet\Control" /v "WaitToKillServiceTimeout"|find.exe /I "WaitToKillServiceTimeout" >>apps\RecR23.txt
IF EXIST apps\RecR23.txt find.exe /I "WaitToKillServiceTimeout"<apps\RecR23.txt>NUL && (
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
For /f "tokens=3 delims=	" %%G in (apps\RecR23.txt) do echo "WaitToKillServiceTimeout"="%%G"
echo. )
apps\Csweg export "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" apps\RecR25.txt
IF EXIST apps\RecR25.txt find.exe /I "Shell"<apps\RecR25.txt>NUL && (
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
find.exe /I "SFCDisable"<apps\RecR25.txt
find.exe /I "SFCScan"<apps\RecR25.txt
find.exe /I "Shell"<apps\RecR25.txt|find.exe /I "Explorer.exe"
find.exe /I "Userinit"<apps\RecR25.txt )
apps\Csweg EXPORT "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions" apps\RecR26.txt
IF EXIST apps\RecR26.txt find.exe /I "{"<apps\RecR26.txt>NUL && (
find.exe /I /V "extensions\"<apps\RecR26.txt|find.exe /I /V "{"|find.exe /I /V "Version 5.00" )
apps\Csweg export "HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters" apps\RecR27.txt
IF EXIST apps\RecR27.txt find.exe /I "TransportBindName"<apps\RecR27.txt>NUL && (
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters]
find.exe /I "TransportBindName"<apps\RecR27.txt
echo. )
apps\Csweg export "HKLM\SYSTEM\CurrentControlSet\Services\lanmanworkstation\parameters" apps\RecR28.txt
IF EXIST apps\RecR28.txt find.exe /I "AutoShare"<apps\RecR28.txt>NUL && (
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation\parameters]
find.exe /I "AutoShare"<apps\RecR28.txt
echo. )
apps\Csweg export "HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters" apps\RecR29.txt
IF EXIST apps\RecR29.txt find.exe /I "AutoShare"<apps\RecR29.txt>NUL && (
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters]
find.exe /I "AutoShare"<apps\RecR29.txt
echo. )
echo.
echo [b]ShellExecuteHooks[/b]:
apps\Csweg export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks" apps\RecR30.txt
IF EXIST apps\RecR30.txt find.exe /I "{"<apps\RecR30.txt>NUL && (
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
find.exe /I "{"<apps\RecR30.txt
echo. )
echo. 
echo.
echo [b]Environment[/b]:
apps\Csweg query "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment" /s|find.exe /I /V "elWer"|find.exe /I /V "itten b"|find.exe /I /V "PROCESSOR_ARCHITECTURE"|find.exe /I /V "PROCESSOR_"|find.exe /I /V "NUMBER_OF_PROCESSORS"|find.exe /I /V "FP_NO_HOST_CHECK"
echo.
echo [b]SecurityProviders[/b]:
echo.
echo HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders
apps\Csweg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders"|find.exe /I "SecurityProviders	"
echo.
echo.
echo [b]Authentication Packages[/b]:
echo.
echo HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
apps\Csweg query "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v "Authentication Packages"|find.exe /I "Authentication Packages"
echo.
echo.
echo [b]Subsystem Startup[/b]:
echo.
apps\Csweg QUERY "HKLM\system\currentcontrolset\control\session manager\subsystems" /v Windows|find.exe /I "Windows">apps\recsub1.txt
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems]
For /f "tokens=3 delims=	" %%G in (apps\recsub1.txt) do echo "Windows"="%%G"
echo.
echo.
echo [b]Midi Drivers[/b]:
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
apps\Csweg export "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" apps\recmidi1.txt
find.exe /i "midi"<apps\recmidi1.txt|find.exe /I /V "midimapper"
echo.
echo.
echo [b]Non-Default IFEO Debugger[/b]:
apps\Csweg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options"|find.exe /I "HKEY_"|find.exe /I /V "\your image">>apps\Rec21.txt
IF EXIST apps\Rec21.txt For /f "tokens=7 delims=\" %%G in (apps\Rec21.txt) do apps\Csweg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\%%G"|find.exe /I "Debugger">nul && echo %%G>>apps\Rec22.txt
IF EXIST apps\Rec22.txt For /f "tokens=*" %%G in (apps\Rec22.txt) do apps\Csweg.exe query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\%%G"|find.exe /I /V "lWerX"|find.exe /I /V "Writt"
echo.
echo.
echo 75%% Checked >CON
echo [b]Non-Default Installed Components[/b]:
apps\Csweg query "HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components"|find.exe /I "HKEY_"|find.exe /I /V "89b4c1cd-b018-4511-b0a1-5476dbf70820"|find.exe /I /V "89820200-ecbd-11cf-8b85-00aa005b4383"|find.exe /I /V "89820200-ecbd-11cf-8b85-00aa005b4340"|find.exe /I /V "881dd1c5-3dcf-431b-b061-f3f88e8be88a"|find.exe /I /V "7790769c-0471-11d2-af11-00c04fa35d02"|find.exe /I /V "6bf52a52-394a-11d3-b153-00c04f79faa6"|find.exe /I /V "60b49e34-c7cc-11d0-8953-00a0c90347ff"|find.exe /I /V "5945c046-1e7d-11d1-bc44-00c04fd912be"|find.exe /I /V "4b218e3e-bc98-4770-93d3-2731b9329278"|find.exe /I /V "44bba842-cc51-11cf-aafa-00aa00b6015b"|find.exe /I /V "44bba840-cc51-11cf-aafa-00aa00b6015c"|find.exe /I /V "2c7339cf-2b09-4501-b3f3-f3508c9228ed"|find.exe /I /V "{22d6f312-b0f6-11d0-94ab-0080c74c7e95}"|find.exe /I /V "{2179c5d3-ebff-11cf-b6fd-00aa00b4e220}"|find.exe /I /V "{22d6f312-b0f6-11d0-94ab-0080c74c7e95}"|find.exe /I /V "{26923b43-4d38-484f-9b9e-de460746276c}"|find.exe /I /V "{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}"|find.exe /I /V "{6a5110b5-e14b-4268-a065-ef89ff33c325}"|find.exe /I /V "{73fa19d0-2d75-11d2-995d-00c04f98bbc9}"|find.exe /I /V "{9ef0045a-cdd9-438e-95e6-02b9afec8e11}"|find.exe /I /V "Error"|find.exe /I /V "94de52c8-2d59-4f1b-883e-79663d2d9a8c"|find.exe /I /V "8b15971b-5355-4c82-8c07-7e181ea07608"|find.exe /I /V "kb910393"|find.exe /I /V "407408d4-94ed-4d86-ab69-a7f649d112ee"|find.exe /I /V "ca0a4247-44be-11d1-a005-00805f8abe06">>apps\Rec23.txt
apps\Csweg query "HKCU\SOFTWARE\Microsoft\Active Setup\Installed Components"|find.exe /I "HKEY_"|find.exe /I /V "Error"|find.exe /I /V "26923b43-4d38-484f-9b9e-de460746276c"|find.exe /I /V "60B49E34-C7CC-11D0-8953-00A0C90347FF"|find.exe /I /V "881dd1c5-3dcf-431b-b061-f3f88e8be88a"|find.exe /I /V "2179C5D3-EBFF-11CF-B6FD-00AA00B4E220"|find.exe /I /V "22d6f312-b0f6-11d0-94ab-0080c74c7e95"|find.exe /I /V "2C7339CF-2B09-4501-B3F3-F3508C9228ED"|find.exe /I /V "-CC51-11CF-AAFA-00AA00B6015C}"|find.exe /I /V "4b218e3e-bc98-4770-93d3-2731b9329278"|find.exe /I /V "5945c046-1e7d-11d1-bc44-00c04fd912be"|find.exe /I /V "6BF52A52-394A-11d3-B153-00C04F79FAA6"|find.exe /I /V "72A6D77E-9D80-242D-AC8A-1B032B1DD625"|find.exe /I /V "7790769C-0471-11d2-AF11-00C04FA35D02"|find.exe /I /V "89820200-ECBD-11cf-8B85-00AA005B4">>apps\Rec23B.txt
For /f "tokens=6 delims=\" %%G in (apps\Rec23.txt) do apps\Csweg.exe QUERY "HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\%%G"|find.exe /I "Stubpath">nul && echo %%G>>apps\Rec24.txt
For /f "tokens=6 delims=\" %%G in (apps\Rec23B.txt) do apps\Csweg.exe QUERY "HKCU\SOFTWARE\Microsoft\Active Setup\Installed Components\%%G"|find.exe /I "Stubpath">nul && echo %%G>>apps\Rec24B.txt
IF EXIST apps\Rec24.txt For /f "tokens=*" %%G in (apps\Rec24.txt) do apps\Csweg.exe query "HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\%%G"|find.exe /I /V "elWerX"|find.exe /I /V "Writte"|find.exe /I /V "ComponentID"|find.exe /I /V "IsInstalled"|find.exe /I /V "Locale	REG_SZ"|find.exe /I /V "DontAsk	REG_DWORD"
IF EXIST apps\Rec24B.txt For /f "tokens=*" %%G in (apps\Rec24B.txt) do apps\Csweg.exe query "HKCU\SOFTWARE\Microsoft\Active Setup\Installed Components\%%G"|find.exe /I /V "elWerX"|find.exe /I /V "Writte"|find.exe /I /V "ComponentID"|find.exe /I /V "IsInstalled"|find.exe /I /V "Locale	REG_SZ"|find.exe /I /V "DontAsk	REG_DWORD"
echo.
echo.
echo [b]Non-Default Safeboot Minimal[/b]:
apps\Csweg query "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal"|find.exe /I "HKEY_"|find.exe /I /V "\AppMgmt"|find.exe /I /V "\Base"|find.exe /I /V "\Boot Bus Extender"|find.exe /I /V "\Boot file system"|find.exe /I /V "\CryptSvc"|find.exe /I /V "\DcomLaunch"|find.exe /I /V "\dmadmin"|find.exe /I /V "\dmboot.sys"|find.exe /I /V "\dmio.sys"|find.exe /I /V "\dmload.sys"|find.exe /I /V "\dmserver"|find.exe /I /V "\EventLog"|find.exe /I /V "\File system"|find.exe /I /V "\Filter"|find.exe /I /V "\HelpSvc"|find.exe /I /V "\Netlogon"|find.exe /I /V "\PCI Configuration"|find.exe /I /V "\PlugPlay"|find.exe /I /V "\PNP Filter"|find.exe /I /V "\Primary disk"|find.exe /I /V "\RpcSs"|find.exe /I /V "\SCSI Class"|find.exe /I /V "\sermouse.sys"|find.exe /I /V "\sglfb.sys"|find.exe /I /V "\sr.sys"|find.exe /I /V "\SRService"|find.exe /I /V "\System Bus Extender"|find.exe /I /V "\tga.sys"|find.exe /I /V "\vds"|find.exe /I /V "\vga.sys"|find.exe /I /V "\vgasave.sys"|find.exe /I /V "\WinMgmt"|find.exe /I /V "\{36FC9E60-C465-11CF-8056-444553540000}"|find.exe /I /V "{533c5b84-ec70-11d2-9505-00c04f79deaf}"|find.exe /I /V "-E325-11CE-BFC1-08002BE10318}"|find.exe /I /V "\{71A27CDD-812A-11D0-BEC7-08002BE2092F}"|find.exe /I /V "\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}">>apps\Rec25.txt
IF EXIST apps\Rec25.txt For /f "tokens=7 delims=\" %%G in (apps\Rec25.txt) do apps\Csweg.exe query "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\%%G"|find.exe /I /V "lWerX"|find.exe /I /V "Writt"|find.exe /I /V "Error"
echo.
echo.
echo [b]File Associations[/b]:
echo.
apps\Csweg export "HKEY_CLASSES_ROOT\batfile\shell\open\command" apps\Rec26.txt
TYPE apps\Rec26.txt|find.exe /I /V "Registry Editor"
apps\Csweg export "HKEY_CLASSES_ROOT\cmdfile\shell\open\command" apps\Rec27.txt
TYPE apps\Rec27.txt|find.exe /I /V "Registry Editor"
apps\Csweg export "HKEY_CLASSES_ROOT\comfile\shell\open\command" apps\Rec28.txt
TYPE apps\Rec28.txt|find.exe /I /V "Registry Editor"
apps\Csweg export "HKEY_CLASSES_ROOT\exefile\shell\open\command" apps\Rec29.txt
TYPE apps\Rec29.txt|find.exe /I /V "Registry Editor"
apps\Csweg export "HKEY_CLASSES_ROOT\htafile\shell\open\command" apps\Rec30.txt
TYPE apps\Rec30.txt|find.exe /I /V "Registry Editor"
apps\Csweg export "HKEY_CLASSES_ROOT\HTTP\shell\open\command" apps\Rec31.txt
TYPE apps\Rec31.txt|find.exe /I /V "Registry Editor"
apps\Csweg export "HKEY_CLASSES_ROOT\htmlfile\shell\open\command" apps\Rec32.txt
TYPE apps\Rec32.txt|find.exe /I /V "Registry Editor"
apps\Csweg export "HKEY_CLASSES_ROOT\regedit\shell\open\command" apps\Rec33.txt
TYPE apps\Rec33.txt|find.exe /I /V "Registry Editor"
apps\Csweg export "HKEY_CLASSES_ROOT\regfile\shell\open\command" apps\Rec34.txt
TYPE apps\Rec34.txt|find.exe /I /V "Registry Editor"
echo 100%% Checked >CON
apps\Csweg export "HKEY_CLASSES_ROOT\scrfile\shell\open\command" apps\Rec34B.txt
TYPE apps\Rec34B.txt|find.exe /I /V "Registry Editor"
echo.
apps\Csweg query "HKEY_CLASSES_ROOT\txtfile\shell\open\command"|find.exe /I "32\">>apps\Rec35.txt
echo [HKEY_CLASSES_ROOT\txtfile\shell\open\command]
For /f "tokens=3 delims=	" %%G in (apps\Rec35.txt) do echo @="%%G"
echo.
echo.
echo [b]Finished![/b]
echo.
	)

IF EXIST apps\Rec*.txt Del /q apps\Rec*.txt
IF EXIST Catchmesr.log Del /q Catchmesr.log

Start notepad SystemReport.txt && exit 

exit

:SDUpdate
CLS
IF EXIST SDFix.exe del /q SDFix.exe
IF EXIST %systemdrive%\SDFix.exe del /q %systemdrive%\SDFix.exe
echo.
echo Downloading Latest Version of SDFix
echo.
apps\download http://downloads.andymanchesta.com/RemovalTools/SDFix.exe %systemdrive%\SDFix.exe
pause
IF NOT EXIST %systemdrive%\SDFix.exe GOTO SDUpdate

CLS
echo.
echo.
echo.
echo.
echo.
echo.
echo          SDFix will need to close to allow new files to be added
echo.
echo          Press any key to close SDFix and extract latest version
echo.
echo.
echo.
echo.
echo.
echo.
echo.
pause 
Start %systemdrive%\SDFix.exe

exit

:AVPTool


START "%programfiles%\Internet Explorer\IEXPLORE.EXE" "http://downloads5.kaspersky-labs.com/devbuilds/AVPTool/"

CLS
goto AVCLean

exit

:NGen
CLS
IF EXIST Norman_Malware_Cleaner.exe goto NGenrun
echo.
echo Downloading Norman Malware Cleaner
echo.
echo Norman Malware Cleaner - http://www.norman.com/Virus/Virus_removal_tools/en
echo.
apps\download http://download.norman.no/public/Norman_Malware_Cleaner.exe Norman_Malware_Cleaner.exe
pause

:NGenrun
Start Norman_Malware_Cleaner.exe /run
CLS
echo.
echo.
echo.
echo.
echo           SDFix will now exit and Norman Malware Cleaner will start 
echo.
echo.
echo.
echo         Please Be Patient as the tool may take up to a minute to open...
echo.
echo.
echo.
echo.
echo.
echo.
echo           Scan results will save to 'Desktop\NFix_DATE_TIME.log'
echo.
echo.
echo.
echo.
pause
exit

:ASRun
IF EXIST a2cmd.exe GOTO ASmenu
IF EXIST a2cmd.zip GOTO ASZIP
CLS
echo Downloading a-squared Command Line Scanner
echo.
echo EMSI Software - http://www.emsisoft.com
echo.
apps\download http://download3.emsisoft.com/a2cmd.zip a2cmd.zip
pause
GOTO ASRun 

:ASZIP
apps\unzip -o a2cmd.zip
IF NOT EXIST a2cmd.exe GOTO ASRun

:ASmenu

CLS
echo.
echo.
echo               a-squared Command Line Scanner (EMSI Software)
echo.
echo           (%systemdrive%, Memory, Cookie, Archive and ADS scanning enabled)
echo           (Infected Items are placed into the Quarantine Folder)
echo.
echo   1. Update (Please Update Before Scanning!)
echo.
echo   2. Full Scan 
echo.
echo   3. Full Scan (Heuristic/Riskware Scanning enabled)
echo.
echo   4. Save Quarantine List (Quarantine_Report.txt)
echo.
echo   E. EXIT
echo.
echo     Scanlogs will save to:
echo     %cd%\asquared_Report.txt  
echo.
echo.
set /p Choice=Type 1,2,3,4 or E to Exit....
if [%Choice%]==[1] goto ASUpd
if [%Choice%]==[2] goto ASfull
if [%Choice%]==[3] goto ASheur
if [%Choice%]==[4] goto ASQuar
if [%Choice%]==[E] goto End
For %%a in (1,2,3,4,e,E) do if not [%Choice%]==[%%a] goto End

GOTO AVclean

:ASQuar

a2cmd /ql>Quarantine_Report.txt
start notepad Quarantine_Report.txt

goto ASMenu

:ASUpd
CLS
a2cmd /U

goto ASMenu

:ASfull
start a2cmd /f="%systemdrive%" /m /t /c /a /n /q /l="%cd%\asquared_Report.txt"

exit

:ASheur
start a2cmd /f="%systemdrive%" /m /t /c /h /r /a /n /q /l="%cd%\asquared_Report.txt"

exit

:MENU

CLS
echo.
echo.
echo          Sophos Anti-Virus for Win32 Command Line Interface 
echo                           (SAV32CLI)
echo.
echo.
echo                 1 - Run Quick Scan
echo                 2 - Run Quick scan/Disinfect
echo                 3 - Run Quick scan/Remove Infections
echo                 4 - Run Full Scan 
echo                 5 - Run Full scan/Disinfect
echo                 6 - Run Full scan/Remove Infections
echo                 E - EXIT
echo.
echo.
echo     Scanlogs will save to:
echo     %cd%\SophosReport.txt  
echo.
echo.
echo.
echo.
set /p Choice=Type (1,2,3,4,5,6) to Run Sophos AV scan and save the log or E to Exit....
if [%Choice%]==[1] goto startquick
if [%Choice%]==[2] goto quickdi
if [%Choice%]==[3] goto quickrem
if [%Choice%]==[4] goto startfull
if [%Choice%]==[5] goto fulldi
if [%Choice%]==[6] goto fullrem
if [%Choice%]==[e] goto End
if [%Choice%]==[E] goto End
For %%a in (1,2,3,4,5,6,e,E) do if not [%Choice%]==[%%a] goto AVclean

:startAV
CLS
echo Downloading Definition File from Sophos...
echo.
echo Sophos Anti-Virus - http://www.sophos.com/
echo.
MD "%cd%\IDE">NUL
apps\download http://www.sophos.com/downloads/ide/434_ides.zip 434_ides.zip
apps\unzip -o 434_ides.zip

MOVE *.ide "%cd%\IDE" >NUL
DEL /Q 434_ides.zip >NUL

del /q SophosReport.txt sav32sfx.exe 2>nul
if exist %systemdrive%\SAV32CLI\SAV32CLI.EXE goto MENU

echo.
echo.
echo Downloading SAV32CLI from Sophos...
echo Sophos Anti-Virus - http://www.sophos.com/
echo.
apps\download http://www.sophos.com/tools/sav32sfx.exe sav32sfx.exe
pause
echo.
if exist sav32sfx.exe goto SSSNext
if not exist sav32sfx.exe goto startAV

goto MENU

:SSSNext

if exist %systemdrive%\SAV32CLI\SAV32CLI.EXE goto MENU

cls
echo.
echo                    Please Unzip files to the default location:
echo.
echo                              %systemdrive%\SAV32CLI
echo.
echo     When the Sophos extraction window opens Click 'OK', next click 'Unzip' 
echo.
echo           then 'OK' again and click 'Close' then any key to continue   
echo.
echo.
echo.
echo.                               
echo.
echo.
echo.
echo.
echo.
echo.
echo.
echo.

if exist sav32sfx.exe start sav32sfx.exe

PAUSE

if exist %systemdrive%\SAV32CLI\SAV32CLI.EXE goto MENU
if not exist sav32sfx.exe goto StartAV

GOTO Next

:startquick
start %systemdrive%\SAV32CLI\SAV32CLI -nb -dn --stop-scan -idedir="%cd%\IDE" -P="%cd%\SophosReport.txt"
GOTO END

:quickdi
start %systemdrive%\SAV32CLI\SAV32CLI -di -nc -nb -dn --stop-scan -idedir="%cd%\IDE" -P="%cd%\SophosReport.txt"
GOTO END

:quickrem
start %systemdrive%\SAV32CLI\SAV32CLI -remove -nc -nb -dn --stop-scan -idedir="%cd%\IDE" -P="%cd%\SophosReport.txt"
GOTO END

:startfull
start %systemdrive%\SAV32CLI\SAV32CLI -f -nb -dn --stop-scan -idedir="%cd%\IDE" -P="%cd%\SophosReport.txt"
GOTO END

:fulldi
start %systemdrive%\SAV32CLI\SAV32CLI -f -di -nc -nb -dn --stop-scan -idedir="%cd%\IDE" -P="%cd%\SophosReport.txt"
GOTO END

:fullrem
start %systemdrive%\SAV32CLI\SAV32CLI -f -remove -nc -nb -dn --stop-scan -idedir="%cd%\IDE" -P="%cd%\SophosReport.txt"
GOTO END

:os

CLS

ver|%systemroot%\system32\find.exe "Windows XP">nul && set TypeOS=XP
if [%TypeOS%]==[XP] goto Start
ver|%systemroot%\system32\find.exe "Windows 2000">nul && set TypeOS=W2K
if [%TypeOS%]==[W2K] goto Start

goto End

:Start

IF EXIST check*.txt del/q check*.txt >nul
IF EXIST test* del/q test* >nul
IF EXIST repair*.reg del/q repair*.reg >nul
IF EXIST find*.txt del/q find*.txt >nul
IF EXIST srvcheck.txt del/q srvcheck.txt >nul
IF EXIST *res.txt del/q *res.txt >nul

color 1F
set update=%Version 1.240

echo.
echo.
echo                            *** SDFix %update% ***
echo.
echo. 
echo. 
echo           SDFix was developed with the greatest attention to detail,
echo            However, Use of this program is at your own discretion. 
echo          The program is provided "as is" without warranty of any kind. 
echo.
echo.
echo   Backups will be made of registry entries and files before they are removed 
echo.
echo    Type Y to run SDFix, type A to create a System Report or type N to exit 
echo.
echo.
echo.
echo.
echo.
echo.
set /p Choice=Type Y, A or N to Exit....
if [%Choice%]==[y] goto fix
if [%Choice%]==[Y] goto fix
if [%Choice%]==[n] goto End
if [%Choice%]==[N] goto End
if [%Choice%]==[f] goto Second
if [%Choice%]==[F] goto Second
if [%Choice%]==[S] goto AVclean
if [%Choice%]==[s] goto AVclean
if [%Choice%]==[a] goto SysRep
if [%Choice%]==[A] goto SysRep

For %%a in (Y,y,N,n,S,s,A,a) do if not [%Choice%]==[%%a] goto End

pause

:fix

IF NOT EXIST "%cd%\dnif.exe" COPY /Y "%systemroot%\system32\find.exe" "%cd%\dnif.exe">nul
IF NOT EXIST "%cd%\dnif.exe" COPY /Y "%systemroot%\system32\dllcache\find.exe" "%cd%\dnif.exe">nul
IF NOT EXIST "%cd%\rtsdnif.exe" COPY /Y "%systemroot%\system32\findstr.exe" "%cd%\rtsdnif.exe">nul
IF NOT EXIST "%cd%\rtsdnif.exe" COPY /Y "%systemroot%\system32\dllcache\findstr.exe" "%cd%\rtsdnif.exe">nul
IF NOT EXIST "%cd%\editreg.exe" COPY /Y "%systemroot%\regedit.exe" "%cd%\editreg.exe">nul
IF NOT EXIST "%cd%\editreg.exe" COPY /Y "%systemroot%\system32\dllcache\regedit.exe" "%cd%\editreg.exe">nul
IF NOT EXIST "%cd%\editreg.exe" COPY /Y "%cd%\apps\replace\regedit.exe" "%cd%\editreg.exe">nul
IF NOT EXIST "%cd%\attrib.exe" COPY /Y "%systemroot%\system32\attrib.exe" "%cd%\attrib.exe">nul
IF NOT EXIST "%cd%\apps\CSweg.exe" COPY /Y "%cd%\apps\swreg.exe" "%cd%\apps\CSweg.exe">nul

ver|dnif.exe /I "Windows XP">nul && (
if not exist "%windir%\system32\AUTOEXEC.NT" copy "%cd%\apps\replace\XP\AUTOEXEC.NT" "%windir%\system32\AUTOEXEC.NT">NUL && echo AUTOEXEC.NT Restored from backups>sdfilecheck.txt
if not exist "%windir%\system32\Config.nt" copy "%cd%\apps\replace\XP\Config.nt" "%windir%\system32\Config.nt">NUL && echo Config.nt Restored from backups>>sdfilecheck.txt
if not exist "%windir%\system32\Command.com" copy "%cd%\apps\replace\XP\Command.com" "%windir%\system32\Command.com">NUL && echo Command.com Restored from backups>>sdfilecheck.txt
	)

ver|dnif.exe /I "Windows 2000">nul && (
if not exist "%windir%\system32\AUTOEXEC.NT" copy "%cd%\apps\replace\W2K\AUTOEXEC.NT" "%windir%\system32\AUTOEXEC.NT">NUL && echo AUTOEXEC.NT Restored from backups>sdfilecheck.txt
if not exist "%windir%\system32\Config.nt" copy "%cd%\apps\replace\W2K\Config.nt" "%windir%\system32\Config.nt">NUL && echo Config.nt Restored from backups>>sdfilecheck.txt
if not exist "%windir%\system32\Command.com" copy "%cd%\apps\replace\W2K\Command.com" "%windir%\system32\Command.com">NUL && echo Command.com Restored from backups>>sdfilecheck.txt
	)

apps\process -k explorer.exe >NUL

if exist backups_old3 ren backups_old3 backups_old4
if exist backups_old2 ren backups_old2 backups_old3
if exist backups_old1 ren backups_old1 backups_old2
if exist backups_old ren backups_old backups_old1
if exist backups ren backups backups_old
IF EXIST apps\RemLat.TXT DEL /Q apps\RemLat.TXT>NUL
IF EXIST RemLat*.TXT DEL /Q RemLat*.TXT>NUL
IF NOT EXIST backups mkdir backups >NUL
IF NOT EXIST backupreg mkdir backupreg >NUL

IF NOT EXIST apps\CheckApina1.txt apps\Csweg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows"|dnif.exe /I "Init_DLLs"|dnif.exe /I /V "App">apps\CheckApina1.txt
dnif.exe /I "Init_DLLs"<apps\CheckApina1.txt>NUL && (
FOR /F "TOKENS=3 DELIMS=	" %%C in (apps\CheckApina1.txt) DO if exist %systemroot%\system32\%%C.dll (
ECHO %systemroot%\system32\%%C.dll>apps\RemLat.TXT
MOVE /Y %systemroot%\system32\%%C.dll .\backups\ 2>nul
apps\Cghtme.exe -k %systemroot%\system32\%%C.dll >nul
apps\Cghtme.exe -e %systemroot%\system32\%%C.dll >nul
.\apps\WINMSG.EXE -t "Infected user32.dll Found - Reboot Needed" -m "SDFix Needs To Restart The PC To Unload A Trojan File From Memory, Reboot Back Into Safe Mode And Start SDFix Again"
.\apps\WINMSG.EXE -t "Infected user32.dll Found - Reboot Needed" -m "Press OK To Restart The PC"
start apps\RestartIt!.exe /reboot && exit
	))

apps\Csweg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v AppInit_DLLs|dnif.exe /I "AppInit_DLLs"|dnif.exe /I "iSecurity.cpl">NUL && dir /b/s/a-d "%systemdrive%\iSecurity.cpl">>IsecCheck0.txt

IF EXIST IsecCheck0.txt dnif.exe /I "."<IsecCheck0.txt>NUL && (
For /F "TOKENS=*" %%f IN (IsecCheck0.txt) do (
apps\Cghtme.exe -l nul -k "%%f">nul
apps\Cghtme.exe -e "%%f">nul
IF EXIST "%%f" DEL /Q "%%f">nul
	)
editreg.exe /s apps\Reset_AppInit_DLLs.reg 2>NUL
type IsecCheck0.txt>>Find.txt
del /q IsecCheck0.txt >nul
	)

apps\Csweg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System" /v DisableRegistryTools >nul
apps\Csweg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System" /v DisableRegistryTools >nul
apps\Csweg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System" /v DisableTaskMgr >nul
apps\Csweg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System" /v DisableTaskMgr >nul

cls

echo.
echo Starting Repairs
echo.
echo Checking Running Processes and Services
echo.
if exist %systemroot%\system32\svbhost.exe apps\process -k svbhost.exe >> kill.txt

COPY /Y apps\svcbk.txt apps\svc.txt >NUL
COPY /Y apps\srv2bk.txt apps\srv2.txt >NUL
COPY /Y apps\legacybk.txt apps\legacy.txt >NUL
if exist apps\RemLat.TXT copy apps\RemLat.TXT RemLat.TXT >NUL

IF NOT EXIST %systemroot%\ERUNT\SDFIX_First_Run\ERDNT.EXE apps\erunt %systemroot%\ERUNT\SDFIX_First_Run /noprogresswindow /noconfirmdelete
apps\erunt %systemroot%\ERUNT\SDFIX /noprogresswindow /noconfirmdelete

IF NOT EXIST dummy.sys COPY /Y apps\dummy.sys dummy.sys >NUL
IF NOT EXIST dummy.exe COPY /Y apps\MD5File.exe dummy.exe >NUL

apps\Csweg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System" /v DisableRegistryTools >nul
apps\Csweg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System" /v DisableRegistryTools >nul
apps\Csweg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System" /v DisableTaskMgr >nul
apps\Csweg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System" /v DisableTaskMgr >nul

apps\Csweg acl "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /reset >nul
apps\Csweg acl "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /reset >nul

CLS

>>fixtools2.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe]
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe]
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.com]
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe]
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe]
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.com]
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe]
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe]
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe]
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\userinit.exe]
echo.
	)

apps\Csweg import fixtools2.reg >NUL 2>&1
del /q fixtools*.reg

if exist Data.txt ren Data.txt Data_old_1.txt>NUL
if exist Report_old_4.txt ren Report_old_4.txt Report_old_5.txt>NUL
if exist Report_old_3.txt ren Report_old_3.txt Report_old_4.txt>NUL
if exist Report_old_2.txt ren Report_old_2.txt Report_old_3.txt>NUL
if exist Report_old_1.txt ren Report_old_1.txt Report_old_2.txt>NUL
if exist Report.txt ren Report.txt Report_old_1.txt>NUL

CLS
echo.
echo Starting Repairs
echo.
echo Checking Running Processes and Services
echo.

apps\Csweg.exe query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\clbdriver"|dnif.exe /I "Imagepath"|dnif.exe /I "clbdriver.sys">nul && (
apps\Csweg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\clbdriver" /v "start" /t REG_DWORD /d "4" >nul
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\clbdriver dummy.sys >NUL
	)

apps\Csweg.exe query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\clbdriver"|dnif.exe /I "Imagepath"|dnif.exe /I "vmdesched.sys">nul && (
apps\Csweg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\clbdriver" /v "start" /t REG_DWORD /d "4" >nul
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\vmdesched.sys dummy.sys >NUL
	)

apps\Csweg acl "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msliksurserv" /reset >nul
apps\Csweg.exe query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msliksurserv"|dnif.exe /I "Imagepath"|dnif.exe /I "msliksurserv.sys">nul && (
apps\Csweg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msliksurserv" /v "start" /t REG_DWORD /d "4" >nul
apps\Cghtme.exe -l nul -c "%cd%\dummy.sys" %systemroot%\system32\drivers\msliksurserv.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\msliksurserv.sys dummy.sys >NUL
	)

apps\Csweg acl "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tdssserv" /reset >nul
apps\Csweg acl "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tdssserv" /reset >nul
apps\Csweg acl "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\tdssserv" /reset >nul
apps\Csweg acl "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\tdssserv" /reset >nul
apps\Csweg acl "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TDSSserv.sys)" /reset >nul
apps\Csweg acl "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TDSSserv.sys)" /reset >nul
apps\Csweg acl "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\TDSSserv.sys)" /reset >nul
apps\Csweg acl "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\TDSSserv.sys)" /reset >nul
apps\Csweg acl "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TDSSserv.sys" /reset >nul
apps\Csweg acl "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TDSSserv.sys" /reset >nul
apps\Csweg acl "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\TDSSserv.sys" /reset >nul
apps\Csweg acl "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\TDSSserv.sys" /reset >nul

apps\Csweg.exe query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tdssserv"|dnif.exe /I "Imagepath"|dnif.exe /I "tdss">TESTtdsss1.TXT
IF EXIST TESTtdsss1.TXT DNIF /I ".sys"<TESTtdsss1.TXT>NUL && For /f "tokens=5 delims=\." %%G in (TESTtdsss1.TXT) do (
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%G.sys dummy.sys>NUL
echo %systemroot%\system32\drivers\%%G.sys>>Remlat1.txt
>RepairTDSSS.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\%%G.sys]
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\%%G.sys]
echo.
	)
editreg.exe /s RepairTDSSS.reg 2>NUL
copy RepairTDSSS.reg .\backups >nul
	)

apps\Csweg.exe query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TDSSserv.sys)"|dnif.exe /I "Imagepath"|dnif.exe /I "tdss">TESTtdsss1a.TXT
IF EXIST TESTtdsss1a.TXT DNIF /I ".sys"<TESTtdsss1a.TXT>NUL && For /f "tokens=5 delims=\." %%G in (TESTtdsss1a.TXT) do (
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%G.sys dummy.sys>NUL
echo %systemroot%\system32\drivers\%%G.sys>>Remlat1.txt
>RepairTDSSSa.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\%%G.sys]
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\%%G.sys]
echo.
	)
editreg.exe /s RepairTDSSSa.reg 2>NUL
copy RepairTDSSSa.reg .\backups >nul
	)

apps\Csweg.exe query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TDSSserv.sys"|dnif.exe /I "Imagepath"|dnif.exe /I "tdss">TESTtdsss1b.TXT
IF EXIST TESTtdsss1b.TXT DNIF /I ".sys"<TESTtdsss1b.TXT>NUL && For /f "tokens=5 delims=\." %%G in (TESTtdsss1b.TXT) do (
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%G.sys dummy.sys>NUL
echo %systemroot%\system32\drivers\%%G.sys>>Remlat1.txt
>RepairTDSSSb.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\%%G.sys]
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\%%G.sys]
echo.
	)
editreg.exe /s RepairTDSSSb.reg 2>NUL
copy RepairTDSSSb.reg .\backups >nul
	)

IF EXIST %systemroot%\system\lsass.exe (
IF EXIST %systemroot%\lsass.exe ( 
apps\process -k lsass.exe >nul
apps\shutdown -a >nul
	))

apps\Csweg.exe query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tdssserv\modules"|dnif.exe /I ".dll"|dnif.exe /I "tdss">TESTtdsss2.TXT
IF EXIST TESTtdsss2.TXT For /f "tokens=4 delims=\." %%c in (TESTtdsss2.TXT) do if exist %systemroot%\system32\%%c.dll echo %systemroot%\system32\%%c.dll>>RemLat2.txt
apps\Csweg.exe query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tdssserv\modules"|dnif.exe /I ".dat"|dnif.exe /I "tdss">TESTtdsss2b.TXT
IF EXIST TESTtdsss2b.TXT For /f "tokens=4 delims=\." %%c in (TESTtdsss2b.TXT) do if exist %systemroot%\system32\%%c.dat echo %systemroot%\system32\%%c.dat>>RemLat3.txt
apps\Csweg.exe query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tdssserv\modules"|dnif.exe /I ".log"|dnif.exe /I "tdss">TESTtdsss2c.TXT
IF EXIST TESTtdsss2c.TXT For /f "tokens=4 delims=\." %%c in (TESTtdsss2c.TXT) do if exist %systemroot%\system32\%%c.log echo %systemroot%\system32\%%c.log>>RemLat4.txt

apps\Csweg.exe query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TDSSserv.sys)\modules"|dnif.exe /I ".dll"|dnif.exe /I "tdss">TESTtdsss2a.TXT
IF EXIST TESTtdsss2a.TXT For /f "tokens=4 delims=\." %%c in (TESTtdsss2a.TXT) do if exist %systemroot%\system32\%%c.dll echo %systemroot%\system32\%%c.dll>>RemLat2.txt
apps\Csweg.exe query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TDSSserv.sys)\modules"|dnif.exe /I ".dat"|dnif.exe /I "tdss">TESTtdsss2e.TXT
IF EXIST TESTtdsss2e.TXT For /f "tokens=4 delims=\." %%c in (TESTtdsss2e.TXT) do if exist %systemroot%\system32\%%c.dat echo %systemroot%\system32\%%c.dat>>RemLat3.txt
apps\Csweg.exe query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TDSSserv.sys)\modules"|dnif.exe /I ".log"|dnif.exe /I "tdss">TESTtdsss2d.TXT
IF EXIST TESTtdsss2d.TXT For /f "tokens=4 delims=\." %%c in (TESTtdsss2d.TXT) do if exist %systemroot%\system32\%%c.log echo %systemroot%\system32\%%c.log>>RemLat4.txt

apps\Csweg.exe query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules"|dnif.exe /I ".dll"|dnif.exe /I "tdss">TESTtdsss2f.TXT
IF EXIST TESTtdsss2f.TXT For /f "tokens=4 delims=\." %%c in (TESTtdsss2f.TXT) do if exist %systemroot%\system32\%%c.dll echo %systemroot%\system32\%%c.dll>>RemLat2.txt
apps\Csweg.exe query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules"|dnif.exe /I ".dat"|dnif.exe /I "tdss">TESTtdsss2g.TXT
IF EXIST TESTtdsss2g.TXT For /f "tokens=4 delims=\." %%c in (TESTtdsss2g.TXT) do if exist %systemroot%\system32\%%c.dat echo %systemroot%\system32\%%c.dat>>RemLat3.txt
apps\Csweg.exe query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules"|dnif.exe /I ".log"|dnif.exe /I "tdss">TESTtdsss2h.TXT
IF EXIST TESTtdsss2h.TXT For /f "tokens=4 delims=\." %%c in (TESTtdsss2h.TXT) do if exist %systemroot%\system32\%%c.log echo %systemroot%\system32\%%c.log>>RemLat4.txt

IF EXIST "%systemroot%\system32\drivers\TDSS*.sys" apps\locate "%systemroot%\system32\drivers\TDSS*.sys" /D- /n /nr>TESTClbtds1.txt
IF EXIST "%systemroot%\system32\TDSS*.dll" apps\locate "%systemroot%\system32\TDSS*.dll" /D- /n /nr>>TESTClbtds2.txt
IF EXIST "%systemroot%\system32\TDSS*.dat" apps\locate "%systemroot%\system32\TDSS*.dat" /D- /n /nr>>TESTClbtds2a.txt
IF EXIST "%systemroot%\system32\TDSS*.log" apps\locate "%systemroot%\system32\TDSS*.log" /D- /n /nr>>TESTClbtds2b.txt

IF EXIST "%temp%\TDSS*.tmp" apps\locate "%temp%\TDSS*.tmp" /D- /s:616960! /n /nr>>Remlat0.txt 2>nul
rtsdnif.exe /m /f:TESTClbtds2.txt "idskdrtux.dll">>Remlat2.txt 2>nul
rtsdnif.exe /m /f:TESTClbtds2.txt "tdllog.dll">>Remlat2.txt 2>nul
rtsdnif.exe /m /f:TESTClbtds2.txt "tdlmain.dll">>Remlat2.txt 2>nul
rtsdnif.exe /m /f:TESTClbtds2.txt "iwxengk.dll">>Remlat2.txt 2>nul
rtsdnif.exe /m /f:TESTClbtds2.txt "fiqsefo.dll">>Remlat2.txt 2>nul
rtsdnif.exe /m /f:TESTClbtds2.txt "aawslvy.dll">>Remlat2.txt 2>nul
rtsdnif.exe /m /f:TESTClbtds2.txt "onvtwktly.dll">>Remlat2.txt 2>nul
rtsdnif.exe /m /f:TESTClbtds2.txt "qfhnufyi.dll">>Remlat2.txt 2>nul
rtsdnif.exe /m /f:TESTClbtds2.txt "tumgx.dll">>Remlat2.txt 2>nul
rtsdnif.exe /m /f:TESTClbtds2.txt "usn26622">>Remlat2.txt 2>nul
rtsdnif.exe /m /f:TESTClbtds2.txt "xtcdk.dll">>Remlat2.txt 2>nul
rtsdnif.exe /m /f:TESTClbtds2.txt "yubsmqiwo.dll">>Remlat2.txt 2>nul
rtsdnif.exe /m /f:TESTClbtds2.txt "FindVolumeMountPointClose">>Remlat2.txt 2>nul
rtsdnif.exe /m /f:TESTClbtds2.txt "UpdateICMRegKeyW">>Remlat2.txt 2>nul
rtsdnif.exe /m /f:TESTClbtds1.txt "KeAcquireSpinLock">TESTClbtds3.txt 2>nul
rtsdnif.exe /m /f:TESTClbtds1.txt "KeAcquireSpinLock">>Remlat1.txt 2>nul
rtsdnif.exe /m /f:TESTClbtds1.txt "KeUpdateRunTime">TESTClbtds3.txt 2>nul
rtsdnif.exe /m /f:TESTClbtds1.txt "KeUpdateRunTime">>Remlat1.txt 2>nul
rtsdnif.exe /m /f:TESTClbtds2a.txt "bvu">>Remlat3.txt 2>nul
rtsdnif.exe /m /f:TESTClbtds2b.txt "csrss.exe=">>Remlat4.txt 2>nul
rtsdnif.exe /m /f:TESTClbtds2b.txt "http">>Remlat4.txt 2>nul

IF EXIST TESTClbtds3.txt dnif.exe /I "."<TESTClbtds3.txt>NUL && For /f "tokens=5 delims=\." %%c in (TESTClbtds3.txt) do (
>RepairTDSS.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\%%c.sys]
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\%%c.sys]
echo.
	)
editreg.exe /s RepairTDSS.reg 2>NUL
copy RepairTDSS.reg .\backups\FixTDS_SafeBoot.reg >nul
	)

apps\locate "%systemroot%\system32\*.dll" /D- /s:94208! /n /nr|dnif.exe /I ".dll">>TESTNOTIF3.TXT
apps\locate "%systemroot%\system32\*.dll" /D- /s:98304! /n /nr|dnif.exe /I ".dll">>TESTNOTIF3.TXT
dnif.exe /I ".dll"<TESTNOTIF3.TXT>>TESTNOTIF4.TXT
if exist TESTNOTIF4.TXT rtsdnif.exe /m /f:TESTNOTIF4.TXT "bot.dll">NUL && apps\process -k smss.exe >nul
if exist TESTNOTIF4.TXT rtsdnif.exe /m /f:TESTNOTIF4.TXT "bot.dll">NUL && apps\process -k winlogon.exe >nul

apps\locate "%systemroot%\system32\win???32.dll" /D- /s:19000,28000 /n /nr|dnif.exe /I ".dll">>TESTNeb0.TXT
if exist TESTNeb0.TXT dnif.exe /I "."<TESTNeb0.TXT>NUL && apps\process -k smss.exe >nul
if exist TESTNeb0.TXT dnif.exe /I "."<TESTNeb0.TXT>NUL && apps\process -k winlogon.exe >nul

apps\locate "%systemroot%\system32\*.exe" /D- /s:46080! /n /nr|dnif.exe /I ".exe">>TESTProtect1.TXT
IF EXIST TESTProtect1.TXT For /f "tokens=1 delims=." %%G in (TESTProtect1.TXT) do apps\Csweg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /V Userinit |dnif.exe /I "%%G">NUL && (
ECHO %%G.EXE>>Find.txt
echo %%G.EXE>>TESTProtect2.TXT
	)

apps\Csweg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mcrwave" /v DllName|dnif.exe /I "mcrwave.dll">nul && (
apps\process -k smss.exe >nul
apps\process -k winlogon.exe >nul
	)

apps\locate "%systemdrive%\*.exe" /D- /n /s:143872! /nr|dnif.exe /I ".exe">TESTPushbot1.TXT
if exist TESTPushbot1.TXT for /f "tokens=*" %%a in (TESTPushbot1.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "A811BB5A17404B3384FFC4C449728031">Nul && echo %%a>>TESTPushbot2.TXT
if exist TESTPushbot2.TXT for /f "tokens=2 delims=\" %%a in (TESTPushbot2.TXT) do apps\process -k %%a>>kill.txt

dir /b/s/a-d "%allusersprofile%\abc32.dll" >>TESTXorpix1.txt 2>NUL
dir /b/s/a-d "%allusersprofile%\abc32.dll~" >>TESTXorpix1.txt 2>NUL
dir /b/s/a-d "%allusersprofile%\arm32.dll" >>TESTXorpix1.txt 2>NUL
dir /b/s/a-d "%allusersprofile%\arm32.dll~" >>TESTXorpix1.txt 2>NUL
dir /b/s/a-d "%allusersprofile%\bot.dll" >>TESTXorpix1.txt 2>NUL
dir /b/s/a-d "%allusersprofile%\bot.dll~" >>TESTXorpix1.txt 2>NUL
dir /b/s/a-d "%allusersprofile%\ivn4.dll~" >>TESTXorpix1.txt 2>NUL
dir /b/s/a-d "%allusersprofile%\ivn4.dll~" >>TESTXorpix1.txt 2>NUL
dir /b/s/a-d "%allusersprofile%\linker.dll" >>TESTXorpix1.txt 2>NUL
dir /b/s/a-d "%allusersprofile%\linker.dll~" >>TESTXorpix1.txt 2>NUL
dir /b/s/a-d "%allusersprofile%\partnership.dll" >>TESTXorpix1.txt 2>NUL
dir /b/s/a-d "%allusersprofile%\partnership.dll~" >>TESTXorpix1.txt 2>NUL
dir /b/s/a-d "%allusersprofile%\winsys2f.dll" >>TESTXorpix1.txt 2>NUL
dir /b/s/a-d "%allusersprofile%\winsys2f.dll~" >>TESTXorpix1.txt 2>NUL
IF EXIST TESTXorpix1.txt dnif.exe /I "." <TESTXorpix1.txt>NUL && (
apps\process -k smss.exe >nul
apps\process -k winlogon.exe >nul
	)

> FilekillList1.txt (
echo %temp%\winlogon.exe
echo %systemdrive%\Settings\arm65.dll
echo %systemdrive%\Settings\arm80.dll
echo %systemroot%\Media\smartwarxyu.dll
echo %systemroot%\system32\a3dxx.dll
echo %systemroot%\system32\a3dx8.dll
echo %systemroot%\system32\asplug.dll
echo %systemroot%\system32\Chwmcop.dll
echo %systemroot%\system32\crypts.dll
echo %systemroot%\system32\crypt32rt.dll
echo %systemroot%\system32\cryptsa.dll
echo %systemroot%\system32\divxrs.dll
echo %systemroot%\system32\drivers\winlogon.exe
echo %systemroot%\system32\droute.dll
echo %systemroot%\system32\ibudu.dll
echo %systemroot%\system32\ibuntu.dll
echo %systemroot%\system32\ibutu.dll
echo %systemroot%\system32\iexplorer.dll
echo %systemroot%\system32\instcat.dll
echo %systemroot%\system32\LogCrypt.dll
echo %systemroot%\system32\mcrwave.dll
echo %systemroot%\system32\msdtc32.dll
echo %systemroot%\system32\rpcc.dll
echo %systemroot%\system32\rpccd.dll
echo %systemroot%\system32\upsctl.dll
echo %systemroot%\system32\WinCtrl32.dll
echo %systemroot%\system32\winlogon.dll
echo %systemroot%\system32\WLCtrl32.dll
echo %systemroot%\system32\WinNt32.dll
echo %systemroot%\system32\WinNt64.dll
echo %systemroot%\szr_dll.dll
echo %systemroot%\system32\wudb.dll
echo %systemroot%\winlogon.exe
	)

for /f "tokens=*" %%G in (FilekillList1.txt) do if exist "%%G" (
apps\process -k smss.exe >nul
apps\process -k winlogon.exe >nul
	)

IF EXIST "%systemdrive%\Settings\arm*.dll" apps\Csweg acl "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /reset >nul

if exist %systemroot%\Fonts\wmsncs.exe apps\process -k wmsncs.exe >> kill.txt
if exist %systemroot%\MSLicense.txt apps\process -k notepad.exe >>kill.txt
if exist %systemroot%\system\MSVCRT.exe apps\process -k MSVCRT.exe >> kill.txt
if exist %systemroot%\system\Spool.exe apps\process -k Spool.exe >> kill.txt
if exist %systemroot%\system32\ashDsp.exe apps\process -k ashDsp.exe >> kill.txt
if exist %systemroot%\system32\camacttiv.exe apps\process -k camacttiv.exe >> kill.txt
if exist %systemroot%\system32\Client\svchost32.exe apps\process -k svchost32.exe >> kill.txt
if exist %systemroot%\system32\drivers\btwdins.exe apps\process -k btwdins.exe >nul
if exist %systemroot%\system32\drivers\FmMgr.exe apps\process -k FmMgr.exe >nul
if exist %systemroot%\system32\drivers\LBTWiz.exe apps\process -k LBTWiz.exe >nul
if exist %systemroot%\system32\drivers\PrdMgr.exe apps\process -k PrdMgr.exe >> kill.txt
if exist %systemroot%\system32\drivers\regvcs.exe apps\process -k regvcs.exe >nul
if exist %systemroot%\system32\drivers\service.exe apps\process -k service.exe >nul
if exist %systemroot%\system32\drivers\spool.exe apps\process -k spool.exe >nul
if exist %systemroot%\system32\drivers\spools.exe apps\process -k spools.exe >nul
if exist %systemroot%\system32\drivers\wuact.exe apps\process -k wuact.exe >nul
if exist %systemroot%\system32\drivers\wuaclt.exe apps\process -k wuaclt.exe >nul
if exist %systemroot%\system32\fservice.exe apps\process -k fservice.exe >> kill.txt
if exist %systemroot%\system32\iftuyszv.exe apps\process -k iftuyszv.exe >> kill.txt
if exist %systemroot%\system32\mrcmgr.exe apps\process -k mrcmgr.exe >> kill.txt
if exist %systemroot%\system32\msdhcprs.exe apps\process -k msdhcprs.exe >> kill.txt
if exist %systemroot%\system32\msnmgnr.exe apps\process -k msnmgnr.exe >> kill.txt
if exist %systemroot%\system32\msmsgs.exe apps\process -k msmsgs.exe >> kill.txt
if exist %systemroot%\system32\msnmgnr.exe apps\process -k msnmgnr.exe >> kill.txt
if exist %systemroot%\system32\msupdt.exe apps\process -k msupdt.exe >> kill.txt
if exist %systemroot%\system32\NMBgMonitor.exe apps\process -k NMBgMonitor.exe >> kill.txt
if exist %systemroot%\system32\service.exe apps\process -k service.exe >> kill.txt
if exist %systemroot%\system32\Servicess.exe apps\process -k Servicess.exe >> kill.txt
if exist %systemroot%\system32\taskdrv32.exe apps\process -k taskdrv32.exe >> kill.txt
if exist %systemroot%\system32\uoyzsydz.exe apps\process -k uoyzsydz.exe >> kill.txt
if exist %systemroot%\system32\winservicess.exe apps\process -k winservicess.exe >> kill.txt
if exist %systemroot%\system32\xwusuhzh.exe apps\process -k xwusuhzh.exe >> kill.txt

if exist %systemroot%\wuauclt.exe apps\process -k wuauclt.exe >> kill.txt
if exist "%ProgramFiles%\MSN Messenger\Device Manager\Loc\1774\Setup.exe" apps\process -k Setup.exe >> kill.txt

apps\Csweg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" .\backupreg\Drivers32.reg
apps\Csweg export "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems" .\backupreg\SubSystems.reg
apps\Csweg export "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders" .\backupreg\SecurityProviders.reg
apps\Csweg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components" .\backupreg\Installed_Components.reg
apps\Csweg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" .\backupreg\BHO.reg
apps\Csweg export "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" .\backupreg\IEMain.reg
apps\Csweg export "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop" .\backupreg\IEDesktop.reg
apps\Csweg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" .\backupreg\HKLMRun.reg
apps\Csweg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices" .\backupreg\HKLMRunServices.reg
apps\Csweg export "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" .\backupreg\HKCURun.reg
apps\Csweg export "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices" .\backupreg\HKCURunServices.reg
apps\Csweg export "HKEY_CLASSES_ROOT\exefile\shell\open\command" .\backupreg\exe_shell_open.reg
apps\Csweg export "HKEY_CLASSES_ROOT\txtfile\shell\open\command" .\backupreg\txt_shell_open.reg
apps\Csweg export "HKEY_CLASSES_ROOT\regfile\shell\open\command" .\backupreg\reg_shell_open.reg
apps\Csweg export "HKEY_CLASSES_ROOT\piffile\shell\open\command" .\backupreg\pif_shell_open.reg
apps\Csweg export "HKEY_CLASSES_ROOT\batfile\shell\open\command" .\backupreg\bat_shell_open.reg
apps\Csweg export "HKEY_CLASSES_ROOT\comfile\shell\open\command" .\backupreg\com_shell_open.reg
apps\Csweg export "HKEY_LOCAL_MACHINE\SOFTWARE\Policies" .\backupreg\HKLM_SOFTWARE_Policy.reg
apps\Csweg export "HKEY_CURRENT_USER\SOFTWARE\Policies" .\backupreg\HKCU_SOFTWARE_Policy.reg
apps\Csweg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies" .\backupreg\HKLM_WINDOWS_Policy.reg
apps\Csweg export "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies" .\backupreg\HKCU_WINDOWS_Policy.reg
apps\Csweg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel" .\backupreg\ControlPanel_Load.reg
apps\Csweg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" .\backupreg\AppInit_DLLs.reg
apps\Csweg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" .\backupreg\Winlogon.reg
apps\Csweg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify" .\backupreg\WinlogonNotify.reg
apps\Csweg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler" .\backupreg\SharedTaskScheduler.reg
apps\Csweg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad" .\backupreg\ShellServiceObjectDelayLoad.reg

editreg.exe /s apps\assosfix.reg 2>NUL
apps\Csweg import apps\assosfix.reg 2>NUL

apps\Csweg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" CheckRuns.txt
apps\Csweg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices" CheckRunsSrv1.txt
apps\Csweg export "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" CheckRuns2.txt

apps\Csweg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SDFix" /d "%~s0 /second"
apps\Csweg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\install1" /v "SDFix" /d "%~s0 /second"

IF NOT EXIST %systemroot%\system32\basesrv.dll goto basemis
set "Key_=HKEY_LOCAL_MACHINE\System\CurrentControlSet\control\session manager\subsystems"

apps\Csweg query "%key_%" /v windows >temp00
apps\grep -Fisq ServerDll=basesrv, temp00 || apps\SED "/.*\t/!d;s///; s/ServerDll=[^ ,]*/ServerDll=basesrv/I" temp00 > temp01

if not exist temp01 goto basemis

if exist "%systemroot%\system32\basesrv.dll" (
For /f "tokens=*" %%g in ( temp01
) do @apps\Csweg add "%key_%" /v windows /t reg_expand_sz /d "%%g" >nul
apps\SED -r "/\t/!d;s/.*SubSystemType=[^ ]* ServerDll=([^ ,]*).*$/%systemB%\\\1.dll/I" temp00 >> TESTbase0.txt
	)

IF EXIST TESTbase0.txt dnif.exe /I "base"<TESTbase0.txt|dnif.exe /I "32.dll">NUL && For /f "tokens=1 delims=\." %%g in (TESTbase0.txt) do (
if exist %systemroot%\system32\%%g.dll echo %systemroot%\system32\%%g.dll>BaseCheck6.txt
>BaseChecked.txt (
echo.
echo [HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\SubSystems]
echo.
echo Trojan File %%g.dll and startup entry Found!
echo %%g.dll will be removed after reboot if registry value is repaired
echo.
 ))
if not exist "%systemroot%\system32\basesrv.dll" @(
echo.%systemroot%\system32\basesrv.dll is missing>Baseres.txt
apps\Vdnif.exe -tf %systemroot%\system32\basesrv.dll >>Baseres.txt
	)

:basemis

apps\Csweg.exe EXPORT "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad" Checkdllpatcherssod1.txt
IF EXIST Checkdllpatcherssod1.txt dnif.exe /I "{"<Checkdllpatcherssod1.txt |dnif.exe /I /V "PostBootReminder"|dnif.exe /I /V "CDBurn"|dnif.exe /I /V "WebCheck"|dnif.exe /I /V "SysTray">Checkdllpatcherssod2.txt
IF EXIST Checkdllpatcherssod2.txt dnif.exe /I "{"<Checkdllpatcherssod2.txt>NUL && For /F "TOKENS=2 delims={}" %%d IN (Checkdllpatcherssod2.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%~d}\InprocServer32"|dnif.exe /I "system32\"|dnif.exe /I /V "SHELL32.DLL"|dnif.exe /I /V "webcheck.dll"|dnif.exe /I /V "stobject.dll"|dnif.exe /I /V "WPDShServiceObj.dll">>Checkdllpatcher1.txt

IF EXIST Checkdllpatcher1.txt for /f "tokens=4 delims=\." %%a in (Checkdllpatcher1.txt) do (
IF EXIST "%windir%\temp\SDFix_Filecheck\" RD /Q/S "%windir%\temp\SDFix_Filecheck" 2>nul
IF NOT EXIST "%windir%\temp\SDFix_Filecheck\" MD "%windir%\temp\SDFix_Filecheck" 2>nul
IF NOT EXIST "%windir%\temp\SDFix_Filecheck\SF" MD "%windir%\temp\SDFix_Filecheck\SF"  2>nul
apps\Cghtme.exe -c "%systemroot%\system32\%%a.dll" "%windir%\temp\SDFix_Filecheck\%%a.dll">nul && IF EXIST %windir%\temp\SDFix_Filecheck\%%a.dll echo %windir%\temp\SDFix_Filecheck\%%a.dll>>TESTdllpatcher2.TXT 2>nul
IF NOT EXIST "%windir%\temp\SDFix_Filecheck\SF\explorer.exe" apps\Cghtme.exe -c "%systemroot%\explorer.exe" "%windir%\temp\SDFix_Filecheck\SF\explorer.exe">nul && echo %windir%\temp\SDFix_Filecheck\SF\explorer.exe>>TESTdllpatcher3.TXT
IF NOT EXIST "%windir%\temp\SDFix_Filecheck\SF\lsass.exe" apps\Cghtme.exe -c "%systemroot%\system32\lsass.exe" "%windir%\temp\SDFix_Filecheck\SF\lsass.exe">nul && echo %windir%\temp\SDFix_Filecheck\SF\lsass.exe>>TESTdllpatcher3.TXT
IF NOT EXIST "%windir%\temp\SDFix_Filecheck\SF\services.exe" apps\Cghtme.exe -c "%systemroot%\system32\services.exe" "%windir%\temp\SDFix_Filecheck\SF\services.exe">nul && echo %windir%\temp\SDFix_Filecheck\SF\services.exe>>TESTdllpatcher3.TXT
IF NOT EXIST "%windir%\temp\SDFix_Filecheck\SF\spoolsv.exe" apps\Cghtme.exe -c "%systemroot%\system32\spoolsv.exe" "%windir%\temp\SDFix_Filecheck\SF\spoolsv.exe">nul && echo %windir%\temp\SDFix_Filecheck\SF\spoolsv.exe>>TESTdllpatcher3.TXT
IF NOT EXIST "%windir%\temp\SDFix_Filecheck\SF\svchost.exe" apps\Cghtme.exe -c "%systemroot%\system32\svchost.exe" "%windir%\temp\SDFix_Filecheck\SF\svchost.exe">nul && echo %windir%\temp\SDFix_Filecheck\SF\svchost.exe>>TESTdllpatcher3.TXT
IF NOT EXIST "%windir%\temp\SDFix_Filecheck\SF\winlogon.exe" apps\Cghtme.exe -c "%systemroot%\system32\winlogon.exe" "%windir%\temp\SDFix_Filecheck\SF\winlogon.exe">nul && echo %windir%\temp\SDFix_Filecheck\SF\winlogon.exe>>TESTdllpatcher3.TXT
	)

IF EXIST TESTdllpatcher2.TXT dnif.exe /I "."<TESTdllpatcher2.TXT>NUL && for /f "tokens=5 delims=\." %%b in (TESTdllpatcher2.TXT) do rtsdnif.exe /m /i /f:TESTdllpatcher3.TXT "%%b.dll">TESTdllpatcher5.TXT && rtsdnif.exe /m /c:"IcmpSendEcho" %windir%\temp\SDFix_Filecheck\%%b.dll>NUL && (
echo %%b.dll>>TESTdllpatcher4.TXT
IF EXIST %systemroot%\system32\%%b.dll echo %systemroot%\system32\%%b.dll>>Find.txt
For /F "TOKENS=2 delims={}" %%d IN (Checkdllpatcherssod2.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%~d}\InprocServer32"|dnif.exe /I "system32\"|dnif.exe /I "%%b.dll">nul && echo {%%~d}>>Checkdllpatcherssod3.txt
>Repairdllpatcherssodl.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
	)
IF EXIST Checkdllpatcherssod3.txt DNIF /I "{"<Checkdllpatcherssod3.txt>NUL && For /F "TOKENS=*" %%c IN (Checkdllpatcherssod3.txt) do dnif.exe /I "%%c"<Checkdllpatcherssod1.txt>>Checkdllpatcherssod3a.txt
IF EXIST Checkdllpatcherssod3a.txt DNIF /I "{"<Checkdllpatcherssod3a.txt>NUL && For /F "TOKENS=1 delims==" %%e IN (Checkdllpatcherssod3a.txt) do echo "%%~e"=->>Repairdllpatcherssodl.reg
IF EXIST Checkdllpatcherssod3a.txt DNIF /I "{"<Checkdllpatcherssod3a.txt>NUL && For /F "TOKENS=2 delims={}" %%f IN (Checkdllpatcherssod3a.txt) do echo [-HKEY_CLASSES_ROOT\clsid\{%%~f}]>>Repairdllpatcherssodl.reg
echo.>>Repairdllpatcherssodl.reg
editreg.exe /s Repairdllpatcherssodl.reg 2>NUL
copy Repairdllpatcherssodl.reg .\backups\RepairPatcherSSODL.reg >nul
	)

IF EXIST TESTdllpatcher4.TXT dnif.exe /I "."<TESTdllpatcher4.TXT>NUL && (
dnif.exe /I "explorer.exe"<TESTdllpatcher5.TXT>NUL && echo %systemroot%\explorer.exe>>TESTdllpatcher6.TXT
dnif.exe /I "lsass.exe"<TESTdllpatcher5.TXT>NUL && echo %systemroot%\system32\lsass.exe>>TESTdllpatcher6.TXT
dnif.exe /I "services.exe"<TESTdllpatcher5.TXT>NUL && echo %systemroot%\system32\services.exe>>TESTdllpatcher6.TXT
dnif.exe /I "spoolsv.exe"<TESTdllpatcher5.TXT>NUL && echo %systemroot%\system32\spoolsv.exe>>TESTdllpatcher6.TXT
dnif.exe /I "svchost.exe"<TESTdllpatcher5.TXT>NUL && echo %systemroot%\system32\svchost.exe>>TESTdllpatcher6.TXT
dnif.exe /I "winlogon.exe"<TESTdllpatcher5.TXT>NUL && echo %systemroot%\system32\winlogon.exe>>TESTdllpatcher6.TXT
IF EXIST "%windir%\temp\SDFix_Filecheck\" RD /Q/S "%windir%\temp\SDFix_Filecheck" >nul
	)

IF EXIST TESTdllpatcher6.TXT dnif.exe /I "."<TESTdllpatcher6.TXT>NUL && for /f "tokens=*" %%h in (TESTdllpatcher4.TXT) do (
>patcherres.TXT (
echo.
echo [b]Infected System Files Found![/b]
echo.
echo Below Files have been patched to load %systemroot%\system32\%%h :
echo.
TYPE TESTdllpatcher6.TXT
echo.
echo Note - Run System File Checker To Restore Original Files - SFC /SCANNOW
echo.
	))

apps\locate "%systemroot%\tmp*.bat" /D- /n /nr|dnif.exe /I ".bat">>TESTdllpatcherbat.TXT
IF EXIST TESTdllpatcherbat.TXT DNIF /I "."<TESTdllpatcherbat.TXT>NUL && For /f "tokens=*" %%a in (TESTdllpatcherbat.TXT) do dnif.exe /I "del"<TESTdllpatcherbat.TXT|dnif.exe /I "explorer.ex_">>Find.txt

apps\locate "%systemroot%\system32\*.exe" /D- /s:73728! /n /nr|dnif.exe /I ".exe">>TESTPureMorph00.TXT
apps\locate "%systemroot%\system32\*.exe" /D- /s:77824! /n /nr|dnif.exe /I ".exe">>TESTPureMorph01.TXT
apps\locate "%systemroot%\system32\*.exe" /D- /s:81920! /n /nr|dnif.exe /I ".exe">>TESTPureMorph.TXT
apps\locate "%systemroot%\system32\*.exe" /D- /s:90112! /n /nr|dnif.exe /I ".exe">>TESTPureMorph.TXT
apps\locate "%systemroot%\system32\*.exe" /D- /s:98304! /n /nr|dnif.exe /I ".exe">>TESTPureMorph.TXT
apps\locate "%systemroot%\system32\*.exe" /D- /s:114688! /n /nr|dnif.exe /I ".exe">>TESTPureMorph0b.TXT
apps\locate "%systemroot%\system32\*.exe" /D- /s:118784! /n /nr|dnif.exe /I ".exe">>TESTPureMorph0a.TXT
apps\locate "%systemroot%\system32\*.exe" /D- /s:86016! /n /nr|dnif.exe /I ".exe">>TESTPureMorph0c.TXT

if exist TESTPureMorph00.TXT For /f "tokens=1 delims=." %%a in (TESTPureMorph00.TXT) do apps\MD5File.exe "%%a.exe"|dnif.exe /I "717A9E63E0B3411D7A3F99142F31A148">Nul && echo %%a.exe>>TESTPureMorph1.TXT
if exist TESTPureMorph01.TXT For /f "tokens=1 delims=." %%a in (TESTPureMorph01.TXT) do apps\MD5File.exe "%%a.exe"|dnif.exe /I "EC1744577D4F9FBCB284602496AFF88D">Nul && echo %%a.exe>>TESTPureMorph1.TXT
if exist TESTPureMorph.TXT For /f "tokens=1 delims=." %%a in (TESTPureMorph.TXT) do apps\MD5File.exe "%%a.exe"|dnif.exe /I "24CA7DA83ED1FEE13877C99FE2513ABB">Nul && echo %%a.exe>>TESTPureMorph1.TXT
if exist TESTPureMorph.TXT For /f "tokens=1 delims=." %%a in (TESTPureMorph.TXT) do apps\MD5File.exe "%%a.exe"|dnif.exe /I "96BD37891B8E32766CED12F000FEA820">Nul && echo %%a.exe>>TESTPureMorph1.TXT
if exist TESTPureMorph.TXT For /f "tokens=1 delims=." %%a in (TESTPureMorph.TXT) do apps\MD5File.exe "%%a.exe"|dnif.exe /I "2AD65950A91E9DAEF3FFA3B3072ABC11">Nul && echo %%a.exe>>TESTPureMorph1.TXT
if exist TESTPureMorph.TXT For /f "tokens=1 delims=." %%a in (TESTPureMorph.TXT) do apps\MD5File.exe "%%a.exe"|dnif.exe /I "6A6D110DC842697450090DFB1AEF790E">Nul && echo %%a.exe>>TESTPureMorph1.TXT
if exist TESTPureMorph.TXT For /f "tokens=1 delims=." %%a in (TESTPureMorph.TXT) do apps\MD5File.exe "%%a.exe"|dnif.exe /I "71D0F9FE48CED085085C054CC08BE804">Nul && echo %%a.exe>>TESTPureMorph1.TXT
if exist TESTPureMorph0a.TXT For /f "tokens=1 delims=." %%a in (TESTPureMorph0a.TXT) do apps\MD5File.exe "%%a.exe"|dnif.exe /I "1BC130D5DFFCD6E3EE52CE5D73866482">Nul && echo %%a.exe>>TESTPureMorph1.TXT
if exist TESTPureMorph0b.TXT For /f "tokens=1 delims=." %%a in (TESTPureMorph0b.TXT) do apps\MD5File.exe "%%a.exe"|dnif.exe /I "df37027537b52e73ff98450b9c2d4060">Nul && echo %%a.exe>>TESTPureMorph1.TXT
if exist TESTPureMorph0c.TXT For /f "tokens=1 delims=." %%a in (TESTPureMorph0c.TXT) do apps\MD5File.exe "%%a.exe"|dnif.exe /I "0F2B5B6F106BF003862F338569685E26">Nul && echo %%a.exe>>TESTPureMorph1.TXT
if exist TESTPureMorph0c.TXT For /f "tokens=1 delims=." %%a in (TESTPureMorph0c.TXT) do apps\MD5File.exe "%%a.exe"|dnif.exe /I "DDA9FFC6C9B95398A4BF9A9DE70F581F">Nul && echo %%a.exe>>TESTPureMorph1.TXT

IF EXIST TESTPureMorph1.TXT dnif.exe "."<TESTPureMorph1.TXT>NUL && (
TYPE TESTPureMorph1.TXT>>Find.txt
For /f "tokens=4 delims=\" %%b in (TESTPureMorph1.TXT) do dnif.exe /i "%%b"<CheckRuns2.txt>>TESTPureMorph2.TXT
IF EXIST TESTPureMorph2.TXT dnif.exe "."<TESTPureMorph2.TXT>NUL && For /f "tokens=1 delims==" %%c in (TESTPureMorph2.TXT) do (
>RepairPureMorph.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
echo %%c=-
	)
editreg.exe /s RepairPureMorph.reg 2>NUL
copy RepairPureMorph.reg .\backups\RepairPureMorph.reg >nul
	))

dnif.exe /I "Windows UDP Control Center"<CheckRuns.txt>CheckIRCNoPic0.txt
dnif.exe /I "."<CheckIRCNoPic0.txt>nul && for /f "tokens=2 delims==." %%a in (CheckIRCNoPic0.txt) do echo %systemroot%\%%~a.exe>>CheckIRCNoPic1.txt
rtsdnif.exe /m /f:CheckIRCNoPic1.txt "reptile.exe">>Find.txt 2>nul
rtsdnif.exe /m /f:CheckIRCNoPic1.txt "Support.Scr">>RemLat.txt 2>nul

dnif.exe /I "\svchost.exe"<CheckRuns.txt|dnif.exe /I "\system32">TestStart0.txt
apps\locate "%systemroot%\system32\svchost.exe" D- /s:69632! /n|dnif.exe /I ".exe"|dnif.exe /I /V "system32\svchost.exe">>TestStart1.txt
rtsdnif.exe /m /f:TestStart1.txt "Hijack This">>TestStart2.txt 2>NUL
rtsdnif.exe /m /f:TestStart2.txt "Project1">>TestStart3.txt 2>NUL

IF EXIST TestStart3.txt dnif.exe "."<TestStart3.txt>nul && for /f "tokens=4 delims=\" %%e in (TestStart3.txt) do dnif.exe /I "system32\\%%e\\svchost.exe"<TestStart0.txt>TestStart5.txt && (
TYPE TestStart3.txt>>Find.txt
IF EXIST TestStart5.txt dnif.exe "."<TestStart5.txt>nul && for /f "tokens=1 delims==" %%b in (TestStart5.txt) do (
>RepairStartPage.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
	)
echo %%b=->>RepairStartPage.reg
echo.>>RepairStartPage.reg
editreg.exe /s RepairStartPage.reg 2>NUL 
copy RepairStartPage.reg .\backups\ >nul
	))

dnif.exe /I "\\SUE"<CheckRuns.txt|dnif.exe /I "\WINDOWS\\SUE">NUL && dnif.exe /I "\WINDOWS\\SUE"<CheckRuns2.txt>CheckVacsRuns0a.txt && (
>RepairVacRuns.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
	)
for /f "tokens=2 delims=\\." %%a in (CheckVacsRuns0a.txt) do ECHO "\\%%a.exe"=->>RepairVacRuns.reg
for /f "tokens=2 delims=\\." %%a in (CheckVacsRuns0a.txt) do IF EXIST %systemroot%\%%a.exe echo %systemroot%\%%a.exe>>Find.txt
echo [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]>>RepairVacRuns.reg
for /f "tokens=2 delims=\\." %%a in (CheckVacsRuns0a.txt) do ECHO "\\%%a.exe"=->>RepairVacRuns.reg
editreg.exe /s RepairVacRuns.reg 2>NUL 
copy RepairVacRuns.reg .\backups\ >nul
	)

dnif.exe /I "\\VIE"<CheckRuns.txt|dnif.exe /I "\system32\\VIE">NUL && dnif.exe /I "\system32\\VIE"<CheckRuns2.txt>CheckVacsRuns0b.txt && (
>RepairVacRunsa.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
	)
for /f "tokens=2 delims=\\." %%a in (CheckVacsRuns0b.txt) do ECHO "\\%%a.exe"=->>RepairVacRunsa.reg
for /f "tokens=2 delims=\\." %%a in (CheckVacsRuns0b.txt) do IF EXIST %systemroot%\system32\%%a.exe echo %systemroot%\system32\%%a.exe>>Find.txt
echo [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]>>RepairVacRunsa.reg
for /f "tokens=2 delims=\\." %%a in (CheckVacsRuns0b.txt) do ECHO "\\%%a.exe"=->>RepairVacRunsa.reg
editreg.exe /s RepairVacRunsa.reg 2>NUL 
copy RepairVacRunsa.reg .\backups\ >nul
	)

dnif.exe /I "\\YUR"<CheckRuns.txt|dnif.exe /I "\system32\\YUR">NUL && dnif.exe /I "\system32\\YUR"<CheckRuns2.txt>CheckVacsRuns0c.txt && (
>RepairVacRunsb.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
	)
for /f "tokens=2 delims=\\." %%a in (CheckVacsRuns0c.txt) do ECHO "\\%%a.exe"=->>RepairVacRunsb.reg
for /f "tokens=2 delims=\\." %%a in (CheckVacsRuns0c.txt) do IF EXIST %systemroot%\system32\%%a.exe echo %systemroot%\system32\%%a.exe>>Find.txt
echo [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]>>RepairVacRunsb.reg
for /f "tokens=2 delims=\\." %%a in (CheckVacsRuns0c.txt) do ECHO "\\%%a.exe"=->>RepairVacRunsb.reg
editreg.exe /s RepairVacRunsb.reg 2>NUL 
copy RepairVacRunsb.reg .\backups\ >nul
	)

dnif.exe /I "hc"<CheckRuns.txt|dnif.exe /I "j0e">>TESTAv20081.txt
IF EXIST TESTAv20081.txt dnif.exe /I "."<TESTAv20081.txt>NUL && (
>RepairAv20081.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
FOR /F "TOKENS=1 DELIMS==" %%G in (TESTAv20081.txt) DO ECHO %%G=-
echo [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
FOR /F "TOKENS=1 DELIMS==" %%G in (TESTAv20081.txt) DO ECHO %%G=-
echo.
	)
editreg.exe /s RepairAv20081.reg 2>NUL
copy RepairAv20081.reg .\backups\RepairAv2008.reg >nul
	)

dir /b/s/a-d %systemroot%\system32\*hc???j0e???*.exe>>TestFakeAlertRun1.txt 2>nul
dnif.exe /I "."<TestFakeAlertRun1.txt>NUL && (
TYPE TestFakeAlertRun1.txt>>Find.txt
echo Windows Registry Editor Version 5.00>RepairFakeAlertRun.reg
echo.>>RepairFakeAlertRun.reg
for /f "tokens=4 delims=\." %%a in (TestFakeAlertRun1.txt) do (
>>RepairFakeAlertRun.reg (
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
echo "%%a"=-
echo [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
echo "%%a"=-
echo.
	)
editreg.exe /s RepairFakeAlertRun.reg 2>NUL 
copy RepairFakeAlertRun.reg .\backups\ >nul
	))

dnif.exe /I "Reminder"<CheckRuns.txt|dnif.exe /I "SecureExpertCleaner">>TESTSecCleaner.txt
IF EXIST TESTSecCleaner.txt dnif.exe /I "."<TESTSecCleaner.txt>NUL && (
>RepairSecCleaner.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
echo "Reminder"=-
echo.
	)
editreg.exe /s RepairSecCleaner.reg 2>NUL
copy RepairSecCleaner.reg .\backups >nul
	)

apps\Csweg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"|dnif.exe /I "\Uninstall\"|dnif.exe /I /V "{">>TESTfakebsd0.txt

IF EXIST TESTfakebsd0.txt For /f "tokens=7 delims=\" %%G in (TESTfakebsd0.txt) do apps\Csweg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%%G" /v "DisplayName"|dnif.exe /I "AntivirXP08">NUL && ECHO %%G>>TESTfakebsd0A.txt
IF EXIST TESTfakebsd0A.txt For /f "tokens=*" %%G in (TESTfakebsd0A.txt) do apps\Csweg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%%G" /v "DisplayName"|dnif.exe /I "DisplayName"|dnif.exe /I "AntivirXP08">NUL && (
apps\Csweg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" TESTfakebsdrn1.txt
dnif.exe /I "\\%%G\\%%G.exe"<TESTfakebsdrn1.txt>TESTfakebsdrn2.txt
IF EXIST "%programfiles%\%%G\database.dat" (
dir /b/s/a-d "%programfiles%\%%G\*">>Find.txt 2>nul
dir /b/s/a-d "%appdata%\%%G\*">>Find.txt 2>nul
IF EXIST "%programfiles%\%%G" rd /s/q "%programfiles%\%%G">nul && echo Folder %programfiles%\%%G - Removed>>Foldel1.txt
IF EXIST "%appdata%\%%G" rd /s/q "%appdata%\%%G">nul && echo Folder %appdata%\%%G - Removed>>Foldel1.txt 2>nul
	)
>Repairfakebsd1.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%%G]
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\%%G]
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion]
echo "%%G"=-
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
echo "AntivirXP08"=-
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
IF EXIST TESTfakebsdrn2.txt For /f "tokens=1 delims==" %%b in (TESTfakebsdrn2.txt) do echo %%b=-
	)
dnif.exe /I /V "\]"<Repairfakebsd1.reg>Repairfakebsd1A.reg
editreg.exe /s Repairfakebsd1A.reg 2>NUL 
copy Repairfakebsd1A.reg .\backups\AntivirXP08.reg >nul
	)

IF EXIST TESTfakebsd0.txt For /f "tokens=7 delims=\" %%G in (TESTfakebsd0.txt) do apps\Csweg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%%G" /v "DisplayName"|dnif.exe /I "MProtector">NUL && ECHO %%G>>TESTfakebsd0b.txt
IF EXIST TESTfakebsd0b.txt For /f "tokens=*" %%G in (TESTfakebsd0b.txt) do apps\Csweg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%%G" /v "DisplayName"|dnif.exe /I "DisplayName"|dnif.exe /I "MProtector">NUL && (
apps\Csweg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" TESTfakebsdrn1b.txt
dnif.exe /I "\\%%G\\%%G.exe"<TESTfakebsdrn1b.txt>TESTfakebsdrn2b.txt
IF EXIST "%programfiles%\%%G\%%Gskin.dll" dir /b/s/a-d "%programfiles%\%%G\*">>Find.txt 2>nul
IF EXIST "%appdata%\%%G\Quarantine\*" dir /b/s/a-d "%appdata%\%%G\*">>Find.txt 2>nul
IF EXIST "%programfiles%\%%G" rd /s/q "%programfiles%\%%G">nul && echo Folder %programfiles%\%%G - Removed>>Foldel1.txt
IF EXIST "%appdata%\%%G" rd /s/q "%appdata%\%%G">nul && echo Folder %appdata%\%%G - Removed>>Foldel1.txt
>Repairfakebsd1b.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%%G]
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\%%G]
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion]
echo "%%G"=-
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
echo "MProtector08"=-
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
IF EXIST TESTfakebsdrn2b.txt For /f "tokens=1 delims==" %%b in (TESTfakebsdrn2b.txt) do echo %%b=-
	)
dnif.exe /I /V "\]"<Repairfakebsd1b.reg>Repairfakebsd2b.reg
editreg.exe /s Repairfakebsd2b.reg 2>NUL 
copy Repairfakebsd2b.reg .\backups\MProtector08.reg >nul
	)

IF EXIST TESTfakebsd0.txt For /f "tokens=7 delims=\" %%G in (TESTfakebsd0.txt) do apps\Csweg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%%G" /v "DisplayName"|dnif.exe /I "AntiMalware2009">NUL && ECHO %%G>>TESTfakebsd0c.txt
IF EXIST TESTfakebsd0c.txt For /f "tokens=*" %%G in (TESTfakebsd0c.txt) do apps\Csweg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%%G" /v "DisplayName"|dnif.exe /I "DisplayName"|dnif.exe /I "AntiMalware2009">NUL && (
apps\Csweg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" TESTfakebsdrn1c.txt
dnif.exe /I "\\%%G\\%%G.exe"<TESTfakebsdrn1c.txt>TESTfakebsdrn2c.txt
IF EXIST "%programfiles%\%%G\database.dat" (
dir /b/s/a-d "%programfiles%\%%G\*">>Find.txt 2>nul
dir /b/s/a-d "%appdata%\%%G\*">>Find.txt 2>nul
IF EXIST "%programfiles%\%%G" rd /s/q "%programfiles%\%%G">nul && echo Folder %programfiles%\%%G - Removed>>Foldel1.txt
IF EXIST "%appdata%\%%G" rd /s/q "%appdata%\%%G">nul && echo Folder %appdata%\%%G - Removed>>Foldel1.txt 2>nul
	)
>Repairfakebsd1c.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%%G]
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\%%G]
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion]
echo "%%G"=-
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
echo "AntiMalware2009"=-
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
IF EXIST TESTfakebsdrn2c.txt For /f "tokens=1 delims==" %%b in (TESTfakebsdrn2c.txt) do echo %%b=-
	)
dnif.exe /I /V "\]"<Repairfakebsd1c.reg>Repairfakebsd2c.reg
editreg.exe /s Repairfakebsd2c.reg 2>NUL 
copy Repairfakebsd2c.reg .\backups\AntiMalware2009.reg >nul
	)

apps\SWREG.exe QUERY "HKEY_USERS"|dnif.exe /I "s-">>testusers1.txt
for /f "TOKENS=*" %%b in (testusers1.txt) do apps\SWREG.exe QUERY "%%b\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /V Shell|DNIF /I "shell"|DNIF /I "sysguard\sysguard.exe">nul && (
>>RepairSysGuard.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [%%b\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
echo "Shell"="Explorer.exe"
	)
editreg.exe /s RepairSysGuard.reg 2>NUL 
copy RepairSysGuard.reg .\backups >nul
	)

apps\locate "%systemroot%\system32\*.exe" /D- /s:94208! /n /nr|dnif.exe /I ".exe">>TESTfbsoda1.TXT
IF EXIST TESTfbsoda1.TXT rtsdnif.exe /m /f:TESTfbsoda1.TXT "redtube.com">>TESTfbsoda2.TXT 2>NUL
IF EXIST TESTfbsoda2.TXT rtsdnif.exe /m /f:TESTfbsoda2.TXT "adultfriendfinder.com">>Find.txt 2>NUL

apps\sc query type= service state= inactive |dnif.exe /I "SERVICE_NAME"|dnif.exe /I "(">>TestTinyProxy1.txt
IF EXIST TestTinyProxy1.txt dnif.exe /I "(" <TestTinyProxy1.txt>nul && For /f "tokens=2,3* delims=: " %%G in (TestTinyProxy1.txt) do ECHO %%G %%H %%I>>TestTinyProxy2.txt
IF EXIST "%programfiles%\TinyProxy\TinyProxy.exe" For /f "tokens=*" %%b in (TestTinyProxy2.txt) do apps\SWREG.exe QUERY "HKLM\System\CurrentControlSet\Services\%%b" /V ImagePath |FIND.EXE /I "ImagePath"|Find.exe /I "%programfiles%\TinyProxy\TinyProxy.exe">nul && echo %%b>>apps\svc.txt

apps\sc query type= driver state= inactive |dnif.exe /I "SERVICE_NAME"|dnif.exe /I "{">>Testmbrsinowal1.txt
IF EXIST Testmbrsinowal1.txt dnif.exe /I "{"<Testmbrsinowal1.txt>NUL && For /f "tokens=2 delims=: " %%G in (Testmbrsinowal1.txt) do apps\Csweg.exe QUERY "HKLM\System\CurrentControlSet\Services\%%G" /V ImagePath |dnif.exe /I "ImagePath"|dnif.exe /I "TEMP"|dnif.exe /I ".tmp">nul && echo %%G>>apps\svc.txt
IF EXIST Testmbrsinowal1.txt dnif.exe /I "{"<Testmbrsinowal1.txt>NUL && For /f "tokens=2 delims=: " %%G in (Testmbrsinowal1.txt) do apps\Csweg.exe QUERY "HKLM\System\CurrentControlSet\Services\%%G" /V ImagePath |dnif.exe /I "ImagePath"|dnif.exe /I "TEMP"|dnif.exe /I ".tmp">>Testmbrsinowal2.txt
IF EXIST Testmbrsinowal2.txt dnif.exe "." <Testmbrsinowal2.txt>NUL && for /f "tokens=6 delims=\" %%c in (Testmbrsinowal2.txt) do (
IF EXIST "%temp%\%%c" echo "%temp%\%%c">>Find.txt
IF EXIST "%systemroot%\Temp\%%c" echo "%systemroot%\Temp\%%c">>Find.txt
echo foundsin>sinowaltest1.txt
	)

apps\locate "%systemroot%\system32\*.syz" /D- /n /nr|dnif.exe /I ".syz">>Testmbrsinowal3.txt
rtsdnif.exe /m /f:Testmbrsinowal4.txt /C:"WMDM PMSP Service">>Find.txt 2>NUL

apps\locate "%userprofile%\*.exe" /D- /s:58368! /n /nr|dnif.exe /I ".exe">>testTofsee5.txt 2>NUL
for /f "tokens=*" %%a in (testTofsee5.txt) do apps\MD5File.exe "%%a"|dnif.exe /I "0E35435FA08C226BDCD8875A5749DDD3">NUL && echo %%a>>testTofsee6.txt
for /f "tokens=*" %%a in (testTofsee5.txt) do apps\MD5File.exe "%%a"|dnif.exe /I "9FB88914FA95B65FC8491F42DBC218F7">NUL && echo %%a>>testTofsee6.txt
IF EXIST testTofsee6.txt dnif.exe /I "."<testTofsee6.txt>NUL && for /f "tokens=4 delims=\" %%c in (testTofsee6.txt) do apps\process -k %%c>>kill.txt

apps\locate "%userprofile%\*.exe" /D- /s:58368! /n /nr|dnif.exe /I ".exe">>testTofsee1.txt 2>NUL
apps\locate "%systemroot%\system32\*.exe" /D- /s:58368! /n  /nr|dnif.exe /I ".exe">>testTofsee1.txt 2>NUL
IF EXIST testTofsee1.txt for /f "tokens=*" %%a in (testTofsee1.txt) do apps\MD5File.exe "%%a"|dnif.exe /I "0E35435FA08C226BDCD8875A5749DDD3">NUL && echo %%a>>Tofseetest2.txt
IF EXIST testTofsee1.txt for /f "tokens=*" %%a in (testTofsee1.txt) do apps\MD5File.exe "%%a"|dnif.exe /I "9FB88914FA95B65FC8491F42DBC218F7">NUL && echo %%a>>Tofseetest2.txt

IF EXIST Tofseetest2.txt dnif.exe /I "."<Tofseetest2.txt>NUL && (
TYPE Tofseetest2.txt>>Find.txt
dnif.exe /I ".exe \\u"<CheckRuns.txt>>testTofsee3.txt
for /f "tokens=4 delims=\\." %%a in (testTofsee3.txt) do apps\MD5File.exe "%systemroot%\system32\%%a.exe"|dnif.exe /I "0E35435FA08C226BDCD8875A5749DDD3">NUL && (
>RepairTofseeRun.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
ECHO "%%a"=-
	)
editreg.exe /s RepairTofseeRun.reg 2>NUL 
copy RepairTofseeRun.reg .\backups\ >nul
	))

apps\locate "%userprofile%\*.exe" /D- /s:59904! /n /nr|dnif.exe /I ".exe">>testTofsee5a.txt 2>NUL
for /f "tokens=*" %%a in (testTofsee5a.txt) do apps\MD5File.exe "%%a"|dnif.exe /I "d94d23a5cd46f5900bd5d98eaff975b5">NUL && echo %%a>>testTofsee6a.txt
IF EXIST testTofsee6a.txt dnif.exe /I "."<testTofsee6a.txt>NUL && for /f "tokens=4 delims=\" %%c in (testTofsee6a.txt) do apps\process -k %%c>>kill.txt

apps\locate "%userprofile%\*.exe" /D- /s:59904! /n|dnif.exe /I ".exe">>testTofsee1a.txt 2>NUL
apps\locate "%systemroot%\system32\*.exe" /D- /s:59904! /n|dnif.exe /I ".exe">>testTofsee1a.txt 2>NUL
IF EXIST testTofsee1a.txt for /f "tokens=*" %%a in (testTofsee1a.txt) do apps\MD5File.exe "%%a"|dnif.exe /I "d94d23a5cd46f5900bd5d98eaff975b5">NUL && echo %%a>>Tofseetest2a.txt

IF EXIST Tofseetest2a.txt dnif.exe /I "."<Tofseetest2a.txt>NUL && (
TYPE Tofseetest2a.txt>>Find.txt
dnif.exe /I ".exe \\u"<CheckRuns.txt>>testTofsee3a.txt
for /f "tokens=4 delims=\\." %%a in (testTofsee3a.txt) do apps\MD5File.exe "%systemroot%\system32\%%a.exe"|dnif.exe /I "d94d23a5cd46f5900bd5d98eaff975b5">NUL && (
>RepairTofseeRun.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
ECHO "%%a"=-
	)
editreg.exe /s RepairTofseeRun.reg 2>NUL
copy RepairTofseeRun.reg .\backups\ >nul
	))

apps\locate "%userprofile%\*.exe" /D- /s:33280! /n /nr|dnif.exe /I ".exe">>testTofsee5b.txt 2>NUL
for /f "tokens=*" %%a in (testTofsee5b.txt) do apps\MD5File.exe "%%a"|dnif.exe /I "A53A029D75D45E9CA43A21986B135794">NUL && echo %%a>>testTofsee6b.txt
for /f "tokens=*" %%a in (testTofsee5b.txt) do apps\MD5File.exe "%%a"|dnif.exe /I "C65126514AAE1CFA45274534666E1C53">NUL && echo %%a>>testTofsee6b.txt
for /f "tokens=*" %%a in (testTofsee5b.txt) do apps\MD5File.exe "%%a"|dnif.exe /I "D16E5B9AA888C3C6D83C2773D1F46017">NUL && echo %%a>>testTofsee6b.txt
IF EXIST testTofsee6b.txt dnif.exe /I "."<testTofsee6b.txt>NUL && for /f "tokens=4 delims=\" %%c in (testTofsee6b.txt) do apps\process -k %%c>>kill.txt

apps\locate "%userprofile%\*.exe" /D- /s:33280! /n|dnif.exe /I ".exe">>testTofsee1b.txt 2>NUL
apps\locate "%systemroot%\system32\*.exe" /D- /s:33280! /n|dnif.exe /I ".exe">>testTofsee1b.txt 2>NUL
IF EXIST testTofsee1b.txt for /f "tokens=*" %%a in (testTofsee1b.txt) do apps\MD5File.exe "%%a"|dnif.exe /I "A53A029D75D45E9CA43A21986B135794">NUL && echo %%a>>Tofseetest2b.txt
IF EXIST testTofsee1b.txt for /f "tokens=*" %%a in (testTofsee1b.txt) do apps\MD5File.exe "%%a"|dnif.exe /I "C65126514AAE1CFA45274534666E1C53">NUL && echo %%a>>Tofseetest2b.txt
IF EXIST testTofsee1b.txt for /f "tokens=*" %%a in (testTofsee1b.txt) do apps\MD5File.exe "%%a"|dnif.exe /I "D16E5B9AA888C3C6D83C2773D1F46017">NUL && echo %%a>>Tofseetest2b.txt

IF EXIST Tofseetest2b.txt dnif.exe /I "."<Tofseetest2b.txt>NUL && (
TYPE Tofseetest2b.txt>>Find.txt
dnif.exe /I ".exe \\u"<CheckRuns.txt>>testTofsee3b.txt
for /f "tokens=4 delims=\\." %%a in (testTofsee3b.txt) do apps\MD5File.exe "%systemroot%\system32\%%a.exe"|dnif.exe /I "C65126514AAE1CFA45274534666E1C53">NUL && (
>RepairTofseeRun.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
ECHO "%%a"=-
	)
editreg.exe /s RepairTofseeRun.reg 2>NUL 
copy RepairTofseeRun.reg .\backups\ >nul
	))

dnif.exe /I "F-Secure Gatekeeper"<CheckRuns.txt>NUL && IF EXIST %systemroot%\system32\taskmon.exe echo %systemroot%\system32\taskmon.exe>>Find.txt

IF EXIST kill.txt dnif.exe /i "Killing"<kill.txt>>stopped.txt

apps\Csweg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects"|dnif.exe /I "{">TESTVundo0.txt 
IF EXIST TESTVundo0.txt For /f "tokens=8 delims=\{}" %%G in (TESTVundo0.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I ".dll"|dnif.exe /I "system32">>TESTVundo1.txt
IF EXIST TESTVundo1.txt For /f "tokens=4 delims=\" %%C in (TESTVundo1.txt) do echo %%C>>TESTVundo2.txt
IF EXIST TESTVundo2.txt For /f "tokens=1 delims=." %%d in (TESTVundo2.txt) do apps\Csweg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\%%d" /V DllName|dnif.exe /I "%%d.dll">nul && echo %%d.dll>>TESTVundo3.txt
IF EXIST TESTVundo3.txt For /f "tokens=8 delims=\{}" %%f in (TESTVundo0.txt) do For /f "tokens=*" %%l in (TESTVundo3.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%f}\InprocServer32"|dnif.exe /I "%%l">nul && echo %%f>>TESTVundo4.txt

IF EXIST TESTVundo4.txt dnif.exe /I "-"<TESTVundo4.txt>NUL && (
IF EXIST TESTVundo3.txt dnif.exe /I "."<TESTVundo3.txt>NUL && (
For /f "tokens=1 delims=." %%e in (TESTVundo3.txt) do IF EXIST %systemroot%\system32\%%e.dll echo %systemroot%\system32\%%e.dll>>Find.txt
apps\process -k smss.exe >nul
apps\process -k winlogon.exe >nul
>RepairVundo1.reg (
echo Windows Registry Editor Version 5.00
echo. )
For /f "tokens=1 delims=." %%f in (TESTVundo3.txt) do echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\%%f]>>RepairVundo1.reg
For /f "tokens=*" %%M in (TESTVundo4.txt) do (
>>RepairVundo1.reg (
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%M}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%M}]
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
echo "{%%M}"=-
echo. )
editreg.exe /s RepairVundo1.reg 2>NUL
copy RepairVundo1.reg .\backups\RepairVundo.reg >nul
	)))

apps\locate "%systemroot%\system32\*.dll" /D- /s:21504! /n /nr|dnif.exe /I ".dll">>TESTPakesSpam1.TXT
IF EXIST TESTPakesSpam1.TXT rtsdnif.exe /m /f:TESTPakesSpam1.TXT "hi, botnet Jack here">TESTPakesSpam2.TXT 2>NUL

IF EXIST TESTPakesSpam2.TXT DNIF.EXE /I "."<TESTPakesSpam2.TXT>NUL && (
apps\process -k smss.exe >nul
apps\process -k winlogon.exe >nul
echo Windows Registry Editor Version 5.00>RepairPakesSpam.reg
echo.>>RepairPakesSpam.reg
FOR /F "TOKENS=4 DELIMS=\." %%l IN (TESTPakesSpam2.TXT) DO (
if exist %systemroot%\system32\%%l.dll echo %systemroot%\system32\%%l.dll>>Find.txt
apps\Csweg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\%%l" /v DllName|dnif.exe /I "%%l.dll">nul && echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\%%l]>>RepairPakesSpam.reg
	)
echo.>>RepairPakesSpam.reg
dnif.exe /I /V "\]"<RepairPakesSpam.reg>>RepairPakes.reg
editreg.exe /s RepairPakes.reg 2>NUL
copy RepairPakes.reg .\backups >nul
	)

apps\locate "%systemroot%\system32\*.dll" /D- /s:35328! /n /nr|dnif.exe /I ".dll">>TESTVundofile1.txt
for /f "tokens=*" %%a in (TESTVundofile1.txt) do apps\MD5File.exe "%%a"|dnif.exe /I "5FFC842485FCBA7E30254A6F0418E05A">NUL && echo %%a>>Find.txt

apps\locate "%systemroot%\system32\*.dll" /D- /s:248320! /n /nr|dnif.exe /I ".dll">>TESTVundofile2.txt
for /f "tokens=*" %%a in (TESTVundofile2.txt) do apps\MD5File.exe "%%a"|dnif.exe /I "DAE39CCEEC3CEEBBE613318E51878AD3">NUL && echo %%a>>Find.txt

apps\locate "%systemroot%\system32\*.dll" /D- /s:13312! /n /nr|dnif.exe /I ".dll">>TESTsts1.TXT
rtsdnif.exe /m /f:TESTsts1.TXT "extremalgey.com">>TESTsts2.TXT 2>NUL
rtsdnif.exe /m /f:TESTsts1.TXT "extremalgey.com">>Find.txt 2>NUL

apps\locate "%systemroot%\system32\*.dll" /D- /s:15360! /n /nr|dnif.exe /I ".dll">>TESTsts1a.TXT
rtsdnif.exe /m /f:TESTsts1a.TXT "militaryass.com">>TESTsts2.TXT 2>NUL
rtsdnif.exe /m /f:TESTsts1a.TXT "militaryass.com">>Find.txt 2>nul

apps\Csweg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler" CheckSTS1.txt
IF EXIST CheckSTS1.txt dnif.exe /I "{"<CheckSTS1.txt>CheckSTS2.txt

IF EXIST CheckSTS2.txt dnif.exe /I "{"<CheckSTS2.txt>NUL && For /f "tokens=2 delims={}" %%c in (CheckSTS2.txt) do For /f "tokens=4 delims=\." %%f in (TESTsts2.TXT) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%c}\InprocServer32"|dnif.exe /I "%%f.dll">nul && (
>RepairSTSzlob1.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
echo "{%%c}"=-
echo [-HKEY_CLASSES_ROOT\CLSID\{%%c}]
echo.
	)
editreg.exe /s RepairSTSzlob1.reg 2>NUL
copy RepairSTSzlob1.reg .\backups\RepairZlob.reg >nul
	)

apps\Csweg EXPORT "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" CheckKrakRuns0.txt
apps\Csweg EXPORT "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices" CheckKrakRuns.txt
IF EXIST CheckKrakRuns.txt dnif.exe /I "="<CheckKrakRuns.txt|dnif.exe /I "system32">CheckKrakRuns1.txt
IF EXIST CheckKrakRuns1.txt dnif.exe /I "."<CheckKrakRuns1.txt>NUL && for /f "tokens=4 delims=\\. " %%G in (CheckKrakRuns1.txt) do ECHO %systemroot%\system32\%%G.exe>CheckKrakRuns2.txt
rtsdnif.exe /m /f:CheckKrakRuns2.txt "XPTPSW" >>CheckKrakRuns3.txt 2>NUL
rtsdnif.exe /m /f:CheckKrakRuns3.txt "VirtualProtect" >>CheckKrakRuns4.txt 2>NUL
rtsdnif.exe /m /f:CheckKrakRuns4.txt "VirtualAlloc" >>CheckKrakRuns5.txt 2>NUL
rtsdnif.exe /m /f:CheckKrakRuns5.txt "VirtualFree" >>CheckKrakRuns6.txt 2>NUL
IF EXIST CheckKrakRuns6.txt dnif.exe /I "."<CheckKrakRuns6.txt>NUL && For /f "tokens=4 delims=\." %%a in (CheckKrakRuns6.txt) DO dnif.exe /I "\%%a.exe"<CheckKrakRuns0.txt>nul && dnif.exe /I "\%%a.exe"<CheckKrakRuns.txt>CheckKrakRuns7.txt

IF EXIST CheckKrakRuns7.txt dnif.exe /I "."<CheckKrakRuns7.txt>NUL && For /f "tokens=1 delims==" %%c in (CheckKrakRuns7.txt) DO (
>RepairKrakenRuns1.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
echo %%c=-
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
echo %%c=-
echo.
	)
For /f "tokens=4 delims=\." %%a in (CheckKrakRuns7.txt) DO IF EXIST %systemroot%\system32\%%a.exe echo %systemroot%\system32\%%a.exe>>Find.txt

editreg.exe /s RepairKrakenRuns1.reg 2>NUL
copy RepairKrakenRuns1.reg .\backups >nul
	)

apps\sc.exe GetKeyName "BT Modem Lock"|dnif.exe /I "SUCCESS">NUL && (
apps\sc.exe GetKeyName "BT Modem Lock"|dnif.exe /I "SUCCESS">testkraken1.txt
for /f "tokens=6 delims= " %%G in (testkraken1.txt) do apps\Csweg.exe QUERY "HKLM\SYSTEM\CurrentControlSet\Services\%%G" /V ImagePath |dnif.exe /I "ImagePath"|dnif.exe /I "\system32\" |dnif.exe /I /V "ModemLock."|dnif.exe /I /V "BT">>testkraken2.txt
IF EXIST testkraken2.txt dnif.exe /I "."<testkraken2.txt>NUL &&  For /f "tokens=3" %%a in (testkraken2.txt) do echo %%a>>testkraken4.txt
IF EXIST testkraken4.txt dnif.exe /I "."<testkraken4.txt>NUL && ( 
TYPE testkraken4.txt>>Find.txt
For /f "tokens=6 delims= " %%a in (testkraken1.txt) DO echo %%a>>apps\svc.txt
FOR /F "TOKENS=4 DELIMS=\." %%C in (testkraken4.txt) DO (
>RepairKrakenRun.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
ECHO "%%C"=-
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
ECHO "%%C"=-
	)
editreg.exe /s RepairKrakenRun.reg 2>NUL
copy RepairKrakenRun.reg .\backups >nul
	)))

apps\sc.exe GetKeyName "Print Spooler Service"|dnif.exe /I "SUCCESS">NUL && (
apps\sc.exe GetKeyName "Print Spooler Service"|dnif.exe /I "SUCCESS">testkraken1a.txt
for /f "tokens=6 delims= " %%G in (testkraken1a.txt) do apps\Csweg.exe QUERY "HKLM\SYSTEM\CurrentControlSet\Services\%%G" /V ImagePath |dnif.exe /I "ImagePath"|dnif.exe /I "\system32\" >>testkraken2a.txt
IF EXIST testkraken2a.txt dnif.exe /I "."<testkraken2a.txt>NUL &&  For /f "tokens=3" %%a in (testkraken2a.txt) do echo %%a>>testkraken4a.txt
IF EXIST testkraken4a.txt dnif.exe /I "."<testkraken4a.txt>NUL && ( 
TYPE testkraken4a.txt>>Find.txt
For /f "tokens=6 delims= " %%a in (testkraken1a.txt) DO echo %%a>>apps\svc.txt
FOR /F "TOKENS=4 DELIMS=\." %%C in (testkraken4a.txt) DO (
>RepairKrakenRun1.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
ECHO "%%C"=-
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
ECHO "%%C"=-
	)
editreg.exe /s RepairKrakenRun1.reg 2>NUL
copy RepairKrakenRun1.reg .\backups >nul
	)))

apps\sc.exe GetKeyName "Electronic Arts Licensing"|dnif.exe /I "SUCCESS">NUL && (
apps\sc.exe GetKeyName "Electronic Arts Licensing"|dnif.exe /I "SUCCESS">testkraken1b.txt
for /f "tokens=6 delims= " %%G in (testkraken1b.txt) do apps\Csweg.exe QUERY "HKLM\SYSTEM\CurrentControlSet\Services\%%G" /V ImagePath |dnif.exe /I "ImagePath"|dnif.exe /I "\system32\"|dnif.exe /I /V "Service."|dnif.exe /I /V "Shared\">>testkraken2b.txt
IF EXIST testkraken2b.txt dnif.exe /I "."<testkraken2b.txt>NUL &&  For /f "tokens=3" %%a in (testkraken2b.txt) do echo %%a>>testkraken4b.txt
IF EXIST testkraken4b.txt dnif.exe /I "."<testkraken4b.txt>NUL && ( 
TYPE testkraken4b.txt>>Find.txt
For /f "tokens=6 delims= " %%a in (testkraken1b.txt) DO echo %%a>>apps\svc.txt
FOR /F "TOKENS=4 DELIMS=\." %%C in (testkraken4b.txt) DO (
>RepairKrakenRun2.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
ECHO "%%C"=-
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
ECHO "%%C"=-
	)
editreg.exe /s RepairKrakenRun2.reg 2>NUL
copy RepairKrakenRun2.reg .\backups >nul
	)))

apps\sc.exe GetKeyName "Electronic Arts Licensing Service"|dnif.exe /I "SUCCESS">NUL && (
apps\sc.exe GetKeyName "Electronic Arts Licensing Service"|dnif.exe /I "SUCCESS">testkraken1c.txt
for /f "tokens=6 delims= " %%G in (testkraken1c.txt) do apps\Csweg.exe QUERY "HKLM\SYSTEM\CurrentControlSet\Services\%%G" /V ImagePath |dnif.exe /I "ImagePath"|dnif.exe /I "\system32\"|dnif.exe /I /V "Service."|dnif.exe /I /V "Shared\" >>testkraken2c.txt
IF EXIST testkraken2c.txt dnif.exe /I "."<testkraken2c.txt>NUL &&  For /f "tokens=3" %%a in (testkraken2c.txt) do echo %%a>>testkraken4c.txt
IF EXIST testkraken4c.txt dnif.exe /I "."<testkraken4c.txt>NUL && ( 
TYPE testkraken4c.txt>>Find.txt
For /f "tokens=6 delims= " %%a in (testkraken1c.txt) DO echo %%a>>apps\svc.txt
FOR /F "TOKENS=4 DELIMS=\." %%C in (testkraken4c.txt) DO (
>RepairKrakenRun3.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
ECHO "%%C"=-
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
ECHO "%%C"=-
	)
editreg.exe /s RepairKrakenRun3.reg 2>NUL
copy RepairKrakenRun3.reg .\backups >nul
	)))

apps\sc.exe GetKeyName "DQLWinService"|dnif.exe /I "SUCCESS">NUL && (
apps\sc.exe GetKeyName "DQLWinService"|dnif.exe /I "SUCCESS">testkraken1d.txt
for /f "tokens=6 delims= " %%G in (testkraken1d.txt) do apps\Csweg.exe QUERY "HKLM\SYSTEM\CurrentControlSet\Services\%%G" /V ImagePath |dnif.exe /I "ImagePath"|dnif.exe /I "\system32\"|dnif.exe /I /V "Service."|dnif.exe /I /V "AdpPlugins" >>testkraken2d.txt
IF EXIST testkraken2d.txt dnif.exe /I "."<testkraken2d.txt>NUL &&  For /f "tokens=3" %%a in (testkraken2d.txt) do echo %%a>>testkraken4d.txt
IF EXIST testkraken4d.txt dnif.exe /I "."<testkraken4d.txt>NUL && ( 
TYPE testkraken4d.txt>>Find.txt
For /f "tokens=6 delims= " %%a in (testkraken1d.txt) DO echo %%a>>apps\svc.txt
FOR /F "TOKENS=4 DELIMS=\." %%C in (testkraken4d.txt) DO (
>RepairKrakenRun4.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
ECHO "%%C"=-
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
ECHO "%%C"=-
	)
editreg.exe /s RepairKrakenRun4.reg 2>NUL
copy RepairKrakenRun4.reg .\backups >nul
	)))

apps\sc.exe GetKeyName "Creative Labs Licensing"|dnif.exe /I "SUCCESS">NUL && (
apps\sc.exe GetKeyName "Creative Labs Licensing"|dnif.exe /I "SUCCESS">testkraken1e.txt
for /f "tokens=6 delims= " %%G in (testkraken1e.txt) do apps\Csweg.exe QUERY "HKLM\SYSTEM\CurrentControlSet\Services\%%G" /V ImagePath |dnif.exe /I "ImagePath"|dnif.exe /I "\system32\"|dnif.exe /I /V "CreativeLicensing."|dnif.exe /I /V "Shared\" >>testkraken2e.txt
IF EXIST testkraken2e.txt dnif.exe /I "."<testkraken2e.txt>NUL &&  For /f "tokens=3" %%a in (testkraken2e.txt) do echo %%a>>testkraken4e.txt
IF EXIST testkraken4e.txt dnif.exe /I "."<testkraken4e.txt>NUL && ( 
TYPE testkraken4e.txt>>Find.txt
For /f "tokens=6 delims= " %%a in (testkraken1e.txt) DO echo %%a>>apps\svc.txt
FOR /F "TOKENS=4 DELIMS=\." %%C in (testkraken4e.txt) DO (
>RepairKrakenRun5.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
ECHO "%%C"=-
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
ECHO "%%C"=-
	)
editreg.exe /s RepairKrakenRun5.reg 2>NUL
copy RepairKrakenRun5.reg .\backups >nul
	)))

apps\sc.exe GetKeyName "BlueSoleilCS"|dnif.exe /I "SUCCESS">NUL && (
apps\sc.exe GetKeyName "BlueSoleilCS"|dnif.exe /I "SUCCESS">testkraken1f.txt
for /f "tokens=6 delims= " %%G in (testkraken1f.txt) do apps\Csweg.exe QUERY "HKLM\SYSTEM\CurrentControlSet\Services\%%G" /V ImagePath |dnif.exe /I "ImagePath"|dnif.exe /I "\system32\"|dnif.exe /I /V "bluesoleil"|dnif.exe /I /V "Corporation">>testkraken2f.txt
IF EXIST testkraken2f.txt dnif.exe /I "."<testkraken2f.txt>NUL &&  For /f "tokens=3" %%a in (testkraken2f.txt) do echo %%a>>testkraken4f.txt
IF EXIST testkraken4f.txt dnif.exe /I "."<testkraken4f.txt>NUL && ( 
TYPE testkraken4f.txt>>Find.txt
For /f "tokens=6 delims= " %%a in (testkraken1f.txt) DO echo %%a>>apps\svc.txt
FOR /F "TOKENS=4 DELIMS=\." %%C in (testkraken4f.txt) DO (
>RepairKrakenRun6.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
ECHO "%%C"=-
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
ECHO "%%C"=-
	)
editreg.exe /s RepairKrakenRun6.reg 2>NUL
copy RepairKrakenRun6.reg .\backups >nul
	)))

apps\sc.exe GetKeyName "Axon Service"|dnif.exe /I "SUCCESS">NUL && (
apps\sc.exe GetKeyName "Axon Service"|dnif.exe /I "SUCCESS">testkraken1g.txt
for /f "tokens=6 delims= " %%G in (testkraken1g.txt) do apps\Csweg.exe QUERY "HKLM\SYSTEM\CurrentControlSet\Services\%%G" /V ImagePath |dnif.exe /I "ImagePath"|dnif.exe /I "\system32\"|dnif.exe /I /V "axon"|dnif.exe /I /V "NCH" >>testkraken2g.txt
IF EXIST testkraken2g.txt dnif.exe /I "."<testkraken2g.txt>NUL &&  For /f "tokens=3" %%a in (testkraken2g.txt) do echo %%a>>testkraken4g.txt
IF EXIST testkraken4g.txt dnif.exe /I "."<testkraken4g.txt>NUL && ( 
TYPE testkraken4g.txt>>Find.txt
For /f "tokens=6 delims= " %%a in (testkraken1g.txt) DO echo %%a>>apps\svc.txt
FOR /F "TOKENS=4 DELIMS=\." %%C in (testkraken4g.txt) DO (
>RepairKrakenRun7.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
ECHO "%%C"=-
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
ECHO "%%C"=-
	)
editreg.exe /s RepairKrakenRun7.reg 2>NUL
copy RepairKrakenRun7.reg .\backups >nul
	)))

apps\sc.exe GetKeyName "Aventail VPN Client"|dnif.exe /I "SUCCESS">NUL && (
apps\sc.exe GetKeyName "Aventail VPN Client"|dnif.exe /I "SUCCESS">testkraken1h.txt
for /f "tokens=6 delims= " %%G in (testkraken1h.txt) do apps\Csweg.exe QUERY "HKLM\SYSTEM\CurrentControlSet\Services\%%G" /V ImagePath |dnif.exe /I "ImagePath"|dnif.exe /I "\system32\"|dnif.exe /I /V "ngvpnmgr"|dnif.exe /I /V "mgr.exe" >>testkraken2h.txt
IF EXIST testkraken2h.txt dnif.exe /I "."<testkraken2h.txt>NUL &&  For /f "tokens=3" %%a in (testkraken2h.txt) do echo %%a>>testkraken4h.txt
IF EXIST testkraken4h.txt dnif.exe /I "."<testkraken4h.txt>NUL && ( 
TYPE testkraken4h.txt>>Find.txt
For /f "tokens=6 delims= " %%a in (testkraken1h.txt) DO echo %%a>>apps\svc.txt
FOR /F "TOKENS=4 DELIMS=\." %%C in (testkraken4h.txt) DO (
>RepairKrakenRun8.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
ECHO "%%C"=-
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
ECHO "%%C"=-
	)
editreg.exe /s RepairKrakenRun8.reg 2>NUL
copy RepairKrakenRun8.reg .\backups >nul
	)))

apps\sc.exe GetKeyName "Ati HotKey"|dnif.exe /I "SUCCESS">NUL && (
apps\sc.exe GetKeyName "Ati HotKey"|dnif.exe /I "SUCCESS">testkraken1i.txt
for /f "tokens=6 delims= " %%G in (testkraken1i.txt) do apps\Csweg.exe QUERY "HKLM\SYSTEM\CurrentControlSet\Services\%%G" /V ImagePath |dnif.exe /I "ImagePath"|dnif.exe /I "\system32\"|dnif.exe /I /V "Ati2evxx." |dnif.exe /I /V "Poller">>testkraken2i.txt
IF EXIST testkraken2i.txt dnif.exe /I "."<testkraken2i.txt>NUL &&  For /f "tokens=3" %%a in (testkraken2i.txt) do echo %%a>>testkraken4i.txt
IF EXIST testkraken4i.txt dnif.exe /I "."<testkraken4i.txt>NUL && ( 
TYPE testkraken4i.txt>>Find.txt
For /f "tokens=6 delims= " %%a in (testkraken1i.txt) DO echo %%a>>apps\svc.txt
FOR /F "TOKENS=4 DELIMS=\." %%C in (testkraken4i.txt) DO (
>RepairKrakenRun9.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
ECHO "%%C"=-
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
ECHO "%%C"=-
	)
editreg.exe /s RepairKrakenRun9.reg 2>NUL
copy RepairKrakenRun9.reg .\backups >nul
	)))

apps\sc.exe GetKeyName "Amazon Unbox Video Service"|dnif.exe /I "SUCCESS">NUL && (
apps\sc.exe GetKeyName "Amazon Unbox Video Service"|dnif.exe /I "SUCCESS">testkraken1j.txt
for /f "tokens=6 delims= " %%G in (testkraken1j.txt) do apps\Csweg.exe QUERY "HKLM\SYSTEM\CurrentControlSet\Services\%%G" /V ImagePath |dnif.exe /I "ImagePath"|dnif.exe /I "\system32\"|dnif.exe /I /V "ADVWindowsClientService."|dnif.exe /I /V "Amazon">>testkraken2j.txt
IF EXIST testkraken2j.txt dnif.exe /I "."<testkraken2j.txt>NUL &&  For /f "tokens=3" %%a in (testkraken2j.txt) do echo %%a>>testkraken4j.txt
IF EXIST testkraken4j.txt dnif.exe /I "."<testkraken4j.txt>NUL && ( 
TYPE testkraken4j.txt>>Find.txt
For /f "tokens=6 delims= " %%a in (testkraken1j.txt) DO echo %%a>>apps\svc.txt
FOR /F "TOKENS=4 DELIMS=\." %%C in (testkraken4j.txt) DO (
>RepairKrakenRun10.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
ECHO "%%C"=-
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
ECHO "%%C"=-
	)
editreg.exe /s RepairKrakenRun10.reg 2>NUL
copy RepairKrakenRun10.reg .\backups >nul
	)))

apps\sc.exe GetKeyName "Advanced Networking Service"|dnif.exe /I "SUCCESS">NUL && (
apps\sc.exe GetKeyName "Advanced Networking Service"|dnif.exe /I "SUCCESS">testkraken1k.txt
for /f "tokens=6 delims= " %%G in (testkraken1k.txt) do apps\Csweg.exe QUERY "HKLM\SYSTEM\CurrentControlSet\Services\%%G" /V ImagePath |dnif.exe /I "ImagePath"|dnif.exe /I "\system32\"|dnif.exe /I /V "hnm_svc."|dnif.exe /I /V "Dell">>testkraken2k.txt
IF EXIST testkraken2k.txt dnif.exe /I "."<testkraken2k.txt>NUL &&  For /f "tokens=3" %%a in (testkraken2k.txt) do echo %%a>>testkraken4k.txt
IF EXIST testkraken4k.txt dnif.exe /I "."<testkraken4k.txt>NUL && ( 
TYPE testkraken4k.txt>>Find.txt
For /f "tokens=6 delims= " %%a in (testkraken1k.txt) DO echo %%a>>apps\svc.txt
FOR /F "TOKENS=4 DELIMS=\." %%C in (testkraken4k.txt) DO (
>RepairKrakenRun11.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
ECHO "%%C"=-
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
ECHO "%%C"=-
	)
editreg.exe /s RepairKrakenRun11.reg 2>NUL
copy RepairKrakenRun11.reg .\backups >nul
	)))

apps\sc.exe GetKeyName "ActiveSMART Service"|dnif.exe /I "SUCCESS">NUL && (
apps\sc.exe GetKeyName "ActiveSMART Service"|dnif.exe /I "SUCCESS">testkraken1l.txt
for /f "tokens=6 delims= " %%G in (testkraken1l.txt) do apps\Csweg.exe QUERY "HKLM\SYSTEM\CurrentControlSet\Services\%%G" /V ImagePath |dnif.exe /I "ImagePath"|dnif.exe /I "\system32\"|dnif.exe /I /V "Service"|dnif.exe /I /V "SMART" >>testkraken2l.txt
IF EXIST testkraken2l.txt dnif.exe /I "."<testkraken2l.txt>NUL &&  For /f "tokens=3" %%a in (testkraken2l.txt) do echo %%a>>testkraken4l.txt
IF EXIST testkraken4l.txt dnif.exe /I "."<testkraken4l.txt>NUL && ( 
TYPE testkraken4l.txt>>Find.txt
For /f "tokens=6 delims= " %%a in (testkraken1l.txt) DO echo %%a>>apps\svc.txt
FOR /F "TOKENS=4 DELIMS=\." %%C in (testkraken4l.txt) DO (
>RepairKrakenRun12.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
ECHO "%%C"=-
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
ECHO "%%C"=-
	)
editreg.exe /s RepairKrakenRun12.reg 2>NUL
copy RepairKrakenRun12.reg .\backups >nul
	)))

apps\sc.exe GetKeyName "Compaq DMI Web Agent"|dnif.exe /I "SUCCESS">NUL && (
apps\sc.exe GetKeyName "Compaq DMI Web Agent"|dnif.exe /I "SUCCESS">testkraken1m.txt
for /f "tokens=6 delims= " %%G in (testkraken1m.txt) do apps\Csweg.exe QUERY "HKLM\SYSTEM\CurrentControlSet\Services\%%G" /V ImagePath |dnif.exe /I "ImagePath"|dnif.exe /I "\system32\"|dnif.exe /I /V "webdmi."|dnif.exe /I /V "COMPAQ" >>testkraken2m.txt
IF EXIST testkraken2m.txt dnif.exe /I "."<testkraken2m.txt>NUL &&  For /f "tokens=3" %%a in (testkraken2m.txt) do echo %%a>>testkraken4m.txt
IF EXIST testkraken4m.txt dnif.exe /I "."<testkraken4m.txt>NUL && ( 
TYPE testkraken4m.txt>>Find.txt
For /f "tokens=6 delims= " %%a in (testkraken1m.txt) DO echo %%a>>apps\svc.txt
FOR /F "TOKENS=4 DELIMS=\." %%C in (testkraken4m.txt) DO (
>RepairKrakenRun13.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
ECHO "%%C"=-
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
ECHO "%%C"=-
	)
editreg.exe /s RepairKrakenRun13.reg 2>NUL
copy RepairKrakenRun13.reg .\backups >nul
	)))

apps\sc.exe GetKeyName "CommServer"|dnif.exe /I "SUCCESS">NUL && (
apps\sc.exe GetKeyName "CommServer"|dnif.exe /I "SUCCESS">testkraken1n.txt
for /f "tokens=6 delims= " %%G in (testkraken1n.txt) do apps\Csweg.exe QUERY "HKLM\SYSTEM\CurrentControlSet\Services\%%G" /V ImagePath |dnif.exe /I "ImagePath"|dnif.exe /I "\system32\"|dnif.exe /I /V "cotscsinf"|dnif.exe /I /V "platinum" >>testkraken2n.txt
IF EXIST testkraken2n.txt dnif.exe /I "."<testkraken2n.txt>NUL &&  For /f "tokens=3" %%a in (testkraken2n.txt) do echo %%a>>testkraken4n.txt
IF EXIST testkraken4n.txt dnif.exe /I "."<testkraken4n.txt>NUL && ( 
TYPE testkraken4n.txt>>Find.txt
For /f "tokens=6 delims= " %%a in (testkraken1n.txt) DO echo %%a>>apps\svc.txt
FOR /F "TOKENS=4 DELIMS=\." %%C in (testkraken4n.txt) DO (
>RepairKrakenRun14.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
ECHO "%%C"=-
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
ECHO "%%C"=-
	)
editreg.exe /s RepairKrakenRun14.reg 2>NUL
copy RepairKrakenRun14.reg .\backups >nul
	)))

apps\sc.exe GetKeyName "Cognos ReportNet"|dnif.exe /I "SUCCESS">NUL && (
apps\sc.exe GetKeyName "Cognos ReportNet"|dnif.exe /I "SUCCESS">testkraken1o.txt
for /f "tokens=6 delims= " %%G in (testkraken1o.txt) do apps\Csweg.exe QUERY "HKLM\SYSTEM\CurrentControlSet\Services\%%G" /V ImagePath |dnif.exe /I "ImagePath"|dnif.exe /I "\system32\"|dnif.exe /I /V "cogbootstrapservice."|dnif.exe /I /V "cognos" >>testkraken2o.txt
IF EXIST testkraken2o.txt dnif.exe /I "."<testkraken2o.txt>NUL &&  For /f "tokens=3" %%a in (testkraken2o.txt) do echo %%a>>testkraken4o.txt
IF EXIST testkraken4o.txt dnif.exe /I "."<testkraken4o.txt>NUL && ( 
TYPE testkraken4o.txt>>Find.txt
For /f "tokens=6 delims= " %%a in (testkraken1o.txt) DO echo %%a>>apps\svc.txt
FOR /F "TOKENS=4 DELIMS=\." %%C in (testkraken4o.txt) DO (
>RepairKrakenRun15.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
ECHO "%%C"=-
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
ECHO "%%C"=-
	)
editreg.exe /s RepairKrakenRun15.reg 2>NUL
copy RepairKrakenRun15.reg .\backups >nul
	)))

apps\sc.exe GetKeyName "CMG Shield"|dnif.exe /I "SUCCESS">NUL && (
apps\sc.exe GetKeyName "CMG Shield"|dnif.exe /I "SUCCESS">testkraken1p.txt
for /f "tokens=6 delims= " %%G in (testkraken1p.txt) do apps\Csweg.exe QUERY "HKLM\SYSTEM\CurrentControlSet\Services\%%G" /V ImagePath |dnif.exe /I "ImagePath"|dnif.exe /I "\system32\"|dnif.exe /I /V "Credant"|dnif.exe /I /V "CmgShield">>testkraken2p.txt
IF EXIST testkraken2p.txt dnif.exe /I "."<testkraken2p.txt>NUL &&  For /f "tokens=3" %%a in (testkraken2p.txt) do echo %%a>>testkraken4p.txt
IF EXIST testkraken4p.txt dnif.exe /I "."<testkraken4p.txt>NUL && ( 
TYPE testkraken4p.txt>>Find.txt
For /f "tokens=6 delims= " %%a in (testkraken1p.txt) DO echo %%a>>apps\svc.txt
FOR /F "TOKENS=4 DELIMS=\." %%C in (testkraken4p.txt) DO (
>RepairKrakenRun16.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
ECHO "%%C"=-
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
ECHO "%%C"=-
	)
editreg.exe /s RepairKrakenRun16.reg 2>NUL
copy RepairKrakenRun16.reg .\backups >nul
	)))

apps\sc.exe GetKeyName "DigiCtrl"|dnif.exe /I "SUCCESS">NUL && (
apps\sc.exe GetKeyName "DigiCtrl"|dnif.exe /I "SUCCESS">testkraken1q.txt
for /f "tokens=6 delims= " %%G in (testkraken1q.txt) do apps\Csweg.exe QUERY "HKLM\SYSTEM\CurrentControlSet\Services\%%G" /V ImagePath |dnif.exe /I "ImagePath"|dnif.exe /I "\system32\"|dnif.exe /I /V "digisc"|dnif.exe /I /V "Matrox" >>testkraken2q.txt
IF EXIST testkraken2q.txt dnif.exe /I "."<testkraken2q.txt>NUL &&  For /f "tokens=3" %%a in (testkraken2q.txt) do echo %%a>>testkraken4q.txt
IF EXIST testkraken4q.txt dnif.exe /I "."<testkraken4q.txt>NUL && ( 
TYPE testkraken4q.txt>>Find.txt
For /f "tokens=6 delims= " %%a in (testkraken1q.txt) DO echo %%a>>apps\svc.txt
FOR /F "TOKENS=4 DELIMS=\." %%C in (testkraken4q.txt) DO (
>RepairKrakenRun17.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
ECHO "%%C"=-
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
ECHO "%%C"=-
	)
editreg.exe /s RepairKrakenRun17.reg 2>NUL
copy RepairKrakenRun17.reg .\backups >nul
	)))

apps\sc.exe GetKeyName "Dell Printer Status Watcher"|dnif.exe /I "SUCCESS">NUL && (
apps\sc.exe GetKeyName "Dell Printer Status Watcher"|dnif.exe /I "SUCCESS">testkraken1r.txt
for /f "tokens=6 delims= " %%G in (testkraken1r.txt) do apps\Csweg.exe QUERY "HKLM\SYSTEM\CurrentControlSet\Services\%%G" /V ImagePath |dnif.exe /I "ImagePath"|dnif.exe /I "\system32\"|dnif.exe /I /V "DLPWD"|dnif.exe /I /V "dell" >>testkraken2r.txt
IF EXIST testkraken2r.txt dnif.exe /I "."<testkraken2r.txt>NUL &&  For /f "tokens=3" %%a in (testkraken2r.txt) do echo %%a>>testkraken4r.txt
IF EXIST testkraken4r.txt dnif.exe /I "."<testkraken4r.txt>NUL && ( 
TYPE testkraken4r.txt>>Find.txt
For /f "tokens=6 delims= " %%a in (testkraken1r.txt) DO echo %%a>>apps\svc.txt
FOR /F "TOKENS=4 DELIMS=\." %%C in (testkraken4r.txt) DO (
>RepairKrakenRun18.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
ECHO "%%C"=-
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
ECHO "%%C"=-
	)
editreg.exe /s RepairKrakenRun18.reg 2>NUL
copy RepairKrakenRun18.reg .\backups >nul
	)))

apps\sc.exe GetKeyName "DeepSight Extractor Service for NP08"|dnif.exe /I "SUCCESS">NUL && (
apps\sc.exe GetKeyName "DeepSight Extractor Service for NP08"|dnif.exe /I "SUCCESS">testkraken1s.txt
for /f "tokens=6 delims= " %%G in (testkraken1s.txt) do apps\Csweg.exe QUERY "HKLM\SYSTEM\CurrentControlSet\Services\%%G" /V ImagePath |dnif.exe /I "ImagePath"|dnif.exe /I "\system32\" >>testkraken2s.txt
IF EXIST testkraken2s.txt dnif.exe /I "."<testkraken2s.txt>NUL &&  For /f "tokens=3" %%a in (testkraken2s.txt) do echo %%a>>testkraken4s.txt
IF EXIST testkraken4s.txt dnif.exe /I "."<testkraken4s.txt>NUL && ( 
TYPE testkraken4s.txt>>Find.txt
For /f "tokens=6 delims= " %%a in (testkraken1s.txt) DO echo %%a>>apps\svc.txt
FOR /F "TOKENS=4 DELIMS=\." %%C in (testkraken4s.txt) DO (
>RepairKrakenRun19.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
ECHO "%%C"=-
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
ECHO "%%C"=-
	)
editreg.exe /s RepairKrakenRun19.reg 2>NUL
copy RepairKrakenRun19.reg .\backups >nul
	)))

apps\sc.exe GetKeyName "Wireless Adapter Configurator"|dnif.exe /I "SUCCESS">NUL && (
apps\sc.exe GetKeyName "Wireless Adapter Configurator"|dnif.exe /I "SUCCESS">testkraken1t.txt
for /f "tokens=6 delims= " %%G in (testkraken1t.txt) do apps\Csweg.exe QUERY "HKLM\SYSTEM\CurrentControlSet\Services\%%G" /V ImagePath |dnif.exe /I "ImagePath"|dnif.exe /I "\system32\"|dnif.exe /I /V "Daemon"|dnif.exe /I /V "Wireless" >>testkraken2t.txt
IF EXIST testkraken2t.txt dnif.exe /I "."<testkraken2t.txt>NUL &&  For /f "tokens=3" %%a in (testkraken2t.txt) do echo %%a>>testkraken4t.txt
IF EXIST testkraken4t.txt dnif.exe /I "."<testkraken4t.txt>NUL && ( 
TYPE testkraken4t.txt>>Find.txt
For /f "tokens=6 delims= " %%a in (testkraken1t.txt) DO echo %%a>>apps\svc.txt
FOR /F "TOKENS=4 DELIMS=\." %%C in (testkraken4t.txt) DO (
>RepairKrakenRun20.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
ECHO "%%C"=-
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
ECHO "%%C"=-
	)
editreg.exe /s RepairKrakenRun20.reg 2>NUL
copy RepairKrakenRun20.reg .\backups >nul
	)))

apps\sc.exe GetKeyName "LXCCCustomerConnect"|dnif.exe /I "SUCCESS">NUL && (
apps\sc.exe GetKeyName "LXCCCustomerConnect"|dnif.exe /I "SUCCESS">testkraken1u.txt
for /f "tokens=6 delims= " %%G in (testkraken1u.txt) do apps\Csweg.exe QUERY "HKLM\SYSTEM\CurrentControlSet\Services\%%G" /V ImagePath |dnif.exe /I "ImagePath"|dnif.exe /I "\system32\"|dnif.exe /I /V "spool"|dnif.exe /I /V "LXCCserv" >>testkraken2u.txt
IF EXIST testkraken2u.txt dnif.exe /I "."<testkraken2u.txt>NUL &&  For /f "tokens=3" %%a in (testkraken2u.txt) do echo %%a>>testkraken4u.txt
IF EXIST testkraken4u.txt dnif.exe /I "."<testkraken4u.txt>NUL && ( 
TYPE testkraken4u.txt>>Find.txt
For /f "tokens=6 delims= " %%a in (testkraken1u.txt) DO echo %%a>>apps\svc.txt
FOR /F "TOKENS=4 DELIMS=\." %%C in (testkraken4u.txt) DO (
>RepairKrakenRun21.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
ECHO "%%C"=-
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
ECHO "%%C"=-
	)
editreg.exe /s RepairKrakenRun21.reg 2>NUL
copy RepairKrakenRun21.reg .\backups >nul
	)))

apps\sc.exe GetKeyName "SolidWorks Licensing Service"|dnif.exe /I "SUCCESS">NUL && (
apps\sc.exe GetKeyName "SolidWorks Licensing Service"|dnif.exe /I "SUCCESS">testkraken1v.txt
for /f "tokens=6 delims= " %%G in (testkraken1v.txt) do apps\Csweg.exe QUERY "HKLM\SYSTEM\CurrentControlSet\Services\%%G" /V ImagePath |dnif.exe /I "ImagePath"|dnif.exe /I "\system32\"|dnif.exe /I /V "SolidWorksLicensing"|dnif.exe /I /V "Service" >>testkraken2v.txt
IF EXIST testkraken2v.txt dnif.exe /I "."<testkraken2v.txt>NUL &&  For /f "tokens=3" %%a in (testkraken2v.txt) do echo %%a>>testkraken4v.txt
IF EXIST testkraken4v.txt dnif.exe /I "."<testkraken4v.txt>NUL && ( 
TYPE testkraken4v.txt>>Find.txt
For /f "tokens=6 delims= " %%a in (testkraken1v.txt) DO echo %%a>>apps\svc.txt
FOR /F "TOKENS=4 DELIMS=\." %%C in (testkraken4v.txt) DO (
>RepairKrakenRun22.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
ECHO "%%C"=-
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
ECHO "%%C"=-
	)
editreg.exe /s RepairKrakenRun22.reg 2>NUL
copy RepairKrakenRun22.reg .\backups >nul
	)))

apps\sc.exe GetKeyName "AOL Antivirus Update Service"|dnif.exe /I "SUCCESS">NUL && (
apps\sc.exe GetKeyName "AOL Antivirus Update Service"|dnif.exe /I "SUCCESS">testkraken1w.txt
for /f "tokens=6 delims= " %%G in (testkraken1w.txt) do apps\Csweg.exe QUERY "HKLM\SYSTEM\CurrentControlSet\Services\%%G" /V ImagePath |dnif.exe /I "ImagePath"|dnif.exe /I "\system32\"|dnif.exe /I /V "AOL"|dnif.exe /I /V "aolavupd.exe" >>testkraken2w.txt
IF EXIST testkraken2w.txt dnif.exe /I "."<testkraken2w.txt>NUL &&  For /f "tokens=3" %%a in (testkraken2w.txt) do echo %%a>>testkraken4w.txt
IF EXIST testkraken4w.txt dnif.exe /I "."<testkraken4w.txt>NUL && ( 
TYPE testkraken4w.txt>>Find.txt
For /f "tokens=6 delims= " %%a in (testkraken1w.txt) DO echo %%a>>apps\svc.txt
	))

apps\sc.exe GetKeyName "SmartLinkService"|dnif.exe /I "SUCCESS">NUL && (
apps\sc.exe GetKeyName "SmartLinkService"|dnif.exe /I "SUCCESS">testkraken1x.txt
for /f "tokens=6 delims= " %%G in (testkraken1x.txt) do apps\Csweg.exe QUERY "HKLM\SYSTEM\CurrentControlSet\Services\%%G" /V ImagePath |dnif.exe /I "ImagePath"|dnif.exe /I "\system32\"|dnif.exe /I /V "slserv">>testkraken2x.txt
IF EXIST testkraken2x.txt dnif.exe /I "."<testkraken2x.txt>NUL &&  For /f "tokens=3" %%a in (testkraken2x.txt) do echo %%a>>testkraken4x.txt
IF EXIST testkraken4x.txt dnif.exe /I "."<testkraken4x.txt>NUL && ( 
TYPE testkraken4x.txt>>Find.txt
For /f "tokens=6 delims= " %%a in (testkraken1x.txt) DO echo %%a>>apps\svc.txt
	))

apps\sc.exe GetKeyName "Websense CPM Report Scheduler"|dnif.exe /I "SUCCESS">NUL && (
apps\sc.exe GetKeyName "Websense CPM Report Scheduler"|dnif.exe /I "SUCCESS">testkraken1y.txt
for /f "tokens=6 delims= " %%G in (testkraken1y.txt) do apps\Csweg.exe QUERY "HKLM\SYSTEM\CurrentControlSet\Services\%%G" /V ImagePath |dnif.exe /I "ImagePath"|dnif.exe /I "\system32\"|dnif.exe /I /V "Websense"|dnif.exe /I /V "BatchQueue" >>testkraken2y.txt
IF EXIST testkraken2y.txt dnif.exe /I "."<testkraken2y.txt>NUL &&  For /f "tokens=3" %%a in (testkraken2y.txt) do echo %%a>>testkraken4y.txt
IF EXIST testkraken4y.txt dnif.exe /I "."<testkraken4y.txt>NUL && ( 
TYPE testkraken4y.txt>>Find.txt
For /f "tokens=6 delims= " %%a in (testkraken1y.txt) DO echo %%a>>apps\svc.txt
	))

apps\sc.exe GetKeyName "Asset Management Daemon"|dnif.exe /I "SUCCESS">NUL && (
apps\sc.exe GetKeyName "Asset Management Daemon"|dnif.exe /I "SUCCESS">testkraken1z.txt
for /f "tokens=6 delims= " %%G in (testkraken1z.txt) do apps\Csweg.exe QUERY "HKLM\SYSTEM\CurrentControlSet\Services\%%G" /V ImagePath |dnif.exe /I "ImagePath"|dnif.exe /I "\system32\"|dnif.exe /I /V "dtsslsrv"|dnif.exe /I /V "Portrait" >>testkraken2z.txt
IF EXIST testkraken2z.txt dnif.exe /I "."<testkraken2z.txt>NUL &&  For /f "tokens=3" %%a in (testkraken2z.txt) do echo %%a>>testkraken4z.txt
IF EXIST testkraken4z.txt dnif.exe /I "."<testkraken4z.txt>NUL && ( 
TYPE testkraken4z.txt>>Find.txt
For /f "tokens=6 delims= " %%a in (testkraken1z.txt) DO echo %%a>>apps\svc.txt
	))

apps\sc.exe GetKeyName "BsHelpCS"|dnif.exe /I "SUCCESS">NUL && (
apps\sc.exe GetKeyName "BsHelpCS"|dnif.exe /I "SUCCESS">testkraken1aa.txt
for /f "tokens=6 delims= " %%G in (testkraken1aa.txt) do apps\Csweg.exe QUERY "HKLM\SYSTEM\CurrentControlSet\Services\%%G" /V ImagePath |dnif.exe /I "ImagePath"|dnif.exe /I "\system32\"|dnif.exe /I /V "BlueSoleil"|dnif.exe /I /V "BsHelpCS" >>testkraken2aa.txt
IF EXIST testkraken2aa.txt dnif.exe /I "."<testkraken2aa.txt>NUL &&  For /f "tokens=3" %%a in (testkraken2aa.txt) do echo %%a>>testkraken4aa.txt
IF EXIST testkraken4aa.txt dnif.exe /I "."<testkraken4aa.txt>NUL && ( 
TYPE testkraken4aa.txt>>Find.txt
For /f "tokens=6 delims= " %%a in (testkraken1aa.txt) DO echo %%a>>apps\svc.txt
	))

apps\sc.exe GetKeyName "Backbone Service"|dnif.exe /I "SUCCESS">NUL && (
apps\sc.exe GetKeyName "Backbone Service"|dnif.exe /I "SUCCESS">testkraken1ab.txt
for /f "tokens=6 delims= " %%G in (testkraken1ab.txt) do apps\Csweg.exe QUERY "HKLM\SYSTEM\CurrentControlSet\Services\%%G" /V ImagePath |dnif.exe /I "ImagePath"|dnif.exe /I "\system32\"|dnif.exe /I /V "CATSysDemon"|dnif.exe /I /V "Dassault" >>testkraken2ab.txt
IF EXIST testkraken2ab.txt dnif.exe /I "."<testkraken2ab.txt>NUL &&  For /f "tokens=3" %%a in (testkraken2ab.txt) do echo %%a>>testkraken4ab.txt
IF EXIST testkraken4ab.txt dnif.exe /I "."<testkraken4ab.txt>NUL && ( 
TYPE testkraken4ab.txt>>Find.txt
For /f "tokens=6 delims= " %%a in (testkraken1ab.txt) DO echo %%a>>apps\svc.txt
	))

apps\Csweg query "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/html" /V CLSID|dnif.exe /I "CLSID"|dnif.exe /I "53B95211-7D77-11D2-9F80-00104B107C96">NUL && (
>RepairFilter.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/html]
echo.
	)
editreg.exe /s RepairFilter.reg 2>NUL
	)

apps\sc query type= service state= inactive |dnif.exe /I "SERVICE_NAME">>TestbotsServ1.txt
IF EXIST TestbotsServ1.txt For /f "tokens=2 delims=: " %%G in (TestbotsServ1.txt) do ECHO %%G>>TestbotsServ2.txt

IF EXIST %systemroot%\system32\csrcs.exe For /f "tokens=*" %%G in (TestbotsServ2.txt) do apps\Csweg.exe QUERY "HKLM\System\CurrentControlSet\Services\%%G" /V ImagePath |dnif.exe /I "ImagePath"|dnif.exe /I "system32\csrcs.exe">nul && echo %%G>>apps\svc.txt
IF EXIST %systemroot%\system32\svshost.exe For /f "tokens=*" %%b in (TestbotsServ2.txt) do apps\Csweg.exe QUERY "HKLM\System\CurrentControlSet\Services\%%b" /V ImagePath |dnif.exe /I "ImagePath"|dnif.exe /I "system32\svshost.exe">nul && echo %%b>>apps\svc.txt

apps\Csweg.exe EXPORT "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad" Checkss1.txt
IF EXIST Checkss1.txt dnif.exe /I "{"<Checkss1.txt|dnif.exe /I /V "PostBootReminder"|dnif.exe /I /V "CDBurn"|dnif.exe /I /V "WebCheck"|dnif.exe /I /V "SysTray">Checkss2.txt
IF EXIST Checkss2.txt dnif.exe /I "{"<Checkss2.txt>NUL && (
For /F "TOKENS=1 delims==" %%a IN (Checkss2.txt) do echo %%~a>>Checkss3.txt
For /F "TOKENS=2 delims={}" %%b IN (Checkss2.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%~b}\InprocServer32"|dnif.exe /I "\Installer\">nul && echo %%~b>>Checkss4.txt
IF EXIST Checkss3.txt For /F "TOKENS=*" %%c IN (Checkss3.txt) do (
IF EXIST Checkss4.txt For /F "TOKENS=*" %%d IN (Checkss4.txt) do (
dir /b/s/a-d "%systemroot%\Installer\%%c.dll" 2>nul | dnif.exe /I "%%d">>Checkss5.txt
	)))

IF EXIST Checkss5.txt dnif.exe /I "{"<Checkss5.txt>NUL && (
>RepairSSODL.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion]
echo "domains"=-
echo [-HKEY_CLASSES_ROOT\zip.extension]
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
	)
For /F "TOKENS=5 delims=\." %%f IN (Checkss5.txt) do echo "%%f"=->>RepairSSODL.reg
For /F "TOKENS=4 delims=\{}" %%g IN (Checkss5.txt) do echo [-HKEY_CLASSES_ROOT\clsid\{%%g}]>>RepairSSODL.reg
TYPE Checkss5.txt>>Find.txt
editreg.exe /s RepairSSODL.reg 2>NUL
copy RepairSSODL.reg .\backups >nul
For /F "TOKENS=4 delims=\{}" %%j IN (Checkss5.txt) do IF EXIST "%systemroot%\Installer\{%%j}\" rd /s/q "%systemroot%\Installer\{%%j}\" >nul && echo Folder %systemroot%\Installer\{%%j} - Removed>>FolDel2.txt
	)

apps\Csweg.exe EXPORT "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad" Checkssnw1a.txt
IF EXIST Checkssnw1a.txt dnif.exe /I "{"<Checkssnw1a.txt |dnif.exe /I /V "PostBootReminder"|dnif.exe /I /V "CDBurn"|dnif.exe /I /V "WebCheck"|dnif.exe /I /V "SysTray">Checkssnw2a.txt
IF EXIST Checkssnw2a.txt dnif.exe /I "{"<Checkssnw2a.txt>NUL && For /F "TOKENS=2 delims={}" %%b IN (Checkssnw2a.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%~b}\InprocServer32"|dnif.exe /I "WINDOWS\Resources\">NUL && ECHO {%%~b}>>Checkssnw4a.txt
IF EXIST Checkssnw2a.txt dnif.exe /I "{"<Checkssnw2a.txt>NUL && For /F "TOKENS=2 delims={}" %%b IN (Checkssnw2a.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%~b}\InprocServer32"|dnif.exe /I "WINDOWS\Resources\">NUL && dnif.exe /I "%%~b"<Checkssnw2a.txt>>Checkssnw4b.txt

IF EXIST Checkssnw4a.txt dnif.exe /I "{"<Checkssnw4a.txt>NUL && (
>RepairSSODL2a.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion]
echo "domains"=-
echo [-HKEY_CLASSES_ROOT\zip.extension]
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
	)
For /F "TOKENS=1 delims==" %%b IN (Checkssnw4b.txt) do echo "%%~b"=->>RepairSSODL2a.reg
For /F "TOKENS=1 delims={}" %%f IN (Checkssnw4a.txt) do echo [-HKEY_CLASSES_ROOT\clsid\{%%~f}]>>RepairSSODL2a.reg
editreg.exe /s RepairSSODL2a.reg 2>NUL
copy RepairSSODL2a.reg .\backups\RepairSSODL.reg >nul
	)

IF EXIST Checkssnw2a.txt dnif.exe /I "{"<Checkssnw2a.txt>NUL && For /F "TOKENS=2 delims={}" %%b IN (Checkssnw2a.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%~b}\InprocServer32"|dnif.exe /I "%programfiles%">Checkssnwprog2e.txt && ECHO {%%~b}>>Checkssnwprog4a.txt
IF EXIST Checkssnwprog4a.txt For /F "TOKENS=3 delims=\" %%L IN (Checkssnwprog2e.txt) do For /F "TOKENS=4 delims=\." %%e IN (Checkssnwprog2e.txt) do For /F "TOKENS=*" %%a IN (Checkssnwprog4a.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\%%~a\InprocServer32"|dnif.exe /I "%programfiles%"|dnif.exe /I "\%%e.dll">nul && IF EXIST "%programfiles%\%%L\%%e.dll" echo %programfiles%\%%L\%%e.dll>>CheckssnwprogS1.txt

IF EXIST CheckssnwprogS1.txt dnif.exe /i "."<CheckssnwprogS1.txt>nul && (
rtsdnif.exe /m /f:CheckssnwprogS1.txt "RichIJb">>CheckssnwprogS2.txt
rtsdnif.exe /m /f:CheckssnwprogS2.txt "SuspendThread">>CheckssnwprogS3.txt
rtsdnif.exe /m /f:CheckssnwprogS3.txt "dxwjcxxg.dll">>CheckssnwprogS4.txt
	)

IF EXIST CheckssnwprogS4.txt dnif.exe /i "."<CheckssnwprogS4.txt>nul && (
For /F "TOKENS=2 delims={}" %%b IN (Checkssnw2a.txt) do For /F "TOKENS=1 delims=." %%n IN (CheckssnwprogS4.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%~b}\InprocServer32"|dnif.exe /I "%programfiles%"|dnif.exe /I "%%n.dll">nul && (
ECHO {%%~b}>>Checkssnwprog0a.txt
dnif.exe /I "{%%~b}"<Checkssnw2a.txt>>Checkssnwprog0b.txt
IF EXIST "%%n.dll" echo %%n.dll>>Find.txt
>RepairSSODLProg1.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
	)
For /F "TOKENS=1 delims==" %%d IN (Checkssnwprog0b.txt) do echo "%%~d"=->>RepairSSODLProg1.reg
echo [-HKEY_CLASSES_ROOT\clsid\{%%~b}]>>RepairSSODLProg1.reg
	)
editreg.exe /s RepairSSODLProg1.reg 2>NUL
copy RepairSSODLProg1.reg .\backups\RepairPureMorphSSODL.reg >nul
	)

apps\locate "%systemroot%\Resources\*.dll" /D- /s:12800! /n /nr /O:"&W"|dnif.exe /I ".dll">>TESTssnw0a.TXT
dnif.exe /I "."<TESTssnw0a.TXT>NUL && For /F "TOKENS=*" %%f IN (TESTssnw0a.TXT) do echo %%~f>>TESTssnw0b.TXT
IF EXIST TESTssnw0b.TXT rtsdnif.exe /m /f:TESTssnw0b.TXT "CLSID">> TESTssnw1a.TXT 2>nul
IF EXIST TESTssnw1a.TXT rtsdnif.exe /m /f:TESTssnw1a.TXT "adjust_fdiv">> TESTssnw2a.TXT 2>nul
IF EXIST TESTssnw2a.TXT rtsdnif.exe /m /f:TESTssnw2a.TXT "DLL.B">>Find.txt 2>NUL

apps\Csweg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /V midi |dnif.exe /I "midi" |dnif.exe /I ".CPX">>TESTmidi1.txt
IF EXIST TESTmidi1.txt For /f "tokens=3 delims=	" %%G in (TESTmidi1.txt) do @CALL SET defmid=%%G
apps\Csweg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /V midi1 | dnif.exe /I "midi1" |dnif.exe /I ".CPX">>TESTmidi2.txt
IF EXIST TESTmidi2.txt For /f "tokens=3 delims=	" %%B in (TESTmidi2.txt) do @CALL SET susmid=%%B
apps\Csweg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /V midi2 | dnif.exe /I "midi2"|dnif.exe /I ".CPX">>TESTmidi3.txt
IF EXIST TESTmidi3.txt For /f "tokens=3 delims=	" %%B in (TESTmidi3.txt) do @CALL SET newsmid=%%B
apps\Csweg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /V midimapper | dnif.exe /I "midimapper"|dnif.exe /I ".CPX">>TESTmidi4.txt
IF EXIST TESTmidi4.txt For /f "tokens=3 delims=	" %%B in (TESTmidi4.txt) do @CALL SET smapmid=%%B
apps\Csweg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /V aux1 | dnif.exe /I "aux1"|dnif.exe /I ".CPX">>TESTmidi5.txt
IF EXIST TESTmidi5.txt For /f "tokens=3 delims=	" %%B in (TESTmidi5.txt) do @CALL SET silban=%%B

dnif.exe /I "aux1"<TESTmidi5.txt>nul && (
IF NOT [%silban%]==[wdmaud.drv] (
ECHO %systemroot%\system32\%silban%>>miditestaux1.txt
IF EXIST miditestaux1.txt dnif.exe /I ".CPX"<miditestaux1.txt>NUL && (
For /f "tokens=4 delims=\." %%A in (miditestaux1.txt) DO ECHO %%A>miditestaux2.txt
APPS\LOCATE %SYSTEMROOT%\SYSTEM32\*.CPX /N | dnif.exe /I "~">miditestaux3.txt
dnif.exe /I "."<miditestaux3.txt>NUL && For /f "tokens=4 delims=\~" %%A in (miditestaux3.txt) DO dnif.exe /I "%%A"<miditestaux2.txt>NUL && DIR /B/S/A-D %systemroot%\system32\%%A*.CPX>miditestaux4.txt
IF EXIST miditestaux4.txt dnif.exe /I "."<miditestaux4.txt | dnif.exe /I "system32">>miditestaux5.txt
For /f "tokens=*" %%C in (miditestaux5.txt) do apps\Cghtme.exe -l nul -k %%C >NUL
>Repairaux1.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
echo "aux1"="wdmaud.drv"
echo.
	)
editreg.exe /s Repairaux1.reg 2>NUL
echo.>midires.txt
echo SilentBanker/PWS:Win32/Yaludle.A found!>>midires.txt
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]>>midires.txt
echo "aux1"="wdmaud.drv">>midires.txt
echo.>>midires.txt
echo Restoring aux1 registry value to wdmaud.drv>>midires.txt
copy Repairaux1.reg .\backups >nul
	)))

dnif.exe /I "midimapper"<TESTmidi4.txt>nul && (
IF NOT [%smapmid%]==[midimap.dll] (
ECHO %systemroot%\system32\%smapmid%>>miditestnewmap1.txt
IF EXIST miditestnewmap1.txt dnif.exe /I ".CPX"<miditestnewmap1.txt>NUL && (
For /f "tokens=4 delims=\." %%A in (miditestnewmap1.txt) DO ECHO %%A>miditestnewmap2.txt
APPS\LOCATE %SYSTEMROOT%\SYSTEM32\*.CPX /N | dnif.exe /I "~">miditestnewmap3.txt
dnif.exe /I "."<miditestnewmap3.txt>NUL && For /f "tokens=4 delims=\~" %%A in (miditestnewmap3.txt) DO dnif.exe /I "%%A"<miditestnewmap2.txt>NUL && DIR /B/S/A-D %systemroot%\system32\%%A*.CPX>miditestnewmap4.txt
IF EXIST miditestnewmap4.txt dnif.exe /I "."<miditestnewmap4.txt | dnif.exe /I "system32">>miditestnewmap5.txt
For /f "tokens=*" %%C in (miditestnewmap5.txt) do apps\Cghtme.exe -l nul -k %%C >NUL
>Repairmidimap1.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
echo "midimapper"="midimap.dll"
echo.
	)
editreg.exe /s Repairmidimap1.reg 2>NUL
echo.>midires.txt
echo SilentBanker/PWS:Win32/Yaludle.A found!>>midires.txt
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]>>midires.txt
echo "midimapper"="midimap.dll">>midires.txt
echo.>>midires.txt
ECHO Restoring midimapper registry value to midimap.dll>>midires.txt
copy Repairmidimap1.reg .\backups >nul
	)))

dnif.exe /I "midi1"<TESTmidi2.txt>nul && (
IF NOT [%susmid%]==[%defmid%] (
ECHO %systemroot%\system32\%susmid%>>TESTmidi3.txt
rtsdnif.exe /m /f:TESTmidi3.txt "paantspitrl">> TESTmidi4.txt 2>nul
rtsdnif.exe /m /f:TESTmidi4.txt "betanvc4enn">> midiTEST1.txt 2>nul
IF EXIST midiTEST1.txt dnif.exe /I "."<midiTEST1.txt>NUL && (
For /f "tokens=*" %%C in (midiTEST1.txt) do apps\Cghtme.exe -l nul -k %%C >NUL
apps\locate "%systemroot%\system32\*.cpl" /D- /n /nr|dnif.exe /I ".cpl">>midiTEST2.txt
rtsdnif.exe /m /f:midiTEST2.txt "%susmid%">>Find.txt 2>NUL
>Repairmidi.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
echo "midi1"="wdmaud.drv"
echo.
	)
editreg.exe /s Repairmidi.reg 2>NUL
echo.>midires.txt
echo SilentBanker/PWS:Win32/Yaludle.A found!>>midires.txt
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]>>midires.txt
apps\Csweg export "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" testmidi10.txt
echo "midi1"="%susmid%">>midires.txt
echo.>>midires.txt
ECHO Restoring .midi1 driver registry value to wdmaud.drv>>midires.txt
copy Repairmidi.reg .\backups >nul
	)))

dnif.exe /I "midi1"<TESTmidi2.txt>nul && (
IF NOT [%susmid%]==[%defmid%] (
ECHO %systemroot%\system32\%susmid%>>miditestnew1.txt
IF EXIST miditestnew1.txt dnif.exe /I ".CPX"<miditestnew1.txt>NUL && (
For /f "tokens=4 delims=\." %%A in (miditestnew1.txt) DO ECHO %%A>miditestnew2.txt
APPS\LOCATE %SYSTEMROOT%\SYSTEM32\*.CPX /N | dnif.exe /I "~">miditestnew3.txt
dnif.exe /I "."<miditestnew3.txt>NUL && For /f "tokens=4 delims=\~" %%A in (miditestnew3.txt) DO dnif.exe /I "%%A"<miditestnew2.txt>NUL && DIR /B/S/A-D %systemroot%\system32\%%A*.CPX>miditestnew4.txt
IF EXIST miditestnew4.txt dnif.exe /I "."<miditestnew4.txt | dnif.exe /I "system32">>miditestnew5.txt
For /f "tokens=*" %%C in (miditestnew5.txt) do apps\Cghtme.exe -l nul -k %%C >NUL
>Repairmidi.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
echo "midi1"="wdmaud.drv"
echo.
	)
editreg.exe /s Repairmidi.reg 2>NUL
echo.>midires.txt
echo SilentBanker/PWS:Win32/Yaludle.A found!>>midires.txt
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]>>midires.txt
apps\Csweg export "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" testmidi10.txt
dnif.exe /i "midi1"<testmidi10.txt>>midires.txt
echo.>>midires.txt
ECHO Restoring .midi1 driver registry value to wdmaud.drv>>midires.txt
copy Repairmidi.reg .\backups >nul
	)))

dnif.exe /I "midi2"<TESTmidi3.txt>nul && (
IF NOT [%newsmid%]==[%defmid%] (
ECHO %systemroot%\system32\%newsmid%>>miditestnew1a.txt
IF EXIST miditestnew1a.txt dnif.exe /I ".CPX"<miditestnew1a.txt>NUL && (
For /f "tokens=4 delims=\." %%A in (miditestnew1a.txt) DO ECHO %%A>miditestnew2a.txt
APPS\LOCATE %SYSTEMROOT%\SYSTEM32\*.CPX /N | dnif.exe /I "~">miditestnew3a.txt
dnif.exe /I "."<miditestnew3a.txt>NUL && For /f "tokens=4 delims=\~" %%A in (miditestnew3a.txt) DO dnif.exe /I "%%A"<miditestnew2a.txt>NUL && DIR /B/S/A-D %systemroot%\system32\%%A*.CPX>miditestnew4a.txt
IF EXIST miditestnew4a.txt dnif.exe /I "."<miditestnew4a.txt | dnif.exe /I "system32">>miditestnew5a.txt
For /f "tokens=*" %%C in (miditestnew5a.txt) do apps\Cghtme.exe -l nul -k %%C >NUL
>Repairmidi2.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
echo "midi2"="wdmaud.drv"
echo.
	)
editreg.exe /s Repairmidi2.reg 2>NUL
echo.>midires.txt
echo SilentBanker/PWS:Win32/Yaludle.A found!>>midires.txt
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]>>midires.txt
apps\Csweg export "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" testmidi10a.txt
dnif.exe /i "midi2"<testmidi10a.txt>>midires.txt
echo.>>midires.txt
ECHO Restoring .midi2 driver registry value to wdmaud.drv>>midires.txt
copy Repairmidi2.reg .\backups >nul
	)))

dnif.exe /I "midi1"<TESTmidi2.txt>nul && (
IF NOT [%susmid%]==[%defmid%] (
ECHO %systemroot%\system32\%susmid%>>miditestnew50.txt
IF EXIST miditestnew50.txt dnif.exe /I ".CPX"<miditestnew50.txt>NUL && (
echo|apps\Cghtme.exe -f "%systemroot%\system32"|dnif.exe /I ".cpx">>miditestnew60.txt
dnif.exe /I "."<miditestnew60.txt>NUL && For /f "tokens=1 delims= " %%A in (miditestnew60.txt) DO (
apps\Cghtme.exe -l nul -k %%A >NUL
ECHO %%A>>miditestnew70.txt
	)
>Repairmidi.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
echo "midi1"="wdmaud.drv"
echo.
)
editreg.exe /s Repairmidi.reg 2>NUL
echo.>midires.txt
echo SilentBanker/PWS:Win32/Yaludle.A found!>>midires.txt
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]>>midires.txt
apps\Csweg export "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" testmidi10.txt
dnif.exe /i "midi1"<testmidi10.txt>>midires.txt
echo.>>midires.txt
ECHO Restoring .midi1 driver registry value to wdmaud.drv>>midires.txt
copy Repairmidi.reg .\backups >nul
	)))

dnif.exe /I "midi2"<TESTmidi3.txt>nul && (
IF NOT [%newsmid%]==[%defmid%] (
ECHO %systemroot%\system32\%susmid%>>miditestnew50a.txt
IF EXIST miditestnew50a.txt dnif.exe /I ".CPX"<miditestnew50a.txt>NUL && (
echo|apps\Cghtme.exe -f "%systemroot%\system32"|dnif.exe /I ".cpx">>miditestnew60a.txt
dnif.exe /I "."<miditestnew60a.txt>NUL && For /f "tokens=1 delims= " %%A in (miditestnew60a.txt) DO (
apps\Cghtme.exe -l nul -k %%A >NUL
ECHO %%A>>miditestnew70a.txt
	)
>Repairmidi3.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
echo "midi2"="wdmaud.drv"
echo.
)
editreg.exe /s Repairmidi3.reg 2>NUL
echo.>midires.txt
echo SilentBanker/PWS:Win32/Yaludle.A found!>>midires.txt
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]>>midires.txt
apps\Csweg export "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" testmidi10b.txt
dnif.exe /i "midi2"<testmidi10b.txt>>midires.txt
echo.>>midires.txt
ECHO Restoring .midi2 driver registry value to wdmaud.drv>>midires.txt
copy Repairmidi3.reg .\backups >nul
	)))

apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{72A128E0-2240-40c8-9E92-5387D64F839E}\InprocServer32"|dnif.exe /I ".dll">>TESTADMedBHO1a.txt
IF EXIST TESTADMedBHO1a.txt dnif.exe /I ".dll"<TESTADMedBHO1a.txt>NUL && For /f "tokens=3 delims=\." %%C in (TESTADMedBHO1a.txt) do IF EXIST %systemroot%\%%C.dll echo %systemroot%\%%C.dll>>find.txt

apps\Csweg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects"|dnif.exe /I "{">TESTbho.txt
For /f "tokens=8 delims=\{}" %%B in (TESTbho.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%B}\InprocServer32"|dnif.exe /I "system32">>TESTBHOa.TXT && echo %%B>>TESTadzbho1.txt

IF EXIST TESTBHOa.TXT For /f "tokens=3 delims=		" %%G in (TESTBHOa.TXT) do echo %%G>>TESTADMed1.TXT
IF EXIST TESTADMed1.TXT rtsdnif.exe /m /f:TESTADMed1.TXT "10026069-7A5F-4531-811E-C8DF20643BEE">>TESTADMed2a.TXT 2>NUL
IF EXIST TESTADMed1.TXT rtsdnif.exe /m /f:TESTADMed1.TXT "15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF">>TESTADMed2a.TXT 2>NUL
IF EXIST TESTADMed1.TXT rtsdnif.exe /m /f:TESTADMed1.TXT "xvideoplugin.JetVideoPlugin">>TESTADMed3.TXT 2>NUL

IF EXIST TESTADMed2a.TXT dnif.exe /I "."<TESTADMed2a.TXT>NUL && (
TYPE TESTADMed2a.TXT>>Find.txt
For /f "tokens=8 delims=\{}" %%G in (TESTbho.txt) do For /f "tokens=4 delims=\." %%A in (TESTADMed2a.TXT) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "%%A.dll">nul && (
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\Typelib"|dnif.exe /I "{"|dnif.exe /I /V "\">TESTAdmedTypelib1.txt
>RepairIEDef.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
echo [-HKEY_CLASSES_ROOT\Interface\{%%G}]
For /f "tokens=2 delims=\{}" %%A in (TESTAdmedTypelib1.txt) do echo [-HKEY_CLASSES_ROOT\TypeLib\{%%A}]
echo.
	)
editreg.exe /s RepairIEDef.reg 2>NUL
copy RepairIEDef.reg .\backups\RepairIEDefender.reg >nul
	))

IF EXIST TESTADMed3.TXT dnif.exe /I "."<TESTADMed3.TXT>NUL && (
TYPE TESTADMed3.TXT>>Find.txt
For /f "tokens=8 delims=\{}" %%G in (TESTbho.txt) do For /f "tokens=4 delims=\." %%A in (TESTADMed3.TXT) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "%%A.dll">nul && (
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\Typelib"|dnif.exe /I "{"|dnif.exe /I /V "\">TESTAdmedTypelib2.txt
>RepairBlackmail.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
For /f "tokens=2 delims=\{}" %%A in (TESTAdmedTypelib2.txt) do echo [-HKEY_CLASSES_ROOT\TypeLib\{%%A}]
echo.
	)
editreg.exe /s RepairBlackmail.reg 2>NUL
copy RepairIEDef.reg .\backups\RepairBlackmail.reg >nul
	))

IF EXIST TESTadzbho1.txt For /f "tokens=*" %%G in (TESTadzbho1.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}"|dnif.exe /I "mxlivemedia browser">nul && (
>Repairmxlivemedia.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
	)
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "system32">TESTmxlivemedia1.txt
IF EXIST TESTmxlivemedia1.txt For /f "tokens=4 delims=\." %%C in (TESTmxlivemedia1.txt) do (
dnif.exe /I "%%C"<CheckRuns.txt|dnif.exe /I ".">TESTmxlivemedia2.txt
IF EXIST %systemroot%\system32\%%C.dll echo %systemroot%\system32\%%C.dll>>Find.txt
IF EXIST %systemroot%\system32\_%%C.dll echo %systemroot%\system32\_%%C.dll>>Find.txt
	)
IF EXIST TESTmxlivemedia2.txt dnif.exe /I "."<TESTmxlivemedia2.txt>NUL && For /f "tokens=1 delims==" %%F in (TESTmxlivemedia2.txt) do (
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]>>Repairmxlivemedia.reg
echo %%F=->>Repairmxlivemedia.reg
echo.>>Repairmxlivemedia.reg
	)
editreg.exe /s Repairmxlivemedia.reg 2>NUL
copy Repairmxlivemedia.reg .\backups\Repairmxlivemedia.reg >nul
	)

apps\Csweg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mxlivemedia" /v "UninstallString"|dnif.exe /I "\system32\">>TESTmxlivemedia3.txt
IF EXIST TESTmxlivemedia3.txt dnif.exe /I ".exe"<TESTmxlivemedia3.txt>NUL && For /f "tokens=4 delims=\." %%e in (TESTmxlivemedia3.txt) do IF EXIST %systemroot%\system32\%%e.exe echo %systemroot%\system32\%%e.exe>>Find.txt

IF EXIST TESTadzbho1.txt For /f "tokens=*" %%G in (TESTadzbho1.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}"|dnif.exe /I "gooochi browser">nul && (
>Repairgooochibrowser.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
	)
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "system32">TESTgooochibrowser1.txt
IF EXIST TESTgooochibrowser1.txt For /f "tokens=4 delims=\." %%C in (TESTgooochibrowser1.txt) do (
dnif.exe /I "%%C"<CheckRuns.txt|dnif.exe /I ".">TESTgooochibrowser2.txt
IF EXIST %systemroot%\system32\%%C.dll echo %systemroot%\system32\%%C.dll>>Find.txt
IF EXIST %systemroot%\system32\_%%C.dll echo %systemroot%\system32\_%%C.dll>>Find.txt
	)
IF EXIST TESTgooochibrowser2.txt dnif.exe /I "."<TESTgooochibrowser2.txt>NUL && For /f "tokens=1 delims==" %%F in (TESTgooochibrowser2.txt) do (
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]>>Repairgooochibrowser.reg
echo %%F=->>Repairgooochibrowser.reg
echo.>>Repairgooochibrowser.reg
	)
editreg.exe /s Repairgooochibrowser.reg 2>NUL
copy Repairgooochibrowser.reg .\backups\ >nul
	)

apps\Csweg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\gooochi" /v "UninstallString"|dnif.exe /I "\system32\">>TESTgooochibrowser3.txt
IF EXIST TESTgooochibrowser3.txt dnif.exe /I ".exe"<TESTgooochibrowser3.txt>NUL && For /f "tokens=4 delims=\." %%e in (TESTgooochibrowser3.txt) do IF EXIST %systemroot%\system32\%%e.exe echo %systemroot%\system32\%%e.exe>>Find.txt

IF EXIST TESTadzbho1.txt For /f "tokens=*" %%G in (TESTadzbho1.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}"|dnif.exe /I "rightonadz browser optimizer">nul && (
>Repairrightonadz.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
	)
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "system32">TESTrightonadz1.txt
IF EXIST TESTrightonadz1.txt For /f "tokens=4 delims=\." %%C in (TESTrightonadz1.txt) do (
dnif.exe /I "%%C"<CheckRuns.txt|dnif.exe /I ".">TESTrightonadz2.txt
IF EXIST %systemroot%\system32\%%C.dll echo %systemroot%\system32\%%C.dll>>Find.txt
IF EXIST %systemroot%\system32\_%%C.dll echo %systemroot%\system32\_%%C.dll>>Find.txt
	)
IF EXIST TESTrightonadz2.txt dnif.exe /I "."<TESTrightonadz2.txt>NUL && For /f "tokens=1 delims==" %%F in (TESTrightonadz2.txt) do (
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]>>Repairrightonadz.reg
echo %%F=->>Repairrightonadz.reg
echo.>>Repairrightonadz.reg
	)
editreg.exe /s Repairrightonadz.reg 2>NUL
copy Repairrightonadz.reg .\backups\ >nul
	)

apps\Csweg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\rightonadz" /v "UninstallString"|dnif.exe /I "\system32\">>TESTrightonadz3.txt
IF EXIST TESTrightonadz3.txt dnif.exe /I ".exe"<TESTrightonadz3.txt>NUL && For /f "tokens=4 delims=\." %%e in (TESTrightonadz3.txt) do IF EXIST %systemroot%\system32\%%e.exe echo %systemroot%\system32\%%e.exe>>Find.txt

IF EXIST TESTadzbho1.txt For /f "tokens=*" %%G in (TESTadzbho1.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}"|dnif.exe /I "superiorads browser">nul && (
>Repairsuperiorads.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
	)
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "system32">TESTsuperiorads1.txt
IF EXIST TESTsuperiorads1.txt For /f "tokens=4 delims=\." %%C in (TESTsuperiorads1.txt) do (
dnif.exe /I "%%C"<CheckRuns.txt|dnif.exe /I ".">TESTsuperiorads2.txt
IF EXIST %systemroot%\system32\%%C.dll echo %systemroot%\system32\%%C.dll>>Find.txt
IF EXIST %systemroot%\system32\_%%C.dll echo %systemroot%\system32\_%%C.dll>>Find.txt
	)
IF EXIST TESTsuperiorads2.txt dnif.exe /I "."<TESTsuperiorads2.txt>NUL && For /f "tokens=1 delims==" %%F in (TESTsuperiorads2.txt) do (
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]>>Repairsuperiorads.reg
echo %%F=->>Repairsuperiorads.reg
echo.>>Repairsuperiorads.reg
	)
editreg.exe /s Repairsuperiorads.reg 2>NUL
copy Repairsuperiorads.reg .\backups\ >nul
	)

apps\Csweg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\superiorads" /v "UninstallString"|dnif.exe /I "\system32\">>TESTsuperiorads3.txt
IF EXIST TESTsuperiorads3.txt dnif.exe /I ".exe"<TESTsuperiorads3.txt>NUL && For /f "tokens=4 delims=\." %%e in (TESTsuperiorads3.txt) do IF EXIST %systemroot%\system32\%%e.exe echo %systemroot%\system32\%%e.exe>>Find.txt

IF EXIST TESTadzbho1.txt For /f "tokens=*" %%G in (TESTadzbho1.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}"|dnif.exe /I "ads_optimizer">nul && (
>Repairads_optimizer.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
	)
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "system32">TESTads_optimizer1.txt
IF EXIST TESTads_optimizer1.txt For /f "tokens=4 delims=\." %%C in (TESTads_optimizer1.txt) do (
IF EXIST %systemroot%\system32\%%C.dll echo %systemroot%\system32\%%C.dll>>Find.txt
IF EXIST %systemroot%\system32\_%%C.dll echo %systemroot%\system32\_%%C.dll>>Find.txt
	)
editreg.exe /s Repairads_optimizer.reg 2>NUL
copy Repairads_optimizer.reg .\backups\ >nul
	)

IF EXIST TESTadzbho1.txt For /f "tokens=*" %%G in (TESTadzbho1.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}"|dnif.exe /I "MySidesearch Search Assistant">nul && (
>RepairMySidesearch.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
	)
editreg.exe /s RepairMySidesearch.reg 2>NUL
copy RepairMySidesearch.reg .\backups\ >nul
	)

IF EXIST TESTadzbho1.txt For /f "tokens=*" %%G in (TESTadzbho1.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}"|dnif.exe /I "mysidesearch search enhancer">nul && (
>RepairMySidesearch1.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
	)
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "system32">TESTMySidesearch2.txt
IF EXIST TESTMySidesearch2.txt For /f "tokens=4 delims=\." %%C in (TESTMySidesearch2.txt) do (
IF EXIST %systemroot%\system32\%%C.dll echo %systemroot%\system32\%%C.dll>>Find.txt
IF EXIST %systemroot%\system32\_%%C.dll echo %systemroot%\system32\_%%C.dll>>Find.txt
	)
editreg.exe /s RepairMySidesearch1.reg 2>NUL
copy RepairMySidesearch1.reg .\backups\RepairMySidesearch.reg >nul
	)

apps\Csweg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5967A1AE-4028-9850-1E14-845792D42842}" /v "UninstallString"|dnif.exe /I "\system32\">>TESTMySidesearch3.txt
IF EXIST TESTMySidesearch3.txt dnif.exe /I ".exe"<TESTMySidesearch3.txt>NUL && For /f "tokens=4 delims=\." %%e in (TESTMySidesearch3.txt) do IF EXIST %systemroot%\system32\%%e.dll-uninst.exe echo %systemroot%\system32\%%e.dll-uninst.exe>>Find.txt

IF EXIST TESTadzbho1.txt For /f "tokens=*" %%G in (TESTadzbho1.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}"|dnif.exe /I "adzgalore">nul && (
>Repairadzgalore.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
	)
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "system32">TESTadzgalore2.txt
IF EXIST TESTadzgalore2.txt For /f "tokens=4 delims=\." %%C in (TESTadzgalore2.txt) do (
IF EXIST %systemroot%\system32\%%C.dll echo %systemroot%\system32\%%C.dll>>Find.txt
IF EXIST %systemroot%\system32\_%%C.dll echo %systemroot%\system32\_%%C.dll>>Find.txt
	)
editreg.exe /s Repairadzgalore.reg 2>NUL
copy Repairadzgalore.reg .\backups\ >nul
	)

IF EXIST TESTadzbho1.txt For /f "tokens=*" %%G in (TESTadzbho1.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}"|dnif.exe /I "mysidesearch browser optimizer">nul && (
>Repairmysidesearchoptimizer.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
	)
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "system32">TESTmysidesearchoptimizer2.txt
IF EXIST TESTmysidesearchoptimizer2.txt For /f "tokens=4 delims=\." %%C in (TESTmysidesearchoptimizer2.txt) do (
IF EXIST %systemroot%\system32\%%C.dll echo %systemroot%\system32\%%C.dll>>Find.txt
IF EXIST %systemroot%\system32\_%%C.dll echo %systemroot%\system32\_%%C.dll>>Find.txt
	)
editreg.exe /s Repairmysidesearchoptimizer.reg 2>NUL
copy Repairmysidesearchoptimizer.reg .\backups\ >nul
	)

IF EXIST TESTadzbho1.txt For /f "tokens=*" %%G in (TESTadzbho1.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}"|dnif.exe /I "rightonadz browser">nul && (
>Repairrightonadzenhancer.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
	)
editreg.exe /s Repairrightonadzenhancer.reg 2>NUL
copy Repairrightonadzenhancer.reg .\backups\ >nul
	)

IF EXIST TESTadzbho1.txt For /f "tokens=*" %%G in (TESTadzbho1.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}"|dnif.exe /I "superiorads">nul && (
>Repairsuperioradsoptimizer.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
	)
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "system32">TESTsuperioradsoptimizer2.txt
IF EXIST TESTsuperioradsoptimizer2.txt For /f "tokens=4 delims=\." %%C in (TESTsuperioradsoptimizer2.txt) do (
IF EXIST %systemroot%\system32\%%C.dll echo %systemroot%\system32\%%C.dll>>Find.txt
IF EXIST %systemroot%\system32\_%%C.dll echo %systemroot%\system32\_%%C.dll>>Find.txt
	)
editreg.exe /s Repairsuperioradsoptimizer.reg 2>NUL
copy Repairsuperioradsoptimizer.reg .\backups\ >nul
	)

IF EXIST TESTadzbho1.txt For /f "tokens=*" %%G in (TESTadzbho1.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}"|dnif.exe /I "giantads.biz">nul && (
>Repairgiantadsoptimizer.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
	)
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "system32">TESTgiantadsoptimizer2.txt
IF EXIST TESTgiantadsoptimizer2.txt For /f "tokens=4 delims=\." %%C in (TESTgiantadsoptimizer2.txt) do (
IF EXIST %systemroot%\system32\%%C.dll echo %systemroot%\system32\%%C.dll>>Find.txt
IF EXIST %systemroot%\system32\_%%C.dll echo %systemroot%\system32\_%%C.dll>>Find.txt
	)
editreg.exe /s Repairgiantadsoptimizer.reg 2>NUL
copy Repairgiantadsoptimizer.reg .\backups\ >nul
	)

IF EXIST TESTadzbho1.txt For /f "tokens=*" %%G in (TESTadzbho1.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}"|dnif.exe /I "targettedbanner browser">nul && (
>Repairtargettedbanner.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
	)
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "system32">TESTtargettedbanner2.txt
IF EXIST TESTtargettedbanner2.txt For /f "tokens=4 delims=\." %%C in (TESTtargettedbanner2.txt) do (
IF EXIST %systemroot%\system32\%%C.dll echo %systemroot%\system32\%%C.dll>>Find.txt
IF EXIST %systemroot%\system32\_%%C.dll echo %systemroot%\system32\_%%C.dll>>Find.txt
	)
editreg.exe /s Repairtargettedbanner.reg 2>NUL
copy Repairtargettedbanner.reg .\backups\ >nul
	)

IF EXIST TESTadzbho1.txt For /f "tokens=*" %%G in (TESTadzbho1.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}"|dnif.exe /I "cpmsky browser">nul && (
>Repaircpmsky.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
	)
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "system32">TESTcpmsky2.txt
IF EXIST TESTcpmsky2.txt For /f "tokens=4 delims=\." %%C in (TESTcpmsky2.txt) do (
IF EXIST %systemroot%\system32\%%C.dll echo %systemroot%\system32\%%C.dll>>Find.txt
IF EXIST %systemroot%\system32\_%%C.dll echo %systemroot%\system32\_%%C.dll>>Find.txt
	)
editreg.exe /s Repaircpmsky.reg 2>NUL
copy Repaircpmsky.reg .\backups\ >nul
	)

apps\Csweg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\cpmsky" /v "UninstallString"|dnif.exe /I "\system32\">>TESTcpmsky3.txt
IF EXIST TESTcpmsky3.txt dnif.exe /I ".exe"<TESTcpmsky3.txt>NUL && For /f "tokens=4 delims=\." %%e in (TESTcpmsky3.txt) do IF EXIST %systemroot%\system32\%%e.exe echo %systemroot%\system32\%%e.exe>>Find.txt

IF EXIST TESTadzbho1.txt For /f "tokens=*" %%G in (TESTadzbho1.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}"|dnif.exe /I "addestination browser optimizer">nul && (
>Repairaddestination.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
	)
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "system32">TESTaddestination2.txt
IF EXIST TESTaddestination2.txt For /f "tokens=4 delims=\." %%C in (TESTaddestination2.txt) do (
IF EXIST %systemroot%\system32\%%C.dll echo %systemroot%\system32\%%C.dll>>Find.txt
IF EXIST %systemroot%\system32\_%%C.dll echo %systemroot%\system32\_%%C.dll>>Find.txt
	)
editreg.exe /s Repairaddestination.reg 2>NUL
copy Repairaddestination.reg .\backups\ >nul
	)

IF EXIST TESTadzbho1.txt For /f "tokens=*" %%G in (TESTadzbho1.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}"|dnif.exe /I "adsonmedia browser">nul && (
>Repairadsonmedia.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
	)
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "system32">TESTadsonmedia2.txt
IF EXIST TESTadsonmedia2.txt For /f "tokens=4 delims=\." %%C in (TESTadsonmedia2.txt) do (
IF EXIST %systemroot%\system32\%%C.dll echo %systemroot%\system32\%%C.dll>>Find.txt
IF EXIST %systemroot%\system32\_%%C.dll echo %systemroot%\system32\_%%C.dll>>Find.txt
	)
editreg.exe /s Repairadsonmedia.reg 2>NUL
copy Repairadsonmedia.reg .\backups\ >nul
	)

IF EXIST TESTadzbho1.txt For /f "tokens=*" %%G in (TESTadzbho1.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}"|dnif.exe "adssite">nul && (
>Repairadssite.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
	)
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "system32">TESTadssite2.txt
IF EXIST TESTadssite2.txt For /f "tokens=4 delims=\." %%C in (TESTadssite2.txt) do (
IF EXIST %systemroot%\system32\%%C.dll echo %systemroot%\system32\%%C.dll>>Find.txt	)
IF EXIST %systemroot%\system32\_%%C.dll echo %systemroot%\system32\_%%C.dll>>Find.txt
editreg.exe /s Repairadssite.reg 2>NUL
copy Repairadssite.reg .\backups\ >nul
	)
 
IF EXIST TESTadzbho1.txt For /f "tokens=*" %%G in (TESTadzbho1.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}"|dnif.exe /I "bannerstyles browser">nul && (
>Repairbannerstyles.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
	)
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "system32">TESTbannerstyles2.txt
IF EXIST TESTbannerstyles2.txt For /f "tokens=4 delims=\." %%C in (TESTbannerstyles2.txt) do (
IF EXIST %systemroot%\system32\%%C.dll echo %systemroot%\system32\%%C.dll>>Find.txt
IF EXIST %systemroot%\system32\_%%C.dll echo %systemroot%\system32\_%%C.dll>>Find.txt
	)
editreg.exe /s Repairbannerstyles.reg 2>NUL
copy Repairbannerstyles.reg .\backups\ >nul
	)

IF EXIST TESTadzbho1.txt For /f "tokens=*" %%G in (TESTadzbho1.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}"|dnif.exe /I "bannerstyles15 browser">nul && (
>Repairbannerstyles15.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
	)
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "system32">TESTbannerstyles215.txt
IF EXIST TESTbannerstyles215.txt For /f "tokens=4 delims=\." %%C in (TESTbannerstyles215.txt) do (
IF EXIST %systemroot%\system32\%%C.dll echo %systemroot%\system32\%%C.dll>>Find.txt
IF EXIST %systemroot%\system32\_%%C.dll echo %systemroot%\system32\_%%C.dll>>Find.txt
	)
editreg.exe /s Repairbannerstyles15.reg 2>NUL
copy Repairbannerstyles15.reg .\backups\ >nul
	)

IF EXIST TESTadzbho1.txt For /f "tokens=*" %%G in (TESTadzbho1.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}"|dnif.exe /I "bannerstyle browser">nul && (
>Repairbannerstylesa.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
	)
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "system32">TESTbannerstyles2a.txt
IF EXIST TESTbannerstyles2a.txt For /f "tokens=4 delims=\." %%C in (TESTbannerstyles2a.txt) do (
IF EXIST %systemroot%\system32\%%C.dll echo %systemroot%\system32\%%C.dll>>Find.txt
IF EXIST %systemroot%\system32\_%%C.dll echo %systemroot%\system32\_%%C.dll>>Find.txt
	)
editreg.exe /s Repairbannerstylesa.reg 2>NUL
copy Repairbannerstylesa.reg .\backups\ >nul
	)

IF EXIST TESTadzbho1.txt For /f "tokens=*" %%G in (TESTadzbho1.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}"|dnif.exe /I "banneradsgalore">nul && (
>Repairbanneradsgalore.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
	)
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "system32">TESTbanneradsgalore2.txt
IF EXIST TESTbanneradsgalore2.txt For /f "tokens=4 delims=\." %%C in (TESTbanneradsgalore2.txt) do (
IF EXIST %systemroot%\system32\%%C.dll echo %systemroot%\system32\%%C.dll>>Find.txt
IF EXIST %systemroot%\system32\_%%C.dll echo %systemroot%\system32\_%%C.dll>>Find.txt
	)
editreg.exe /s Repairbanneradsgalore.reg 2>NUL
copy Repairbanneradsgalore.reg .\backups\ >nul
	)

IF EXIST TESTadzbho1.txt For /f "tokens=*" %%G in (TESTadzbho1.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}"|dnif.exe /I "nextads browser">nul && (
>Repairnextads.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
	)
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "system32">TESTnextads2.txt
IF EXIST TESTnextads2.txt For /f "tokens=4 delims=\." %%C in (TESTnextads2.txt) do (
IF EXIST %systemroot%\system32\%%C.dll echo %systemroot%\system32\%%C.dll>>Find.txt
IF EXIST %systemroot%\system32\_%%C.dll echo %systemroot%\system32\_%%C.dll>>Find.txt
	)
editreg.exe /s Repairnextads.reg 2>NUL
copy Repairnextads.reg .\backups\ >nul
	)

IF EXIST TESTadzbho1.txt For /f "tokens=*" %%G in (TESTadzbho1.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}"|dnif.exe /I "agadoo browser">nul && (
>Repairagadoo.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
	)
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "system32">TESTagadoo2.txt
IF EXIST TESTagadoo2.txt For /f "tokens=4 delims=\." %%C in (TESTagadoo2.txt) do (
dnif.exe /I "%%C"<CheckRuns.txt|dnif.exe /I ".">TESTagadoo22b.txt
IF EXIST %systemroot%\system32\%%C.dll echo %systemroot%\system32\%%C.dll>>Find.txt
IF EXIST %systemroot%\system32\_%%C.dll echo %systemroot%\system32\_%%C.dll>>Find.txt
	)
IF EXIST TESTagadoo22b.txt dnif.exe /I "."<TESTagadoo22b.txt>NUL && For /f "tokens=1 delims==" %%F in (TESTagadoo22b.txt) do (
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]>>Repairagadoo.reg
echo %%F=->>Repairagadoo.reg
echo.>>Repairagadoo.reg
	)
editreg.exe /s Repairagadoo.reg 2>NUL
copy Repairagadoo.reg .\backups\ >nul
	)

IF EXIST TESTadzbho1.txt For /f "tokens=*" %%G in (TESTadzbho1.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}"|dnif.exe /I "radbanner browser">nul && (
>Repairradbanner.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
	)
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "system32">TESTradbanner2.txt
IF EXIST TESTradbanner2.txt For /f "tokens=4 delims=\." %%C in (TESTradbanner2.txt) do (
IF EXIST %systemroot%\system32\%%C.dll echo %systemroot%\system32\%%C.dll>>Find.txt
IF EXIST %systemroot%\system32\_%%C.dll echo %systemroot%\system32\_%%C.dll>>Find.txt
	)
editreg.exe /s Repairradbanner.reg 2>NUL
copy Repairradbanner.reg .\backups\ >nul
	)

IF EXIST TESTadzbho1.txt For /f "tokens=*" %%G in (TESTadzbho1.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}"|dnif.exe /I "dcads">nul && (
>Repairdcads.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
	)
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "system32">TESTdcads2.txt
IF EXIST TESTdcads2.txt For /f "tokens=4 delims=\." %%C in (TESTdcads2.txt) do (
IF EXIST %systemroot%\system32\%%C.dll echo %systemroot%\system32\%%C.dll>>Find.txt
IF EXIST %systemroot%\system32\_%%C.dll echo %systemroot%\system32\_%%C.dll>>Find.txt
	)
editreg.exe /s Repairdcads.reg 2>NUL
copy Repairdcads.reg .\backups\ >nul
	)

IF EXIST TESTadzbho1.txt For /f "tokens=*" %%G in (TESTadzbho1.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}"|dnif.exe /I "bambanner browser">nul && (
>Repairbambanner.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
	)
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "system32">TESTbambanner2.txt
IF EXIST TESTbambanner2.txt For /f "tokens=4 delims=\." %%C in (TESTbambanner2.txt) do (
IF EXIST %systemroot%\system32\%%C.dll echo %systemroot%\system32\%%C.dll>>Find.txt
IF EXIST %systemroot%\system32\_%%C.dll echo %systemroot%\system32\_%%C.dll>>Find.txt
	)
editreg.exe /s Repairbambanner.reg 2>NUL
copy Repairbambanner.reg .\backups\ >nul
	)

apps\Csweg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\bambanner" /v "UninstallString"|dnif.exe /I "\system32\">>TESTbambanner3.txt
IF EXIST TESTbambanner3.txt dnif.exe /I ".exe"<TESTbambanner3.txt>NUL && For /f "tokens=4 delims=\." %%e in (TESTbambanner3.txt) do IF EXIST %systemroot%\system32\%%e.exe echo %systemroot%\system32\%%e.exe>>Find.txt

IF EXIST TESTadzbho1.txt For /f "tokens=*" %%G in (TESTadzbho1.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}"|dnif.exe /I "milehighads browser">nul && (
>Repairmilehighads.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
	)
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "system32">TESTmilehighads1b.txt
IF EXIST TESTmilehighads1b.txt For /f "tokens=4 delims=\." %%C in (TESTmilehighads1b.txt) do (
dnif.exe /I "%%C"<CheckRuns.txt|dnif.exe /I ".">TESTmilehighads2b.txt
IF EXIST %systemroot%\system32\%%C.dll echo %systemroot%\system32\%%C.dll>>Find.txt
IF EXIST %systemroot%\system32\_%%C.dll echo %systemroot%\system32\_%%C.dll>>Find.txt
	)
IF EXIST TESTmilehighads2b.txt dnif.exe /I "."<TESTmilehighads2b.txt>NUL && For /f "tokens=1 delims==" %%F in (TESTmilehighads2b.txt) do (
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]>>Repairmilehighads.reg
echo %%F=->>Repairmilehighads.reg
echo.>>Repairmilehighads.reg
	)
editreg.exe /s Repairmilehighads.reg 2>NUL
copy Repairmilehighads.reg .\backups\ >nul
	)

apps\Csweg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\innbanner" /v "UninstallString"|dnif.exe /I "\system32\">>TESTinnbanner1.txt
IF EXIST TESTinnbanner1.txt dnif.exe /I ".exe"<TESTinnbanner1.txt>NUL && For /f "tokens=4 delims=\." %%e in (TESTinnbanner1.txt) do IF EXIST %systemroot%\system32\%%e.exe echo %systemroot%\system32\%%e.exe>>Find.txt

IF EXIST TESTadzbho1.txt For /f "tokens=*" %%G in (TESTadzbho1.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}"|dnif.exe /I "innbanner browser">nul && (
>Repairinnbanner.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
	)
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "system32">TESTinnbanner1b.txt
IF EXIST TESTinnbanner1b.txt For /f "tokens=4 delims=\." %%C in (TESTinnbanner1b.txt) do (
dnif.exe /I "%%C"<CheckRuns.txt|dnif.exe /I ".">TESTinnbanner2b.txt
IF EXIST %systemroot%\system32\%%C.dll echo %systemroot%\system32\%%C.dll>>Find.txt
IF EXIST %systemroot%\system32\_%%C.dll echo %systemroot%\system32\_%%C.dll>>Find.txt
	)
IF EXIST TESTinnbanner2b.txt dnif.exe /I "."<TESTinnbanner2b.txt>NUL && For /f "tokens=1 delims==" %%F in (TESTinnbanner2b.txt) do (
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]>>Repairinnbanner.reg
echo %%F=->>Repairinnbanner.reg
echo.>>Repairinnbanner.reg
	)
editreg.exe /s Repairinnbanner.reg 2>NUL
copy Repairinnbanner.reg .\backups\ >nul
	)

IF EXIST TESTadzbho1.txt For /f "tokens=*" %%G in (TESTadzbho1.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}"|dnif.exe /I "offersfortoday browser">nul && (
>Repairoffersfortoday.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
	)
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "system32">TESToffersfortoday1b.txt
IF EXIST TESToffersfortoday1b.txt For /f "tokens=4 delims=\." %%C in (TESToffersfortoday1b.txt) do (
dnif.exe /I "%%C"<CheckRuns.txt|dnif.exe /I ".">TESToffersfortoday2b.txt
IF EXIST %systemroot%\system32\%%C.dll echo %systemroot%\system32\%%C.dll>>Find.txt
IF EXIST %systemroot%\system32\_%%C.dll echo %systemroot%\system32\_%%C.dll>>Find.txt
	)
IF EXIST TESToffersfortoday2b.txt dnif.exe /I "."<TESToffersfortoday2b.txt>NUL && For /f "tokens=1 delims==" %%F in (TESToffersfortoday2b.txt) do (
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]>>Repairoffersfortoday.reg
echo %%F=->>Repairoffersfortoday.reg
echo.>>Repairoffersfortoday.reg
	)
editreg.exe /s Repairoffersfortoday.reg 2>NUL
copy Repairoffersfortoday.reg .\backups\Repairoffersfortoday1.reg >nul
	)

IF EXIST TESTfakebsd0.txt For /f "tokens=7 delims=\" %%G in (TESTfakebsd0.txt) do apps\Csweg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%%G" /v "DisplayName"|dnif.exe /I "RON Tool ">NUL && ECHO %%G>>TESTOffersfortoday.txt
IF EXIST TESTOffersfortoday.txt For /f "tokens=*" %%G in (TESTOffersfortoday.txt) do apps\Csweg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%%G" /v "DisplayName"|dnif.exe /I "DisplayName"|dnif.exe /I "RON Tool ">NUL && (
apps\Csweg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%%G" /v "UninstallString"|dnif.exe /I "UninstallString"|dnif.exe /I "\system32\">TESTOffersfortoday1.txt
For /f "tokens=4 delims=\." %%b in (TESTOffersfortoday1.txt) do IF EXIST %systemroot%\system32\%%b.exe echo %systemroot%\system32\%%b.exe>>Find.txt
>RepairOffersfortoday1.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%%G]
echo.
	)
dnif.exe /I /V "\]"<RepairOffersfortoday1.reg>RepairOffersfortoday2.reg
editreg.exe /s Repairoffersfortoday2.reg 2>NUL
copy Repairoffersfortoday2.reg .\backups\RepairIconAds.reg >nul
	)

IF EXIST TESTadzbho1.txt For /f "tokens=*" %%G in (TESTadzbho1.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "ipv6monl.dll">nul && (
>RepairCimuz1.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
echo [-HKEY_CLASSES_ROOT\AppId\{%%G}]
echo.
	)
editreg.exe /s RepairCimuz1.reg 2>NUL
copy RepairCimuz1.reg .\backups\RepairCimuz.reg >nul
	)

apps\locate "%systemroot%\system32\*.dll" /D- /s:83968! /n /nr|dnif.exe /I ".dll">>TESTsilentbanker1.TXT
rtsdnif.exe /m /f:TESTsilentbanker1.TXT "reloc" >>TESTsilentbanker2.TXT 2>NUL
for /f "tokens=*" %%a in (TESTsilentbanker2.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "04794A7A18373B5644F6755EB877EE48">NUL && echo %%a>>TESTsilentbanker3.TXT
for /f "tokens=*" %%a in (TESTsilentbanker2.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "39E3EB2F4FA37E42D6FB171E2205BC3C">NUL && echo %%a>>TESTsilentbanker3.TXT
for /f "tokens=*" %%a in (TESTsilentbanker2.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "5D88F76885BE1986A4422D4597A5B8EA">NUL && echo %%a>>TESTsilentbanker3.TXT

IF EXIST TESTsilentbanker3.TXT For /f "tokens=8 delims=\{}" %%G in (TESTbho.txt) do For /f "tokens=4 delims=\" %%C in (TESTsilentbanker3.TXT) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "%%C">nul && (
TYPE TESTsilentbanker3.TXT>>Find.txt
apps\locate "%systemroot%\system32\*.cpl" /D- /n /nr|dnif.exe /I ".cpl">>TESTsilentbanker4.TXT
rtsdnif.exe /m /I /f:TESTsilentbanker4.TXT "%%C">>Find.txt 2>NUL
>Repairsilentbanker.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
echo.
	)
editreg.exe /s Repairsilentbanker.reg 2>NUL
copy Repairsilentbanker.reg .\backups\silentbanker.reg >nul
	)

apps\sc.exe GetKeyName "TCP/IP NetBIOS"|dnif.exe /I "SUCCESS"|dnif.exe /I "NetBS">NUL && (
editreg.exe /s apps\HaxdFix.reg 2>NUL
echo.>Haxfnd1.txt
echo Restoring Default "DependOnService" values for Eventlog, lanmanworkstation, lanmanserver, RpcSs, Dnscache, EventSystem, Netman, ProtectedStorage and Spooler Services>>Haxfnd1.txt
	)

apps\Csweg.exe QUERY "HKLM\SYSTEM\CurrentControlSet\Services\Virtual Memory Dispatcher" /V ImagePath |dnif.exe /I "ImagePath">testruss1.txt
IF EXIST testruss1.txt dnif.exe /I "."<testruss1.txt>NUL &&  For /f "tokens=3 delims=	." %%b in (testruss1.txt) do IF EXIST %%b.exe echo %%~b.exe>>Find.txt

apps\Csweg.exe QUERY "HKLM\SYSTEM\CurrentControlSet\Services\Virtual Memory Protector" /V ImagePath |dnif.exe /I "ImagePath">testruss2.txt
IF EXIST testruss2.txt dnif.exe /I "."<testruss2.txt>NUL &&  For /f "tokens=3 delims=	." %%b in (testruss2.txt) do IF EXIST %%b.exe echo %%~b.exe>>Find.txt

apps\Csweg.exe QUERY "HKLM\SYSTEM\CurrentControlSet\Services\Physical Memory Protector" /V ImagePath |dnif.exe /I "ImagePath">testruss3.txt
IF EXIST testruss3.txt dnif.exe /I "."<testruss3.txt>NUL &&  For /f "tokens=3 delims=	." %%b in (testruss3.txt) do IF EXIST %%b.exe echo %%~b.exe>>Find.txt

apps\Csweg.exe QUERY "HKLM\SYSTEM\CurrentControlSet\Services\Virtual Memory Protector" /V ImagePath |dnif.exe /I "ImagePath">testruss1a.txt
IF EXIST testruss1a.txt dnif.exe /I "."<testruss1a.txt>NUL &&  For /f "tokens=3" %%a in (testruss1a.txt) do echo %%~a>>testruss2a.txt
IF EXIST testruss2a.txt dnif.exe /I "."<testruss2a.txt>NUL &&  For /f "tokens=1 delims=." %%b in (testruss2a.txt) do IF EXIST %%b.exe echo %%b.exe>>Find.txt

apps\locate "%systemroot%\system32\*.dll" /D- /s:31000,60000! /n /nr|dnif.exe /I ".dll">>TEST800.TXT
rtsdnif.exe /m /f:TEST800.TXT "NETHELPERLib">> TEST801.TXT 2>NUL
rtsdnif.exe /m /f:TEST801.TXT "HookWWW">> TEST802.TXT 2>NUL
rtsdnif.exe /m /f:TEST802.TXT "Hookd">> TEST803.TXT 2>NUL
rtsdnif.exe /m /f:TEST803.TXT "Helper.DLL">>TESTbank2.TXT 2>NUL
rtsdnif.exe /m /f:TEST803.TXT "duo.dll">>TESTbank2.TXT 2>NUL
rtsdnif.exe /m /f:TEST803.TXT "D.dll">>TESTbank2.TXT 2>NUL
rtsdnif.exe /m /f:TEST800.TXT "UpackByDwing">> TEST804.TXT 2>NUL
rtsdnif.exe /m /f:TEST804.TXT "NETHELPERLib">> TEST805.TXT 2>NUL
rtsdnif.exe /m /f:TEST805.TXT "Hookd">> TEST806.TXT 2>NUL
rtsdnif.exe /m /f:TEST806.TXT "HookWWW">>TESTbank2.TXT 2>NUL
IF EXIST TESTbank2.TXT TYPE TESTbank2.TXT>>Find.txt
IF EXIST TESTbank2.txt For /f "tokens=4 delims=\." %%A in (TESTbank2.TXT) do For /f "tokens=8 delims=\{}" %%G in (TESTbho.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "%%A.dll">nul && (
>Repairbanker.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
echo.
	)
editreg.exe /s Repairbanker.reg 2>NUL
copy Repairbanker.reg .\backups\Repairbanker.reg >nul
	)

IF EXIST %systemroot%\system32\mmx?????.dll dir /b/s/a-d %systemroot%\system32\mmx?????.dll>TestDBHO1.txt 2nul
IF EXIST TestDBHO1.txt rtsdnif.exe /m /I /f:TestDBHO1.txt "Yahoo">TestDBHO2.txt 2>nul
IF EXIST TestDBHO2.txt rtsdnif.exe /m /I /f:TestDBHO2.txt "userinit">TestDBHO3.txt 2>nul

IF EXIST TestDBHO3.txt dnif.exe "."<TestDBHO3.txt>NUL && For /f "tokens=5 delims=\mmx." %%d in (TestDBHO3.txt) do (
IF EXIST %systemroot%\system32\mmx%%d.dll echo %systemroot%\system32\mmx%%d.dll>>TestDBHO4.txt
IF EXIST %systemroot%\system32\mmx%%d.dll echo %systemroot%\system32\mmx%%d.dll>>Find.txt
IF EXIST %systemroot%\system32\mx%%d.dll echo %systemroot%\system32\mx%%d.dll>>Find.txt
	)

IF EXIST TestDBHO4.txt dnif.exe "."<TestDBHO4.txt>NUL && For /f "tokens=4 delims=\." %%b in (TestDBHO4.txt) do for /f "tokens=8 delims=\{}" %%h in (TESTbho.txt) DO apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%h}\InprocServer32"|dnif.exe /I "system32\%%b.dll">nul && (
>RepairDBHO.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%h}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%h}]
echo.
	)
editreg.exe /s RepairDBHO.reg 2>NUL
copy RepairDBHO.reg .\backups\RepairDBHO.reg >nul
	)

IF EXIST TESTbho.txt For /f "tokens=8 delims=\{}" %%G in (TESTbho.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "WINDOWS\mesdxbrq">nul && (
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\Typelib"|dnif.exe /I "{"|dnif.exe /I /V "\">>TESTcpvTypelib30.txt
>Repaircpv30.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
For /f "tokens=2 delims=\{}" %%A in (TESTcpvTypelib30.txt) do echo [-HKEY_CLASSES_ROOT\TypeLib\{%%A}]
echo.
	)
editreg.exe /s Repaircpv30.reg 2>NUL
copy Repaircpv30.reg .\backups\RepairCpvBHO30.reg >nul
	)

IF EXIST TESTbho.txt For /f "tokens=8 delims=\{}" %%G in (TESTbho.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "WINDOWS\twmxbsqr">nul && (
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\Typelib"|dnif.exe /I "{"|dnif.exe /I /V "\">>TESTcpvTypelib31.txt
>Repaircpv31.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
For /f "tokens=2 delims=\{}" %%A in (TESTcpvTypelib31.txt) do echo [-HKEY_CLASSES_ROOT\TypeLib\{%%A}]
echo.
	)
editreg.exe /s Repaircpv31.reg 2>NUL
copy Repaircpv31.reg .\backups\RepairCpvBHO31.reg >nul
	)

IF EXIST TESTbho.txt For /f "tokens=8 delims=\{}" %%G in (TESTbho.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "WINDOWS\rodqgpvl">nul && (
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\Typelib"|dnif.exe /I "{"|dnif.exe /I /V "\">>TESTcpvTypelib32.txt
>Repaircpv32.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
For /f "tokens=2 delims=\{}" %%A in (TESTcpvTypelib32.txt) do echo [-HKEY_CLASSES_ROOT\TypeLib\{%%A}]
echo.
	)
editreg.exe /s Repaircpv32.reg 2>NUL
copy Repaircpv32.reg .\backups\RepairCpvBHO32.reg >nul
	)

IF EXIST TESTbho.txt For /f "tokens=8 delims=\{}" %%G in (TESTbho.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "WINDOWS\vanwxemg">nul && (
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\Typelib"|dnif.exe /I "{"|dnif.exe /I /V "\">>TESTcpvTypelib33.txt
>Repaircpv33.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
For /f "tokens=2 delims=\{}" %%A in (TESTcpvTypelib33.txt) do echo [-HKEY_CLASSES_ROOT\TypeLib\{%%A}]
echo.
	)
editreg.exe /s Repaircpv33.reg 2>NUL
copy Repaircpv33.reg .\backups\RepairCpvBHO33.reg >nul
	)

IF EXIST TESTbho.txt For /f "tokens=8 delims=\{}" %%G in (TESTbho.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "WINDOWS\vmgspntb">nul && (
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\Typelib"|dnif.exe /I "{"|dnif.exe /I /V "\">>TESTcpvTypelib34.txt
>Repaircpv34.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
For /f "tokens=2 delims=\{}" %%A in (TESTcpvTypelib34.txt) do echo [-HKEY_CLASSES_ROOT\TypeLib\{%%A}]
echo.
	)
editreg.exe /s Repaircpv34.reg 2>NUL
copy Repaircpv34.reg .\backups\RepairCpvBHO34.reg >nul
	)

IF EXIST TESTbho.txt For /f "tokens=8 delims=\{}" %%G in (TESTbho.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "WINDOWS\dfmlxbpk">nul && (
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\Typelib"|dnif.exe /I "{"|dnif.exe /I /V "\">>TESTcpvTypelib35.txt
>Repaircpv35.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
For /f "tokens=2 delims=\{}" %%A in (TESTcpvTypelib35.txt) do echo [-HKEY_CLASSES_ROOT\TypeLib\{%%A}]
echo.
	)
editreg.exe /s Repaircpv35.reg 2>NUL
copy Repaircpv35.reg .\backups\RepairCpvBHO35.reg >nul
	)

IF EXIST TESTbho.txt For /f "tokens=8 delims=\{}" %%G in (TESTbho.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "WINDOWS\nkefbltd">nul && (
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\Typelib"|dnif.exe /I "{"|dnif.exe /I /V "\">>TESTcpvTypelib36.txt
>Repaircpv36.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
For /f "tokens=2 delims=\{}" %%A in (TESTcpvTypelib36.txt) do echo [-HKEY_CLASSES_ROOT\TypeLib\{%%A}]
echo.
	)
editreg.exe /s Repaircpv36.reg 2>NUL
copy Repaircpv36.reg .\backups\RepairCpvBHO36.reg >nul
	)

IF EXIST TESTbho.txt For /f "tokens=8 delims=\{}" %%G in (TESTbho.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "WINDOWS\vortsgbq">nul && (
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\Typelib"|dnif.exe /I "{"|dnif.exe /I /V "\">>TESTcpvTypelib37.txt
>Repaircpv37.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
For /f "tokens=2 delims=\{}" %%A in (TESTcpvTypelib37.txt) do echo [-HKEY_CLASSES_ROOT\TypeLib\{%%A}]
echo.
	)
editreg.exe /s Repaircpv37.reg 2>NUL
copy Repaircpv37.reg .\backups\RepairCpvBHO37.reg >nul
	)

IF EXIST TESTbho.txt For /f "tokens=8 delims=\{}" %%G in (TESTbho.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "WINDOWS\grfxbano">nul && (
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\Typelib"|dnif.exe /I "{"|dnif.exe /I /V "\">>TESTcpvTypelib38.txt
>Repaircpv38.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
For /f "tokens=2 delims=\{}" %%A in (TESTcpvTypelib38.txt) do echo [-HKEY_CLASSES_ROOT\TypeLib\{%%A}]
echo.
	)
editreg.exe /s Repaircpv38.reg 2>NUL
copy Repaircpv38.reg .\backups\RepairCpvBHO38.reg >nul
	)

IF EXIST TESTbho.txt For /f "tokens=8 delims=\{}" %%G in (TESTbho.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "WINDOWS\aetlsrkn">nul && (
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\Typelib"|dnif.exe /I "{"|dnif.exe /I /V "\">>TESTcpvTypelib39.txt
>Repaircpv39.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
For /f "tokens=2 delims=\{}" %%A in (TESTcpvTypelib39.txt) do echo [-HKEY_CLASSES_ROOT\TypeLib\{%%A}]
echo.
	)
editreg.exe /s Repaircpv39.reg 2>NUL
copy Repaircpv39.reg .\backups\RepairCpvBHO39.reg >nul
	)

IF EXIST TESTbho.txt For /f "tokens=8 delims=\{}" %%G in (TESTbho.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "WINDOWS\rsdgbtkq">nul && (
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\Typelib"|dnif.exe /I "{"|dnif.exe /I /V "\">>TESTcpvTypelib40.txt
>Repaircpv40.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
For /f "tokens=2 delims=\{}" %%A in (TESTcpvTypelib40.txt) do echo [-HKEY_CLASSES_ROOT\TypeLib\{%%A}]
echo.
	)
editreg.exe /s Repaircpv40.reg 2>NUL
copy Repaircpv40.reg .\backups\RepairCpvBHO40.reg >nul
	)

IF EXIST TESTbho.txt For /f "tokens=8 delims=\{}" %%G in (TESTbho.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "Applications\iebt.dll">nul && (
>RepairZlobBHO.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
echo.
	)
editreg.exe /s RepairZlobBHO.reg 2>NUL
copy RepairZlobBHO.reg .\backups >nul
	)

IF EXIST TESTbho.txt For /f "tokens=8 delims=\{}" %%G in (TESTbho.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "system32\CodecBHO.dll">nul && (
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\Typelib"|dnif.exe /I "{"|dnif.exe /I /V "\">>TESTCodecBHO.txt
>RepairCodecBHO.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
For /f "tokens=2 delims=\{}" %%A in (TESTCodecBHO.txt) do echo [-HKEY_CLASSES_ROOT\TypeLib\{%%A}]
echo.
	)
editreg.exe /s RepairCodecBHO.reg 2>NUL
copy RepairCodecBHO.reg .\backups >nul
	)

IF EXIST TESTbho.txt For /f "tokens=8 delims=\{}" %%G in (TESTbho.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "system32\RichVideoCodec.dll">nul && (
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\Typelib"|dnif.exe /I "{"|dnif.exe /I /V "\">>TESTRichVideoCodec.txt
>RepairRichVideoCodec.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
For /f "tokens=2 delims=\{}" %%A in (TESTRichVideoCodec.txt) do echo [-HKEY_CLASSES_ROOT\TypeLib\{%%A}]
echo.
	)
editreg.exe /s RepairRichVideoCodec.reg 2>NUL
copy RepairRichVideoCodec.reg .\backups >nul
	)

IF EXIST TESTbho.txt For /f "tokens=8 delims=\{}" %%G in (TESTbho.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "system32\LPVideo.dll">nul && (
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\Typelib"|dnif.exe /I "{"|dnif.exe /I /V "\">>TESTLPVideo.txt
>RepairLPVideo.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
For /f "tokens=2 delims=\{}" %%A in (TESTLPVideo.txt) do echo [-HKEY_CLASSES_ROOT\TypeLib\{%%A}]
echo.
	)
editreg.exe /s RepairLPVideo.reg 2>NUL
copy RepairLPVideo.reg .\backups >nul
	)

IF EXIST TESTbho.txt For /f "tokens=8 delims=\{}" %%G in (TESTbho.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "system32\getsn32.dll">nul && (
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\Typelib"|dnif.exe /I "{"|dnif.exe /I /V "\">>TESTgetsn32.txt
>Repairgetsn32.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
For /f "tokens=2 delims=\{}" %%A in (TESTgetsn32.txt) do echo [-HKEY_CLASSES_ROOT\TypeLib\{%%A}]
echo.
	)
editreg.exe /s Repairgetsn32.reg 2>NUL
copy Repairgetsn32.reg .\backups >nul
	)

IF EXIST TESTbho.txt For /f "tokens=8 delims=\{}" %%G in (TESTbho.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "\Program Files\QdrDrive\">nul && (
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\Typelib"|dnif.exe /I "{"|dnif.exe /I /V "\">>TESTAdband1.txt
>RepairAdband1.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
For /f "tokens=2 delims=\{}" %%A in (TESTAdband1.txt) do echo [-HKEY_CLASSES_ROOT\TypeLib\{%%A}]
echo.
	)
editreg.exe /s RepairAdband1.reg 2>NUL
copy RepairAdband1.reg .\backups\RepairAdband1.reg >nul
	)

IF EXIST TESTbho.txt For /f "tokens=8 delims=\{}" %%G in (TESTbho.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "\Program Files\ISM\">nul && (
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\Typelib"|dnif.exe /I "{"|dnif.exe /I /V "\">>TESTAdband2.txt
>RepairAdband2.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
For /f "tokens=2 delims=\{}" %%A in (TESTAdband2.txt) do echo [-HKEY_CLASSES_ROOT\TypeLib\{%%A}]
echo.
	)
editreg.exe /s RepairAdband2.reg 2>NUL
copy RepairAdband2.reg .\backups\RepairAdband2.reg >nul
	)

IF EXIST TESTbho.txt For /f "tokens=8 delims=\{}" %%G in (TESTbho.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "altcmd\altcmd32.dll">nul && (
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\Typelib"|dnif.exe /I "{"|dnif.exe /I /V "\">>TESTaltcmd2.txt
>Repairaltcmd.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
For /f "tokens=2 delims=\{}" %%A in (TESTaltcmd2.txt) do echo [-HKEY_CLASSES_ROOT\TypeLib\{%%A}]
echo.
	)
editreg.exe /s Repairaltcmd.reg 2>NUL
copy Repairaltcmd.reg .\backups\ >nul
	)

apps\Csweg query "HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar"|dnif.exe /I "{">>TESTcpvtoolbar1.txt
apps\Csweg query "HKCR">TESTCPVHKU0.txt

IF EXIST TESTcpvtoolbar1.txt For /f "tokens=2 delims={}" %%G in (TESTcpvtoolbar1.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "vwsrfton.dll">nul && (
dnif.exe /I "ROOT\V"<TESTCPVHKU0.txt>TESTCPVHKU3Ac.txt
dnif.exe /I "vwsrfton"<TESTCPVHKU3Ac.txt>TESTCPVHKU27Ac.txt
>Repaircpvtoolbar30.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
echo "{%%G}"=-
IF EXIST TESTCPVHKU27Ac.txt dnif.exe /I "."<TESTCPVHKU27Ac.txt>NUL && For /f "tokens=*" %%A in (TESTCPVHKU27Ac.txt) do echo [-%%A]
echo.
	)
editreg.exe /s Repaircpvtoolbar30.reg 2>NUL
copy Repaircpvtoolbar30.reg .\backups\CpvToolbar30.reg >nul
	)

IF EXIST TESTcpvtoolbar1.txt For /f "tokens=2 delims={}" %%G in (TESTcpvtoolbar1.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "rafbsvnx.dll">nul && (
dnif.exe /I "ROOT\r"<TESTCPVHKU0.txt>TESTCPVHKU3Ad.txt
dnif.exe /I "rafbsvnx"<TESTCPVHKU3Ad.txt>TESTCPVHKU27Ad.txt
>Repaircpvtoolbar31.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
echo "{%%G}"=-
IF EXIST TESTCPVHKU27Ad.txt dnif.exe /I "."<TESTCPVHKU27Ad.txt>NUL && For /f "tokens=*" %%A in (TESTCPVHKU27Ad.txt) do echo [-%%A]
echo.
	)
editreg.exe /s Repaircpvtoolbar31.reg 2>NUL
copy Repaircpvtoolbar31.reg .\backups\CpvToolbar31.reg >nul
	)

IF EXIST TESTcpvtoolbar1.txt For /f "tokens=2 delims={}" %%G in (TESTcpvtoolbar1.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "qalkfxor.dll">nul && (
dnif.exe /I "ROOT\q"<TESTCPVHKU0.txt>TESTCPVHKU3Ae.txt
dnif.exe /I "rafbsvnx"<TESTCPVHKU3Ae.txt>TESTCPVHKU27Ae.txt
>Repaircpvtoolbar32.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
echo "{%%G}"=-
IF EXIST TESTCPVHKU27Ae.txt dnif.exe /I "."<TESTCPVHKU27Ae.txt>NUL && For /f "tokens=*" %%A in (TESTCPVHKU27Ae.txt) do echo [-%%A]
echo.
	)
editreg.exe /s Repaircpvtoolbar32.reg 2>NUL
copy Repaircpvtoolbar32.reg .\backups\CpvToolbar32.reg >nul
	)

IF EXIST TESTcpvtoolbar1.txt For /f "tokens=2 delims={}" %%G in (TESTcpvtoolbar1.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "gksraemq.dll">nul && (
dnif.exe /I "ROOT\g"<TESTCPVHKU0.txt>TESTCPVHKU3g.txt
dnif.exe /I "gksraemq"<TESTCPVHKU3g.txt>TESTCPVHKU3ga.txt
>Repaircpvtoolbar33.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
echo "{%%G}"=-
IF EXIST TESTCPVHKU3ga.txt dnif.exe /I "."<TESTCPVHKU3ga.txt>NUL && For /f "tokens=*" %%A in (TESTCPVHKU3ga.txt) do echo [-%%A]
echo.
	)
editreg.exe /s Repaircpvtoolbar33.reg 2>NUL
copy Repaircpvtoolbar33.reg .\backups\CpvToolbar33.reg >nul
	)

IF EXIST TESTcpvtoolbar1.txt For /f "tokens=2 delims={}" %%G in (TESTcpvtoolbar1.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "fqbewlna.dll">nul && (
dnif.exe /I "ROOT\f"<TESTCPVHKU0.txt>TESTCPVHKUf1.txt
dnif.exe /I "fqbewlna"<TESTCPVHKUf1.txt>TESTCPVHKUf1a.txt
>Repaircpvtoolbar34.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
echo "{%%G}"=-
IF EXIST TESTCPVHKUf1a.txt dnif.exe /I "."<TESTCPVHKUf1a.txt>NUL && For /f "tokens=*" %%A in (TESTCPVHKUf1a.txt) do echo [-%%A]
echo.
	)
editreg.exe /s Repaircpvtoolbar34.reg 2>NUL
copy Repaircpvtoolbar34.reg .\backups\CpvToolbar34.reg >nul
	)

IF EXIST TESTcpvtoolbar1.txt For /f "tokens=2 delims={}" %%G in (TESTcpvtoolbar1.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "peltodgx.dll">nul && (
dnif.exe /I "ROOT\p"<TESTCPVHKU0.txt>TESTCPVHKUp1.txt
dnif.exe /I "peltodgx"<TESTCPVHKUp1.txt>TESTCPVHKUp1a.txt
>Repaircpvtoolbar35.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
echo "{%%G}"=-
IF EXIST TESTCPVHKUp1a.txt dnif.exe /I "."<TESTCPVHKUp1a.txt>NUL && For /f "tokens=*" %%A in (TESTCPVHKUp1a.txt) do echo [-%%A]
echo.
	)
editreg.exe /s Repaircpvtoolbar35.reg 2>NUL
copy Repaircpvtoolbar35.reg .\backups\CpvToolbar35.reg >nul
	)

IF EXIST TESTcpvtoolbar1.txt For /f "tokens=2 delims={}" %%G in (TESTcpvtoolbar1.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "dkwqgnbe.dll">nul && (
dnif.exe /I "ROOT\d"<TESTCPVHKU0.txt>TESTCPVHKUd1.txt
dnif.exe /I "dkwqgnbe"<TESTCPVHKUd1.txt>TESTCPVHKUd1a.txt
>Repaircpvtoolbar36.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
echo "{%%G}"=-
IF EXIST TESTCPVHKUd1a.txt dnif.exe /I "."<TESTCPVHKUd1a.txt>NUL && For /f "tokens=*" %%A in (TESTCPVHKUd1a.txt) do echo [-%%A]
echo.
	)
editreg.exe /s Repaircpvtoolbar36.reg 2>NUL
copy Repaircpvtoolbar36.reg .\backups\CpvToolbar36.reg >nul
	)

IF EXIST TESTcpvtoolbar1.txt For /f "tokens=2 delims={}" %%G in (TESTcpvtoolbar1.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "olnmraew.dll">nul && (
dnif.exe /I "ROOT\o"<TESTCPVHKU0.txt>TESTCPVHKUd1o.txt
dnif.exe /I "olnmraew"<TESTCPVHKUd1o.txt>TESTCPVHKUd1oa.txt
>Repaircpvtoolbar37.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
echo "{%%G}"=-
IF EXIST TESTCPVHKUd1oa.txt dnif.exe /I "."<TESTCPVHKUd1oa.txt>NUL && For /f "tokens=*" %%A in (TESTCPVHKUd1oa.txt) do echo [-%%A]
echo.
	)
editreg.exe /s Repaircpvtoolbar37.reg 2>NUL
copy Repaircpvtoolbar37.reg .\backups\CpvToolbar37.reg >nul
	)

IF EXIST TESTcpvtoolbar1.txt For /f "tokens=2 delims={}" %%G in (TESTcpvtoolbar1.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "rosqxvmn.dll">nul && (
dnif.exe /I "ROOT\r"<TESTCPVHKU0.txt>TESTCPVHKUd1r.txt
dnif.exe /I "rosqxvmn"<TESTCPVHKUd1o.txt>TESTCPVHKUd1ra.txt
>Repaircpvtoolbar38.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
echo "{%%G}"=-
IF EXIST TESTCPVHKUd1ra.txt dnif.exe /I "."<TESTCPVHKUd1ra.txt>NUL && For /f "tokens=*" %%A in (TESTCPVHKUd1ra.txt) do echo [-%%A]
echo.
	)
editreg.exe /s Repaircpvtoolbar38.reg 2>NUL
copy Repaircpvtoolbar38.reg .\backups\CpvToolbar38.reg >nul
	)

IF EXIST TESTcpvtoolbar1.txt For /f "tokens=2 delims={}" %%G in (TESTcpvtoolbar1.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "bkqxdons.dll">nul && (
dnif.exe /I "ROOT\b"<TESTCPVHKU0.txt>TESTCPVHKUb1.txt
dnif.exe /I "bkqxdons"<TESTCPVHKUb1.txt>TESTCPVHKUb1a.txt
>Repaircpvtoolbar39.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
echo "{%%G}"=-
IF EXIST TESTCPVHKUb1a.txt dnif.exe /I "."<TESTCPVHKUb1a.txt>NUL && For /f "tokens=*" %%A in (TESTCPVHKUb1a.txt) do echo [-%%A]
echo.
	)
editreg.exe /s Repaircpvtoolbar39.reg 2>NUL
copy Repaircpvtoolbar39.reg .\backups\CpvToolbar39.reg >nul
	)

IF EXIST TESTcpvtoolbar1.txt For /f "tokens=2 delims={}" %%G in (TESTcpvtoolbar1.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "wvfsrqab.dll">nul && (
dnif.exe /I "ROOT\w"<TESTCPVHKU0.txt>TESTCPVHKUw1.txt
dnif.exe /I "wvfsrqab"<TESTCPVHKUw1.txt>TESTCPVHKUw1a.txt
>Repaircpvtoolbar40.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
echo "{%%G}"=-
IF EXIST TESTCPVHKUw1a.txt dnif.exe /I "."<TESTCPVHKUw1a.txt>NUL && For /f "tokens=*" %%A in (TESTCPVHKUw1a.txt) do echo [-%%A]
echo.
	)
editreg.exe /s Repaircpvtoolbar40.reg 2>NUL
copy Repaircpvtoolbar40.reg .\backups\CpvToolbar40.reg >nul
	)

IF EXIST TESTcpvtoolbar1.txt For /f "tokens=2 delims={}" %%G in (TESTcpvtoolbar1.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "Applications\iebr.dll">nul && (
>RepairZlobToolbar.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
echo "{%%G}"=-
echo.
	)
editreg.exe /s RepairZlobToolbar.reg 2>NUL
copy RepairZlobToolbar.reg .\backups >nul
	)

apps\Csweg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /V ProductId|dnif.exe /I "ProductId" >>CheckProdID1.txt
IF EXIST CheckProdID1.txt dnif.exe /I "VIRUS"<CheckProdID1.txt>NUL && (
apps\Csweg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /V ProductId|dnif.exe /I "ProductId" >>CheckProdID2.txt
IF EXIST CheckProdID2.txt dnif.exe /I "-"<CheckProdID2.txt>NUL && (
for /f "tokens=3 delims=	" %%a in (CheckProdID2.txt) do (
>RepairProductID.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion]
ECHO "ProductId"="%%a"
echo.
	)
editreg.exe /s RepairProductID.reg 2>NUL
copy RepairProductID.reg .\backups\RepairProductID.reg >nul
echo Restoring Windows Product ID To Remove Fake Virus Alert>vacprod.txt
	)))

apps\Csweg query "HKEY_CURRENT_USER\Control Panel\International" /V sTimeFormat|dnif.exe /I "sTimeFormat" >>ChecksTime1.txt
for /f "tokens=3 delims=	" %%a in (ChecksTime1.txt) do ECHO %%a>>ChecksTime2.txt

IF EXIST ChecksTime2.txt dnif.exe /I "VIRUS"<ChecksTime2.txt>NUL && (
dnif.exe /I /V "hh:"<ChecksTime2.txt|dnif.exe /I /V "tt">>ChecksTime3.txt
dnif.exe /I /V "hh:"<ChecksTime2.txt|dnif.exe /I "tt">>ChecksTime4.txt
>RepairClock.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_CURRENT_USER\Control Panel\International]
dnif.exe "HH:mm:"<ChecksTime2.txt>NUL && echo "sTimeFormat"="HH:mm:ss"
dnif.exe "hh:mm:"<ChecksTime2.txt|dnif.exe /I /V "tt">NUL && echo "sTimeFormat"="hh:mm:ss"
dnif.exe "hh:mm:"<ChecksTime2.txt|dnif.exe "tt">NUL && echo "sTimeFormat"="hh:mm:ss tt"
	)
dnif.exe /I "h:"<ChecksTime3.txt>NUL && dnif.exe "H:mm:"<ChecksTime2.txt>NUL && echo "sTimeFormat"="H:mm:ss">>RepairClock.reg
dnif.exe "h:mm:"<ChecksTime4.txt|dnif.exe "tt">NUL && echo "sTimeFormat"="h:mm:ss tt">>RepairClock.reg
	
editreg.exe /s RepairClock.reg 2>NUL
copy RepairClock.reg .\backups\RepairClock.reg >nul
echo Restoring Time Format To Remove Fake Virus Alert>>vacprod.txt
	)

apps\locate "%allusersprofile%\qmgr?.dat" /D- /n|dnif.exe /I ".dat">>TESTBITS1.TXT

IF EXIST TESTBITS1.TXT rtsdnif.exe /m /f:TESTBITS1.TXT "5.8...6.5...2.3.4.">>TESTBITS00.TXT 2>NUL
IF EXIST TESTBITS1.TXT rtsdnif.exe /m /f:TESTBITS1.TXT "7.7...7.4...4.8.">>TESTBITS00.TXT 2>NUL
IF EXIST TESTBITS1.TXT rtsdnif.exe /m /f:TESTBITS1.TXT "7.7...9.1...2.2.7.">>TESTBITS00.TXT 2>NUL
IF EXIST TESTBITS1.TXT rtsdnif.exe /m /f:TESTBITS1.TXT "7.7...9.1...2.2.8.">>TESTBITS00.TXT 2>NUL
IF EXIST TESTBITS1.TXT rtsdnif.exe /m /f:TESTBITS1.TXT "7.8...1.5.7...1.4.2.">>TESTBITS00.TXT 2>NUL
IF EXIST TESTBITS1.TXT rtsdnif.exe /m /f:TESTBITS1.TXT "7.8...1.5.7...1.4.3.">>TESTBITS00.TXT 2>NUL
IF EXIST TESTBITS1.TXT rtsdnif.exe /m /f:TESTBITS1.TXT "8.0...9.3...4.8.">>TESTBITS00.TXT 2>NUL
IF EXIST TESTBITS1.TXT rtsdnif.exe /m /f:TESTBITS1.TXT "9.1...2.0.3...9.3.">>TESTBITS00.TXT 2>NUL
IF EXIST TESTBITS1.TXT rtsdnif.exe /m /f:TESTBITS1.TXT "7.7.7.-.z.l.o...c.n">>TESTBITS00.TXT 2>NUL
IF EXIST TESTBITS1.TXT rtsdnif.exe /m /f:TESTBITS1.TXT "m.o.s.c.o.w...r.u">>TESTBITS00.TXT 2>NUL
IF EXIST TESTBITS1.TXT rtsdnif.exe /m /f:TESTBITS1.TXT "m.e.g.a.u.p.l.i.n.k">>TESTBITS00.TXT 2>NUL
IF EXIST TESTBITS1.TXT rtsdnif.exe /m /f:TESTBITS1.TXT "c.o.d.e.c.s">>TESTBITS00.TXT 2>NUL
IF EXIST TESTBITS1.TXT rtsdnif.exe /m /f:TESTBITS1.TXT "d.r.o.p.-.i.t.">>TESTBITS00.TXT 2>NUL
IF EXIST TESTBITS1.TXT rtsdnif.exe /m /f:TESTBITS1.TXT "f.l.y.v.i.d.e.o.n.e.t.w.o.r.k">>TESTBITS00.TXT 2>NUL
IF EXIST TESTBITS1.TXT rtsdnif.exe /m /f:TESTBITS1.TXT "p.o.r.n">>TESTBITS00.TXT 2>NUL
IF EXIST TESTBITS1.TXT rtsdnif.exe /m /f:TESTBITS1.TXT "i.n.2.s.e.a.r.c.h">>TESTBITS00.TXT 2>NUL
IF EXIST TESTBITS1.TXT rtsdnif.exe /m /f:TESTBITS1.TXT "n.u.d.e">>TESTBITS00.TXT 2>NUL
IF EXIST TESTBITS1.TXT rtsdnif.exe /m /f:TESTBITS1.TXT "s.a.f.e.p.r.o">>TESTBITS00.TXT 2>NUL
IF EXIST TESTBITS1.TXT rtsdnif.exe /m /f:TESTBITS1.TXT "r.e.d.d.i.i...o.r.g">>TESTBITS00.TXT 2>NUL
IF EXIST TESTBITS1.TXT rtsdnif.exe /m /f:TESTBITS1.TXT "s.e.x.">>TESTBITS00.TXT 2>NUL
IF EXIST TESTBITS1.TXT rtsdnif.exe /m /f:TESTBITS1.TXT "a.d.w.o.r.d.s.s...i.n.f.o">>TESTBITS00.TXT 2>NUL
IF EXIST TESTBITS1.TXT rtsdnif.exe /m /f:TESTBITS1.TXT "s.o.f.t.w.o.r.l.d">>TESTBITS00.TXT 2>NUL
IF EXIST TESTBITS1.TXT rtsdnif.exe /m /f:TESTBITS1.TXT "s.p.y.w.a.r.e.">>TESTBITS00.TXT 2>NUL
IF EXIST TESTBITS1.TXT rtsdnif.exe /m /f:TESTBITS1.TXT "s.t.a.t.s.b.o.a.t">>TESTBITS00.TXT 2>NUL
IF EXIST TESTBITS1.TXT rtsdnif.exe /m /f:TESTBITS1.TXT "s.u.p.e.r.t.d.s">>TESTBITS00.TXT 2>NUL
IF EXIST TESTBITS1.TXT rtsdnif.exe /m /f:TESTBITS1.TXT "t.h.e.n.m.n.e.t.w.o.r.k">>TESTBITS00.TXT 2>NUL
IF EXIST TESTBITS1.TXT rtsdnif.exe /m /f:TESTBITS1.TXT "t.r.a.f.f.i.c./.a.l.l./.f.i.l.e.s.">>TESTBITS00.TXT 2>NUL
IF EXIST TESTBITS1.TXT rtsdnif.exe /m /f:TESTBITS1.TXT "u.p.d.a.t.e.c.u.b.e">>TESTBITS00.TXT 2>NUL
IF EXIST TESTBITS1.TXT rtsdnif.exe /m /f:TESTBITS1.TXT "w.i.n.u.p.d.a.t.e.2...n.e.t">>TESTBITS00.TXT 2>NUL
IF EXIST TESTBITS1.TXT rtsdnif.exe /m /f:TESTBITS1.TXT "z.u.p.a.c.h.a">>TESTBITS00.TXT 2>NUL
IF EXIST TESTBITS00.TXT dnif.exe /I ".dat"<TESTBITS00.TXT>NUL && (
apps\sc.exe stop BITS >NUL
For /f "tokens=*" %%G in (TESTBITS00.TXT) do apps\Cghtme.exe -e %%G >nul
ECHO %AllUsersProfile%\Application Data\Microsoft\Network\Downloader\qmgr0.dat - Contains Links to Malware Sites! - Deleted>BITSTEST.TXT
ECHO %AllUsersProfile%\Application Data\Microsoft\Network\Downloader\qmgr1.dat - Contains Links to Malware Sites! - Deleted>>BITSTEST.TXT
	)

apps\Csweg.exe QUERY "HKLM\SYSTEM\CurrentControlSet\Services\cmdService"|dnif.exe /I "imagepath"|dnif.exe /I "\command.exe" >>Checkcom.txt 2>nul
IF EXIST Checkcom.txt dnif.exe /I "\command.exe"<Checkcom.txt>nul && (
For /F "TOKENS=2,3 delims=\" %%g IN (Checkcom.txt) Do (
IF EXIST %systemroot%\%%h\asappsrv.dll echo %systemroot%\%%h\asappsrv.dll>>Find.txt
IF EXIST %systemroot%\%%h\command.exe echo %systemroot%\%%h\command.exe>>Find.txt
IF EXIST %systemroot%\%%h\*.vbs dir /b/s/a-d %systemroot%\%%h\*.vbs >>checkvbs.txt
IF EXIST checkvbs.txt rtsdnif.exe /m /f:checkvbs.txt "command.adservs">>Find.txt
attrib -h -r -s %systemroot%\%%h >nul
	))

apps\locate "%systemroot%\system32\win???32.dll" /D- /s:19000,34000 /n /nr|dnif.exe /I ".dll">>TESTNeb1.TXT
IF EXIST TESTNeb1.TXT dnif.exe /I "WIN"<TESTNeb1.TXT>NUL && for /f "tokens=4 delims=\." %%a in (TESTNeb1.TXT) do echo %%a>>TESTNeb2.TXT
IF EXIST TESTNeb2.TXT dnif.exe /I "WIN"<TESTNeb2.TXT>NUL && for /f "tokens=*" %%b in (TESTNeb2.TXT) do apps\Csweg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\%%b" /V DllName|dnif.exe /I "%%b.dll">nul && echo %%b>>TESTNeb3.TXT
IF EXIST TESTNeb3.TXT dnif.exe /I "WIN"<TESTNeb3.TXT>NUL && for /f "tokens=*" %%c in (TESTNeb3.TXT) do (
IF EXIST %systemroot%\system32\%%c.dll echo %systemroot%\system32\%%c.dll>>Find.txt
>RepairNeb1.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\%%c]
echo.
	)
editreg.exe /s RepairNeb1.reg 2>NUL
copy RepairNeb1.reg .\backups\NebularFix.reg >nul
	)

dir /b/s/a-d %systemroot%\system32\*hc???j0e???*.bmp>>TESTScreenSavebmp1.TXT 2>nul
dnif.exe /I "."<TESTScreenSavebmp1.TXT>NUL && (
TYPE TESTScreenSavebmp1.TXT>>Find.txt
>RepairWp1.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_CURRENT_USER\Control Panel\Desktop]
echo "ConvertedWallpaper"=""
echo "OriginalWallpaper"=""
echo "WallpaperStyle"="2"
echo.
	)
editreg.exe /s RepairWp1.reg 2>NUL
echo Restoring Default Desktop Wallpaper >TESTUC3.TXT && editreg.exe /s apps\HPFix4.reg 2>NUL
	)

IF EXIST %systemroot%\mywallpaper.bmp echo Restoring Default Desktop Wallpaper >TESTUC3.TXT && editreg.exe /s apps\HPFix4.reg 2>NUL
IF EXIST "%programfiles%\winvi\dsktp\*" echo Restoring Default Desktop Wallpaper>TESTUC3.TXT && editreg.exe /s apps\HPFix4.reg 2>NUL
IF EXIST "%programfiles%\winvi\dsktp\*" editreg.exe /s apps\HPFix5.reg 2>NUL

apps\Csweg query "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders" /V SecurityProviders|dnif.exe /I "SecurityProviders"|dnif.exe /I ".dll">TESTSecPro1.txt

dnif.exe /I "wowfx.dll"<TESTSecPro1.txt>>NUL && (
IF NOT EXIST apps\dumm md apps\dumm >nul
attrib +r apps\dumm
move /y "apps\dumm" "%systemroot%\system32\wowfx.dll" >nul
echo Resetting SecurityProviders Value >TESTsec.txt
echo.Windows Registry Editor Version 5.00>FixSecurityProvider.reg
echo.>>FixSecurityProvider.reg
echo.[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]>>FixSecurityProvider.reg 
apps\Csweg query "hklm\system\currentcontrolset\control\securityproviders" /v securityproviders |(
    apps\SED -r "/.*\t/!d; s/^ +(.*)\t.*\t(.*)$/\x22\1\x22=\x22\2\x22/; s/, wowfx.dll//" )>>FixSecurityProvider.reg
editreg.exe /s FixSecurityProvider.reg 2>NUL
copy FixSecurityProvider.reg .\backups >nul
	)

dnif.exe /I "xlibgfl254.dll"<TESTSecPro1.txt>>NUL && (
echo Resetting SecurityProviders Value >TESTsec.txt
echo.Windows Registry Editor Version 5.00>FixSecurityProvider2.reg
echo.>>FixSecurityProvider2.reg
echo.[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]>>FixSecurityProvider2.reg 
apps\Csweg query "hklm\system\currentcontrolset\control\securityproviders" /v securityproviders |(
    apps\SED -r "/.*\t/!d; s/^ +(.*)\t.*\t(.*)$/\x22\1\x22=\x22\2\x22/; s/, xlibgfl254.dll//" )>>FixSecurityProvider2.reg
editreg.exe /s FixSecurityProvider2.reg 2>NUL
copy FixSecurityProvider2.reg .\backups >nul
	)

dnif.exe /I "msansspc.dll"<TESTSecPro1.txt>>NUL && (
echo Resetting SecurityProviders Value >TESTsec.txt
echo.Windows Registry Editor Version 5.00>FixSecurityProvider.reg
echo.>>FixSecurityProvider.reg
echo.[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]>>FixSecurityProvider.reg 
apps\Csweg query "hklm\system\currentcontrolset\control\securityproviders" /v securityproviders |(
    apps\SED -r "/.*\t/!d; s/^ +(.*)\t.*\t(.*)$/\x22\1\x22=\x22\2\x22/; s/, msansspc.dll//" )>>FixSecurityProvider.reg
editreg.exe /s FixSecurityProvider.reg 2>NUL
copy FixSecurityProvider.reg .\backups >nul
	)

dnif.exe /I "windowsdefender.exe"<CheckRunsSrv1.txt>>NUL && (
>RepairRunWD1.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
echo "Windows Defender"=-
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
echo "Windows Defender"=-
echo.
	)
editreg.exe /s RepairRunWD1.reg 2>NUL 
copy RepairRunWD1.reg .\backups >nul
	)

dnif.exe /I "2009\\av2009.exe"<CheckRuns2.txt>>Findav2009.txt
IF EXIST Findav2009.txt dnif.exe /I "."<Findav2009.txt>NUL && (
>Repairav2009.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
FOR /F "TOKENS=1 DELIMS==" %%G in (Findav2009.txt) DO (
ECHO %%G=-
echo [-HKEY_CURRENT_USER\SOFTWARE\%%~G]
	)
echo.
	)
dnif.exe /I /V"\]"<Repairav2009.reg>>Repairav2009A.reg
editreg.exe /s Repairav2009A.reg 2>NUL
copy Repairav2009A.reg .\backups\Repairav2009.reg >nul
	)

dnif.exe /I "AV9\\av2009.exe"<CheckRuns2.txt>>Findav2009a.txt
IF EXIST Findav2009a.txt dnif.exe /I "."<Findav2009a.txt>NUL && (
>Repairav2009a.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
FOR /F "TOKENS=1 DELIMS==" %%G in (Findav2009a.txt) DO (
ECHO %%G=-
echo [-HKEY_CURRENT_USER\SOFTWARE\%%~G]
	)
echo.
	)
dnif.exe /I /V"\]"<Repairav2009a.reg>>Repairav2009aa.reg
editreg.exe /s Repairav2009aa.reg 2>NUL
copy Repairav2009aa.reg .\backups\Repairav2009.reg >nul
	)

dnif.exe /I "\Program Files\\ISM\"<CheckRuns2.txt>>FindAdbandrun1.txt
IF EXIST FindAdbandrun1.txt dnif.exe /I "."<FindAdbandrun1.txt>NUL && (
>RepairAdbandRun1.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
FOR /F "TOKENS=1 DELIMS==" %%G in (FindAdbandrun1.txt) DO ECHO %%G=-
echo.
	)
editreg.exe /s RepairAdbandRun1.reg 2>NUL
copy RepairAdbandRun1.reg .\backups >nul
	)

dnif.exe /I "\Program Files\\ISM2\"<CheckRuns2.txt>>FindAdbandrun2.txt
IF EXIST FindAdbandrun2.txt dnif.exe /I "."<FindAdbandrun2.txt>NUL && (
>RepairAdbandRun2.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
FOR /F "TOKENS=1 DELIMS==" %%G in (FindAdbandrun2.txt) DO ECHO %%G=-
echo.
	)
editreg.exe /s RepairAdbandRun2.reg 2>NUL
copy RepairAdbandRun2.reg .\backups >nul
	)

dnif.exe /I "\Program Files\\QdrModule\"<CheckRuns2.txt>>FindAdbandrun3.txt
IF EXIST FindAdbandrun3.txt dnif.exe /I "."<FindAdbandrun3.txt>NUL && (
>RepairAdbandRun3.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
FOR /F "TOKENS=1 DELIMS==" %%G in (FindAdbandrun3.txt) DO ECHO %%G=-
echo.
	)
editreg.exe /s RepairAdbandRun3.reg 2>NUL
copy RepairAdbandRun3.reg .\backups >nul
	)

dnif.exe /I "\Program Files\\GetModule\"<CheckRuns2.txt>>FindAdbandrun3a.txt
IF EXIST FindAdbandrun3a.txt dnif.exe /I "."<FindAdbandrun3a.txt>NUL && (
>RepairAdbandRun3a.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
FOR /F "TOKENS=1 DELIMS==" %%G in (FindAdbandrun3a.txt) DO ECHO %%G=-
echo.
	)
editreg.exe /s RepairAdbandRun3a.reg 2>NUL
copy RepairAdbandRun3a.reg .\backups >nul
	)

dnif.exe /I "\Program Files\\QdrPack\"<CheckRuns2.txt>>FindAdbandrun4.txt
IF EXIST FindAdbandrun4.txt dnif.exe /I "."<FindAdbandrun4.txt>NUL && (
>RepairAdbandRun4.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
FOR /F "TOKENS=1 DELIMS==" %%G in (FindAdbandrun4.txt) DO ECHO %%G=-
echo.
	)
editreg.exe /s RepairAdbandRun4.reg 2>NUL
copy RepairAdbandRun4.reg .\backups >nul
	)

dnif.exe /I "\Program Files\\GetPack\"<CheckRuns2.txt>>FindAdbandrun4a.txt
IF EXIST FindAdbandrun4a.txt dnif.exe /I "."<FindAdbandrun4a.txt>NUL && (
>RepairAdbandRun4a.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
FOR /F "TOKENS=1 DELIMS==" %%G in (FindAdbandrun4a.txt) DO ECHO %%G=-
echo.
	)
editreg.exe /s RepairAdbandRun4a.reg 2>NUL
copy RepairAdbandRun4a.reg .\backups >nul
	)

dnif.exe /I "\Program Files\\VnrPack\"<CheckRuns2.txt>>FindAdbandrun5.txt
IF EXIST FindAdbandrun5.txt dnif.exe /I "."<FindAdbandrun5.txt>NUL && (
>RepairAdbandRun5.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
FOR /F "TOKENS=1 DELIMS==" %%G in (FindAdbandrun5.txt) DO ECHO %%G=-
echo.
	)
editreg.exe /s RepairAdbandRun5.reg 2>NUL
copy RepairAdbandRun5.reg .\backups >nul
	)

dnif.exe /I "\Program Files\\VnrBlock\"<CheckRuns2.txt>>FindAdbandrun6.txt
IF EXIST FindAdbandrun6.txt dnif.exe /I "."<FindAdbandrun6.txt>NUL && (
>RepairAdbandRun6.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
FOR /F "TOKENS=1 DELIMS==" %%G in (FindAdbandrun6.txt) DO ECHO %%G=-
echo.
	)
editreg.exe /s RepairAdbandRun6.reg 2>NUL
copy RepairAdbandRun6.reg .\backups >nul
	)

dnif.exe /I "\\XP Antivirus\\xpa.exe"<CheckRuns2.txt>>Findroguerun1.txt
IF EXIST Findroguerun1.txt dnif.exe /I "."<Findroguerun1.txt>NUL && (
>Repairroguerun1.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
FOR /F "TOKENS=1 DELIMS==" %%G in (Findroguerun1.txt) DO ECHO %%G=-
echo.
	)
editreg.exe /s Repairroguerun1.reg 2>NUL
copy Repairroguerun1.regg .\backups\Repairrun1.reg >nul
	)

dnif.exe /I "\\RECYCLER\\S-1-5-21-"<CheckRuns2.txt|dnif.exe /I "windowsupdate.exe">>FindIRCBrute.txt
IF EXIST FindIRCBrute.txt dnif.exe /I "."<FindIRCBrute.txt>NUL && FOR /F "TOKENS=3 DELIMS=\" %%G in (FindIRCBrute.txt) DO IF EXIST %systemdrive%\RECYCLER\%%~G\windowsupdate.exe ECHO %systemdrive%\RECYCLER\%%~G\windowsupdate.exe>>Find.txt

CLS
echo.
echo Starting Repairs
echo.
echo Checking Running Processes and Services
echo.
echo.
echo Please Be Patient As This May Take Up To 20 Minutes
echo.

apps\Csweg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices" /V UpdateWin|dnif.exe /I "UpdateWin">TESTLDPinch0.txt
IF EXIST TESTLDPinch0.txt dnif.exe "UpdateWin"<TESTLDPinch0.txt|dnif.exe /I "\system32\">TESTLDPinch1.txt
IF EXIST TESTLDPinch1.txt For /F "TOKENS=4 delims=\." %%g IN (TESTLDPinch1.txt) DO IF EXIST %systemroot%\system32\%%g.exe echo %systemroot%\system32\%%g.exe>>Find.txt

apps\Csweg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices" /V IEUpdate|dnif.exe /I "IEUpdate">TESTLDPinch2.txt
IF EXIST TESTLDPinch2.txt dnif.exe "IEUpdate"<TESTLDPinch2.txt|dnif.exe /I "\system32\">TESTLDPinch3.txt
IF EXIST TESTLDPinch3.txt For /F "TOKENS=4 delims=\." %%g IN (TESTLDPinch3.txt) DO IF EXIST %systemroot%\system32\%%g.exe echo %systemroot%\system32\%%g.exe>>Find.txt

apps\Csweg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V mssysif|dnif.exe /I "mssysif">TESTDropper1.txt
IF EXIST TESTDropper1.txt dnif.exe "mssysif"<TESTDropper1.txt|dnif.exe /I "\system32\">TESTDropper2.txt
IF EXIST TESTDropper2.txt dnif.exe "mssysif"<TESTDropper2.txt>NUL && For /F "TOKENS=4 delims=\." %%g IN (TESTDropper2.txt) DO (
IF EXIST %systemroot%\system32\%%g.exe echo %systemroot%\system32\%%g.exe>>Find.txt
IF EXIST %systemroot%\system32\%%g.tmp echo %systemroot%\system32\%%g.tmp>>Find.txt
	)

apps\locate "%systemroot%\system32\*.exe" /D- /s:44544! /n /nr|dnif.exe /I ".exe"|dnif.exe /I /V "TSCUPGRD"|dnif.exe /I /V "ALG.EXE">>TESTLDPinch4a.txt
apps\locate "%systemroot%\system32\*.exe" /D- /s:45568! /n /nr|dnif.exe /I ".exe"|dnif.exe /I /V "DRWTSN32"|dnif.exe /I /V "EXTRAC32.EXE" >>TESTLDPinch4b.txt
IF EXIST TESTLDPinch4a.txt for /f "tokens=*" %%a in (TESTLDPinch4a.txt) do apps\MD5File.exe "%%a"|dnif.exe /I "01CE5DC95B60265ECE0E74E0138B6176">NUL && echo %%a>>TESTLDPinch5.txt
IF EXIST TESTLDPinch4a.txt for /f "tokens=*" %%a in (TESTLDPinch4a.txt) do apps\MD5File.exe "%%a"|dnif.exe /I "A3BE03E82F723E010B74B2376F3ED273">NUL && echo %%a>>TESTLDPinch5.txt
IF EXIST TESTLDPinch4b.txt for /f "tokens=*" %%a in (TESTLDPinch4b.txt) do apps\MD5File.exe "%%a"|dnif.exe /I "10D99F0417D1ED36D99A81F30FC48466">NUL && echo %%a>>TESTLDPinch5.txt
IF EXIST TESTLDPinch4b.txt for /f "tokens=*" %%a in (TESTLDPinch4b.txt) do apps\MD5File.exe "%%a"|dnif.exe /I "112CF72A8DF73C124370459A2FDC9290">NUL && echo %%a>>TESTLDPinch5.txt
IF EXIST TESTLDPinch5.txt dnif.exe /I "."<TESTLDPinch5.txt>NUL && FOR /F "TOKENS=*" %%G in (TESTLDPinch5.txt) DO dnif.exe /I "%%G"<Find.txt>NUL||ECHO %%G>>Find.txt

apps\Csweg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad" /V "oledll"|dnif.exe /I "oledll"> CheckLDPINC1.txt
IF EXIST CheckLDPINC1.txt dnif.exe /I "{"<CheckLDPINC1.txt>NUL && For /F "TOKENS=2 delims={}" %%b IN (CheckLDPINC1.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%~b}\InprocServer32"|dnif.exe ".dll">>CheckLDPINC2.txt
IF EXIST CheckLDPINC2.txt For /F "TOKENS=3 delims=	" %%C IN (CheckLDPINC2.txt) do IF EXIST "%%C" ECHO %%C>>Find.txt

dnif.exe /I "system32\\rwwnw64d.exe"<CheckRuns.txt>>Findrun002.txt
IF EXIST Findrun002.txt dnif.exe /I "."<Findrun002.txt>NUL && (
>RepairRun09.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
FOR /F "TOKENS=1 DELIMS==" %%G in (Findrun002.txt) DO ECHO %%G=-
echo.
	)
editreg.exe /s RepairRun09.reg 2>NUL
copy RepairRun09.reg .\backups >nul
	)

dnif.exe /I "system32\\jpwnw64.exe"<CheckRuns.txt>>Findrun002a.txt
IF EXIST Findrun002a.txt dnif.exe /I "."<Findrun002a.txt>NUL && (
>RepairRun09a.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
FOR /F "TOKENS=1 DELIMS==" %%G in (Findrun002a.txt) DO ECHO %%G=-
echo.
	)
editreg.exe /s RepairRun09a.reg 2>NUL
copy RepairRun09a.reg .\backups >nul
	)

dnif.exe /I "WINDOWS\\twain_32.exe"<CheckRuns.txt>>Findrun30.txt
IF EXIST Findrun30.txt dnif.exe /I "."<Findrun30.txt>NUL && (
>RepairRun100.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
FOR /F "TOKENS=1 DELIMS==" %%G in (Findrun30.txt) DO ECHO %%G=-
echo.
	)
editreg.exe /s RepairRun100.reg 2>NUL
copy RepairRun100.reg .\backups >nul
	)

dnif.exe /I "\winlogan.exe"<CheckRuns.txt>>Findrun31.txt
IF EXIST Findrun31.txt dnif.exe /I "."<Findrun31.txt>NUL && (
>RepairRun101.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
FOR /F "TOKENS=1 DELIMS==" %%G in (Findrun31.txt) DO ECHO %%G=-
echo [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
FOR /F "TOKENS=1 DELIMS==" %%G in (Findrun31.txt) DO ECHO %%G=-
echo [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
FOR /F "TOKENS=1 DELIMS==" %%G in (Findrun31.txt) DO ECHO %%G=-
echo.
	)
editreg.exe /s RepairRun101.reg 2>NUL
copy RepairRun101.reg .\backups\winlogan_run.reg >nul
	)

dnif.exe /I "\winlogen.exe"<CheckRuns.txt>>Findrun31a.txt
IF EXIST Findrun31a.txt dnif.exe /I "."<Findrun31a.txt>NUL && (
>RepairRun101a.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
FOR /F "TOKENS=1 DELIMS==" %%G in (Findrun31a.txt) DO ECHO %%G=-
echo [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
FOR /F "TOKENS=1 DELIMS==" %%G in (Findrun31a.txt) DO ECHO %%G=-
echo [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
FOR /F "TOKENS=1 DELIMS==" %%G in (Findrun31a.txt) DO ECHO %%G=-
echo.
	)
editreg.exe /s RepairRun101a.reg 2>NUL
copy RepairRun101a.reg .\backups\winlogen_run.reg >nul
	)

dnif.exe /I "\winlogun.exe"<CheckRuns.txt>>Findrun31b.txt
IF EXIST Findrun31b.txt dnif.exe /I "."<Findrun31b.txt>NUL && (
>RepairRun101b.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
FOR /F "TOKENS=1 DELIMS==" %%G in (Findrun31b.txt) DO ECHO %%G=-
echo [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
FOR /F "TOKENS=1 DELIMS==" %%G in (Findrun31b.txt) DO ECHO %%G=-
echo [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
FOR /F "TOKENS=1 DELIMS==" %%G in (Findrun31b.txt) DO ECHO %%G=-
echo.
	)
editreg.exe /s RepairRun101b.reg 2>NUL
copy RepairRun101b.reg .\backups\winlogun_run.reg >nul
	)

dnif.exe /I "\csrssc.exe"<CheckRuns2.txt>>Findrun32.txt
IF EXIST Findrun32.txt dnif.exe /I "."<Findrun32.txt>NUL && (
>RepairRun102.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
FOR /F "TOKENS=1 DELIMS==" %%G in (Findrun32.txt) DO ECHO %%G=-
echo [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
FOR /F "TOKENS=1 DELIMS==" %%G in (Findrun32.txt) DO ECHO %%G=-
echo [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
FOR /F "TOKENS=1 DELIMS==" %%G in (Findrun32.txt) DO ECHO %%G=-
echo.
	)
editreg.exe /s RepairRun102.reg 2>NUL
copy RepairRun102.reg .\backups\RepairRun2.reg >nul
	)

dnif.exe /I "dwwnw64r.exe"<CheckRuns.txt>>FindrunDW_Start.txt
IF EXIST FindrunDW_Start.txt dnif.exe /I "."<FindrunDW_Start.txt>NUL && (
>RepairDW_Start.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
FOR /F "TOKENS=1 DELIMS==" %%G in (FindrunDW_Start.txt) DO ECHO %%G=-
echo.
	)
editreg.exe /s RepairDW_Start.reg 2>NUL
copy RepairDW_Start.reg .\backups >nul
	)

dnif.exe /I "Messenger"<CheckRuns.txt|dnif.exe /I "msnmgsr.exe">>Findrunbot1.txt
IF EXIST Findrunbot1.txt dnif.exe /I "."<Findrunbot1.txt>NUL && (
>Repairrunbot1.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
echo "Messenger"=-
echo.
	)
editreg.exe /s Repairrunbot1.reg 2>NUL
copy Repairrunbot1.reg .\backups\Repair_bot_run.reg >nul
	)

dnif.exe /I "WINDOWS\ctfmon.exe"<CheckRuns.txt>>Findrunbifrose1.txt
IF EXIST Findrunbifrose1.txt dnif.exe /I "."<Findrunbifrose1.txt>NUL && (
>Repairrunbifrose1.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
FOR /F "TOKENS=1 DELIMS==" %%G in (Findrunbifrose1.txt) DO ECHO %%G=-
echo [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
FOR /F "TOKENS=1 DELIMS==" %%G in (Findrunbifrose1.txt) DO ECHO %%G=-
echo.
	)
editreg.exe /s Repairrunbifrose1.reg 2>NUL
copy Repairrunbifrose1.reg .\backups\Repair_bifrose_run.reg >nul
	)

apps\locate "%systemroot%\system32\*.dll" /D- /s:88000,89000 /n /nr|dnif.exe /I ".dll">>TESTbdat1.TXT
IF EXIST TESTbdat1.TXT rtsdnif.exe /m /f:TESTbdat1.TXT "Integer">>TESTbdat2.TXT 2>nul
IF EXIST TESTbdat2.TXT rtsdnif.exe /m /f:TESTbdat2.TXT "Delphi">>TESTbdat3.TXT 2>nul
IF EXIST TESTbdat3.TXT rtsdnif.exe /m /f:TESTbdat3.TXT "XorCmp">>TESTbdat4.TXT 2>nul
IF EXIST TESTbdat4.TXT rtsdnif.exe /m /f:TESTbdat4.TXT "hidden">>Findbhos1.txt 2>nul

apps\locate "%systemroot%\system32\*.dll" /D- /s:93000,94000 /n /nr|dnif.exe /I ".dll">>TESTbdat1a.TXT
IF EXIST TESTbdat1a.TXT rtsdnif.exe /m /f:TESTbdat1a.TXT "Integer">>TESTbdat2a.TXT 2>nul
IF EXIST TESTbdat2a.TXT rtsdnif.exe /m /f:TESTbdat2a.TXT "Delphi">>TESTbdat3a.TXT 2>nul
IF EXIST TESTbdat3a.TXT rtsdnif.exe /m /f:TESTbdat3a.TXT "InternetCrackUrlA">>TESTbdat4a.TXT 2>nul
IF EXIST TESTbdat3a.TXT rtsdnif.exe /m /f:TESTbdat4a.TXT "StdMFC32.dll">>Findbhos1.txt 2>nul

IF EXIST Findbhos1.txt dnif.exe /I "."<Findbhos1.txt>NUL && For /f "tokens=4 delims=\~" %%a in (Findbhos1.txt) do For /f "tokens=8 delims=\{}" %%G in (TESTbho.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "\System32\"|dnif.exe /I "\%%a">>nul && echo %%G>>Findbhos01.txt

IF EXIST Findbhos01.txt dnif.exe /I "-"<Findbhos01.txt>NUL && (
>RepairBHOdat1.reg (
echo Windows Registry Editor Version 5.00
echo. )
For /f "tokens=*" %%b in (Findbhos01.txt) do (
TYPE Findbhos1.txt>>Find.txt
>>RepairBHOdat1.reg (
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%b}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%b}]
echo.
	)
editreg.exe /s RepairBHOdat1.reg 2>NUL
copy RepairBHOdat1.reg .\backups\RepairdatBHO.reg >nul
	))

For /f "tokens=8 delims=\{}" %%G in (TESTbho.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "WINDOWS\pctools.dll">nul && echo %%G>>TESTbhvac17.TXT
IF EXIST TESTbhvac17.TXT For /f "tokens=*" %%C in (TESTbhvac17.TXT) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%C}\InprocServer32"|dnif.exe /I "WINDOWS\pctools.dll">nul && (
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%C}\Typelib"|dnif.exe /I "{"|dnif.exe /I /V "\">>TESTTypelib17.txt
>RepairBHO18.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%C}]
echo [-HKEY_CLASSES_ROOT\AppID\{%%C}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%C}]
For /f "tokens=2 delims=\{}" %%A in (TESTTypelib17.txt) do echo [-HKEY_CLASSES_ROOT\TypeLib\{%%A}]
echo.
	)
editreg.exe /s RepairBHO18.reg 2>NUL
copy RepairBHO18.reg .\backups\pctools.reg >nul
	)

For /f "tokens=8 delims=\{}" %%G in (TESTbho.txt) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "sbmdl.dll">nul && (
echo Restoring Default IE HomePage>>hpcheck.txt
editreg.exe /s apps\HPFix2.reg 2>NUL
	)

apps\locate "%userprofile%\Google\googl*.dll" /D- /s:24576! /n /nr|dnif.exe /I ".dll">>TESTfakeg4.TXT
apps\locate "%Programfiles%\Google\googl*.dll" /D- /s:24576! /n /nr|dnif.exe /I ".dll">>TESTfakeg4.TXT
rtsdnif.exe /m /f:TESTfakeg4.TXT "6Rich">> TESTfakeg5.TXT
rtsdnif.exe /m /f:TESTfakeg5.TXT "googletoolbar.DLL">>Find.txt
rtsdnif.exe /m /f:TESTfakeg5.TXT "googletoolbar.DLL">NUL && (
>>RepairFakeGoogle2.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4D91-8333-CF10577473F7}]
echo [-HKEY_CLASSES_ROOT\CLSID\{AA58ED58-01DD-4D91-8333-CF10577473F7}]
echo [-HKEY_CLASSES_ROOT\Googletoolbar.Google]
echo [-HKEY_CLASSES_ROOT\Googletoolbar.Google.1]
echo.
	)
editreg.exe /s RepairFakeGoogle2.reg 2>NUL
copy RepairFakeGoogle2.reg .\backups\RepairFakeGoogle2.reg >nul
	)

apps\Csweg export "HKCR\CLSID\{36DBC179-A19F-48F2-B16A-6A3E19B42A87}\InprocServer32" TESTBZ1.TXT
IF EXIST TESTBZ1.TXT dnif.exe /I "@"<TESTBZ1.TXT|dnif.exe /I "\">TESTBZ2.TXT && (
For /f "tokens=2,3* DELIMS==" %%a in (TESTBZ2.TXT) do echo %%~a >>TESTBZ3.TXT
For /f "tokens=4 DELIMS=\\." %%c in (TESTBZ3.TXT) do IF EXIST %systemroot%\system32\%%~c.dll echo %systemroot%\system32\%%~c.dll>>Find.txt
	)

apps\Csweg export "HKCR\CLSID\{B5AC49A2-94F2-42BD-F434-2604812C897D}\InprocServer32" TESTBHO12.TXT
IF EXIST TESTBHO12.TXT dnif.exe /I "@"<TESTBHO12.TXT|dnif.exe /I "\">TESTBHO13.TXT && (
For /f "tokens=2,3* DELIMS==" %%a in (TESTBHO13.TXT) do echo %%~a>>TESTBHO14.TXT
For /f "tokens=4 DELIMS=\\." %%c in (TESTBHO14.TXT) do IF EXIST %systemroot%\system32\%%~c.dll echo %systemroot%\system32\%%~c.dll>>Find.txt
	)

apps\Csweg export "HKCR\CLSID\{B5AF0562-94F3-42BD-F434-2604812C797D}\InprocServer32" TESTBHO15.TXT
IF EXIST TESTBHO15.TXT dnif.exe /I "@"<TESTBHO15.TXT|dnif.exe /I "\">TESTBHO16.TXT && (
For /f "tokens=2,3* DELIMS==" %%a in (TESTBHO16.TXT) do echo %%~a>>TESTBHO17.TXT
For /f "tokens=4 DELIMS=\\." %%c in (TESTBHO17.TXT) do IF EXIST %systemroot%\system32\%%~c.dll echo %systemroot%\system32\%%~c.dll>>Find.txt
	)

apps\Csweg export "HKCR\CLSID\{C5AF49A2-94F3-42BD-F434-2604812C897D}\InprocServer32" TESTBHO18.TXT
IF EXIST TESTBHO18.TXT dnif.exe /I "@"<TESTBHO18.TXT|dnif.exe /I "\">TESTBHO19.TXT && (
For /f "tokens=2,3* DELIMS==" %%a in (TESTBHO19.TXT) do echo %%~a>>TESTBHO20.TXT
For /f "tokens=4 DELIMS=\\." %%c in (TESTBHO20.TXT) do IF EXIST %systemroot%\system32\%%~c.dll echo %systemroot%\system32\%%~c.dll>>Find.txt
	)

apps\Csweg export "HKCR\CLSID\{C5AF49A2-94F3-42BD-F434-3604812C897D}\InprocServer32" TESTBHO18a.TXT
IF EXIST TESTBHO18a.TXT dnif.exe /I "@"<TESTBHO18a.TXT|dnif.exe /I "\">TESTBHO19a.TXT && (
For /f "tokens=2,3* DELIMS==" %%a in (TESTBHO19a.TXT) do echo %%~a>>TESTBHO20a.TXT
For /f "tokens=4 DELIMS=\\." %%c in (TESTBHO20a.TXT) do IF EXIST %systemroot%\system32\%%~c.dll echo %systemroot%\system32\%%~c.dll>>Find.txt
	)

apps\Csweg export "HKCR\CLSID\{C5BF49A2-94F3-42BD-F434-3604812C897D}\InprocServer32" TESTBHO18B.TXT
IF EXIST TESTBHO18B.TXT dnif.exe /I "@"<TESTBHO18B.TXT|dnif.exe /I "\">TESTBHO19B.TXT && (
For /f "tokens=2,3* DELIMS==" %%a in (TESTBHO19B.TXT) do echo %%~a>>TESTBHO20B.TXT
For /f "tokens=4 DELIMS=\\." %%c in (TESTBHO20B.TXT) do IF EXIST %systemroot%\system32\%%~c.dll echo %systemroot%\system32\%%~c.dll>>Find.txt
	)

apps\Csweg export "HKCR\CLSID\{8DD6F82D-A947-414B-ABD0-72CEF07FB544}\InprocServer32" TESTmirar1a.TXT
IF EXIST TESTmirar1a.TXT dnif.exe /I "@"<TESTmirar1a.TXT|dnif.exe /I "\">TESTmirar2a.TXT && (
For /f "tokens=2,3* DELIMS==" %%a in (TESTmirar2a.TXT) do echo %%~a>>TESTmirar3a.TXT
For /f "tokens=4 DELIMS=\\." %%c in (TESTmirar3a.TXT) do IF EXIST %systemroot%\system32\%%~c.dll echo %systemroot%\system32\%%~c.dll>>Find.txt
	)
apps\Csweg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad" testssodl.txt

dnif.exe "dgksvbpn"<testssodl.txt>>ssodl.txt
dnif.exe "dtseqrxk"<testssodl.txt>>ssodl.txt
dnif.exe "lfstbwvd"<testssodl.txt>>ssodl.txt
dnif.exe "mgxfebsq"<testssodl.txt>>ssodl.txt
dnif.exe "neksolda"<testssodl.txt>>ssodl.txt
dnif.exe "ngwstxfd"<testssodl.txt>>ssodl.txt
dnif.exe "onfwbsak"<testssodl.txt>>ssodl.txt
dnif.exe "qmafxprs"<testssodl.txt>>ssodl.txt
dnif.exe "qnflkotm"<testssodl.txt>>ssodl.txt
dnif.exe "qrbgltos"<testssodl.txt>>ssodl.txt
dnif.exe "rwlfsdmk"<testssodl.txt>>ssodl.txt
dnif.exe "vwnskbot"<testssodl.txt>>ssodl.txt
dnif.exe "wfexqnrp"<testssodl.txt>>ssodl.txt
dnif.exe "wvbegpqs"<testssodl.txt>>ssodl.txt
dnif.exe "xgpsarbm"<testssodl.txt>>ssodl.txt
dnif.exe "xrdwbfgn"<testssodl.txt>>ssodl.txt

if exist ssodl.txt dnif.exe /I "{" <ssodl.txt>NUL && goto ssodlfix

goto nextssodl

:ssodlfix

>>fixssodl.reg (
echo Windows Registry Editor Version 5.00
echo.
FOR /F "TOKENS=2 DELIMS={}" %%G in (ssodl.txt) DO echo [-HKEY_CLASSES_ROOT\CLSID\{%%G}]
	)

editreg.exe /s fixssodl.reg 2>NUL
copy fixssodl.reg .\backups >nul
del /q fixssodl.reg >nul

editreg.exe /s apps\MyGkFix2.reg 2>NUL
echo Restoring Default HomePage Value>TESTHPFix.txt
echo Restoring Default Desktop Components Value>>TESTHPFix.txt

:nextssodl

dnif.exe "antivirus"<testssodl.txt>>ssodl2.txt
dnif.exe "AppProcSmart"<testssodl.txt>>ssodl2.txt
dnif.exe "DscSmartSrv"<testssodl.txt>>ssodl2.txt
dnif.exe "Java"<testssodl.txt>>ssodl2.txt
dnif.exe "mjd"<testssodl.txt>>ssodl2.txt
dnif.exe "modems"<testssodl.txt>>ssodl2.txt
dnif.exe "mondb"<testssodl.txt>>ssodl2.txt
dnif.exe "oledll"<testssodl.txt>>ssodl2.txt
dnif.exe "printers"<testssodl.txt>>ssodl2.txt
dnif.exe "ProcService"<testssodl.txt>>ssodl2.txt
dnif.exe "prodigy1"<testssodl.txt>>ssodl2.txt
dnif.exe "prodigy323"<testssodl.txt>>ssodl2.txt
dnif.exe "rdfhost"<testssodl.txt>>ssodl2.txt
dnif.exe "rdihost"<testssodl.txt>>ssodl2.txt
dnif.exe "rdshost"<testssodl.txt>>ssodl2.txt
dnif.exe "sb0t"<testssodl.txt>>ssodl2.txt
dnif.exe "syshelps"<testssodl.txt>>ssodl2.txt
dnif.exe "syshosts"<testssodl.txt>>ssodl2.txt
dnif.exe "system32"<testssodl.txt>>ssodl2.txt
dnif.exe "Version1"<testssodl.txt>>ssodl2.txt
dnif.exe "Version3"<testssodl.txt>>ssodl2.txt
dnif.exe "WLogon"<testssodl.txt>>ssodl2.txt
dnif.exe "w32s"<testssodl.txt>>ssodl2.txt
dnif.exe "xesf"<testssodl.txt>>ssodl2.txt

if exist ssodl2.txt dnif.exe /I "{"<ssodl2.txt>NUL && goto fixssodl

goto skipssodl

:fixssodl

>>fixssodl2.reg (
echo Windows Registry Editor Version 5.00
echo.
FOR /F "TOKENS=2 DELIMS={}" %%G in (ssodl2.txt) DO echo [-HKEY_CLASSES_ROOT\CLSID\{%%G}]
	)

editreg.exe /s fixssodl2.reg 2>NUL
copy fixssodl2.reg .\backups >nul
del /q fixssodl2.reg >nul

:skipssodl

del /q ssodl*.txt>NUL

CLS
echo.
echo Starting Repairs
echo.
echo Checking Running Processes and Services
echo.
echo.
echo Please Be Patient As This May Take Up To 20 Minutes
echo.
apps\Csweg QUERY "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page"|dnif.exe /i "quicknews.info">NUL && echo Restoring Default HKCU HomePage>>hpcheck.txt && editreg.exe /s apps\HPFix2.reg 2>NUL
apps\Csweg QUERY "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page"|dnif.exe /i "ircdown.com">NUL && echo Restoring Default HKCU HomePage>>hpcheck.txt && editreg.exe /s apps\HPFix2.reg 2>NUL
apps\Csweg QUERY "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page"|dnif.exe /i "lookanddiscover.com">NUL && echo Restoring Default HKCU HomePage>>hpcheck.txt && editreg.exe /s apps\HPFix2.reg 2>NUL
apps\Csweg QUERY "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page"|dnif.exe /i "winxprotector.com">NUL && echo Restoring Default IE HomePage>>hpcheck.txt && editreg.exe /s apps\HPFix6.reg 2>NUL
apps\Csweg QUERY "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page"|dnif.exe /i "spywarewarning">NUL && echo Restoring Default IE HomePage>>hpcheck.txt && editreg.exe /s apps\HPFix6.reg 2>NUL
apps\Csweg QUERY "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main" /v "Search Page"|dnif.exe /i "internetsearchservice">NUL && echo Restoring Default IE Search Pages>>hpcheck.txt && editreg.exe /s apps\HPFix9.reg 2>NUL
apps\Csweg QUERY "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main" /v "Search Page"|dnif.exe /i "windiwsfsearch.com">NUL && echo Restoring Default IE Search Pages>>hpcheck.txt && editreg.exe /s apps\HPFix9.reg 2>NUL
apps\Csweg QUERY "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page"|dnif.exe /i "dbsarticles.com">NUL && echo Restoring Default HKCU HomePage>>hpcheck.txt && editreg.exe /s apps\HPFix2.reg 2>NUL
apps\Csweg QUERY "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page"|dnif.exe /i "porno">NUL && echo Restoring Default HKCU HomePage>>hpcheck.txt && editreg.exe /s apps\HPFix2.reg 2>NUL
apps\Csweg QUERY "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page"|dnif.exe /i "freeart1cile">NUL && echo Restoring Default HKCU HomePage>>hpcheck.txt && editreg.exe /s apps\HPFix2.reg 2>NUL
apps\Csweg QUERY "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page"|dnif.exe /i "searchhereonline">NUL && echo Restoring Default HKCU HomePage>>hpcheck.txt && editreg.exe /s apps\HPFix2.reg 2>NUL
apps\Csweg QUERY "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page"|dnif.exe /i "w-w-w-dot-com">NUL && echo Restoring Default HKCU HomePage>>hpcheck.txt && editreg.exe /s apps\HPFix2.reg 2>NUL
apps\Csweg QUERY "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page"|dnif.exe /i "demd0">NUL && echo Restoring Default IE Value>>hpcheck.txt && editreg.exe /s apps\HPFix3.reg 2>NUL
apps\Csweg QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Search" /v "SearchAssistant"|dnif.exe /i "demd0">NUL && echo Restoring Default IE Settings>>hpcheck.txt && editreg.exe /s apps\HPFix3.reg 2>NUL
apps\Csweg QUERY "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page"|dnif.exe /i "bestwish">NUL && echo Restoring Default IE Settings>>hpcheck.txt && editreg.exe /s apps\HPFix3.reg 2>NUL
apps\Csweg QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Search" /v "SearchAssistant"|dnif.exe /i "bestwish">NUL && echo Restoring Default IE Settings>>hpcheck.txt && editreg.exe /s apps\HPFix3.reg 2>NUL
apps\Csweg QUERY "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\General"|dnif.exe /I "warn.htm">NUL && echo Restoring Default Desktop Wallpaper>>hpcheck.txt && editreg.exe /s apps\HPFix4.reg 2>NUL
apps\Csweg QUERY "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\General"|dnif.exe /I "default.htm">NUL && echo Restoring Default Desktop Wallpaper>>hpcheck.txt && editreg.exe /s apps\HPFix4.reg 2>NUL
apps\Csweg QUERY "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /V Wallpaper|dnif.exe /I "desktop.html">NUL && echo Restoring Default Desktop Wallpaper>>hpcheck.txt && editreg.exe /s apps\HPFix4.reg 2>NUL
apps\Csweg QUERY "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page"|dnif.exe /i "homepage.html">NUL && echo Restoring Default IE Settings>>hpcheck.txt && editreg.exe /s apps\HPFix8.reg 2>NUL

apps\locate "%programfiles%\*.htm" /D- /s:100,150 /n|dnif.exe /I ".htm">>TESTTTCBHO1.TXT
IF EXIST TESTTTCBHO1.TXT rtsdnif.exe /m /f:TESTTTCBHO1.TXT "k8l.info/">NUL && editreg.exe /s apps\FixComponents.reg 2>NUL

apps\Csweg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows"|dnif.exe /I "Init_DLLs"|dnif.exe /I /V "App">CheckApin1.txt
IF EXIST CheckApin1.txt dnif.exe /I "Init_DLLs"<CheckApin1.txt>NUL && (
FOR /F "TOKENS=1 DELIMS= " %%G in (CheckApin1.txt) DO ECHO %%G>CheckApin2.txt
FOR /F "TOKENS=1 DELIMS=	" %%D in (CheckApin2.txt) DO (
>Repairuser32patch.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
echo "%%D"=-
echo.
	)
ECHO %%D Registry Value Removed>>apinres.txt
editreg.exe /s Repairuser32patch.reg 2>NUL 
copy Repairuser32patch.reg .\backups >nul
	)
FOR /F "TOKENS=3 DELIMS=	" %%C in (CheckApin1.txt) DO if exist %systemroot%\system32\%%C.dll ECHO %systemroot%\system32\%%C.dll>>FIND.TXT
	)

IF NOT EXIST %systemroot%\system32\dllcache\user32.dll apps\Cghtme.exe -c %systemroot%\system32\user32.dll %systemroot%\system32\dllcache\user32.dll>nul

IF NOT EXIST %systemroot%\system32\dllcache\user32.dll GOTO USER32SKP
IF EXIST %systemroot%\system32\dllcache\user32.dll echo %systemroot%\system32\dllcache\user32.dll>CheckApin3.txt
dnif.exe /i "."<CheckApin3.txt>nul && rtsdnif.exe /I /m /f:CheckApin3.txt "a.p.p.I.n.i.t">NUL && GOTO USER32SKP || (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\user32.dll'
) Do @echo "%%~g" %%~zg %%~tg>>CheckApin5.txt
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\user32.dll'
) Do @echo %%~g>>CheckApin6.txt
dir /b/a-d %systemroot%\system32\*|dnif.exe /I /V "."|dnif.exe /I /V "user">TESTAPINUSR1.TXT
FOR /F "TOKENS=*" %%D in (TESTAPINUSR1.TXT) DO echo %SYSTEMROOT%\System32\%%D>>TESTAPINUSR2.TXT
rtsdnif.exe /m /f:TESTAPINUSR2.TXT "user32.pdb">TESTAPINUSR3.TXT 2>nul
rtsdnif.exe /m /f:TESTAPINUSR3.TXT "windows.hlp">TESTAPINUSR4.TXT
FOR /F "TOKENS=*" %%b in (TESTAPINUSR4.TXT) DO apps\md5file %%b>>CheckApin7.txt
FOR /F "TOKENS=*" %%c in (CheckApin6.txt) DO apps\md5file %%c>>CheckApin8.txt
>user32res.txt (
echo.
echo [b]Infected user32.dll Found![/b]
echo.
echo user32.dll File Locations:
echo.
TYPE CheckApin5.txt
echo.
TYPE CheckApin8.txt
echo.
echo.
TYPE CheckApin7.txt
echo.
echo.
echo Note: SDFix does not repair this file!
echo.
echo.
	))

:USER32SKP

apps\locate "%systemroot%\system32\userinit.exe" /D- /s:7000,9500 /n /nr|dnif.exe /I ".exe">TESTui1.TXT
apps\locate "%systemroot%\system32\dllcache\userinit.exe" /D- /s:7000,9500 /n /nr|dnif.exe /I ".exe">>TESTui1.TXT
IF EXIST TESTui1.TXT dnif.exe /I "."<TESTui1.TXT>NUL && (
echo %systemroot%\system32\stus.exe>TESTui8a.TXT
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\userinit.exe'
) Do @echo "%%~g" %%~zg %%~tg >>TESTui4.TXT
>>userres1.txt (
echo.
echo [b]Infected userinit.exe Found![/b]
echo.
echo userinit.exe File Locations:
echo.
TYPE TESTui4.TXT
echo.
echo LDPinch Infected File Listed Below:
echo.
TYPE TESTui1.TXT
echo.
COPY /Y "%systemroot%\system32\userinit.exe" .\backups>nul
echo File copied to Backups Folder
echo Attempting to replace userinit.exe with original version 
IF EXIST "%systemroot%\system32\dllcache\userinit.exe" COPY /Y "%systemroot%\system32\dllcache\userinit.exe" "%systemroot%\system32\userinit.exe">nul
echo.
apps\locate "%systemroot%\system32\userinit.exe" /D- /s:7000,9500 /n /nr|dnif.exe /I ".exe">>TESTui1a.TXT
IF EXIST TESTui1a.TXT dnif.exe /I "."<TESTui1a.TXT>NUL && IF EXIST %systemroot%\ServicePackFiles\i386\userinit.exe  COPY /Y %systemroot%\ServicePackFiles\i386\userinit.exe "%systemroot%\system32\userinit.exe">nul
apps\locate "%systemroot%\system32\userinit.exe" /D- /s:7000,9500 /n /nr|dnif.exe /I ".exe">>TESTui1b.TXT
IF EXIST TESTui1b.TXT dnif.exe /I "."<TESTui1b.TXT>NUL && IF EXIST "%systemroot%\System32\stus.exe" (
rtsdnif.exe /m /f:TESTui8a.TXT "WinStationQueryInformation">TESTui9a.TXT
rtsdnif.exe /m /f:TESTui9a.TXT "userinit.pdb">TESTui10a.TXT 2>nul
rtsdnif.exe /m /f:TESTui10a.TXT "ntdll.dll">nul && COPY /Y "%systemroot%\System32\stus.exe" "%systemroot%\System32\userinit.exe">nul
	)
apps\locate "%systemroot%\system32\userinit.exe" /D- /s:7000,9500 /n /nr|dnif.exe /I ".">NUL && echo Unable To Replace Infected File!||echo Original userinit.exe Restored && IF EXIST %systemroot%\System32\stus.exe ECHO %systemroot%\system32\stus.exe>>Find.txt
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\userinit.exe'
) Do @echo "%%~g" %%~zg %%~tg
echo.
	))

dir /b/s/a-d "%systemroot%\system32\userinit.exe">>TESTui0a.TXT
IF EXIST TESTui0a.TXT rtsdnif.exe /m /f:TESTui0a.TXT "IsValidSecurityDescriptor">>TESTui1a.TXT 2>nul
IF EXIST TESTui1a.TXT rtsdnif.exe /m /f:TESTui1a.TXT "ChildWindowFromPoint">>TESTui2a.TXT 2>nul
IF EXIST TESTui2a.TXT rtsdnif.exe /m /f:TESTui2a.TXT "LookupAccountSidA">>TESTui3a.TXT 2>nul

IF EXIST TESTui3a.TXT dnif.exe /I "."<TESTui3a.TXT>NUL && (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\userinit.exe'
) Do @echo "%%~g" %%~zg %%~tg >>TESTui4a.TXT
>userres1.txt (
echo.
echo [b]Infected userinit.exe Found![/b]
echo.
echo userinit.exe File Locations:
echo.
TYPE TESTui4a.TXT
echo.
echo Infected File Listed Below:
echo.
TYPE TESTui3a.TXT
echo.
COPY /Y "%systemroot%\system32\userinit.exe" .\backups>nul
echo File copied to Backups Folder
echo Attempting to replace userinit.exe with original version 
echo.
IF EXIST "%systemroot%\system32\dllcache\userinit.exe" COPY /Y "%systemroot%\system32\dllcache\userinit.exe" "%systemroot%\system32\userinit.exe">nul
rtsdnif.exe /m /f:TESTui1a.TXT "IsValidSecurityDescriptor">>TESTui5a.TXT 2>nul
rtsdnif.exe /m /f:TESTui5a.TXT "ChildWindowFromPoint">NUL && echo Unable To Replace Infected File!||echo Original userinit.exe Restored
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\userinit.exe'
) Do @echo "%%~g" %%~zg %%~tg 
echo.
	))

dir /b/s/a-d "%systemroot%\system32\userinit.exe">>TESTuisep08.TXT
IF EXIST TESTuisep08.TXT rtsdnif.exe /m /f:TESTuisep08.TXT "IsValidAcl">>TESTuisep08a.TXT 2>nul
IF EXIST TESTuisep08a.TXT rtsdnif.exe /m /f:TESTuisep08a.TXT "GetIconInfo">>TESTuisep08b.TXT 2>nul
IF EXIST TESTuisep08b.TXT rtsdnif.exe /m /f:TESTuisep08b.TXT "SetMessageExtraInfo">>TESTuisep08c.TXT 2>nul

IF EXIST TESTuisep08c.TXT dnif.exe /I "."<TESTuisep08c.TXT>NUL && (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\userinit.exe'
) Do @echo "%%~g" %%~zg %%~tg >>TESTuisep08d.TXT
>userres1.txt (
echo.
echo [b]Infected userinit.exe Found![/b]
echo.
echo userinit.exe File Locations:
echo.
TYPE TESTuisep08d.TXT
echo.
echo Infected File Listed Below:
echo.
TYPE TESTuisep08c.TXT
echo.
COPY /Y "%systemroot%\system32\userinit.exe" .\backups>nul
echo File copied to Backups Folder
echo Attempting to replace userinit.exe with original version 
echo.
IF EXIST "%systemroot%\system32\dllcache\userinit.exe" COPY /Y "%systemroot%\system32\dllcache\userinit.exe" "%systemroot%\system32\userinit.exe">nul
rtsdnif.exe /m /f:TESTuisep08a.TXT "IsValidAcl">>TESTuisep08e.TXT 2>nul
rtsdnif.exe /m /f:TESTuisep08e.TXT "SetMessageExtraInfo">NUL && echo Unable To Replace Infected File!||echo Original userinit.exe Restored
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\userinit.exe'
) Do @echo "%%~g" %%~zg %%~tg 
echo.
	))

dir /b/s/a-d %systemroot%\winlogon.exe>>wlog1.txt
IF EXIST wlog1.txt rtsdnif.exe /m /f:wlog1.txt "mstscex.dll">>wlog2.txt 2>nul
IF EXIST wlog2.txt dnif.exe /i "."<wlog2.txt>NUL && (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\winlogon.exe'
) Do @echo "%%~g" %%~zg %%~tg >>wlog3.txt
>> wlogonck.txt (
echo.
echo [b]Infected Winlogon.exe Found![/b]
echo.
echo Winlogon File Locations:
echo.
TYPE wlog3.txt
echo.
echo Infected Files Are Listed Below:
echo.
TYPE wlog2.txt
echo. 
echo Note: SDFix Does Not Repair This File!
echo.
	))

dir /b/s/a-d "%systemroot%\system32\beep.sys">>bpTEST1.TXT
IF EXIST bpTEST1.TXT rtsdnif.exe /m /f:bpTEST1.TXT "rootkit">>bpTEST3.TXT 2>nul
IF EXIST bpTEST3.TXT dnif.exe /I "."<bpTEST3.TXT>NUL && (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg >>bpTEST4.TXT
>>bpres.txt (
echo.
echo [b]Infected beep.sys Found![/b]
echo.
echo beep.sys File Locations:
echo.
TYPE bpTEST4.TXT
echo.
echo Infected File Listed Below:
echo.
TYPE bpTEST3.TXT
echo.
echo File copied to Backups Folder
echo Attempting to replace beep.sys with original version 
echo.
COPY /Y "%systemroot%\system32\drivers\beep.sys" .\backups>nul
IF EXIST "%systemroot%\system32\dllcache\beep.sys" COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys" >nul
echo.
rtsdnif.exe /m /f:bpTEST1.TXT "rootkit" >>bpTEST6.TXT
IF EXIST bpTEST6.TXT dnif.exe /I "."<bpTEST6.TXT>NUL && (
ver|dnif.exe "Windows XP">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\dllcache\beep.sys apps\Replace\xp\beep.sys >nul
ver|dnif.exe "Windows XP">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\xp\beep.sys >nul
ver|dnif.exe "Windows 2000">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\dllcache\beep.sys apps\Replace\w2k\beep.sys >nul
ver|dnif.exe "Windows 2000">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\w2k\beep.sys >nul
	)))

dir /b/s/a-d "%systemroot%\system32\beep.sys">>beepFA0.TXT
IF EXIST beepFA0.TXT rtsdnif.exe /m /f:beepFA0.TXT "NTOSKRNL.EXE">>beepFA1.TXT 2>nul
IF EXIST beepFA1.TXT rtsdnif.exe /m /f:beepFA1.TXT "MmGetSystemRoutineAddress">>beepFA2.TXT 2>nul
IF EXIST beepFA2.TXT rtsdnif.exe /m /f:beepFA2.TXT "ZwDeleteFile">>beepFA3.TXT 2>nul
IF EXIST beepFA3.TXT rtsdnif.exe /m /f:beepFA3.TXT "HalHandleNMI">>beepFA4.TXT 2>nul

IF EXIST beepFA4.TXT dnif.exe /I "."<beepFA4.TXT>NUL && (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg >>beepFA5.TXT
>beepFAres.txt (
echo.
echo [b]Infected beep.sys Found![/b]
echo.
echo beep.sys File Locations:
echo.
TYPE beepFA5.TXT
echo.
echo Infected File Listed Below:
echo.
TYPE beepFA4.TXT
echo.
echo File copied to Backups Folder
echo Attempting to replace beep.sys with original version 
echo.
COPY /Y "%systemroot%\system32\drivers\beep.sys" .\backups>nul
IF EXIST "%systemroot%\system32\dllcache\beep.sys" COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys" >nul
echo.
rtsdnif.exe /m /f:beepFA3.TXT "HalHandleNMI" >>beepFA6.TXT
IF EXIST beepFA6.TXT dnif.exe /I "."<beepFA6.TXT>NUL && (
ver|dnif.exe "Windows XP">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\xp\beep.sys >nul
ver|dnif.exe "Windows 2000">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\w2k\beep.sys >nul
	)))

dir /b/s/a-d "%systemroot%\system32\beep.sys">beepxcodec0.TXT
IF EXIST beepxcodec0.TXT rtsdnif.exe /m /f:beepxcodec0.TXT "HalProcessorIdle">>beepxcodec1.TXT 2>nul
IF EXIST beepxcodec1.TXT rtsdnif.exe /m /f:beepxcodec1.TXT "KeAcquireSpinLock">>beepxcodec2.TXT 2>nul
IF EXIST beepxcodec2.TXT rtsdnif.exe /m /f:beepxcodec2.TXT "KeUpdateRunTime">>beepxcodec3.TXT 2>nul
IF EXIST beepxcodec3.TXT rtsdnif.exe /m /f:beepxcodec3.TXT "IoFreeIrp">>beepxcodec4.TXT 2>nul

IF EXIST beepxcodec4.TXT dnif.exe /I "."<beepxcodec4.TXT>NUL && (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg >>beepxcodec5.TXT
>beepxcodecres.txt (
echo.
echo [b]Infected beep.sys Found![/b]
echo.
echo beep.sys File Locations:
echo.
TYPE beepxcodec5.TXT
echo.
echo Infected File Listed Below:
echo.
TYPE beepxcodec4.TXT
echo.
echo File copied to Backups Folder
echo Attempting to replace beep.sys with original version 
echo.
COPY /Y "%systemroot%\system32\drivers\beep.sys" .\backups>nul
IF EXIST "%systemroot%\system32\dllcache\beep.sys" COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys" >nul
echo.
rtsdnif.exe /m /f:beepxcodec3.TXT "IoFreeIrp" >>beepxcodec6.TXT
IF EXIST beepxcodec6.TXT dnif.exe /I "."<beepxcodec6.TXT>NUL && (
ver|dnif.exe "Windows XP">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\xp\beep.sys >nul
ver|dnif.exe "Windows 2000">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\w2k\beep.sys >nul
	)))

apps\locate "%systemroot%\system32\taskmgr.exe" /D- /s:15374! /n|dnif.exe /I ".exe">>TESTtaskmg1.TXT
IF EXIST TESTtaskmg1.TXT dnif.exe /I "."<TESTtaskmg1.TXT>NUL && (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\taskmgr.exe'
) Do @echo "%%~g" %%~zg %%~tg >>TESTtaskmg2.TXT
>userres1b.txt (
echo.
echo [b]Infected taskmgr.exe Found![/b]
echo.
echo taskmgr.exe File Locations:
echo.
TYPE TESTtaskmg2.TXT
echo.
echo Infected File Listed Below:
echo.
TYPE TESTtaskmg1.TXT
echo.
COPY /Y "%systemroot%\system32\taskmgr.exe" .\backups>nul
echo File copied to Backups Folder
echo Attempting to replace taskmgr.exe with original version 
echo.
IF EXIST "%systemroot%\system32\dllcache\taskmgr.exe" COPY /Y "%systemroot%\system32\dllcache\taskmgr.exe" "%systemroot%\system32\taskmgr.exe">nul
apps\locate "%systemroot%\system32\taskmgr.exe" /D- /s:15374! /n|dnif.exe /I ".exe">>TESTtaskmg3.TXT
IF EXIST TESTtaskmg3.TXT dnif.exe /I "."<TESTtaskmg3.TXT>NUL && echo Unable To Replace Infected File!||echo Original taskmgr.exe Restored
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\taskmgr.exe'
) Do @echo "%%~g" %%~zg %%~tg 
echo.
	))

apps\Csweg.exe query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\aspi113210"|dnif.exe /I "Imagepath">>Checkasp.txt
IF EXIST Checkasp.txt dnif.exe /I "Imagepath"<Checkasp.txt>NUL && FOR /F "TOKENS=4 DELIMS=\" %%G in (Checkasp.txt) DO IF EXIST %systemroot%\system32\%%G ECHO %systemroot%\system32\%%G>>Find.txt

IF EXIST TESTRkAgent*.txt DEL /Q TESTRkAgent*.txt >NUL

apps\locate "%systemroot%\*.exe" /D- /s:159744! /n /nr|dnif.exe /I ".exe">>TESTrkagentfile0.TXT
apps\locate "%systemroot%\system32\*.exe" /D- /s:159744! /n /nr|dnif.exe /I ".exe">>TESTrkagentfile0.TXT
if exist TESTrkagentfile0.txt for /f "tokens=*" %%a in (TESTrkagentfile0.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "75A1AA37CF0680415B9E3CF3DFCD6640">NUL && echo %%a>>TESTrkagentfilefound.TXT

apps\locate "%systemroot%\*.exe" /D- /s:163840! /n /nr|dnif.exe /I ".exe">>TESTrkagentfile1.TXT
apps\locate "%systemroot%\system32\*.exe" /D- /s:163840! /n /nr|dnif.exe /I ".exe">>TESTrkagentfile1.TXT
if exist TESTrkagentfile1.txt for /f "tokens=*" %%a in (TESTrkagentfile1.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "513041016300AD114F6534A34396F311">NUL && echo %%a>>TESTrkagentfilefound.TXT
if exist TESTrkagentfile1.txt for /f "tokens=*" %%a in (TESTrkagentfile1.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "5410FAB38DC315FAEB5DB8BDFD62A435">NUL && echo %%a>>TESTrkagentfilefound.TXT
if exist TESTrkagentfile1.txt for /f "tokens=*" %%a in (TESTrkagentfile1.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "9465C840B7F7A57911764F1ABC9AFEE5">NUL && echo %%a>>TESTrkagentfilefound.TXT
if exist TESTrkagentfile1.txt for /f "tokens=*" %%a in (TESTrkagentfile1.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "AC8801B61E433FA4358AB8CE2367C490">NUL && echo %%a>>TESTrkagentfilefound.TXT

apps\locate "%systemroot%\*.exe" /D- /s:167936! /n /nr|dnif.exe /I ".exe">>TESTrkagentfile2.TXT
apps\locate "%systemroot%\system32\*.exe" /D- /s:167936! /n /nr|dnif.exe /I ".exe">>TESTrkagentfile2.TXT
if exist TESTrkagentfile2.txt for /f "tokens=*" %%a in (TESTrkagentfile2.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "06A115013358B5077A038FB5CA7EB07D">NUL && echo %%a>>TESTrkagentfilefound.TXT
if exist TESTrkagentfile2.txt for /f "tokens=*" %%a in (TESTrkagentfile2.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "089EEEB66D34F5C70FEB237AA88CA99B">NUL && echo %%a>>TESTrkagentfilefound.TXT
if exist TESTrkagentfile2.txt for /f "tokens=*" %%a in (TESTrkagentfile2.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "11d6717be4aaa27ffc440fc2b90eaee4">NUL && echo %%a>>TESTrkagentfilefound.TXT
if exist TESTrkagentfile2.txt for /f "tokens=*" %%a in (TESTrkagentfile2.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "1B0C6DE92670FE47A4660AB7A3DB46D3">NUL && echo %%a>>TESTrkagentfilefound.TXT
if exist TESTrkagentfile2.txt for /f "tokens=*" %%a in (TESTrkagentfile2.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "56D8AF831EBE4E7FABA16352A8985B50">NUL && echo %%a>>TESTrkagentfilefound.TXT
if exist TESTrkagentfile2.txt for /f "tokens=*" %%a in (TESTrkagentfile2.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "BD16EDF4E8D433722E040F5CCE424297">NUL && echo %%a>>TESTrkagentfilefound.TXT
if exist TESTrkagentfile2.txt for /f "tokens=*" %%a in (TESTrkagentfile2.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "8994362C9B63CEA992D7C9398CC71A4D">NUL && echo %%a>>TESTrkagentfilefound.TXT
if exist TESTrkagentfile2.txt for /f "tokens=*" %%a in (TESTrkagentfile2.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "8e30d253631b841ccc9a73fdf2900daf">NUL && echo %%a>>TESTrkagentfilefound.TXT
if exist TESTrkagentfile2.txt for /f "tokens=*" %%a in (TESTrkagentfile2.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "AA81B12E2FF5216E8AA77C41E15B3D60">NUL && echo %%a>>TESTrkagentfilefound.TXT

apps\locate "%systemroot%\*.exe" /D- /s:172032! /n /nr|dnif.exe /I ".exe">>TESTrkagentfile3.TXT
apps\locate "%systemroot%\system32\*.exe" /D- /s:172032! /n /nr|dnif.exe /I ".exe">>TESTrkagentfile3.TXT
if exist TESTrkagentfile3.txt for /f "tokens=*" %%a in (TESTrkagentfile3.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "20D381357B8855EA42B90669BB2D6A7E">NUL && echo %%a>>TESTrkagentfilefound.TXT
if exist TESTrkagentfile3.txt for /f "tokens=*" %%a in (TESTrkagentfile3.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "22d9ab5166015b7881c9d7a94b5e6eaf">NUL && echo %%a>>TESTrkagentfilefound.TXT
if exist TESTrkagentfile3.txt for /f "tokens=*" %%a in (TESTrkagentfile3.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "63056A718097EC605D60A6C642EE1AAC">NUL && echo %%a>>TESTrkagentfilefound.TXT
if exist TESTrkagentfile3.txt for /f "tokens=*" %%a in (TESTrkagentfile3.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "7AA46BDF5365D85A690AAC01E95A9031">NUL && echo %%a>>TESTrkagentfilefound.TXT
if exist TESTrkagentfile3.txt for /f "tokens=*" %%a in (TESTrkagentfile3.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "854237A305DA92FEF796431848D3EAAD">NUL && echo %%a>>TESTrkagentfilefound.TXT
if exist TESTrkagentfile3.txt for /f "tokens=*" %%a in (TESTrkagentfile3.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "9FF49D2224C8579CD681F58C43029801">NUL && echo %%a>>TESTrkagentfilefound.TXT
if exist TESTrkagentfile3.txt for /f "tokens=*" %%a in (TESTrkagentfile3.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "CDAA4F883BE382D72BB4860D1050169F">NUL && echo %%a>>TESTrkagentfilefound.TXT
if exist TESTrkagentfile3.txt for /f "tokens=*" %%a in (TESTrkagentfile3.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "D82625FB00758C629A8A266A73AEA87D">NUL && echo %%a>>TESTrkagentfilefound.TXT

apps\locate "%systemroot%\*.exe" /D- /s:176128! /n /nr|dnif.exe /I ".exe">>TESTrkagentfile4.TXT
apps\locate "%systemroot%\system32\*.exe" /D- /s:176128! /n /nr|dnif.exe /I ".exe">>TESTrkagentfile4.TXT
if exist TESTrkagentfile4.txt for /f "tokens=*" %%a in (TESTrkagentfile4.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "2f51f9d613207747e8aa176dcd0d0b7f">NUL && echo %%a>>TESTrkagentfilefound.TXT
if exist TESTrkagentfile4.txt for /f "tokens=*" %%a in (TESTrkagentfile4.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "5B622819A2154BC50EB9EE10118E3F71">NUL && echo %%a>>TESTrkagentfilefound.TXT
if exist TESTrkagentfile4.txt for /f "tokens=*" %%a in (TESTrkagentfile4.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "7607B5D24A9238E7F8FBAABD6C9791DE">NUL && echo %%a>>TESTrkagentfilefound.TXT
if exist TESTrkagentfile4.txt for /f "tokens=*" %%a in (TESTrkagentfile4.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "88F970581210E26BD86459870C09D899">NUL && echo %%a>>TESTrkagentfilefound.TXT
if exist TESTrkagentfile4.txt for /f "tokens=*" %%a in (TESTrkagentfile4.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "A1AE0D661F4EFF9CF1533B73EB51F8B0">NUL && echo %%a>>TESTrkagentfilefound.TXT
if exist TESTrkagentfile4.txt for /f "tokens=*" %%a in (TESTrkagentfile4.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "BC51694181D7EDA82EE85A9D3427D2E6">NUL && echo %%a>>TESTrkagentfilefound.TXT
if exist TESTrkagentfile4.txt for /f "tokens=*" %%a in (TESTrkagentfile4.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "C196721EDE2DEB3C59FE11012B1C7F60">NUL && echo %%a>>TESTrkagentfilefound.TXT
if exist TESTrkagentfile4.txt for /f "tokens=*" %%a in (TESTrkagentfile4.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "C1CAA8B9B76CE2461F3E6510C6FB6E83">NUL && echo %%a>>TESTrkagentfilefound.TXT
if exist TESTrkagentfile4.txt for /f "tokens=*" %%a in (TESTrkagentfile4.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "D028870DEF7B65985035184E288BA54C">NUL && echo %%a>>TESTrkagentfilefound.TXT
if exist TESTrkagentfile4.txt for /f "tokens=*" %%a in (TESTrkagentfile4.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "EE3955533368ABBB1EE5C380FBB94BB8">NUL && echo %%a>>TESTrkagentfilefound.TXT

apps\locate "%systemroot%\*.exe" /D- /s:180224! /n /nr|dnif.exe /I ".exe">>TESTrkagentfile5.TXT
apps\locate "%systemroot%\system32\*.exe" /D- /s:180224! /n /nr|dnif.exe /I ".exe">>TESTrkagentfile5.TXT
if exist TESTrkagentfile5.txt for /f "tokens=*" %%a in (TESTrkagentfile5.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "1AF6D96C3080A043DBBB8D7F47602BA0">NUL && echo %%a>>TESTrkagentfilefound.TXT
if exist TESTrkagentfile5.txt for /f "tokens=*" %%a in (TESTrkagentfile5.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "1EFBBBD2E5BBA497C5F223EC23B6E4CC">NUL && echo %%a>>TESTrkagentfilefound.TXT
if exist TESTrkagentfile5.txt for /f "tokens=*" %%a in (TESTrkagentfile5.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "36A8C78207BD36D8600F4201E25334B7">NUL && echo %%a>>TESTrkagentfilefound.TXT
if exist TESTrkagentfile5.txt for /f "tokens=*" %%a in (TESTrkagentfile5.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "7D817CD6FC93DA0DB61BF54DE6873304">NUL && echo %%a>>TESTrkagentfilefound.TXT
if exist TESTrkagentfile5.txt for /f "tokens=*" %%a in (TESTrkagentfile5.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "983383102FAAD6C58CE253809B379591">NUL && echo %%a>>TESTrkagentfilefound.TXT
if exist TESTrkagentfile5.txt for /f "tokens=*" %%a in (TESTrkagentfile5.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "C2848B134B87AD29BB0DDDB3B3F648ED">NUL && echo %%a>>TESTrkagentfilefound.TXT

apps\locate "%systemroot%\*.exe" /D- /s:184320! /n /nr|dnif.exe /I ".exe">>TESTrkagentfile5a.TXT
apps\locate "%systemroot%\system32\*.exe" /D- /s:184320! /n /nr|dnif.exe /I ".exe">>TESTrkagentfile5a.TXT
if exist TESTrkagentfile5a.txt for /f "tokens=*" %%a in (TESTrkagentfile5a.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "66B4A4CC9E22AD77BB0BF458648453A9">NUL && echo %%a>>TESTrkagentfilefound.TXT
if exist TESTrkagentfile5a.txt for /f "tokens=*" %%a in (TESTrkagentfile5a.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "a46fea8dfa1618a44e65e3b27fc8938d">NUL && echo %%a>>TESTrkagentfilefound.TXT
if exist TESTrkagentfile5a.txt for /f "tokens=*" %%a in (TESTrkagentfile5a.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "FE36BBF28404391B715A49C89A0AC0D9">NUL && echo %%a>>TESTrkagentfilefound.TXT

apps\locate "%systemroot%\*.exe" /D- /s:192512! /n /nr|dnif.exe /I ".exe">>TESTrkagentfile6.TXT
apps\locate "%systemroot%\system32\*.exe" /D- /s:192512! /n /nr|dnif.exe /I ".exe">>TESTrkagentfile6.TXT
if exist TESTrkagentfile6.txt for /f "tokens=*" %%a in (TESTrkagentfile6.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "D3CA67999E555FC9DB82F9F1F9414B37">NUL && echo %%a>>TESTrkagentfilefound.TXT
if exist TESTrkagentfile6.txt for /f "tokens=*" %%a in (TESTrkagentfile6.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "FADED58E5A189EEBD1DEE85487B8DBE6">NUL && echo %%a>>TESTrkagentfilefound.TXT

apps\locate "%systemroot%\*.exe" /D- /s:167947! /n /nr|dnif.exe /I ".exe">>TESTrkagentfile7.TXT
apps\locate "%systemroot%\system32\*.exe" /D- /s:167947! /n /nr|dnif.exe /I ".exe">>TESTrkagentfile7.TXT
if exist TESTrkagentfile7.txt for /f "tokens=*" %%a in (TESTrkagentfile7.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "6E9F5B283A847D257FE5EDF0C3970EEB">NUL && echo %%a>>TESTrkagentfilefound.TXT

if exist TESTrkagentfilefound.TXT DNIF.EXE /I "."<TESTrkagentfilefound.TXT>NUL && for /f "tokens=3 delims=\." %%b in (TESTrkagentfilefound.TXT) do (
>Repairrkagentfile.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
ECHO "%%b"=-
echo.
	)
editreg.exe /s Repairrkagentfile.reg 2>NUL 
copy Repairrkagentfile.reg .\backups\Repair_RootkitAgent_Run.reg >nul
TYPE TESTrkagentfilefound.TXT>>Find.txt
	)

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:176640! /n /nr|dnif.exe /I ".sys">>TESTrkagentsys1.TXT
IF EXIST TESTrkagentsys1.TXT for /f "tokens=*" %%a in (TESTrkagentsys1.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "7BE5719D3E948C63635B6DA12F8A82C6">NUL && echo %%a>>TESTrkagentsys0.TXT
IF EXIST TESTrkagentsys1.TXT for /f "tokens=*" %%a in (TESTrkagentsys1.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "3916DDFD64D165EF77AD39DB57B897D7">NUL && echo %%a>>TESTrkagentsys0.TXT
IF EXIST TESTrkagentsys1.TXT for /f "tokens=*" %%a in (TESTrkagentsys1.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "B0E06B91214ABF63848608E7B3B83989">NUL && echo %%a>>TESTrkagentsys0.TXT

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:177152! /n /nr|dnif.exe /I ".sys">>TESTrkagentsys2.TXT
IF EXIST TESTrkagentsys2.TXT for /f "tokens=*" %%a in (TESTrkagentsys2.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "038E9EC406A400A38794BBA634B53E14">NUL && echo %%a>>TESTrkagentsys0.TXT
IF EXIST TESTrkagentsys2.TXT for /f "tokens=*" %%a in (TESTrkagentsys2.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "BAB63DD5F71FC0AC4A546C5254B30838">NUL && echo %%a>>TESTrkagentsys0.TXT
IF EXIST TESTrkagentsys2.TXT for /f "tokens=*" %%a in (TESTrkagentsys2.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "CA76587ECF50E57FB08B02A621FF6F41">NUL && echo %%a>>TESTrkagentsys0.TXT

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:177664! /n /nr|dnif.exe /I ".sys">>TESTrkagentsys3.TXT
IF EXIST TESTrkagentsys3.TXT for /f "tokens=*" %%a in (TESTrkagentsys3.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "5D995054E9787363518BF7828A5B979D">NUL && echo %%a>>TESTrkagentsys0.TXT
IF EXIST TESTrkagentsys3.TXT for /f "tokens=*" %%a in (TESTrkagentsys3.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "7DD0FEB41C1F110C927B9768631E1E5E">NUL && echo %%a>>TESTrkagentsys0.TXT
IF EXIST TESTrkagentsys3.TXT for /f "tokens=*" %%a in (TESTrkagentsys3.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "8C7D054ABA419E0A53832AB575F8C637">NUL && echo %%a>>TESTrkagentsys0.TXT
IF EXIST TESTrkagentsys3.TXT for /f "tokens=*" %%a in (TESTrkagentsys3.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "A443E23EACEB8DB09DA04BF092CCF6C1">NUL && echo %%a>>TESTrkagentsys0.TXT
IF EXIST TESTrkagentsys3.TXT for /f "tokens=*" %%a in (TESTrkagentsys3.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "E05E8D027295CD4DF66844BB14A566EB">NUL && echo %%a>>TESTrkagentsys0.TXT
IF EXIST TESTrkagentsys3.TXT for /f "tokens=*" %%a in (TESTrkagentsys3.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "FB0A5BF906B93959FF4E6F896FCFE7B5">NUL && echo %%a>>TESTrkagentsys0.TXT

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:178176! /n /nr|dnif.exe /I ".sys">>TESTrkagentsys4.TXT
IF EXIST TESTrkagentsys4.TXT for /f "tokens=*" %%a in (TESTrkagentsys4.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "92E7835403BE22749CF019B46077EB21">NUL && echo %%a>>TESTrkagentsys0.TXT
IF EXIST TESTrkagentsys4.TXT for /f "tokens=*" %%a in (TESTrkagentsys4.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "B10A49B0E2EF7D19B65DFD4D7B992081">NUL && echo %%a>>TESTrkagentsys0.TXT
IF EXIST TESTrkagentsys4.TXT for /f "tokens=*" %%a in (TESTrkagentsys4.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "EB3149042B66DE59474D32CAC32DF6D8">NUL && echo %%a>>TESTrkagentsys0.TXT
IF EXIST TESTrkagentsys4.TXT for /f "tokens=*" %%a in (TESTrkagentsys4.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "F00AE4A27614851C38DC018ACC96E23E">NUL && echo %%a>>TESTrkagentsys0.TXT

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:178688! /n /nr|dnif.exe /I ".sys">>TESTrkagentsys5.TXT
IF EXIST TESTrkagentsys5.TXT for /f "tokens=*" %%a in (TESTrkagentsys5.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "8AE59CF7ABC7076B8E747A8B740AEAAC">NUL && echo %%a>>TESTrkagentsys0.TXT
IF EXIST TESTrkagentsys5.TXT for /f "tokens=*" %%a in (TESTrkagentsys5.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "8b49c9b90a5197ff7c5fb62137f4ea4f">NUL && echo %%a>>TESTrkagentsys0.TXT
IF EXIST TESTrkagentsys5.TXT for /f "tokens=*" %%a in (TESTrkagentsys5.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "A03E4E64936261A93415640231B2191B">NUL && echo %%a>>TESTrkagentsys0.TXT
IF EXIST TESTrkagentsys5.TXT for /f "tokens=*" %%a in (TESTrkagentsys5.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "D0BDFE047122204807F7C4B777FC3424">NUL && echo %%a>>TESTrkagentsys0.TXT

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:179200! /n /nr|dnif.exe /I ".sys">>TESTrkagentsys6.TXT
IF EXIST TESTrkagentsys6.TXT for /f "tokens=*" %%a in (TESTrkagentsys6.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "165149460C1DE061424A00B83F7FBD85">NUL && echo %%a>>TESTrkagentsys0.TXT
IF EXIST TESTrkagentsys6.TXT for /f "tokens=*" %%a in (TESTrkagentsys6.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "542a3318de8453fb8708e492b6dba002">NUL && echo %%a>>TESTrkagentsys0.TXT
IF EXIST TESTrkagentsys6.TXT for /f "tokens=*" %%a in (TESTrkagentsys6.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "6927c62d6bfa1a60226c18953c36f69e">NUL && echo %%a>>TESTrkagentsys0.TXT
IF EXIST TESTrkagentsys6.TXT for /f "tokens=*" %%a in (TESTrkagentsys6.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "8E184943C9E0E05436BCDC06F21070D1">NUL && echo %%a>>TESTrkagentsys0.TXT
IF EXIST TESTrkagentsys6.TXT for /f "tokens=*" %%a in (TESTrkagentsys6.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "f650f87bb7741f05b2fd760283b73e34">NUL && echo %%a>>TESTrkagentsys0.TXT

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:179712! /n /nr|dnif.exe /I ".sys">>TESTrkagentsys6a.TXT
IF EXIST TESTrkagentsys6a.TXT for /f "tokens=*" %%a in (TESTrkagentsys6a.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "4B8FB6463ECC65403875D8B8B37C1D04">NUL && echo %%a>>TESTrkagentsys0.TXT
IF EXIST TESTrkagentsys6a.TXT for /f "tokens=*" %%a in (TESTrkagentsys6a.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "8B90CD7E723083064E1B88AB5708163A">NUL && echo %%a>>TESTrkagentsys0.TXT

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:180736! /n /nr|dnif.exe /I ".sys">>TESTrkagentsys7.TXT
IF EXIST TESTrkagentsys7.TXT for /f "tokens=*" %%a in (TESTrkagentsys7.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "4D2B2B16BD643B52D3EF75EED1C8D48B">NUL && echo %%a>>TESTrkagentsys0.TXT
IF EXIST TESTrkagentsys7.TXT for /f "tokens=*" %%a in (TESTrkagentsys7.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "746d073b7b10cb7313eb65f1aec83de0">NUL && echo %%a>>TESTrkagentsys0.TXT
IF EXIST TESTrkagentsys7.TXT for /f "tokens=*" %%a in (TESTrkagentsys7.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "9F802DCB1CDD312B787366ADB8BD5ED1">NUL && echo %%a>>TESTrkagentsys0.TXT
IF EXIST TESTrkagentsys7.TXT for /f "tokens=*" %%a in (TESTrkagentsys7.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "E711682C8A19F71C72620C8B0E2650F0">NUL && echo %%a>>TESTrkagentsys0.TXT

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:181248! /n /nr|dnif.exe /I ".sys">>TESTrkagentsys7a.TXT
IF EXIST TESTrkagentsys7a.TXT for /f "tokens=*" %%a in (TESTrkagentsys7a.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "0159C83880E88434F2A304319CF75ECD">NUL && echo %%a>>TESTrkagentsys0.TXT
IF EXIST TESTrkagentsys7a.TXT for /f "tokens=*" %%a in (TESTrkagentsys7a.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "3709294D0DF774C340A8F3DE5315EAFA">NUL && echo %%a>>TESTrkagentsys0.TXT
IF EXIST TESTrkagentsys7a.TXT for /f "tokens=*" %%a in (TESTrkagentsys7a.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "7A4FF201D819535BFACA80F0B2BE2066">NUL && echo %%a>>TESTrkagentsys0.TXT

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:182784! /n /nr|dnif.exe /I ".sys">>TESTrkagentsys8.TXT
IF EXIST TESTrkagentsys8.TXT for /f "tokens=*" %%a in (TESTrkagentsys8.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "165149460C1DE061424A00B83F7FBD85">NUL && echo %%a>>TESTrkagentsys0.TXT

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:185856! /n /nr|dnif.exe /I ".sys">>TESTrkagentsys8a.TXT
IF EXIST TESTrkagentsys8a.TXT for /f "tokens=*" %%a in (TESTrkagentsys8a.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "1e3059b25dbe9043ded63b47e24c6fcc">NUL && echo %%a>>TESTrkagentsys0.TXT

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:193024! /n /nr|dnif.exe /I ".sys">>TESTrkagentsys9.TXT
IF EXIST TESTrkagentsys9.TXT for /f "tokens=*" %%a in (TESTrkagentsys9.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "7f6ececc84f16c9b8f7682b9fca57118">NUL && echo %%a>>TESTrkagentsys0.TXT
IF EXIST TESTrkagentsys9.TXT for /f "tokens=*" %%a in (TESTrkagentsys9.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "E93A2A4513678BA4C7CB7CBE84D0BE96">NUL && echo %%a>>TESTrkagentsys0.TXT

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:194048! /n /nr|dnif.exe /I ".sys">>TESTrkagentsys10.TXT
IF EXIST TESTrkagentsys10.TXT for /f "tokens=*" %%a in (TESTrkagentsys10.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "697E0E53CE30352ECA24965F5D3F63C5">NUL && echo %%a>>TESTrkagentsys0.TXT

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:183296! /n /nr|dnif.exe /I ".sys">>TESTrkagentsys11.TXT
IF EXIST TESTrkagentsys11.TXT for /f "tokens=*" %%a in (TESTrkagentsys11.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "3620FD540854A9F651E0B6F4002B6106">NUL && echo %%a>>TESTrkagentsys0.TXT

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:196608! /n /nr|dnif.exe /I ".sys">>TESTrkagentsys12.TXT
IF EXIST TESTrkagentsys12.TXT for /f "tokens=*" %%a in (TESTrkagentsys12.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "5A6331FB1F10E53AD9E22FB4A309FAC3">NUL && echo %%a>>TESTrkagentsys0.TXT

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:180224! /n /nr|dnif.exe /I ".sys">>TESTrkagentsys13.TXT
IF EXIST TESTrkagentsys13.TXT for /f "tokens=*" %%a in (TESTrkagentsys13.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "BC318540A1E08521C899C3EC34F2EA94">NUL && echo %%a>>TESTrkagentsys0.TXT
IF EXIST TESTrkagentsys13.TXT for /f "tokens=*" %%a in (TESTrkagentsys13.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "F38AF91CE19A2B9704D6E647878DE760">NUL && echo %%a>>TESTrkagentsys0.TXT

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:191488! /n /nr|dnif.exe /I ".sys">>TESTrkagentsys14.TXT
IF EXIST TESTrkagentsys14.TXT for /f "tokens=*" %%a in (TESTrkagentsys14.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "D732578AB16FC0148F89478784B8691">NUL && echo %%a>>TESTrkagentsys0.TXT

IF EXIST TESTrkagentsys0.TXT dnif.exe /I "."<TESTrkagentsys0.TXT>NUL && FOR /F "TOKENS=5 DELIMS=\." %%A in (TESTrkagentsys0.TXT) DO (
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%A.sys dummy.sys >NUL
echo %systemroot%\system32\drivers\%%A.sys>>RemLat.txt
echo %%A>>apps\srv2.txt
echo %%A>>apps\svc.txt
echo %%A>>apps\legacy.txt
echo %systemroot%\system32\drivers\%%A.sys - Rootkit Srizbi>>TESTRKanT1.TXT
apps\sc config %%A start= disabled >nul
apps\locate "%systemroot%\system32\????????.tmp" /D- /s:29! /n /nr|dnif.exe /I ".tmp">>Find.txt
	)

apps\Csweg query "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\System Reserved">TESTRkAgent110.txt
IF EXIST TESTRkAgent110.txt dnif.exe /I "Driver Group"<TESTRkAgent110.txt>NUL && (
apps\Cghtme.exe -xqf "%systemroot%\system32\drivers">>TESTRkAgent111.txt
IF EXIST TESTRkAgent111.txt dnif.exe /I "111216"<TESTRkAgent111.txt>>TESTRkAgent111B.txt
IF EXIST TESTRkAgent111.txt dnif.exe /I "120320"<TESTRkAgent111.txt>>TESTRkAgent111B.txt
IF EXIST TESTRkAgent111.txt dnif.exe /I "120832"<TESTRkAgent111.txt>>TESTRkAgent111B.txt
IF EXIST TESTRkAgent111.txt dnif.exe /I "121344"<TESTRkAgent111.txt>>TESTRkAgent111B.txt
IF EXIST TESTRkAgent111.txt dnif.exe /I "122880"<TESTRkAgent111.txt>>TESTRkAgent111B.txt
IF EXIST TESTRkAgent111.txt dnif.exe /I "123392"<TESTRkAgent111.txt>>TESTRkAgent111B.txt
IF EXIST TESTRkAgent111.txt dnif.exe /I "124928"<TESTRkAgent111.txt>>TESTRkAgent111B.txt
IF EXIST TESTRkAgent111.txt dnif.exe /I "125440"<TESTRkAgent111.txt>>TESTRkAgent111B.txt
IF EXIST TESTRkAgent111.txt dnif.exe /I "126464"<TESTRkAgent111.txt>>TESTRkAgent111B.txt
IF EXIST TESTRkAgent111.txt dnif.exe /I "127488"<TESTRkAgent111.txt>>TESTRkAgent111B.txt
IF EXIST TESTRkAgent111.txt dnif.exe /I "128512"<TESTRkAgent111.txt>>TESTRkAgent111B.txt
IF EXIST TESTRkAgent111.txt dnif.exe /I "129024"<TESTRkAgent111.txt>>TESTRkAgent111B.txt
IF EXIST TESTRkAgent111.txt dnif.exe /I "129536"<TESTRkAgent111.txt>>TESTRkAgent111B.txt
IF EXIST TESTRkAgent111.txt dnif.exe /I "130048"<TESTRkAgent111.txt>>TESTRkAgent111B.txt
IF EXIST TESTRkAgent111.txt dnif.exe /I "130560"<TESTRkAgent111.txt>>TESTRkAgent111B.txt
IF EXIST TESTRkAgent111.txt dnif.exe /I "131584"<TESTRkAgent111.txt>>TESTRkAgent111B.txt
IF EXIST TESTRkAgent111.txt dnif.exe /I "133120"<TESTRkAgent111.txt>>TESTRkAgent111B.txt
IF EXIST TESTRkAgent111.txt dnif.exe /I "133632"<TESTRkAgent111.txt>>TESTRkAgent111B.txt
IF EXIST TESTRkAgent111.txt dnif.exe /I "137728"<TESTRkAgent111.txt>>TESTRkAgent111B.txt
IF EXIST TESTRkAgent111.txt dnif.exe /I "139264"<TESTRkAgent111.txt>>TESTRkAgent111B.txt
IF EXIST TESTRkAgent111.txt dnif.exe /I "165376"<TESTRkAgent111.txt>>TESTRkAgent111B.txt
IF EXIST TESTRkAgent111.txt dnif.exe /I "167424"<TESTRkAgent111.txt>>TESTRkAgent111B.txt
IF EXIST TESTRkAgent111.txt dnif.exe /I "167936"<TESTRkAgent111.txt>>TESTRkAgent111B.txt
IF EXIST TESTRkAgent111B.txt dnif.exe /I ".sys"<TESTRkAgent111B.txt>nul && FOR /F "TOKENS=1 DELIMS= " %%D in (TESTRkAgent111B.txt) DO ECHO %%D>>TESTRkAgent111C.txt
IF EXIST TESTRkAgent111C.txt FOR /F "TOKENS=5 DELIMS=\." %%A in (TESTRkAgent111C.txt) DO apps\Csweg query "HKLM\SYSTEM\CurrentControlSet\Services\%%A" /V Group|dnif.exe /I "System Reserved">NUL && (
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%A.sys dummy.sys >NUL
ECHO %systemroot%\system32\drivers\%%A.sys>>RemLat.txt
echo %%A>>apps\srv2.txt
echo %%A>>apps\svc.txt
echo %%A>>apps\legacy.txt
echo %%A.sys>>apps\legacy.txt
apps\sc config %%A start= disabled >nul
echo %systemroot%\system32\drivers\%%A.sys - Rootkit Agent.ea/Srizbi>>TESTRKanT1.TXT
>RepairRK.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\System Reserved]
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\System Reserved]
echo.
	)
editreg.exe /s RepairRK.reg 2>NUL 
copy RepairRK.reg .\backups\Srizbi.reg >nul
apps\locate "%systemroot%\system32\????????.tmp" /D- /s:29! /n /nr|dnif.exe /I ".tmp">>Find.txt
	))

apps\Csweg query "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\System Reserved">TESTRkAgent0110.txt
IF EXIST TESTRkAgent0110.txt dnif.exe /I "Driver Group"<TESTRkAgent0110.txt>NUL && (
echo|apps\Cghtme.exe -xqsf "%systemroot%\system32\drivers" >>TESTRkAgent0111.txt
IF EXIST TESTRkAgent0111.txt dnif.exe /I "111216"<TESTRkAgent0111.txt>>TESTRkAgent0111B.txt
IF EXIST TESTRkAgent0111.txt dnif.exe /I "120320"<TESTRkAgent0111.txt>>TESTRkAgent0111B.txt
IF EXIST TESTRkAgent0111.txt dnif.exe /I "120832"<TESTRkAgent0111.txt>>TESTRkAgent0111B.txt
IF EXIST TESTRkAgent0111.txt dnif.exe /I "121344"<TESTRkAgent0111.txt>>TESTRkAgent0111B.txt
IF EXIST TESTRkAgent0111.txt dnif.exe /I "122880"<TESTRkAgent0111.txt>>TESTRkAgent0111B.txt
IF EXIST TESTRkAgent0111.txt dnif.exe /I "123392"<TESTRkAgent0111.txt>>TESTRkAgent0111B.txt
IF EXIST TESTRkAgent0111.txt dnif.exe /I "124928"<TESTRkAgent0111.txt>>TESTRkAgent0111B.txt
IF EXIST TESTRkAgent0111.txt dnif.exe /I "125440"<TESTRkAgent0111.txt>>TESTRkAgent0111B.txt
IF EXIST TESTRkAgent0111.txt dnif.exe /I "126464"<TESTRkAgent0111.txt>>TESTRkAgent0111B.txt
IF EXIST TESTRkAgent0111.txt dnif.exe /I "127488"<TESTRkAgent0111.txt>>TESTRkAgent0111B.txt
IF EXIST TESTRkAgent0111.txt dnif.exe /I "128512"<TESTRkAgent0111.txt>>TESTRkAgent0111B.txt
IF EXIST TESTRkAgent0111.txt dnif.exe /I "129024"<TESTRkAgent0111.txt>>TESTRkAgent0111B.txt
IF EXIST TESTRkAgent0111.txt dnif.exe /I "129536"<TESTRkAgent0111.txt>>TESTRkAgent0111B.txt
IF EXIST TESTRkAgent0111.txt dnif.exe /I "130048"<TESTRkAgent0111.txt>>TESTRkAgent0111B.txt
IF EXIST TESTRkAgent0111.txt dnif.exe /I "130560"<TESTRkAgent0111.txt>>TESTRkAgent0111B.txt
IF EXIST TESTRkAgent0111.txt dnif.exe /I "131584"<TESTRkAgent0111.txt>>TESTRkAgent0111B.txt
IF EXIST TESTRkAgent0111.txt dnif.exe /I "133120"<TESTRkAgent0111.txt>>TESTRkAgent0111B.txt
IF EXIST TESTRkAgent0111.txt dnif.exe /I "133632"<TESTRkAgent0111.txt>>TESTRkAgent0111B.txt
IF EXIST TESTRkAgent0111.txt dnif.exe /I "137728"<TESTRkAgent0111.txt>>TESTRkAgent0111B.txt
IF EXIST TESTRkAgent0111.txt dnif.exe /I "139264"<TESTRkAgent0111.txt>>TESTRkAgent0111B.txt
IF EXIST TESTRkAgent0111.txt dnif.exe /I "165376"<TESTRkAgent0111.txt>>TESTRkAgent0111B.txt
IF EXIST TESTRkAgent0111.txt dnif.exe /I "167424"<TESTRkAgent0111.txt>>TESTRkAgent0111B.txt
IF EXIST TESTRkAgent0111.txt dnif.exe /I "167936"<TESTRkAgent0111.txt>>TESTRkAgent0111B.txt
IF EXIST TESTRkAgent0111B.txt dnif.exe /I ".sys"<TESTRkAgent0111B.txt>nul && (
FOR /F "TOKENS=5 DELIMS=\." %%A in (TESTRkAgent0111B.txt) DO dnif.exe /I "Services\%%A" <TESTRkAgent0111.txt>NUL && (
dnif.exe /I "%%A.sys"<Find.txt>NUL || (
ECHO %systemroot%\system32\drivers\%%A.sys>>RemLat.txt
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%A.sys dummy.sys >NUL
echo %%A>>apps\srv2.txt
echo %%A>>apps\svc.txt
echo %%A>>apps\legacy.txt
echo %%A.sys>>apps\legacy.txt
apps\sc config %%A start= disabled >nul
echo %systemroot%\system32\drivers\%%A.sys - Rootkit Agent.ea/Srizbi>>TESTRKanT1.TXT
>RepairRK4.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\System Reserved]
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\System Reserved]
echo.
	)
editreg.exe /s RepairRK4.reg 2>NUL 
copy RepairRK4.reg .\backups\Srizbi2.reg >nul
apps\locate "%systemroot%\system32\????????.tmp" /D- /s:29! /n /nr|dnif.exe /I ".tmp">>Find.txt
	))))

apps\Csweg query "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\System Reserved">TESTRkAgentnw1.txt
IF EXIST TESTRkAgentnw1.txt dnif.exe /I "Driver Group"<TESTRkAgentnw1.txt>NUL && (
apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:111216! /n /nr|dnif.exe /I ".sys">>TESTRkAgentnw2.txt
apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:120320! /n /nr|dnif.exe /I ".sys">>TESTRkAgentnw2.txt
apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:120832! /n /nr|dnif.exe /I ".sys">>TESTRkAgentnw2.txt
apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:121344! /n /nr|dnif.exe /I ".sys">>TESTRkAgentnw2.txt
apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:122880! /n /nr|dnif.exe /I ".sys">>TESTRkAgentnw2.txt
apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:123392! /n /nr|dnif.exe /I ".sys">>TESTRkAgentnw2.txt
apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:124928! /n /nr|dnif.exe /I ".sys">>TESTRkAgentnw2.txt
apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:125440! /n /nr|dnif.exe /I ".sys">>TESTRkAgentnw2.txt
apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:126464! /n /nr|dnif.exe /I ".sys">>TESTRkAgentnw2.txt
apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:127488! /n /nr|dnif.exe /I ".sys">>TESTRkAgentnw2.txt
apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:128512! /n /nr|dnif.exe /I ".sys">>TESTRkAgentnw2.txt
apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:129024! /n /nr|dnif.exe /I ".sys">>TESTRkAgentnw2.txt
apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:129536! /n /nr|dnif.exe /I ".sys">>TESTRkAgentnw2.txt
apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:130048! /n /nr|dnif.exe /I ".sys">>TESTRkAgentnw2.txt
apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:130560! /n /nr|dnif.exe /I ".sys">>TESTRkAgentnw2.txt
apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:131584! /n /nr|dnif.exe /I ".sys">>TESTRkAgentnw2.txt
apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:133120! /n /nr|dnif.exe /I ".sys">>TESTRkAgentnw2.txt
apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:133632! /n /nr|dnif.exe /I ".sys">>TESTRkAgentnw2.txt
apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:137728! /n /nr|dnif.exe /I ".sys">>TESTRkAgentnw2.txt
apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:139264! /n /nr|dnif.exe /I ".sys">>TESTRkAgentnw2.txt
apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:165376! /n /nr|dnif.exe /I ".sys">>TESTRkAgentnw2.txt
apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:167424! /n /nr|dnif.exe /I ".sys">>TESTRkAgentnw2.txt
apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:167936! /n /nr|dnif.exe /I ".sys">>TESTRkAgentnw2.txt
IF EXIST TESTRkAgentnw2.txt dnif.exe /I ".sys"<TESTRkAgentnw2.txt>nul && FOR /F "TOKENS=*" %%D in (TESTRkAgentnw2.txt) DO ECHO %%D>>TESTRkAgentnw3.txt
IF EXIST TESTRkAgentnw3.txt FOR /F "TOKENS=5 DELIMS=\." %%A in (TESTRkAgentnw3.txt) DO apps\Csweg query "HKLM\SYSTEM\CurrentControlSet\Services\%%A" /V Group|dnif.exe /I "System Reserved">NUL && (
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%A.sys dummy.sys >NUL
ECHO %systemroot%\system32\drivers\%%A.sys>>RemLat.txt
echo %%A>>apps\srv2.txt
echo %%A>>apps\svc.txt
echo %%A>>apps\legacy.txt
echo %%A.sys>>apps\legacy.txt
apps\sc config %%A start= disabled >nul
echo %systemroot%\system32\drivers\%%A.sys - Rootkit Agent.ea/Srizbi>>TESTRKanT1.TXT
>RepairRK01.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\System Reserved]
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\System Reserved]
echo.
	)
editreg.exe /s RepairRK01.reg 2>NUL 
copy RepairRK01.reg .\backups\Srizbi.reg >nul
apps\locate "%systemroot%\system32\????????.tmp" /D- /s:29! /n /nr|dnif.exe /I ".tmp">>Find.txt
	))

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:20000,32000 /n /nr|dnif.exe /I ".sys">>TESTRkAgent010.txt
rtsdnif.exe /m /f:TESTRkAgent010.txt "runtime3.pdb">>TESTRkAgent10.txt 2>nul
IF EXIST TESTRkAgent10.txt dnif.exe /I "."<TESTRkAgent10.txt>NUL && FOR /F "TOKENS=5 DELIMS=\." %%A in (TESTRkAgent10.txt) DO (
ECHO %systemroot%\system32\drivers\%%A.sys>>RemLat.txt
IF EXIST %systemroot%\%%A.sys ECHO %systemroot%\%%A.sys>>RemLat.txt
IF EXIST %systemroot%\%%A.sys apps\Cghtme.exe -l nul -o %systemroot%\%%A.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%A.sys dummy.sys >NUL
echo %%A>>apps\srv2.txt
echo %%A>>apps\svc.txt
echo %%A>>apps\legacy.txt
echo %%A.sys>>apps\legacy.txt
apps\sc config %%A start= disabled >nul
echo %systemroot%\system32\drivers\%%A.sys - Rootkit Pandex/Cutwail - Runtime.sys>>TESTRKanT1.TXT
>RepairRK1.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\%%A.sys]
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\%%A.sys]
echo.
	)
apps\Csweg acl "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\%%A.sys" /reset /q >nul
apps\Csweg acl "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\%%A.sys" /reset /q >nul
apps\Csweg acl "HKLM\SYSTEM\CurrentControlSet\Services\%%A" /reset /q >nul
editreg.exe /s RepairRK1.reg 2>NUL 
copy RepairRK1.reg .\backups\Runtime3.reg >nul
apps\locate "%systemroot%\system32\????????.tmp" /D- /s:29! /n /nr|dnif.exe /I ".tmp">>Find.txt
	)

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:28000,34000 /n /nr|dnif.exe /I ".sys">>TESTRkAgentprotect1.txt
rtsdnif.exe /m /f:TESTRkAgentprotect1.txt "siberia">>TESTRkAgentprotect2.txt 2>nul
rtsdnif.exe /m /f:TESTRkAgentprotect2.txt "protect.pdb">>TESTRkAgentprotect3.txt 2>nul

IF EXIST TESTRkAgentprotect3.txt dnif.exe /I "."<TESTRkAgentprotect3.txt>NUL && FOR /F "TOKENS=5 DELIMS=\." %%A in (TESTRkAgentprotect3.txt) DO (
ECHO %systemroot%\system32\drivers\%%A.sys>>RemLat.txt
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%A.sys dummy.sys >NUL
echo %%A>>apps\srv2.txt
echo %%A>>apps\svc.txt
echo %%A>>apps\legacy.txt
echo %%A.sys>>apps\legacy.txt
apps\sc config %%A start= disabled >nul
echo %systemroot%\system32\drivers\%%A.sys - Rootkit Pandex/Cutwail - Protect.sys>>TESTRKanT1.TXT
>RepairRKprotect1.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\%%A.sys]
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\%%A.sys]
echo.
	)
apps\Csweg acl "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\%%A.sys" /reset /q >nul
apps\Csweg acl "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\%%A.sys" /reset /q >nul
apps\Csweg acl "HKLM\SYSTEM\CurrentControlSet\Services\%%A" /reset /q >nul
editreg.exe /s RepairRKprotect1.reg 2>NUL 
copy RepairRKprotect1.reg .\backups\RepairRKprotect.reg >nul
apps\locate "%systemroot%\system32\????????.tmp" /D- /s:29! /n /nr|dnif.exe /I ".tmp">>Find.txt
	)

IF EXIST "%systemroot%\glok+*-*.sys" (
dir /b/a-d "%systemroot%\glok+*-*.sys">>TESTstorm1.TXT
for /f "tokens=1 delims=." %%a in (TESTstorm1.TXT) do ( 
        echo %systemroot%\%%a.sys>>RemLat.txt
	echo %%a>>apps\svc.txt
	echo %%a>>apps\legacy.txt
	echo %%a>>apps\srv2.txt
	apps\sc config %%a start= disabled >nul
echo %systemroot%\%%A.sys - Rootkit Nuwar/Storm Worm>>TESTRKanT1.TXT
	))

apps\locate "%systemroot%\system32\*.exe" /D- /s:159746! /n /nr|dnif.exe /I ".exe">>TESTStormRuns1a.txt
rtsdnif.exe /m /f:TESTStormRuns1a.txt "HitBot" >>TESTStormRuns1b.txt 2>NUL
rtsdnif.exe /m /f:TESTStormRuns1b.txt "BestClick.pdb" >>TESTStormRuns2.txt
rtsdnif.exe /m /f:TESTStormRuns1b.txt "BestClick.pdb">>Find.txt

IF EXIST TESTStormRuns2.txt dnif.exe /I "\"<TESTStormRuns2.txt>NUL && for /f "tokens=4 delims=\." %%a in (TESTStormRuns2.txt) do (
>RepairStormRun1.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
ECHO "%%a"=-
echo.
	)
editreg.exe /s RepairStormRun1.reg  2>NUL
copy RepairStormRun1.reg  .\backups\RepairStormRun.reg >nul
	)

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:63920! /n /nr /O:"&W"|dnif.exe /I "sys">>TESTrkrustock1.TXT
for /f "tokens=*" %%a in (TESTrkrustock1.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "8E51E9A0A463F893DA0BFC99870614F3">NUL && echo %%~a>>TESTrkrustock2.TXT

IF EXIST TESTrkrustock2.TXT dnif.exe /I ".sys"<TESTrkrustock2.TXT|dnif.exe /I /V "beep.sys">nul && (
FOR /F "TOKENS=5 DELIMS=\." %%A in (TESTrkrustock2.TXT) DO (
ECHO %systemroot%\system32\drivers\%%A.sys>>RemLat.txt
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%A.sys dummy.sys >NUL
echo %%A>>apps\srv2.txt
echo %%A>>apps\svc.txt
echo %%A>>apps\legacy.txt
apps\sc config %%A start= disabled >nul
echo %systemroot%\system32\drivers\%%A.sys - Rustock.B/Spam-Mailbot.c>>TESTRKanT1.TXT
	))

IF EXIST TESTrkrustock2.TXT dnif.exe /I "beep.sys"<TESTrkrustock2.TXT>nul && (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg >>bprustockTEST2.TXT
>bprustockres.txt (
echo.
echo [b]Infected beep.sys Found![/b]
echo.
echo beep.sys File Locations:
echo.
TYPE bprustockTEST2.TXT
echo.
echo Rustock Infected File Listed Below:
echo.
TYPE TESTrkrustock2.TXT
echo.
echo File copied to Backups Folder
echo Attempting to replace beep.sys with original version 
echo. )
for /f "tokens=*" %%a in (TESTrkrustock2.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "8E51E9A0A463F893DA0BFC99870614F3">NUL && (
attrib +r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\xp\beep.sys >nul
ver|dnif.exe "Windows 2000">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\w2k\beep.sys >nul
	))
	
apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:68018! /n /nr /O:"&W"|dnif.exe /I "sys">>TESTrkrustock1a.TXT
for /f "tokens=*" %%a in (TESTrkrustock1a.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "93C31496EA6203EB2532B837A42A3BA1">NUL && echo %%~a>>TESTrkrustock2a.TXT

IF EXIST TESTrkrustock2a.TXT dnif.exe /I ".sys"<TESTrkrustock2a.TXT|dnif.exe /I /V "beep.sys">TESTrkrustock2aa.TXT
IF EXIST TESTrkrustock2aa.TXT dnif.exe /I ".sys"<TESTrkrustock2aa.TXT|dnif.exe /I /V "beep.sys">nul && (
FOR /F "TOKENS=5 DELIMS=\." %%A in (TESTrkrustock2aa.TXT) DO (
ECHO %systemroot%\system32\drivers\%%A.sys>>RemLat.txt
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%A.sys dummy.sys >NUL
echo %%A>>apps\srv2.txt
echo %%A>>apps\svc.txt
echo %%A>>apps\legacy.txt
apps\sc config %%A start= disabled >nul
echo %systemroot%\system32\drivers\%%A.sys - Rustock.B/Spam-Mailbot.c>>TESTRKanT1.TXT
	))

IF EXIST TESTrkrustock2a.TXT dnif.exe /I "beep.sys"<TESTrkrustock2a.TXT>nul && (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg >>bprustockTEST2a.TXT
>bprustockres.txt (
echo.
echo [b]Infected beep.sys Found![/b]
echo.
echo beep.sys File Locations:
echo.
TYPE bprustockTEST2a.TXT
echo.
echo Rustock Infected File Listed Below:
echo.
TYPE TESTrkrustock2a.TXT
echo.
echo File copied to Backups Folder
echo Attempting to replace beep.sys with original version 
echo. )
for /f "tokens=*" %%a in (TESTrkrustock2a.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "93C31496EA6203EB2532B837A42A3BA1">NUL && (
attrib +r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\xp\beep.sys >nul
ver|dnif.exe "Windows 2000">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\w2k\beep.sys >nul
	))

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:65970! /n /nr /O:"&W"|dnif.exe /I "sys">>TESTrkrustock1b.TXT
for /f "tokens=*" %%a in (TESTrkrustock1b.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "7facc1a651452c710e4c4a6cee1c4112">NUL && echo %%~a>>TESTrkrustock2b.TXT

IF EXIST TESTrkrustock2b.TXT dnif.exe /I ".sys"<TESTrkrustock2b.TXT|dnif.exe /I /V "beep.sys">TESTrkrustock2ba.TXT
IF EXIST TESTrkrustock2ba.TXT dnif.exe /I ".sys"<TESTrkrustock2ba.TXT|dnif.exe /I /V "beep.sys">nul && (
FOR /F "TOKENS=5 DELIMS=\." %%A in (TESTrkrustock2ba.TXT) DO (
ECHO %systemroot%\system32\drivers\%%A.sys>>RemLat.txt
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%A.sys dummy.sys >NUL
echo %%A>>apps\srv2.txt
echo %%A>>apps\svc.txt
echo %%A>>apps\legacy.txt
apps\sc config %%A start= disabled >nul
echo %systemroot%\system32\drivers\%%A.sys - Rustock.B/Spam-Mailbot.c>>TESTRKanT1.TXT
	))

IF EXIST TESTrkrustock2b.TXT dnif.exe /I "beep.sys"<TESTrkrustock2b.TXT>nul && (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg >>bprustockTEST2b.TXT
>bprustockres.txt (
echo.
echo [b]Infected beep.sys Found![/b]
echo.
echo beep.sys File Locations:
echo.
TYPE bprustockTEST2b.TXT
echo.
echo Rustock Infected File Listed Below:
echo.
TYPE TESTrkrustock2b.TXT
echo.
echo File copied to Backups Folder
echo Attempting to replace beep.sys with original version 
echo. )
for /f "tokens=*" %%a in (TESTrkrustock2b.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "7facc1a651452c710e4c4a6cee1c4112">NUL && (
attrib +r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\xp\beep.sys >nul
ver|dnif.exe "Windows 2000">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\w2k\beep.sys >nul
	))

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:58988! /n /nr /O:"&W"|dnif.exe /I "sys">>TESTrkrustock1c.TXT
for /f "tokens=*" %%a in (TESTrkrustock1c.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "1F158FB47EF01342E0C41C789F886A74">NUL && echo %%~a>>TESTrkrustock2c.TXT

IF EXIST TESTrkrustock2c.TXT dnif.exe /I ".sys"<TESTrkrustock2c.TXT|dnif.exe /I /V "beep.sys">TESTrkrustock2ca.TXT
IF EXIST TESTrkrustock2ca.TXT dnif.exe /I ".sys"<TESTrkrustock2ca.TXT|dnif.exe /I /V "beep.sys">nul && (
FOR /F "TOKENS=5 DELIMS=\." %%A in (TESTrkrustock2ca.TXT) DO (
ECHO %systemroot%\system32\drivers\%%A.sys>>RemLat.txt
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%A.sys dummy.sys >NUL
echo %%A>>apps\srv2.txt
echo %%A>>apps\svc.txt
echo %%A>>apps\legacy.txt
apps\sc config %%A start= disabled >nul
echo %systemroot%\system32\drivers\%%A.sys - Rustock.B/Spam-Mailbot.c>>TESTRKanT1.TXT
	))

IF EXIST TESTrkrustock2c.TXT dnif.exe /I "beep.sys"<TESTrkrustock2c.TXT>nul && (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg >>bprustockTEST2c.TXT
>bprustockres.txt (
echo.
echo [b]Infected beep.sys Found![/b]
echo.
echo beep.sys File Locations:
echo.
TYPE bprustockTEST2c.TXT
echo.
echo Rustock Infected File Listed Below:
echo.
TYPE TESTrkrustock2c.TXT
echo.
echo File copied to Backups Folder
echo Attempting to replace beep.sys with original version 
echo. )
for /f "tokens=*" %%a in (TESTrkrustock2c.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "1F158FB47EF01342E0C41C789F886A74">NUL && (
attrib +r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\xp\beep.sys >nul
ver|dnif.exe "Windows 2000">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\w2k\beep.sys >nul
	))

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:65132! /n /nr /O:"&W"|dnif.exe /I "sys">>TESTrkrustock1d.TXT
for /f "tokens=*" %%a in (TESTrkrustock1d.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "8e851c2beea3689af432a63459e45d56">NUL && echo %%~a>>TESTrkrustock2d.TXT

IF EXIST TESTrkrustock2d.TXT dnif.exe /I ".sys"<TESTrkrustock2d.TXT|dnif.exe /I /V "beep.sys">TESTrkrustock2da.TXT
IF EXIST TESTrkrustock2da.TXT dnif.exe /I ".sys"<TESTrkrustock2da.TXT|dnif.exe /I /V "beep.sys">nul && (
FOR /F "TOKENS=5 DELIMS=\." %%A in (TESTrkrustock2da.TXT) DO (
ECHO %systemroot%\system32\drivers\%%A.sys>>RemLat.txt
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%A.sys dummy.sys >NUL
echo %%A>>apps\srv2.txt
echo %%A>>apps\svc.txt
echo %%A>>apps\legacy.txt
apps\sc config %%A start= disabled >nul
echo %systemroot%\system32\drivers\%%A.sys - Rustock.B/Spam-Mailbot.c>>TESTRKanT1.TXT
	))

IF EXIST TESTrkrustock2d.TXT dnif.exe /I "beep.sys"<TESTrkrustock2d.TXT>nul && (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg >>bprustockTEST2d.TXT
>bprustockres.txt (
echo.
echo [b]Infected beep.sys Found![/b]
echo.
echo beep.sys File Locations:
echo.
TYPE bprustockTEST2d.TXT
echo.
echo Rustock Infected File Listed Below:
echo.
TYPE TESTrkrustock2d.TXT
echo.
echo File copied to Backups Folder
echo Attempting to replace beep.sys with original version 
echo. )
for /f "tokens=*" %%a in (TESTrkrustock2d.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "8e851c2beea3689af432a63459e45d56">NUL && (
attrib +r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\xp\beep.sys >nul
ver|dnif.exe "Windows 2000">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\w2k\beep.sys >nul
	))

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:61116! /n /nr /O:"&W"|dnif.exe /I "sys">>TESTrkrustock1e.TXT
for /f "tokens=*" %%a in (TESTrkrustock1e.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "aa14273f9dd0cbd7c57fda23fcf4bf64">NUL && echo %%~a>>TESTrkrustock2e.TXT

IF EXIST TESTrkrustock2e.TXT dnif.exe /I ".sys"<TESTrkrustock2e.TXT|dnif.exe /I /V "beep.sys">TESTrkrustock2ea.TXT
IF EXIST TESTrkrustock2ea.TXT dnif.exe /I ".sys"<TESTrkrustock2ea.TXT|dnif.exe /I /V "beep.sys">nul && (
FOR /F "TOKENS=5 DELIMS=\." %%A in (TESTrkrustock2ea.TXT) DO (
ECHO %systemroot%\system32\drivers\%%A.sys>>RemLat.txt
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%A.sys dummy.sys >NUL
echo %%A>>apps\srv2.txt
echo %%A>>apps\svc.txt
echo %%A>>apps\legacy.txt
apps\sc config %%A start= disabled >nul
echo %systemroot%\system32\drivers\%%A.sys - Rustock.B/Spam-Mailbot.c>>TESTRKanT1.TXT
	))

IF EXIST TESTrkrustock2e.TXT dnif.exe /I "beep.sys"<TESTrkrustock2e.TXT>nul && (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg >>bprustockTEST2e.TXT
>bprustockres.txt (
echo.
echo [b]Infected beep.sys Found![/b]
echo.
echo beep.sys File Locations:
echo.
TYPE bprustockTEST2e.TXT
echo.
echo Rustock Infected File Listed Below:
echo.
TYPE TESTrkrustock2e.TXT
echo.
echo File copied to Backups Folder
echo Attempting to replace beep.sys with original version 
echo. )
for /f "tokens=*" %%a in (TESTrkrustock2e.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "aa14273f9dd0cbd7c57fda23fcf4bf64">NUL && (
attrib +r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\xp\beep.sys >nul
ver|dnif.exe "Windows 2000">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\w2k\beep.sys >nul
	))

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:69820! /n /nr /O:"&W"|dnif.exe /I "sys">>TESTrkrustock1f.TXT
for /f "tokens=*" %%a in (TESTrkrustock1f.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "0069381f4a9e8d2f312c96927627752a">NUL && echo %%~a>>TESTrkrustock2f.TXT

IF EXIST TESTrkrustock2f.TXT dnif.exe /I ".sys"<TESTrkrustock2f.TXT|dnif.exe /I /V "beep.sys">TESTrkrustock2fa.TXT
IF EXIST TESTrkrustock2fa.TXT dnif.exe /I ".sys"<TESTrkrustock2fa.TXT|dnif.exe /I /V "beep.sys">nul && (
FOR /F "TOKENS=5 DELIMS=\." %%A in (TESTrkrustock2fa.TXT) DO (
ECHO %systemroot%\system32\drivers\%%A.sys>>RemLat.txt
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%A.sys dummy.sys >NUL
echo %%A>>apps\srv2.txt
echo %%A>>apps\svc.txt
echo %%A>>apps\legacy.txt
apps\sc config %%A start= disabled >nul
echo %systemroot%\system32\drivers\%%A.sys - Rustock.B/Spam-Mailbot.c>>TESTRKanT1.TXT
	))

IF EXIST TESTrkrustock2f.TXT dnif.exe /I "beep.sys"<TESTrkrustock2f.TXT>nul && (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg >>bprustockTEST2f.TXT
>bprustockres.txt (
echo.
echo [b]Infected beep.sys Found![/b]
echo.
echo beep.sys File Locations:
echo.
TYPE bprustockTEST2f.TXT
echo.
echo Rustock Infected File Listed Below:
echo.
TYPE TESTrkrustock2f.TXT
echo.
echo File copied to Backups Folder
echo Attempting to replace beep.sys with original version 
echo. )
for /f "tokens=*" %%a in (TESTrkrustock2f.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "0069381f4a9e8d2f312c96927627752a">NUL && (
attrib +r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\xp\beep.sys >nul
ver|dnif.exe "Windows 2000">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\w2k\beep.sys >nul
	))

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:85050! /n /nr /O:"&W"|dnif.exe /I "sys">>TESTrkrustock1g.TXT
for /f "tokens=*" %%a in (TESTrkrustock1g.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "8DDC6D3316ADFBA55AE74D12A6FB8F03">NUL && echo %%~a>>TESTrkrustock2g.TXT

IF EXIST TESTrkrustock2g.TXT dnif.exe /I ".sys"<TESTrkrustock2g.TXT|dnif.exe /I /V "beep.sys">TESTrkrustock2ga.TXT
IF EXIST TESTrkrustock2ga.TXT dnif.exe /I ".sys"<TESTrkrustock2ga.TXT|dnif.exe /I /V "beep.sys">nul && (
FOR /F "TOKENS=5 DELIMS=\." %%A in (TESTrkrustock2ga.TXT) DO (
ECHO %systemroot%\system32\drivers\%%A.sys>>RemLat.txt
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%A.sys dummy.sys >NUL
echo %%A>>apps\srv2.txt
echo %%A>>apps\svc.txt
echo %%A>>apps\legacy.txt
apps\sc config %%A start= disabled >nul
echo %systemroot%\system32\drivers\%%A.sys - Rustock.B/Spam-Mailbot.c>>TESTRKanT1.TXT
	))

IF EXIST TESTrkrustock2g.TXT dnif.exe /I "beep.sys"<TESTrkrustock2g.TXT>nul && (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg >>bprustockTEST2g.TXT
>bprustockres.txt (
echo.
echo [b]Infected beep.sys Found![/b]
echo.
echo beep.sys File Locations:
echo.
TYPE bprustockTEST2g.TXT
echo.
echo Rustock Infected File Listed Below:
echo.
TYPE TESTrkrustock2g.TXT
echo.
echo File copied to Backups Folder
echo Attempting to replace beep.sys with original version 
echo. )
for /f "tokens=*" %%a in (TESTrkrustock2g.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "8DDC6D3316ADFBA55AE74D12A6FB8F03">NUL && (
attrib +r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\xp\beep.sys >nul
ver|dnif.exe "Windows 2000">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\w2k\beep.sys >nul
	))

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:105408! /n /nr /O:"&W"|dnif.exe /I "sys">>TESTrkrustock1h.TXT
for /f "tokens=*" %%a in (TESTrkrustock1h.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "142b8db420c24c8c5a1db6bba4be32d4">NUL && echo %%~a>>TESTrkrustock2h.TXT

IF EXIST TESTrkrustock2h.TXT dnif.exe /I ".sys"<TESTrkrustock2h.TXT|dnif.exe /I /V "beep.sys">TESTrkrustock2ha.TXT
IF EXIST TESTrkrustock2ha.TXT dnif.exe /I ".sys"<TESTrkrustock2ha.TXT|dnif.exe /I /V "beep.sys">nul && (
FOR /F "TOKENS=5 DELIMS=\." %%A in (TESTrkrustock2ha.TXT) DO (
ECHO %systemroot%\system32\drivers\%%A.sys>>RemLat.txt
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%A.sys dummy.sys >NUL
echo %%A>>apps\srv2.txt
echo %%A>>apps\svc.txt
echo %%A>>apps\legacy.txt
apps\sc config %%A start= disabled >nul
echo %systemroot%\system32\drivers\%%A.sys - Rustock.B/Spam-Mailbot.c>>TESTRKanT1.TXT
	))

IF EXIST TESTrkrustock2h.TXT dnif.exe /I "beep.sys"<TESTrkrustock2h.TXT>nul && (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg >>bprustockTEST2h.TXT
>bprustockres.txt (
echo.
echo [b]Infected beep.sys Found![/b]
echo.
echo beep.sys File Locations:
echo.
TYPE bprustockTEST2h.TXT
echo.
echo Rustock Infected File Listed Below:
echo.
TYPE TESTrkrustock2h.TXT
echo.
echo File copied to Backups Folder
echo Attempting to replace beep.sys with original version 
echo. )
for /f "tokens=*" %%a in (TESTrkrustock2h.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "142b8db420c24c8c5a1db6bba4be32d4">NUL && (
attrib +r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\xp\beep.sys >nul
ver|dnif.exe "Windows 2000">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\w2k\beep.sys >nul
	))

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:111216! /n /nr /O:"&W"|dnif.exe /I "sys">>TESTrkrustock1i.TXT
for /f "tokens=*" %%a in (TESTrkrustock1i.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "2f4d04bbea32bef7a085327e3419a0c4">NUL && echo %%~a>>TESTrkrustock2i.TXT

IF EXIST TESTrkrustock2i.TXT dnif.exe /I ".sys"<TESTrkrustock2i.TXT|dnif.exe /I /V "beep.sys">TESTrkrustock2ia.TXT
IF EXIST TESTrkrustock2ia.TXT dnif.exe /I ".sys"<TESTrkrustock2ia.TXT|dnif.exe /I /V "beep.sys">nul && (
FOR /F "TOKENS=5 DELIMS=\." %%A in (TESTrkrustock2ia.TXT) DO (
ECHO %systemroot%\system32\drivers\%%A.sys>>RemLat.txt
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%A.sys dummy.sys >NUL
echo %%A>>apps\srv2.txt
echo %%A>>apps\svc.txt
echo %%A>>apps\legacy.txt
apps\sc config %%A start= disabled >nul
echo %systemroot%\system32\drivers\%%A.sys - Rustock.B/Spam-Mailbot.c>>TESTRKanT1.TXT
	))

IF EXIST TESTrkrustock2i.TXT dnif.exe /I "beep.sys"<TESTrkrustock2i.TXT>nul && (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg >>bprustockTEST2i.TXT
>bprustockres.txt (
echo.
echo [b]Infected beep.sys Found![/b]
echo.
echo beep.sys File Locations:
echo.
TYPE bprustockTEST2i.TXT
echo.
echo Rustock Infected File Listed Below:
echo.
TYPE TESTrkrustock2i.TXT
echo.
echo File copied to Backups Folder
echo Attempting to replace beep.sys with original version 
echo. )
for /f "tokens=*" %%a in (TESTrkrustock2i.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "2f4d04bbea32bef7a085327e3419a0c4">NUL && (
attrib +r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\xp\beep.sys >nul
ver|dnif.exe "Windows 2000">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\w2k\beep.sys >nul
	))

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:86804! /n /nr /O:"&W"|dnif.exe /I "sys">>TESTrkrustock1j.TXT
for /f "tokens=*" %%a in (TESTrkrustock1j.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "868692c6d91fb614fbf26dbdbbbcdb3b">NUL && echo %%~a>>TESTrkrustock2j.TXT

IF EXIST TESTrkrustock2j.TXT dnif.exe /I ".sys"<TESTrkrustock2j.TXT|dnif.exe /I /V "beep.sys">TESTrkrustock2ja.TXT
IF EXIST TESTrkrustock2ja.TXT dnif.exe /I ".sys"<TESTrkrustock2ja.TXT|dnif.exe /I /V "beep.sys">nul && (
FOR /F "TOKENS=5 DELIMS=\." %%A in (TESTrkrustock2ja.TXT) DO (
ECHO %systemroot%\system32\drivers\%%A.sys>>RemLat.txt
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%A.sys dummy.sys >NUL
echo %%A>>apps\srv2.txt
echo %%A>>apps\svc.txt
echo %%A>>apps\legacy.txt
apps\sc config %%A start= disabled >nul
echo %systemroot%\system32\drivers\%%A.sys - Rustock.B/Spam-Mailbot.c>>TESTRKanT1.TXT
	))

IF EXIST TESTrkrustock2j.TXT dnif.exe /I "beep.sys"<TESTrkrustock2j.TXT>nul && (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg >>bprustockTEST2j.TXT
>bprustockres.txt (
echo.
echo [b]Infected beep.sys Found![/b]
echo.
echo beep.sys File Locations:
echo.
TYPE bprustockTEST2j.TXT
echo.
echo Rustock Infected File Listed Below:
echo.
TYPE TESTrkrustock2j.TXT
echo.
echo File copied to Backups Folder
echo Attempting to replace beep.sys with original version 
echo. )
for /f "tokens=*" %%a in (TESTrkrustock2j.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "868692c6d91fb614fbf26dbdbbbcdb3b">NUL && (
attrib +r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\xp\beep.sys >nul
ver|dnif.exe "Windows 2000">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\w2k\beep.sys >nul
	))

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:100774! /n /nr /O:"&W"|dnif.exe /I "sys">>TESTrkrustock1k.TXT
for /f "tokens=*" %%a in (TESTrkrustock1k.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "10214243BDB6E43FEDB41CBEC4A349FC">NUL && echo %%~a>>TESTrkrustock2k.TXT

IF EXIST TESTrkrustock2k.TXT dnif.exe /I ".sys"<TESTrkrustock2k.TXT|dnif.exe /I /V "beep.sys">TESTrkrustock2ka.TXT
IF EXIST TESTrkrustock2ka.TXT dnif.exe /I ".sys"<TESTrkrustock2ka.TXT|dnif.exe /I /V "beep.sys">nul && (
FOR /F "TOKENS=5 DELIMS=\." %%A in (TESTrkrustock2ka.TXT) DO (
ECHO %systemroot%\system32\drivers\%%A.sys>>RemLat.txt
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%A.sys dummy.sys >NUL
echo %%A>>apps\srv2.txt
echo %%A>>apps\svc.txt
echo %%A>>apps\legacy.txt
apps\sc config %%A start= disabled >nul
echo %systemroot%\system32\drivers\%%A.sys - Rustock.B/Spam-Mailbot.c>>TESTRKanT1.TXT
	))

IF EXIST TESTrkrustock2k.TXT dnif.exe /I "beep.sys"<TESTrkrustock2k.TXT>nul && (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg >>bprustockTEST2k.TXT
>bprustockres.txt (
echo.
echo [b]Infected beep.sys Found![/b]
echo.
echo beep.sys File Locations:
echo.
TYPE bprustockTEST2k.TXT
echo.
echo Rustock Infected File Listed Below:
echo.
TYPE TESTrkrustock2k.TXT
echo.
echo File copied to Backups Folder
echo Attempting to replace beep.sys with original version 
echo. )
for /f "tokens=*" %%a in (TESTrkrustock2k.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "10214243BDB6E43FEDB41CBEC4A349FC">NUL && (
attrib +r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\xp\beep.sys >nul
ver|dnif.exe "Windows 2000">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\w2k\beep.sys >nul
	))

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:84210! /n /nr /O:"&W"|dnif.exe /I "sys">>TESTrkrustock1l.TXT
for /f "tokens=*" %%a in (TESTrkrustock1l.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "DE3913416F2D57EC4BF68C89D7247A06">NUL && echo %%~a>>TESTrkrustock2l.TXT

IF EXIST TESTrkrustock2l.TXT dnif.exe /I ".sys"<TESTrkrustock2l.TXT|dnif.exe /I /V "beep.sys">TESTrkrustock2la.TXT
IF EXIST TESTrkrustock2la.TXT dnif.exe /I ".sys"<TESTrkrustock2la.TXT|dnif.exe /I /V "beep.sys">nul && (
FOR /F "TOKENS=5 DELIMS=\." %%A in (TESTrkrustock2la.TXT) DO (
ECHO %systemroot%\system32\drivers\%%A.sys>>RemLat.txt
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%A.sys dummy.sys >NUL
echo %%A>>apps\srv2.txt
echo %%A>>apps\svc.txt
echo %%A>>apps\legacy.txt
apps\sc config %%A start= disabled >nul
echo %systemroot%\system32\drivers\%%A.sys - Rustock.B/Spam-Mailbot.c>>TESTRKanT1.TXT
	))

IF EXIST TESTrkrustock2l.TXT dnif.exe /I "beep.sys"<TESTrkrustock2l.TXT>nul && (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg >>bprustockTEST2l.TXT
>bprustockres.txt (
echo.
echo [b]Infected beep.sys Found![/b]
echo.
echo beep.sys File Locations:
echo.
TYPE bprustockTEST2l.TXT
echo.
echo Rustock Infected File Listed Below:
echo.
TYPE TESTrkrustock2l.TXT
echo.
echo File copied to Backups Folder
echo Attempting to replace beep.sys with original version 
echo. )
for /f "tokens=*" %%a in (TESTrkrustock2l.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "DE3913416F2D57EC4BF68C89D7247A06">NUL && (
attrib +r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\xp\beep.sys >nul
ver|dnif.exe "Windows 2000">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\w2k\beep.sys >nul
	))

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:104944! /n /nr /O:"&W"|dnif.exe /I "sys">>TESTrkrustock1m.TXT
for /f "tokens=*" %%a in (TESTrkrustock1m.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "664D0E06F1174048D13D92C238A42A6E">NUL && echo %%~a>>TESTrkrustock2m.TXT

IF EXIST TESTrkrustock2m.TXT dnif.exe /I ".sys"<TESTrkrustock2m.TXT|dnif.exe /I /V "beep.sys">TESTrkrustock2ma.TXT
IF EXIST TESTrkrustock2ma.TXT dnif.exe /I ".sys"<TESTrkrustock2ma.TXT|dnif.exe /I /V "beep.sys">nul && (
FOR /F "TOKENS=5 DELIMS=\." %%A in (TESTrkrustock2ma.TXT) DO (
ECHO %systemroot%\system32\drivers\%%A.sys>>RemLat.txt
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%A.sys dummy.sys >NUL
echo %%A>>apps\srv2.txt
echo %%A>>apps\svc.txt
echo %%A>>apps\legacy.txt
apps\sc config %%A start= disabled >nul
echo %systemroot%\system32\drivers\%%A.sys - Rustock.B/Spam-Mailbot.c>>TESTRKanT1.TXT
	))

IF EXIST TESTrkrustock2m.TXT dnif.exe /I "beep.sys"<TESTrkrustock2m.TXT>nul && (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg >>bprustockTEST2m.TXT
>bprustockres.txt (
echo.
echo [b]Infected beep.sys Found![/b]
echo.
echo beep.sys File Locations:
echo.
TYPE bprustockTEST2m.TXT
echo.
echo Rustock Infected File Listed Below:
echo.
TYPE TESTrkrustock2m.TXT
echo.
echo File copied to Backups Folder
echo Attempting to replace beep.sys with original version 
echo. )
for /f "tokens=*" %%a in (TESTrkrustock2m.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "664D0E06F1174048D13D92C238A42A6E">NUL && (
attrib +r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\xp\beep.sys >nul
ver|dnif.exe "Windows 2000">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\w2k\beep.sys >nul
	))

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:109762! /n /nr /O:"&W"|dnif.exe /I "sys">>TESTrkrustock1n.TXT
for /f "tokens=*" %%a in (TESTrkrustock1n.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "fc5be1b115c13c707ad8f33d8411be51">NUL && echo %%~a>>TESTrkrustock2n.TXT

IF EXIST TESTrkrustock2n.TXT dnif.exe /I ".sys"<TESTrkrustock2n.TXT|dnif.exe /I /V "beep.sys">TESTrkrustock2na.TXT
IF EXIST TESTrkrustock2na.TXT dnif.exe /I ".sys"<TESTrkrustock2na.TXT|dnif.exe /I /V "beep.sys">nul && (
FOR /F "TOKENS=5 DELIMS=\." %%A in (TESTrkrustock2na.TXT) DO (
ECHO %systemroot%\system32\drivers\%%A.sys>>RemLat.txt
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%A.sys dummy.sys >NUL
echo %%A>>apps\srv2.txt
echo %%A>>apps\svc.txt
echo %%A>>apps\legacy.txt
apps\sc config %%A start= disabled >nul
echo %systemroot%\system32\drivers\%%A.sys - Rustock.B/Spam-Mailbot.c>>TESTRKanT1.TXT
	))

IF EXIST TESTrkrustock2n.TXT dnif.exe /I "beep.sys"<TESTrkrustock2n.TXT>nul && (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg >>bprustockTEST2n.TXT
>bprustockres.txt (
echo.
echo [b]Infected beep.sys Found![/b]
echo.
echo beep.sys File Locations:
echo.
TYPE bprustockTEST2n.TXT
echo.
echo Rustock Infected File Listed Below:
echo.
TYPE TESTrkrustock2n.TXT
echo.
echo File copied to Backups Folder
echo Attempting to replace beep.sys with original version 
echo. )
for /f "tokens=*" %%a in (TESTrkrustock2n.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "fc5be1b115c13c707ad8f33d8411be51">NUL && (
attrib +r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\xp\beep.sys >nul
ver|dnif.exe "Windows 2000">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\w2k\beep.sys >nul
	))

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:127488! /n /nr /O:"&W"|dnif.exe /I "sys">>TESTrkrustock1o.TXT
for /f "tokens=*" %%a in (TESTrkrustock1o.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "E8227D82B20018F1AD5907DBA4EB91B2">NUL && echo %%~a>>TESTrkrustock2o.TXT

IF EXIST TESTrkrustock2o.TXT dnif.exe /I ".sys"<TESTrkrustock2o.TXT|dnif.exe /I /V "beep.sys">TESTrkrustock2oa.TXT
IF EXIST TESTrkrustock2oa.TXT dnif.exe /I ".sys"<TESTrkrustock2oa.TXT|dnif.exe /I /V "beep.sys">nul && (
FOR /F "TOKENS=5 DELIMS=\." %%A in (TESTrkrustock2oa.TXT) DO (
ECHO %systemroot%\system32\drivers\%%A.sys>>RemLat.txt
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%A.sys dummy.sys >NUL
echo %%A>>apps\srv2.txt
echo %%A>>apps\svc.txt
echo %%A>>apps\legacy.txt
apps\sc config %%A start= disabled >nul
echo %systemroot%\system32\drivers\%%A.sys - Rustock.B/Spam-Mailbot.c>>TESTRKanT1.TXT
	))

IF EXIST TESTrkrustock2o.TXT dnif.exe /I "beep.sys"<TESTrkrustock2o.TXT>nul && (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg >>bprustockTEST2o.TXT
>bprustockres.txt (
echo.
echo [b]Infected beep.sys Found![/b]
echo.
echo beep.sys File Locations:
echo.
TYPE bprustockTEST2o.TXT
echo.
echo Rustock Infected File Listed Below:
echo.
TYPE TESTrkrustock2o.TXT
echo.
echo File copied to Backups Folder
echo Attempting to replace beep.sys with original version 
echo. )
for /f "tokens=*" %%a in (TESTrkrustock2o.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "E8227D82B20018F1AD5907DBA4EB91B2">NUL && (
attrib +r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\xp\beep.sys >nul
ver|dnif.exe "Windows 2000">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\w2k\beep.sys >nul
	))

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:244448! /n /nr /O:"&W"|dnif.exe /I "sys">>TESTrkrustock1p.TXT
for /f "tokens=*" %%a in (TESTrkrustock1p.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "00430470E6754F082B6C2C19D022CAEA">NUL && echo %%~a>>TESTrkrustock2p.TXT

IF EXIST TESTrkrustock2p.TXT dnif.exe /I ".sys"<TESTrkrustock2p.TXT|dnif.exe /I /V "beep.sys">TESTrkrustock2pa.TXT
IF EXIST TESTrkrustock2pa.TXT dnif.exe /I ".sys"<TESTrkrustock2pa.TXT|dnif.exe /I /V "beep.sys">nul && (
FOR /F "TOKENS=5 DELIMS=\." %%A in (TESTrkrustock2pa.TXT) DO (
ECHO %systemroot%\system32\drivers\%%A.sys>>RemLat.txt
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%A.sys dummy.sys >NUL
echo %%A>>apps\srv2.txt
echo %%A>>apps\svc.txt
echo %%A>>apps\legacy.txt
apps\sc config %%A start= disabled >nul
echo %systemroot%\system32\drivers\%%A.sys - Rustock.B/Spam-Mailbot.c>>TESTRKanT1.TXT
	))

IF EXIST TESTrkrustock2p.TXT dnif.exe /I "beep.sys"<TESTrkrustock2p.TXT>nul && (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg >>bprustockTEST2p.TXT
>bprustockres.txt (
echo.
echo [b]Infected beep.sys Found![/b]
echo.
echo beep.sys File Locations:
echo.
TYPE bprustockTEST2p.TXT
echo.
echo Rustock Infected File Listed Below:
echo.
TYPE TESTrkrustock2p.TXT
echo.
echo File copied to Backups Folder
echo Attempting to replace beep.sys with original version 
echo. )
for /f "tokens=*" %%a in (TESTrkrustock2p.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "00430470E6754F082B6C2C19D022CAEA">NUL && (
attrib +r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\xp\beep.sys >nul
ver|dnif.exe "Windows 2000">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\w2k\beep.sys >nul
	))

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:64056! /n /nr /O:"&W"|dnif.exe /I "sys">>TESTrkrustock1q.TXT
for /f "tokens=*" %%a in (TESTrkrustock1q.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "607F2160D4F06F8D2728A78DA68C4164">NUL && echo %%~a>>TESTrkrustock2q.TXT

IF EXIST TESTrkrustock2q.TXT dnif.exe /I ".sys"<TESTrkrustock2q.TXT|dnif.exe /I /V "beep.sys">TESTrkrustock2qa.TXT
IF EXIST TESTrkrustock2qa.TXT dnif.exe /I ".sys"<TESTrkrustock2qa.TXT|dnif.exe /I /V "beep.sys">nul && (
FOR /F "TOKENS=5 DELIMS=\." %%A in (TESTrkrustock2qa.TXT) DO (
ECHO %systemroot%\system32\drivers\%%A.sys>>RemLat.txt
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%A.sys dummy.sys >NUL
echo %%A>>apps\srv2.txt
echo %%A>>apps\svc.txt
echo %%A>>apps\legacy.txt
apps\sc config %%A start= disabled >nul
echo %systemroot%\system32\drivers\%%A.sys - Rustock.B/Spam-Mailbot.c>>TESTRKanT1.TXT
	))

IF EXIST TESTrkrustock2q.TXT dnif.exe /I "beep.sys"<TESTrkrustock2q.TXT>nul && (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg >>bprustockTEST2q.TXT
>bprustockres.txt (
echo.
echo [b]Infected beep.sys Found![/b]
echo.
echo beep.sys File Locations:
echo.
TYPE bprustockTEST2q.TXT
echo.
echo Rustock Infected File Listed Below:
echo.
TYPE TESTrkrustock2q.TXT
echo.
echo File copied to Backups Folder
echo Attempting to replace beep.sys with original version 
echo. )
for /f "tokens=*" %%a in (TESTrkrustock2q.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "607F2160D4F06F8D2728A78DA68C4164">NUL && (
attrib +r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\xp\beep.sys >nul
ver|dnif.exe "Windows 2000">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\w2k\beep.sys >nul
	))

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:103772! /n /nr /O:"&W"|dnif.exe /I "sys">>TESTrkrustock1r.TXT
for /f "tokens=*" %%a in (TESTrkrustock1r.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "0c4e11e418b1e2b042e729fa2db59fe4">NUL && echo %%~a>>TESTrkrustock2r.TXT

IF EXIST TESTrkrustock2r.TXT dnif.exe /I ".sys"<TESTrkrustock2r.TXT|dnif.exe /I /V "beep.sys">TESTrkrustock2ra.TXT
IF EXIST TESTrkrustock2ra.TXT dnif.exe /I ".sys"<TESTrkrustock2ra.TXT|dnif.exe /I /V "beep.sys">nul && (
FOR /F "TOKENS=5 DELIMS=\." %%A in (TESTrkrustock2ra.TXT) DO (
ECHO %systemroot%\system32\drivers\%%A.sys>>RemLat.txt
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%A.sys dummy.sys >NUL
echo %%A>>apps\srv2.txt
echo %%A>>apps\svc.txt
echo %%A>>apps\legacy.txt
apps\sc config %%A start= disabled >nul
echo %systemroot%\system32\drivers\%%A.sys - Rustock.B/Spam-Mailbot.c>>TESTRKanT1.TXT
	))

IF EXIST TESTrkrustock2r.TXT dnif.exe /I "beep.sys"<TESTrkrustock2r.TXT>nul && (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg >>bprustockTEST2r.TXT
>bprustockres.txt (
echo.
echo [b]Infected beep.sys Found![/b]
echo.
echo beep.sys File Locations:
echo.
TYPE bprustockTEST2r.TXT
echo.
echo Rustock Infected File Listed Below:
echo.
TYPE TESTrkrustock2r.TXT
echo.
echo File copied to Backups Folder
echo Attempting to replace beep.sys with original version 
echo. )
for /f "tokens=*" %%a in (TESTrkrustock2r.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "0c4e11e418b1e2b042e729fa2db59fe4">NUL && (
attrib +r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\xp\beep.sys >nul
ver|dnif.exe "Windows 2000">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\w2k\beep.sys >nul
	))

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:71006! /n /nr /O:"&W"|dnif.exe /I "sys">>TESTrkrustock1s.TXT
for /f "tokens=*" %%a in (TESTrkrustock1s.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "95468C82954797E28074F3F9C87DFA2A">NUL && echo %%~a>>TESTrkrustock2s.TXT

IF EXIST TESTrkrustock2s.TXT dnif.exe /I ".sys"<TESTrkrustock2s.TXT|dnif.exe /I /V "beep.sys">>TESTrkrustock2sa.TXT
IF EXIST TESTrkrustock2sa.TXT dnif.exe /I ".sys"<TESTrkrustock2sa.TXT|dnif.exe /I /V "beep.sys">nul && (
FOR /F "TOKENS=5 DELIMS=\." %%A in (TESTrkrustock2sa.TXT) DO (
ECHO %systemroot%\system32\drivers\%%A.sys>>RemLat.txt
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%A.sys dummy.sys >NUL
echo %%A>>apps\srv2.txt
echo %%A>>apps\svc.txt
echo %%A>>apps\legacy.txt
apps\sc config %%A start= disabled >nul
echo %systemroot%\system32\drivers\%%A.sys - Rustock.B/Spam-Mailbot.c>>TESTRKanT1.TXT
	))

IF EXIST TESTrkrustock2s.TXT dnif.exe /I "beep.sys"<TESTrkrustock2s.TXT>nul && (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg >>bprustockTEST2s.TXT
>bprustockres.txt (
echo.
echo [b]Infected beep.sys Found![/b]
echo.
echo beep.sys File Locations:
echo.
TYPE bprustockTEST2s.TXT
echo.
echo Rustock Infected File Listed Below:
echo.
TYPE TESTrkrustock2s.TXT
echo.
echo File copied to Backups Folder
echo Attempting to replace beep.sys with original version 
echo. )
for /f "tokens=*" %%a in (TESTrkrustock2s.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "95468C82954797E28074F3F9C87DFA2A">NUL && (
attrib +r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\xp\beep.sys >nul
ver|dnif.exe "Windows 2000">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\w2k\beep.sys >nul
	))

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:72374! /n /nr /O:"&W"|dnif.exe /I "sys">>TESTrkrustock1t.TXT
for /f "tokens=*" %%a in (TESTrkrustock1t.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "B4D601898CE651DFD6DF12027A39BBC5">NUL && echo %%~a>>TESTrkrustock2t.TXT

IF EXIST TESTrkrustock2t.TXT dnif.exe /I ".sys"<TESTrkrustock2t.TXT|dnif.exe /I /V "beep.sys">>TESTrkrustock2ta.TXT
IF EXIST TESTrkrustock2ta.TXT dnif.exe /I ".sys"<TESTrkrustock2ta.TXT|dnif.exe /I /V "beep.sys">nul && (
FOR /F "TOKENS=5 DELIMS=\." %%A in (TESTrkrustock2ta.TXT) DO (
ECHO %systemroot%\system32\drivers\%%A.sys>>RemLat.txt
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%A.sys dummy.sys >NUL
echo %%A>>apps\srv2.txt
echo %%A>>apps\svc.txt
echo %%A>>apps\legacy.txt
apps\sc config %%A start= disabled >nul
echo %systemroot%\system32\drivers\%%A.sys - Rustock.B/Spam-Mailbot.c>>TESTRKanT1.TXT
	))

IF EXIST TESTrkrustock2t.TXT dnif.exe /I "beep.sys"<TESTrkrustock2t.TXT>nul && (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg >>bprustockTEST2t.TXT
>bprustockres.txt (
echo.
echo [b]Infected beep.sys Found![/b]
echo.
echo beep.sys File Locations:
echo.
TYPE bprustockTEST2t.TXT
echo.
echo Rustock Infected File Listed Below:
echo.
TYPE TESTrkrustock2t.TXT
echo.
echo File copied to Backups Folder
echo Attempting to replace beep.sys with original version 
echo. )
for /f "tokens=*" %%a in (TESTrkrustock2t.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "B4D601898CE651DFD6DF12027A39BBC5">NUL && (
attrib +r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\xp\beep.sys >nul
ver|dnif.exe "Windows 2000">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\w2k\beep.sys >nul
	))

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:86750! /n /nr /O:"&W"|dnif.exe /I "sys">>TESTrkrustock1u.TXT
for /f "tokens=*" %%a in (TESTrkrustock1u.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "AADB053397D75E69CB875CCB9CA70471">NUL && echo %%~a>>TESTrkrustock2u.TXT

IF EXIST TESTrkrustock2u.TXT dnif.exe /I ".sys"<TESTrkrustock2u.TXT|dnif.exe /I /V "beep.sys">>TESTrkrustock2ua.TXT
IF EXIST TESTrkrustock2ua.TXT dnif.exe /I ".sys"<TESTrkrustock2ua.TXT|dnif.exe /I /V "beep.sys">nul && (
FOR /F "TOKENS=5 DELIMS=\." %%A in (TESTrkrustock2ua.TXT) DO (
ECHO %systemroot%\system32\drivers\%%A.sys>>RemLat.txt
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%A.sys dummy.sys >NUL
echo %%A>>apps\srv2.txt
echo %%A>>apps\svc.txt
echo %%A>>apps\legacy.txt
apps\sc config %%A start= disabled >nul
echo %systemroot%\system32\drivers\%%A.sys - Rustock.B/Spam-Mailbot.c>>TESTRKanT1.TXT
	))

IF EXIST TESTrkrustock2u.TXT dnif.exe /I "beep.sys"<TESTrkrustock2u.TXT>nul && (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg >>bprustockTEST2u.TXT
>bprustockres.txt (
echo.
echo [b]Infected beep.sys Found![/b]
echo.
echo beep.sys File Locations:
echo.
TYPE bprustockTEST2u.TXT
echo.
echo Rustock Infected File Listed Below:
echo.
TYPE TESTrkrustock2u.TXT
echo.
echo File copied to Backups Folder
echo Attempting to replace beep.sys with original version 
echo. )
for /f "tokens=*" %%a in (TESTrkrustock2u.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "AADB053397D75E69CB875CCB9CA70471">NUL && (
attrib +r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\xp\beep.sys >nul
ver|dnif.exe "Windows 2000">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\w2k\beep.sys >nul
	))

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:94720! /n /nr /O:"&W"|dnif.exe /I "sys">>TESTrkrustock1v.TXT
for /f "tokens=*" %%a in (TESTrkrustock1v.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "9AE37C2AAC1417D83195158DDF234CBE">NUL && echo %%~a>>TESTrkrustock2v.TXT

IF EXIST TESTrkrustock2v.TXT dnif.exe /I ".sys"<TESTrkrustock2v.TXT|dnif.exe /I /V "beep.sys">>TESTrkrustock2va.TXT
IF EXIST TESTrkrustock2va.TXT dnif.exe /I ".sys"<TESTrkrustock2va.TXT|dnif.exe /I /V "beep.sys">nul && (
FOR /F "TOKENS=5 DELIMS=\." %%A in (TESTrkrustock2va.TXT) DO (
ECHO %systemroot%\system32\drivers\%%A.sys>>RemLat.txt
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%A.sys dummy.sys >NUL
echo %%A>>apps\srv2.txt
echo %%A>>apps\svc.txt
echo %%A>>apps\legacy.txt
apps\sc config %%A start= disabled >nul
echo %systemroot%\system32\drivers\%%A.sys - Rustock.B/Spam-Mailbot.c>>TESTRKanT1.TXT
	))

IF EXIST TESTrkrustock2v.TXT dnif.exe /I "beep.sys"<TESTrkrustock2v.TXT>nul && (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg >>bprustockTEST2v.TXT
>bprustockres.txt (
echo.
echo [b]Infected beep.sys Found![/b]
echo.
echo beep.sys File Locations:
echo.
TYPE bprustockTEST2v.TXT
echo.
echo Rustock Infected File Listed Below:
echo.
TYPE TESTrkrustock2v.TXT
echo.
echo File copied to Backups Folder
echo Attempting to replace beep.sys with original version 
echo. )
for /f "tokens=*" %%a in (TESTrkrustock2v.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "9AE37C2AAC1417D83195158DDF234CBE">NUL && (
attrib +r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\xp\beep.sys >nul
ver|dnif.exe "Windows 2000">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\w2k\beep.sys >nul
	))

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:100004! /n /nr /O:"&W"|dnif.exe /I "sys">>TESTrkrustock1w.TXT
for /f "tokens=*" %%a in (TESTrkrustock1w.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "FC1D32E680B71E97AC4BE3F567399D21">NUL && echo %%~a>>TESTrkrustock2w.TXT

IF EXIST TESTrkrustock2w.TXT dnif.exe /I ".sys"<TESTrkrustock2w.TXT|dnif.exe /I /V "beep.sys">>TESTrkrustock2wa.TXT
IF EXIST TESTrkrustock2wa.TXT dnif.exe /I ".sys"<TESTrkrustock2wa.TXT|dnif.exe /I /V "beep.sys">nul && (
FOR /F "TOKENS=5 DELIMS=\." %%A in (TESTrkrustock2wa.TXT) DO (
ECHO %systemroot%\system32\drivers\%%A.sys>>RemLat.txt
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%A.sys dummy.sys >NUL
echo %%A>>apps\srv2.txt
echo %%A>>apps\svc.txt
echo %%A>>apps\legacy.txt
apps\sc config %%A start= disabled >nul
echo %systemroot%\system32\drivers\%%A.sys - Rustock.B/Spam-Mailbot.c>>TESTRKanT1.TXT
	))

IF EXIST TESTrkrustock2w.TXT dnif.exe /I "beep.sys"<TESTrkrustock2w.TXT>nul && (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg >>bprustockTEST2w.TXT
>bprustockres.txt (
echo.
echo [b]Infected beep.sys Found![/b]
echo.
echo beep.sys File Locations:
echo.
TYPE bprustockTEST2w.TXT
echo.
echo Rustock Infected File Listed Below:
echo.
TYPE TESTrkrustock2w.TXT
echo.
echo File copied to Backups Folder
echo Attempting to replace beep.sys with original version 
echo. )
for /f "tokens=*" %%a in (TESTrkrustock2w.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "FC1D32E680B71E97AC4BE3F567399D21">NUL && (
attrib +r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\xp\beep.sys >nul
ver|dnif.exe "Windows 2000">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\w2k\beep.sys >nul
	))

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:100062! /n /nr /O:"&W"|dnif.exe /I "sys">>TESTrkrustock1x.TXT
for /f "tokens=*" %%a in (TESTrkrustock1x.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "ED3F915C59B4B398D09A742C1D53A37C">NUL && echo %%~a>>TESTrkrustock2x.TXT

IF EXIST TESTrkrustock2x.TXT dnif.exe /I ".sys"<TESTrkrustock2x.TXT|dnif.exe /I /V "beep.sys">>TESTrkrustock2xa.TXT
IF EXIST TESTrkrustock2xa.TXT dnif.exe /I ".sys"<TESTrkrustock2xa.TXT|dnif.exe /I /V "beep.sys">nul && (
FOR /F "TOKENS=5 DELIMS=\." %%A in (TESTrkrustock2xa.TXT) DO (
ECHO %systemroot%\system32\drivers\%%A.sys>>RemLat.txt
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%A.sys dummy.sys >NUL
echo %%A>>apps\srv2.txt
echo %%A>>apps\svc.txt
echo %%A>>apps\legacy.txt
apps\sc config %%A start= disabled >nul
echo %systemroot%\system32\drivers\%%A.sys - Rustock.B/Spam-Mailbot.c>>TESTRKanT1.TXT
	))

IF EXIST TESTrkrustock2x.TXT dnif.exe /I "beep.sys"<TESTrkrustock2x.TXT>nul && (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg >>bprustockTEST2x.TXT
>bprustockres.txt (
echo.
echo [b]Infected beep.sys Found![/b]
echo.
echo beep.sys File Locations:
echo.
TYPE bprustockTEST2x.TXT
echo.
echo Rustock Infected File Listed Below:
echo.
TYPE TESTrkrustock2x.TXT
echo.
echo File copied to Backups Folder
echo Attempting to replace beep.sys with original version 
echo. )
for /f "tokens=*" %%a in (TESTrkrustock2x.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "ED3F915C59B4B398D09A742C1D53A37C">NUL && (
attrib +r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\xp\beep.sys >nul
ver|dnif.exe "Windows 2000">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\w2k\beep.sys >nul
	))

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:101342! /n /nr /O:"&W"|dnif.exe /I "sys">>TESTrkrustock1y.TXT
for /f "tokens=*" %%a in (TESTrkrustock1y.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "8DCD67243FABB01F3006432C414540E1">NUL && echo %%~a>>TESTrkrustock2y.TXT

IF EXIST TESTrkrustock2y.TXT dnif.exe /I ".sys"<TESTrkrustock2y.TXT|dnif.exe /I /V "beep.sys">>TESTrkrustock2ya.TXT
IF EXIST TESTrkrustock2ya.TXT dnif.exe /I ".sys"<TESTrkrustock2ya.TXT|dnif.exe /I /V "beep.sys">nul && (
FOR /F "TOKENS=5 DELIMS=\." %%A in (TESTrkrustock2ya.TXT) DO (
ECHO %systemroot%\system32\drivers\%%A.sys>>RemLat.txt
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%A.sys dummy.sys >NUL
echo %%A>>apps\srv2.txt
echo %%A>>apps\svc.txt
echo %%A>>apps\legacy.txt
apps\sc config %%A start= disabled >nul
echo %systemroot%\system32\drivers\%%A.sys - Rustock.B/Spam-Mailbot.c>>TESTRKanT1.TXT
	))

IF EXIST TESTrkrustock2y.TXT dnif.exe /I "beep.sys"<TESTrkrustock2y.TXT>nul && (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg >>bprustockTEST2y.TXT
>bprustockres.txt (
echo.
echo [b]Infected beep.sys Found![/b]
echo.
echo beep.sys File Locations:
echo.
TYPE bprustockTEST2y.TXT
echo.
echo Rustock Infected File Listed Below:
echo.
TYPE TESTrkrustock2y.TXT
echo.
echo File copied to Backups Folder
echo Attempting to replace beep.sys with original version 
echo. )
for /f "tokens=*" %%a in (TESTrkrustock2y.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "8DCD67243FABB01F3006432C414540E1">NUL && (
attrib +r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\xp\beep.sys >nul
ver|dnif.exe "Windows 2000">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\w2k\beep.sys >nul
	))

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:104178! /n /nr /O:"&W"|dnif.exe /I "sys">>TESTrkrustock1z.TXT
for /f "tokens=*" %%a in (TESTrkrustock1z.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "6E857E6A76C57F1B3B1FEF8304E36E2A">NUL && echo %%~a>>TESTrkrustock2z.TXT

IF EXIST TESTrkrustock2z.TXT dnif.exe /I ".sys"<TESTrkrustock2z.TXT|dnif.exe /I /V "beep.sys">>TESTrkrustock2za.TXT
IF EXIST TESTrkrustock2za.TXT dnif.exe /I ".sys"<TESTrkrustock2za.TXT|dnif.exe /I /V "beep.sys">nul && (
FOR /F "TOKENS=5 DELIMS=\." %%A in (TESTrkrustock2za.TXT) DO (
ECHO %systemroot%\system32\drivers\%%A.sys>>RemLat.txt
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%A.sys dummy.sys >NUL
echo %%A>>apps\srv2.txt
echo %%A>>apps\svc.txt
echo %%A>>apps\legacy.txt
apps\sc config %%A start= disabled >nul
echo %systemroot%\system32\drivers\%%A.sys - Rustock.B/Spam-Mailbot.c>>TESTRKanT1.TXT
	))

IF EXIST TESTrkrustock2z.TXT dnif.exe /I "beep.sys"<TESTrkrustock2z.TXT>nul && (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg >>bprustockTEST2z.TXT
>bprustockres.txt (
echo.
echo [b]Infected beep.sys Found![/b]
echo.
echo beep.sys File Locations:
echo.
TYPE bprustockTEST2z.TXT
echo.
echo Rustock Infected File Listed Below:
echo.
TYPE TESTrkrustock2z.TXT
echo.
echo File copied to Backups Folder
echo Attempting to replace beep.sys with original version 
echo. )
for /f "tokens=*" %%a in (TESTrkrustock2z.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "6E857E6A76C57F1B3B1FEF8304E36E2A">NUL && (
attrib +r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\xp\beep.sys >nul
ver|dnif.exe "Windows 2000">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\w2k\beep.sys >nul
	))

apps\locate "%systemroot%\*.sys" /D- /s:75698! /n /nr /O:"&W"|dnif.exe /I "sys">>TESTrkrustock1z1a.TXT
for /f "tokens=*" %%a in (TESTrkrustock1z1a.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "7C9EC6774DC19845C8DA3ADFAE328043">NUL && echo %%~a>>TESTrkrustock2z1a.TXT

IF EXIST TESTrkrustock2z1a.TXT dnif.exe /I ".sys"<TESTrkrustock2z1a.TXT|dnif.exe /I /V "beep.sys">>TESTrkrustock2za1a.TXT
IF EXIST TESTrkrustock2za1a.TXT dnif.exe /I ".sys"<TESTrkrustock2za1a.TXT|dnif.exe /I /V "beep.sys">nul && (
FOR /F "TOKENS=3 DELIMS=\." %%A in (TESTrkrustock2za1a.TXT) DO (
ECHO %systemroot%\%%A.sys>>RemLat.txt
apps\Cghtme.exe -l nul -o %systemroot%\%%A.sys dummy.sys >NUL
echo %%A>>apps\srv2.txt
echo %%A>>apps\svc.txt
echo %%A>>apps\legacy.txt
apps\sc config %%A start= disabled >nul
echo %systemroot%\%%A.sys - Rustock.B/Spam-Mailbot.c>>TESTRKanT1.TXT
	))

IF EXIST TESTrkrustock2z1a.TXT dnif.exe /I "beep.sys"<TESTrkrustock2z1a.TXT>nul && (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg >>bprustockTEST2z1a.TXT
>bprustockres.txt (
echo.
echo [b]Infected beep.sys Found![/b]
echo.
echo beep.sys File Locations:
echo.
TYPE bprustockTEST2z1a.TXT
echo.
echo Rustock Infected File Listed Below:
echo.
TYPE TESTrkrustock2z1a.TXT
echo.
echo File copied to Backups Folder
echo Attempting to replace beep.sys with original version 
echo. )
for /f "tokens=*" %%a in (TESTrkrustock2z1a.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "7C9EC6774DC19845C8DA3ADFAE328043">NUL && (
attrib +r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\xp\beep.sys >nul
ver|dnif.exe "Windows 2000">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\w2k\beep.sys >nul
	))

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:90582! /n /nr /O:"&W"|dnif.exe /I "sys">>TESTrkrustock1z1b.TXT
for /f "tokens=*" %%a in (TESTrkrustock1z1b.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "02F4DAA51ACF49ED4FBB3BEC7B321E28">NUL && echo %%~a>>TESTrkrustock2z1b.TXT

IF EXIST TESTrkrustock2z1b.TXT dnif.exe /I ".sys"<TESTrkrustock2z1b.TXT|dnif.exe /I /V "beep.sys">>TESTrkrustock2za1b.TXT
IF EXIST TESTrkrustock2za1b.TXT dnif.exe /I ".sys"<TESTrkrustock2za1b.TXT|dnif.exe /I /V "beep.sys">nul && (
FOR /F "TOKENS=5 DELIMS=\." %%A in (TESTrkrustock2za1b.TXT) DO (
ECHO %systemroot%\system32\drivers\%%A.sys>>RemLat.txt
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%A.sys dummy.sys >NUL
echo %%A>>apps\srv2.txt
echo %%A>>apps\svc.txt
echo %%A>>apps\legacy.txt
apps\sc config %%A start= disabled >nul
echo %systemroot%\system32\drivers\%%A.sys - Rustock.B/Spam-Mailbot.c>>TESTRKanT1.TXT
	))

IF EXIST TESTrkrustock2z1b.TXT dnif.exe /I "beep.sys"<TESTrkrustock2z1b.TXT>nul && (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg >>bprustockTEST2z1b.TXT
>bprustockres.txt (
echo.
echo [b]Infected beep.sys Found![/b]
echo.
echo beep.sys File Locations:
echo.
TYPE bprustockTEST2z1b.TXT
echo.
echo Rustock Infected File Listed Below:
echo.
TYPE TESTrkrustock2z1b.TXT
echo.
echo File copied to Backups Folder
echo Attempting to replace beep.sys with original version 
echo. )
for /f "tokens=*" %%a in (TESTrkrustock2z1b.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "02F4DAA51ACF49ED4FBB3BEC7B321E28">NUL && (
attrib +r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\xp\beep.sys >nul
ver|dnif.exe "Windows 2000">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\w2k\beep.sys >nul
	))

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:25600! /n /nr /O:"&W"|dnif.exe /I "sys">>TESTrkrustock1z1c.TXT
for /f "tokens=*" %%a in (TESTrkrustock1z1c.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "06854109B7AA734743FE9B2277A47150">NUL && echo %%~a>>TESTrkrustock2z1c.TXT

IF EXIST TESTrkrustock2z1c.TXT dnif.exe /I ".sys"<TESTrkrustock2z1c.TXT|dnif.exe /I /V "beep.sys">>TESTrkrustock2za1c.TXT
IF EXIST TESTrkrustock2za1c.TXT dnif.exe /I ".sys"<TESTrkrustock2za1c.TXT|dnif.exe /I /V "beep.sys">nul && (
FOR /F "TOKENS=5 DELIMS=\." %%A in (TESTrkrustock2za1c.TXT) DO (
ECHO %systemroot%\system32\drivers\%%A.sys>>RemLat.txt
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%A.sys dummy.sys >NUL
echo %%A>>apps\srv2.txt
echo %%A>>apps\svc.txt
echo %%A>>apps\legacy.txt
apps\sc config %%A start= disabled >nul
echo %systemroot%\system32\drivers\%%A.sys - Rustock.B/Spam-Mailbot.c>>TESTRKanT1.TXT
	))

IF EXIST TESTrkrustock2z1c.TXT dnif.exe /I "beep.sys"<TESTrkrustock2z1c.TXT>nul && (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg >>bprustockTEST2z1c.TXT
>bprustockres.txt (
echo.
echo [b]Infected beep.sys Found![/b]
echo.
echo beep.sys File Locations:
echo.
TYPE bprustockTEST2z1c.TXT
echo.
echo Rustock Infected File Listed Below:
echo.
TYPE TESTrkrustock2z1c.TXT
echo.
echo File copied to Backups Folder
echo Attempting to replace beep.sys with original version 
echo. )
for /f "tokens=*" %%a in (TESTrkrustock2z1c.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "06854109B7AA734743FE9B2277A47150">NUL && (
attrib +r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\xp\beep.sys >nul
ver|dnif.exe "Windows 2000">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\w2k\beep.sys >nul
	))

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:109150! /n /nr /O:"&W"|dnif.exe /I "sys">>TESTrkrustock1z1e.TXT
for /f "tokens=*" %%a in (TESTrkrustock1z1e.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "5F52CFA27216129B8190E28445D45E9C">NUL && echo %%~a>>TESTrkrustock2z1e.TXT

IF EXIST TESTrkrustock2z1e.TXT dnif.exe /I ".sys"<TESTrkrustock2z1e.TXT|dnif.exe /I /V "beep.sys">>TESTrkrustock2za1e.TXT
IF EXIST TESTrkrustock2za1e.TXT dnif.exe /I ".sys"<TESTrkrustock2za1e.TXT|dnif.exe /I /V "beep.sys">nul && (
FOR /F "TOKENS=5 DELIMS=\." %%A in (TESTrkrustock2za1e.TXT) DO (
ECHO %systemroot%\system32\drivers\%%A.sys>>RemLat.txt
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%A.sys dummy.sys >NUL
echo %%A>>apps\srv2.txt
echo %%A>>apps\svc.txt
echo %%A>>apps\legacy.txt
apps\sc config %%A start= disabled >nul
echo %systemroot%\system32\drivers\%%A.sys - Rustock.B/Spam-Mailbot.c>>TESTRKanT1.TXT
	))

IF EXIST TESTrkrustock2z1e.TXT dnif.exe /I "beep.sys"<TESTrkrustock2z1e.TXT>nul && (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg >>bprustockTEST2z1e.TXT
>bprustockres.txt (
echo.
echo [b]Infected beep.sys Found![/b]
echo.
echo beep.sys File Locations:
echo.
TYPE bprustockTEST2z1e.TXT
echo.
echo Rustock Infected File Listed Below:
echo.
TYPE TESTrkrustock2z1e.TXT
echo.
echo File copied to Backups Folder
echo Attempting to replace beep.sys with original version 
echo. )
for /f "tokens=*" %%a in (TESTrkrustock2z1e.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "5F52CFA27216129B8190E28445D45E9C">NUL && (
attrib +r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\xp\beep.sys >nul
ver|dnif.exe "Windows 2000">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\w2k\beep.sys >nul
	))

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:65214! /n /nr /O:"&W"|dnif.exe /I "sys">>TESTrkrustock1z1f.TXT
for /f "tokens=*" %%a in (TESTrkrustock1z1f.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "A46870173469992FEBE10AF9F43A5351">NUL && echo %%~a>>TESTrkrustock2z1f.TXT

IF EXIST TESTrkrustock2z1f.TXT dnif.exe /I ".sys"<TESTrkrustock2z1f.TXT|dnif.exe /I /V "beep.sys">>TESTrkrustock2za1f.TXT
IF EXIST TESTrkrustock2za1f.TXT dnif.exe /I ".sys"<TESTrkrustock2za1f.TXT|dnif.exe /I /V "beep.sys">nul && (
FOR /F "TOKENS=5 DELIMS=\." %%A in (TESTrkrustock2za1f.TXT) DO (
ECHO %systemroot%\system32\drivers\%%A.sys>>RemLat.txt
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%A.sys dummy.sys >NUL
echo %%A>>apps\srv2.txt
echo %%A>>apps\svc.txt
echo %%A>>apps\legacy.txt
apps\sc config %%A start= disabled >nul
echo %systemroot%\system32\drivers\%%A.sys - Rustock.B/Spam-Mailbot.c>>TESTRKanT1.TXT
	))

IF EXIST TESTrkrustock2z1f.TXT dnif.exe /I "beep.sys"<TESTrkrustock2z1f.TXT>nul && (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg >>bprustockTEST2z1f.TXT
>bprustockres.txt (
echo.
echo [b]Infected beep.sys Found![/b]
echo.
echo beep.sys File Locations:
echo.
TYPE bprustockTEST2z1f.TXT
echo.
echo Rustock Infected File Listed Below:
echo.
TYPE TESTrkrustock2z1f.TXT
echo.
echo File copied to Backups Folder
echo Attempting to replace beep.sys with original version 
echo. )
for /f "tokens=*" %%a in (TESTrkrustock2z1f.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "A46870173469992FEBE10AF9F43A5351">NUL && (
attrib +r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\xp\beep.sys >nul
ver|dnif.exe "Windows 2000">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\w2k\beep.sys >nul
	))

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:76988! /n /nr /O:"&W"|dnif.exe /I "sys">>TESTrkrustock1z1g.TXT
for /f "tokens=*" %%a in (TESTrkrustock1z1g.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "458A176490CF2575533A15F4FB1C31D8">NUL && echo %%~a>>TESTrkrustock2z1g.TXT

IF EXIST TESTrkrustock2z1g.TXT dnif.exe /I ".sys"<TESTrkrustock2z1g.TXT|dnif.exe /I /V "beep.sys">>TESTrkrustock2za1g.TXT
IF EXIST TESTrkrustock2za1g.TXT dnif.exe /I ".sys"<TESTrkrustock2za1g.TXT|dnif.exe /I /V "beep.sys">nul && (
FOR /F "TOKENS=5 DELIMS=\." %%A in (TESTrkrustock2za1g.TXT) DO (
ECHO %systemroot%\system32\drivers\%%A.sys>>RemLat.txt
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%A.sys dummy.sys >NUL
echo %%A>>apps\srv2.txt
echo %%A>>apps\svc.txt
echo %%A>>apps\legacy.txt
apps\sc config %%A start= disabled >nul
echo %systemroot%\system32\drivers\%%A.sys - Rustock.B/Spam-Mailbot.c>>TESTRKanT1.TXT
	))

IF EXIST TESTrkrustock2z1g.TXT dnif.exe /I "beep.sys"<TESTrkrustock2z1g.TXT>nul && (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg >>bprustockTEST2z1g.TXT
>bprustockres.txt (
echo.
echo [b]Infected beep.sys Found![/b]
echo.
echo beep.sys File Locations:
echo.
TYPE bprustockTEST2z1g.TXT
echo.
echo Rustock Infected File Listed Below:
echo.
TYPE TESTrkrustock2z1g.TXT
echo.
echo File copied to Backups Folder
echo Attempting to replace beep.sys with original version 
echo. )
for /f "tokens=*" %%a in (TESTrkrustock2z1g.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "458A176490CF2575533A15F4FB1C31D8">NUL && (
attrib +r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\xp\beep.sys >nul
ver|dnif.exe "Windows 2000">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\w2k\beep.sys >nul
	))

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:85924! /n /nr /O:"&W"|dnif.exe /I "sys">>TESTrkrustock1z1h.TXT
for /f "tokens=*" %%a in (TESTrkrustock1z1h.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "4A8E3CF0B97142A7F4962AEB7A90EE9B">NUL && echo %%~a>>TESTrkrustock2z1h.TXT

IF EXIST TESTrkrustock2z1h.TXT dnif.exe /I ".sys"<TESTrkrustock2z1h.TXT|dnif.exe /I /V "beep.sys">>TESTrkrustock2za1h.TXT
IF EXIST TESTrkrustock2za1h.TXT dnif.exe /I ".sys"<TESTrkrustock2za1h.TXT|dnif.exe /I /V "beep.sys">nul && (
FOR /F "TOKENS=5 DELIMS=\." %%A in (TESTrkrustock2za1h.TXT) DO (
ECHO %systemroot%\system32\drivers\%%A.sys>>RemLat.txt
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%A.sys dummy.sys >NUL
echo %%A>>apps\srv2.txt
echo %%A>>apps\svc.txt
echo %%A>>apps\legacy.txt
apps\sc config %%A start= disabled >nul
echo %systemroot%\system32\drivers\%%A.sys - Rustock.B/Spam-Mailbot.c>>TESTRKanT1.TXT
	))

IF EXIST TESTrkrustock2z1h.TXT dnif.exe /I "beep.sys"<TESTrkrustock2z1h.TXT>nul && (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg >>bprustockTEST2z1h.TXT
>bprustockres.txt (
echo.
echo [b]Infected beep.sys Found![/b]
echo.
echo beep.sys File Locations:
echo.
TYPE bprustockTEST2z1h.TXT
echo.
echo Rustock Infected File Listed Below:
echo.
TYPE TESTrkrustock2z1h.TXT
echo.
echo File copied to Backups Folder
echo Attempting to replace beep.sys with original version 
echo. )
for /f "tokens=*" %%a in (TESTrkrustock2z1h.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "4A8E3CF0B97142A7F4962AEB7A90EE9B">NUL && (
attrib +r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\xp\beep.sys >nul
ver|dnif.exe "Windows 2000">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\w2k\beep.sys >nul
	))

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:96726! /n /nr /O:"&W"|dnif.exe /I "sys">>TESTrkrustock1z1i.TXT
for /f "tokens=*" %%a in (TESTrkrustock1z1i.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "05B685273DBD12C8E09348754B6BDB28">NUL && echo %%~a>>TESTrkrustock2z1i.TXT

IF EXIST TESTrkrustock2z1i.TXT dnif.exe /I ".sys"<TESTrkrustock2z1i.TXT|dnif.exe /I /V "beep.sys">>TESTrkrustock2za1i.TXT
IF EXIST TESTrkrustock2za1i.TXT dnif.exe /I ".sys"<TESTrkrustock2za1i.TXT|dnif.exe /I /V "beep.sys">nul && (
FOR /F "TOKENS=5 DELIMS=\." %%A in (TESTrkrustock2za1i.TXT) DO (
ECHO %systemroot%\system32\drivers\%%A.sys>>RemLat.txt
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%A.sys dummy.sys >NUL
echo %%A>>apps\srv2.txt
echo %%A>>apps\svc.txt
echo %%A>>apps\legacy.txt
apps\sc config %%A start= disabled >nul
echo %systemroot%\system32\drivers\%%A.sys - Rustock.B/Spam-Mailbot.c>>TESTRKanT1.TXT
	))

IF EXIST TESTrkrustock2z1i.TXT dnif.exe /I "beep.sys"<TESTrkrustock2z1i.TXT>nul && (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg >>bprustockTEST2z1i.TXT
>bprustockres.txt (
echo.
echo [b]Infected beep.sys Found![/b]
echo.
echo beep.sys File Locations:
echo.
TYPE bprustockTEST2z1i.TXT
echo.
echo Rustock Infected File Listed Below:
echo.
TYPE TESTrkrustock2z1i.TXT
echo.
echo File copied to Backups Folder
echo Attempting to replace beep.sys with original version 
echo. )
for /f "tokens=*" %%a in (TESTrkrustock2z1i.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "05B685273DBD12C8E09348754B6BDB28">NUL && (
attrib +r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\xp\beep.sys >nul
ver|dnif.exe "Windows 2000">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\w2k\beep.sys >nul
	))

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:105858! /n /nr /O:"&W"|dnif.exe /I "sys">>TESTrkrustock1z1j.TXT
for /f "tokens=*" %%a in (TESTrkrustock1z1j.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "DB0F7AEE649EB55E59910393464950E3">NUL && echo %%~a>>TESTrkrustock2z1j.TXT

IF EXIST TESTrkrustock2z1j.TXT dnif.exe /I ".sys"<TESTrkrustock2z1j.TXT|dnif.exe /I /V "beep.sys">>TESTrkrustock2za1j.TXT
IF EXIST TESTrkrustock2za1j.TXT dnif.exe /I ".sys"<TESTrkrustock2za1j.TXT|dnif.exe /I /V "beep.sys">nul && (
FOR /F "TOKENS=5 DELIMS=\." %%A in (TESTrkrustock2za1j.TXT) DO (
ECHO %systemroot%\system32\drivers\%%A.sys>>RemLat.txt
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%A.sys dummy.sys >NUL
echo %%A>>apps\srv2.txt
echo %%A>>apps\svc.txt
echo %%A>>apps\legacy.txt
apps\sc config %%A start= disabled >nul
echo %systemroot%\system32\drivers\%%A.sys - Rustock.B/Spam-Mailbot.c>>TESTRKanT1.TXT
	))

IF EXIST TESTrkrustock2z1j.TXT dnif.exe /I "beep.sys"<TESTrkrustock2z1j.TXT>nul && (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg >>bprustockTEST2z1j.TXT
>bprustockres.txt (
echo.
echo [b]Infected beep.sys Found![/b]
echo.
echo beep.sys File Locations:
echo.
TYPE bprustockTEST2z1j.TXT
echo.
echo Rustock Infected File Listed Below:
echo.
TYPE TESTrkrustock2z1j.TXT
echo.
echo File copied to Backups Folder
echo Attempting to replace beep.sys with original version 
echo. )
for /f "tokens=*" %%a in (TESTrkrustock2z1j.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "DB0F7AEE649EB55E59910393464950E3">NUL && (
attrib +r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\xp\beep.sys >nul
ver|dnif.exe "Windows 2000">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\w2k\beep.sys >nul
	))

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:100702! /n /nr /O:"&W"|dnif.exe /I "sys">>TESTrkrustock1z1k.TXT
for /f "tokens=*" %%a in (TESTrkrustock1z1k.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "E1A703EF8295089605C74FCA1E8AEA75">NUL && echo %%~a>>TESTrkrustock2z1k.TXT

IF EXIST TESTrkrustock2z1k.TXT dnif.exe /I ".sys"<TESTrkrustock2z1k.TXT|dnif.exe /I /V "beep.sys">>TESTrkrustock2za1k.TXT
IF EXIST TESTrkrustock2za1k.TXT dnif.exe /I ".sys"<TESTrkrustock2za1k.TXT|dnif.exe /I /V "beep.sys">nul && (
FOR /F "TOKENS=5 DELIMS=\." %%A in (TESTrkrustock2za1k.TXT) DO (
ECHO %systemroot%\system32\drivers\%%A.sys>>RemLat.txt
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%A.sys dummy.sys >NUL
echo %%A>>apps\srv2.txt
echo %%A>>apps\svc.txt
echo %%A>>apps\legacy.txt
apps\sc config %%A start= disabled >nul
echo %systemroot%\system32\drivers\%%A.sys - Rustock.B/Spam-Mailbot.c>>TESTRKanT1.TXT
	))

IF EXIST TESTrkrustock2z1k.TXT dnif.exe /I "beep.sys"<TESTrkrustock2z1k.TXT>nul && (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg >>bprustockTEST2z1k.TXT
>bprustockres.txt (
echo.
echo [b]Infected beep.sys Found![/b]
echo.
echo beep.sys File Locations:
echo.
TYPE bprustockTEST2z1k.TXT
echo.
echo Rustock Infected File Listed Below:
echo.
TYPE TESTrkrustock2z1k.TXT
echo.
echo File copied to Backups Folder
echo Attempting to replace beep.sys with original version 
echo. )
for /f "tokens=*" %%a in (TESTrkrustock2z1k.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "E1A703EF8295089605C74FCA1E8AEA75">NUL && (
attrib +r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\xp\beep.sys >nul
ver|dnif.exe "Windows 2000">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\w2k\beep.sys >nul
	))

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:103394! /n /nr /O:"&W"|dnif.exe /I "sys">>TESTrkrustock1z1l.TXT
for /f "tokens=*" %%a in (TESTrkrustock1z1l.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "65b0fc47423b5d4d75426856914a729c">NUL && echo %%~a>>TESTrkrustock2z1l.TXT

IF EXIST TESTrkrustock2z1l.TXT dnif.exe /I ".sys"<TESTrkrustock2z1l.TXT|dnif.exe /I /V "beep.sys">>TESTrkrustock2za1l.TXT
IF EXIST TESTrkrustock2za1l.TXT dnif.exe /I ".sys"<TESTrkrustock2za1l.TXT|dnif.exe /I /V "beep.sys">nul && (
FOR /F "TOKENS=5 DELIMS=\." %%A in (TESTrkrustock2za1l.TXT) DO (
ECHO %systemroot%\system32\drivers\%%A.sys>>RemLat.txt
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%A.sys dummy.sys >NUL
echo %%A>>apps\srv2.txt
echo %%A>>apps\svc.txt
echo %%A>>apps\legacy.txt
apps\sc config %%A start= disabled >nul
echo %systemroot%\system32\drivers\%%A.sys - Rustock.B/Spam-Mailbot.c>>TESTRKanT1.TXT
	))

IF EXIST TESTrkrustock2z1l.TXT dnif.exe /I "beep.sys"<TESTrkrustock2z1l.TXT>nul && (
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg >>bprustockTEST2z1l.TXT
>bprustockres.txt (
echo.
echo [b]Infected beep.sys Found![/b]
echo.
echo beep.sys File Locations:
echo.
TYPE bprustockTEST2z1l.TXT
echo.
echo Rustock Infected File Listed Below:
echo.
TYPE TESTrkrustock2z1l.TXT
echo.
echo File copied to Backups Folder
echo Attempting to replace beep.sys with original version 
echo. )
for /f "tokens=*" %%a in (TESTrkrustock2z1l.TXT) do apps\MD5File.exe "%%~a"|dnif.exe /I "65b0fc47423b5d4d75426856914a729c">NUL && (
attrib +r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\xp\beep.sys >nul
ver|dnif.exe "Windows 2000">nul && apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\beep.sys apps\Replace\w2k\beep.sys >nul
	))

apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:86016! /n /nr /O:"&W"|dnif.exe /I "sys">>TESTrkCore1.TXT
apps\locate "%systemroot%\system32\drivers\*.sys" /D- /s:86144! /n /nr /O:"&W"|dnif.exe /I "sys">>TESTrkCore1.TXT
rtsdnif.exe /m /f:TESTrkCore1.TXT "tndriver">>TESTrkCore2.TXT 2>NUL
rtsdnif.exe /m /f:TESTrkCore2.TXT "CORE.pdb">>TESTrkCore3.TXT 2>NUL
IF EXIST TESTrkCore3.TXT FOR /F "TOKENS=*" %%b in (TESTrkCore3.TXT) DO echo %%~b>>TESTrkCore4.TXT
IF EXIST TESTrkCore4.TXT dnif.exe /I ".sys"<TESTrkCore4.TXT>nul && (
FOR /F "TOKENS=5 DELIMS=\." %%A in (TESTrkCore4.TXT) DO (
ECHO %systemroot%\system32\drivers\%%A.sys>>RemLat.txt
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%A.sys dummy.sys >NUL
echo %%A>>apps\srv2.txt
echo %%A>>apps\svc.txt
echo %%A>>apps\legacy.txt
apps\sc config %%A start= disabled >nul
echo %systemroot%\system32\drivers\%%A.sys - [B]Troj/NtRootK-DQ / Trojan.Garntet[/B]>>TESTRKanT1.TXT
	))

apps\Csweg.exe query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\clbdriver"|dnif.exe /I "Imagepath"|dnif.exe /I "clbdriver.sys">nul && (
apps\Csweg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\clbdriver" /v "start" /t REG_DWORD /d "4" >nul
if exist %systemroot%\system32\drivers\clbdriver.sys echo %systemroot%\system32\drivers\clbdriver.sys - WinNT/Rootkitdrv.DM>>TESTRKanT1.TXT
	)

apps\Csweg.exe query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\clbdriver"|dnif.exe /I "Imagepath"|dnif.exe /I "vmdesched.sys">nul && (
apps\Csweg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\clbdriver" /v "start" /t REG_DWORD /d "4"
ECHO %systemroot%\system32\drivers\vmdesched.sys>>RemLat.txt
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\vmdesched.sys dummy.sys >NUL
if exist %systemroot%\system32\drivers\vmdesched.sys echo %systemroot%\system32\drivers\vmdesched.sys - WinNT/Rootkitdrv.DM>>TESTRKanT1.TXT
	)

apps\Csweg.exe query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msliksurserv"|dnif.exe /I "Imagepath"|dnif.exe /I "msliksurserv.sys">nul && (
apps\Csweg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msliksurserv" /v "start" /t REG_DWORD /d "4" >nul
if exist %systemroot%\system32\drivers\msliksurserv.sys echo %systemroot%\system32\drivers\msliksurserv.sys - WinNT/Rootkitdrv.DM>>TESTRKanT1.TXT
	)

apps\Csweg.exe query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tdssserv"|dnif.exe /I "Imagepath"|dnif.exe /I "tdss">nul && (
apps\Csweg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tdssserv" /v "start" /t REG_DWORD /d "4" >nul
IF EXIST TESTtdsss1.TXT DNIF /I ".sys"<TESTtdsss1.TXT>NUL && For /f "tokens=5 delims=\." %%G in (TESTtdsss1.TXT) do if exist %systemroot%\system32\drivers\%%G.sys echo %systemroot%\system32\drivers\%%G.sys - Rootkit.Win32.Agent.cku>>TESTRKanT1.TXT
	)

apps\Csweg.exe query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TDSSserv.sys)"|dnif.exe /I "Imagepath"|dnif.exe /I "tdss">nul && (
apps\Csweg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TDSSserv.sys)" /v "start" /t REG_DWORD /d "4" >nul
IF EXIST TESTtdsss1a.TXT For /f "tokens=5 delims=\." %%G in (TESTtdsss1a.TXT) do if exist %systemroot%\system32\drivers\%%G.sys echo %systemroot%\system32\drivers\%%G.sys - Rootkit.Win32.Agent.cku>>TESTRKanT1.TXT
	)

apps\Csweg.exe query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TDSSserv.sys"|dnif.exe /I "Imagepath"|dnif.exe /I "tdss">nul && (
apps\Csweg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TDSSserv.sys" /v "start" /t REG_DWORD /d "4" >nul
IF EXIST TESTtdsss1b.TXT For /f "tokens=5 delims=\." %%G in (TESTtdsss1b.TXT) do if exist %systemroot%\system32\drivers\%%G.sys echo %systemroot%\system32\drivers\%%G.sys - Rootkit.Win32.Agent.cku>>TESTRKanT1.TXT
	)

IF EXIST TESTWOUT*.txt DEL /Q TESTWOUT*.txt >NUL
apps\Csweg QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /V System|dnif.exe /I ".exe" >>TESTWOUT1.txt
IF EXIST TESTWOUT1.txt dnif.exe /I "kd"<TESTWOUT1.txt|dnif.exe /I ".exe">>TESTWOUT2.txt
IF EXIST TESTWOUT1.txt dnif.exe /I "cs"<TESTWOUT1.txt|dnif.exe /I ".exe">>TESTWOUT2.txt
IF EXIST TESTWOUT2.txt dnif.exe /I "."<TESTWOUT2.txt>NUL && For /F "TOKENS=3 delims=		." %%g IN (TESTWOUT2.txt) DO (
apps\Cghtme.exe -l nul -e %systemroot%\system32\%%g.exe >NUL
echo %systemroot%\system32\%%g.exe>>Find.txt
echo.>>Woutres.txt
echo DNSChanger Trojan Found!>>Woutres.txt
echo.>>Woutres.txt
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]>>Woutres.txt
echo "System"="%%g.exe">>Woutres.txt
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]>>Woutres.txt
echo "%windir:\=\\%\\system32\\%%g.exe">>Woutres.txt
echo.>>Woutres.txt
echo Restoring Default System value>>Woutres.txt
echo.>>Woutres.txt
>DNSChangerfix.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion]
echo "%%g.exe"=-
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
echo "%windir:\=\\%\\system32\\%%g.exe"=-
echo. 
	)
editreg.exe /s DNSChangerfix.reg 2>NUL
COPY /Y DNSChangerfix.reg .\backups>nul
	)

CLS
echo.
echo Starting Repairs
echo.
echo Checking Running Processes and Services
echo.
echo.
echo Please Be Patient As This May Take Up To 20 Minutes
echo.

IF EXIST TESTsv*.TXT DEL /Q TESTsv*.TXT >NUL
IF EXIST apps\TESTserv*.txt DEL /Q apps\TESTserv*.txt >NUL
IF EXIST Findbhos1.txt dnif.exe /I "."<Findbhos1.txt>NUL && apps\locate "%systemroot%\system32\drivers\*.dat" /D- /n /nr>nul && goto gadatsvc

goto nogodat

:gadatsvc

apps\sc query type= driver|dnif.exe "SERVICE_NAME">>TESTservs0.txt
For /f "tokens=2 delims= " %%G in (TESTservs0.txt) do echo %%G>>TESTservs1.txt
For /f "tokens=*" %%e in (TESTservs1.txt) do apps\Csweg.exe QUERY "HKLM\System\CurrentControlSet\Services\%%e" /V ImagePath|dnif.exe /I "ImagePath"|dnif.exe /I "drivers"|dnif.exe /I ".dat">nul && (
echo %%G>>apps\svc.txt
apps\sc config %%G start= disabled >nul
echo %%G>>TESTservs4.txt
	)

IF EXIST TESTservs4.txt For /f "tokens=*" %%G in (TESTservs4.txt) do apps\Csweg.exe QUERY "HKLM\System\CurrentControlSet\Services\%%G" /V ImagePath|dnif.exe /I "ImagePath"|dnif.exe /I "drivers"|dnif.exe /I ".dat">>TESTservs5.txt
IF EXIST TESTserv5.txt For /f "tokens=4 delims=\. " %%G in (TESTservs5.txt) do IF EXIST %systemroot%\system32\drivers\%%G.dat (
echo %systemroot%\system32\drivers\%%G.dat>>RemLat.txt
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%G.dat dummy.sys >NUL
	)

:nogodat

IF EXIST "%systemroot%\system32\Microsoft\backup.ftp" goto replacetp
IF EXIST "%systemroot%\system32\Microsoft\backup.tftp" goto replacetp

goto sdstart

:replacetp

>> ftpcheck.txt (
echo.
if exist %systemroot%\system32\Microsoft\backup.ftp echo %systemroot%\system32\Microsoft\backup.ftp Found
if exist %systemroot%\system32\Microsoft\backup.tftp echo %systemroot%\system32\Microsoft\backup.tftp Found
echo.
echo [b]Checking files[/b]: 
echo.)

>tplocs.txt (
echo %systemroot%\system32\Microsoft\backup.ftp
echo %systemroot%\system32\Microsoft\backup.tftp
echo %systemroot%\system32\ftp.exe
echo %systemroot%\system32\tftp.exe
echo %systemroot%\system32\dllcache\ftp.exe
echo %systemroot%\system32\dllcache\tftp.exe 
	)

echo %systemroot%\system32\Microsoft\backup.ftp>tplocsbakf.txt
echo %systemroot%\system32\Microsoft\backup.tftp>tplocsbakt.txt

>>ftpcheck.txt (
rtsdnif.exe /m /f:tplocs.txt "XcptFilter">nul && echo [b]Genuine[/b]:
rtsdnif.exe /m /f:tplocs.txt "XcptFilter"
echo.
rtsdnif.exe /m /f:tplocs.txt "JARich">nul && echo [b]Dummy[/b]:
rtsdnif.exe /m /f:tplocs.txt "JARich" 
	)

rtsdnif.exe /m /f:tplocs.txt "JARich" && goto startrep

goto sdstart

:startrep

rtsdnif.exe /m /f:tplocsbakf.txt "XcptFilter" && COPY /Y "%systemroot%\system32\ftp.exe" backups >nul
rtsdnif.exe /m /f:tplocsbakt.txt "XcptFilter" && COPY /Y "%systemroot%\system32\tftp.exe" backups >nul
rtsdnif.exe /m /f:tplocsbakf.txt "XcptFilter" && COPY /Y "%systemroot%\system32\Microsoft\backup.ftp" "%systemroot%\system32\dllcache\ftp.exe" >nul
rtsdnif.exe /m /f:tplocsbakt.txt "XcptFilter" && COPY /Y "%systemroot%\system32\Microsoft\backup.tftp" "%systemroot%\system32\dllcache\tftp.exe" >nul
rtsdnif.exe /m /f:tplocsbakf.txt "XcptFilter" && COPY /Y "%systemroot%\system32\Microsoft\backup.ftp" "%systemroot%\system32\ftp.exe" >nul
rtsdnif.exe /m /f:tplocsbakt.txt "XcptFilter" && COPY /Y "%systemroot%\system32\Microsoft\backup.tftp" "%systemroot%\system32\tftp.exe" >nul

CLS
echo.
echo Starting Repairs
echo.
echo Checking Running Processes and Services
echo.
echo.
echo Please Be Patient As This May Take Up To 20 Minutes
echo.

>> ftpcheck.txt (
echo.
echo Files copied to the SDFix\Backups folder
echo Restoring original files if backups exist
echo. 
echo [b]Rechecking Files[/b]:
echo.
rtsdnif.exe /m /f:tplocs.txt "XcptFilter">nul && echo [b]Genuine[/b]:
rtsdnif.exe /m /f:tplocs.txt "XcptFilter"
echo.
rtsdnif.exe /m /f:tplocs.txt "JARich">nul && echo [b]Dummy[/b]:
rtsdnif.exe /m /f:tplocs.txt "JARich" 
echo. 
	)

:sdstart

CLS
echo.
echo Starting Repairs
echo.
echo Checking Running Processes and Services
echo.
echo.
echo Please Be Patient As This May Take Up To 20 Minutes
echo.

IF EXIST %systemroot%\system32\winlogon.scr (
>ScreenSaverfix.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_CURRENT_USER\Control Panel\Desktop]
echo "SCRNSAVE.EXE"="%windir:\=\\%\\system32\\logon.scr"
echo. 
	)
editreg.exe /s ScreenSaverfix.reg 2>NUL
MOVE /Y ScreenSaverfix.reg .\backups>nul
echo Restoring Default ScreenSaver value>>SSres.txt
 )

dir /b/s/a-d %systemroot%\system32\*hc???j0e???*.scr>>TESTScreenSave1.TXT 2>nul
dnif.exe /I "."<TESTScreenSave1.TXT>NUL && (
TYPE TESTScreenSave1.TXT>>Find.txt
>ScreenSaverfix.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_CURRENT_USER\Control Panel\Desktop]
echo "SCRNSAVE.EXE"="%windir:\=\\%\\system32\\logon.scr"
echo. 
	)
editreg.exe /s ScreenSaverfix.reg 2>NUL
MOVE /Y ScreenSaverfix.reg .\backups>nul
echo Restoring Default ScreenSaver value>>SSres.txt
 )

IF NOT EXIST dummy.sys COPY /Y apps\dummy.sys dummy.sys >NUL
IF NOT EXIST dummy.exe COPY /Y apps\MD5File.exe dummy.exe >NUL

apps\Cghtme.exe -l nul -o "%AppData%\ntos.exe" dummy.exe >NUL
apps\Cghtme.exe -l nul -o "%temp%\services.exe" dummy.exe >NUL
apps\Cghtme.exe -l nul -o "%temp%\winlogon.exe" dummy.exe >NUL
apps\Cghtme.exe -l nul -o %systemdrive%\fwdrv.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemdrive%\qqd.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemdrive%\lich.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemdrive%\suhdlog.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\Cursors\mkwsqp.cur dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\Cursors\rqksgpu.cur dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\Cursors\rwtatpl.lid dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\Cursors\werasqlp.cur dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\fkjdfje.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\help\aiqpbter.chm dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\help\guntest.chm dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\help\hqaply.chm dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\help\lagednick.chm dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\help\merqpo.chm dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\help\oqtxde.chm dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\help\pzqlp.chm dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\help\zeqwur.chm dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\ieqazhew.dll dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\inf\accctsggw.cat dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\inf\agehhtd.cat dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\inf\cjwriiigqazft.cat dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\inf\qwetab.inf dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\inf\rYehhbqzx.adm dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\inf\uxgrafj.adm dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\inf\wseqnx.inf dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\inf\yqzsypbgh.cat dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\inf\yutsubk.cat dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\inf\zyxelmodem.ADM dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\mqzprwe.log dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\njqzpir.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\nqaplwj.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\nkit.dll dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\qalwpmdgt.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\qaszpurn.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\serazavr.log dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\spooldr.exe dummy.exe >NUL
apps\Cghtme.exe -l nul -o %systemroot%\repair\kasutio dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system\efidriver.drv dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system\hipsrv.mm dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system\pcximg.pif dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system\tap64drv dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system\tunnet.ocx dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system\userinfo32.ggt dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\3klagia.dll dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\4fdw.dll dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\asplg.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\bqzpas.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\btstack.ibs dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\bzsqlpa.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\DefLib.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\dprot.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\dwave.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\ellowtab.txt dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\fnhoje dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\frmwrk.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\fvelwow.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\gsbgqpwwfw.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\hcnwg4u.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\hdport.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\hqiopa.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32:huy32.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\itcom.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\iuzqpaf.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\jecsst.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\jkghje.dll dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\jnhjkfrn dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\jwzpqng.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\kernelw.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\krnllds.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\ksnhtr.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\ksys.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\kzq5re.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\lanmandrv.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\lanmanwrk.exe dummy.exe >NUL
apps\Cghtme.exe -l nul -k "%systemroot%\system32\ldcore.dll" >nul
apps\Cghtme.exe -l nul -o %systemroot%\system32\ldr.exe dummy.exe >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32:lzx32.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\lzx32.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\main.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\mrcmgr.exe dummy.exe >NUL
apps\Cghtme.exe -l nul -k "%systemroot%\system32\mcrwave.dll" >nul
apps\Cghtme.exe -l nul -o %systemroot%\system32\msfsr.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\mp32s.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\msdefender.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32:msguard.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -k "%systemroot%\system32\msliksurcredo.dll" >nul
apps\Cghtme.exe -l nul -k "%systemroot%\system32\msliksurdns.dll" >nul
apps\Cghtme.exe -l nul -o %systemroot%\system32\mssync20.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\MZU_DRV.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\narqwe.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\nax12.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\nested.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\nexkaqf.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\noskrnl.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\nso12k.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\ntio256.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\ntload.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\ntos.exe dummy.exe >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\nzqtegh.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\oembios.exe dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32:pe386.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\pjsapdg.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\powerio.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\powermgmt.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\pqasghjd.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\qtprot.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\ras\hhlmken.scp dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\ras\slipmenu1.scp dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\ras\yeyqase.mis dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\reg.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\rotr.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\runtime.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\service.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\spooldr.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\spoolsvv.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\sysrest.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\syswindrv.bin dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\sywtdxaz.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\szr_dr.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\taskmon.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\tdidrv32.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\twext.exe dummy.exe >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\upscr.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\uoyzsydz.exe dummy.exe >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\vbagz.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\win32_rkt.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\wincom32.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\wininit.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -k "%systemroot%\system32\WinNt32.dll" >nul
apps\Cghtme.exe -l nul -k "%systemroot%\system32\WinNt64.dll" >nul
apps\Cghtme.exe -l nul -k "%systemroot%\system32\WLCtrl32.dll" >nul
apps\Cghtme.exe -l nul -o %systemroot%\system32\wmsdkns.exe dummy.exe >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\wsnpoem.exe dummy.exe >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\wsnpoema.exe dummy.exe >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\wsock32.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\wzghui.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\yzbgqap.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32:xpdt.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\xpdt.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\xpdx.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\xwusuhzh.exe dummy.exe >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\ztx86.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\zwqcplsp.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\dllcache\fuurod.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\asc355.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\asc355O.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\asc3550a.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\asc3550o.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\asc3550p.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\asc3550u.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\asc3550v.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\astq.tga dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\core.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\clbdriver.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\ctl_w32.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\dhlp.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\fak32.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\FMTR.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\glaide32.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\grande48.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\ini910p.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\kbd.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\kcp.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\khtml.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\System32\drivers\nkv2.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\msgegh.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\mickey32.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\msliksurserv.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\ndisaluo.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\NdisWon.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\ntio922.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\ntndis.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\ntosnh.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\ntoss.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\ohbusb.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\ohciusb.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\ohctusb.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\ohcuusb.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\ohcusb.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\ohdusb.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\pcantispy.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\protect.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\qandr.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\qwer78.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\restore.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\retx2.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\riode32.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\runtime.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\runtime2.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\runtime2.sy_ dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\services.exe dummy.exe >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\smtpdrv.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\SndSystem.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\spool.exe dummy.exe >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\spools.exe dummy.exe >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\srtwe.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\symavc32.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\sysldr dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\tcpsr.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\tdssserv.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\uwasfsd.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\vissv.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\wsnpoem.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\xpdt.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\xpdx.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\dxdss.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\system32\itcoe.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\Temp\kernel.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\Temp\startdrv.exe dummy.exe >NUL
apps\Cghtme.exe -l nul -o %systemroot%\trahtibedoh.sys dummy.exe >NUL
apps\Cghtme.exe -l nul -o %systemroot%\twain_32\e67gdfg.ds dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\twain_32\jwlbqzpi.dll dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\twain_32\tzraqlo.dll dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\twain_32\ytzpoqw.dll dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\uazpiq.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\uerj45kj.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\ydhqzop.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\widuxngq.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\yeTyezzd.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\zalpqbj.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\zdegpig.ini dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\zeqbqwp.sys dummy.sys >NUL
apps\Cghtme.exe -l nul -o %systemroot%\zsqalpdt.sys dummy.sys >NUL

ver|dnif.exe "Windows XP">nul && apps\Csweg QUERY "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Start_ShowMyComputer|dnif.exe /I "(0x0)">nul && (
echo Restoring Default Start Menu>>VacAlertres.txt
rundll32 setupapi,InstallHinfSection DefaultInstall 128 %cd%\XP_VirusAlert_Repair.inf >nul
	)

time /t>CurrentT.txt 2>NUL
For /f "tokens=*" %%b in (CurrentT.txt) do Call Set cctime=%%b
del /q CurrentT.txt >NUL
echo %cd%>dest.txt

> Report.txt (
echo.
echo [b]SDFix: %update% [/b]
echo Run by %username% on %date% at %cctime%
ver
echo Running From: %cd%
echo.
echo [b]Checking Services [/b]:
echo.
For /f "tokens=*" %%G in (apps\svc.txt) do apps\Csweg.exe QUERY "HKLM\SYSTEM\CurrentControlSet\Services\%%G"|dnif.exe /I "imagepath" >>Check.txt && echo %%~G>>Foundsvc.txt
IF EXIST Foundsvc.txt dnif.exe /I "Driver"<Foundsvc.txt>NUL && apps\Csweg acl "HKLM\SYSTEM\CurrentControlSet\Services\Driver" /reset /q >NUL
IF EXIST TESTRKanT1.TXT echo Rootkit Found :
IF EXIST TESTRKanT1.TXT type TESTRKanT1.TXT
IF EXIST TESTRKanT1.TXT echo.
IF EXIST Foundsvc.txt echo [b]Name [/b]: 
IF EXIST Foundsvc.txt TYPE Foundsvc.txt
IF EXIST Foundsvc.txt echo.
IF EXIST Foundsvc.txt echo [b]Path [/b]:
IF EXIST Check.txt For /f "tokens=3*" %%a in (Check.txt) do echo %%a %%b
IF EXIST Foundsvc.txt echo.
IF EXIST Foundsvc.txt For /f "tokens=*" %%G in (Foundsvc.txt) do apps\Csweg export "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\%%G" backups\%%G.reg>nul
IF EXIST Foundsvc.txt For /f "tokens=*" %%G in (Foundsvc.txt) do apps\SWSC.exe delete "%%G">nul
IF EXIST Foundsvc.txt For /f "tokens=*" %%G in (Foundsvc.txt) do echo %%G - Deleted
IF EXIST Foundsvc.txt echo.
IF EXIST ftpcheck.txt dnif.exe /I "."<ftpcheck.txt>NUL && TYPE ftpcheck.txt
IF EXIST stopped.txt dnif.exe /I "."<stopped.txt>NUL && TYPE stopped.txt
IF EXIST Foundsvc.txt echo.
IF EXIST ndischeck.txt dnif.exe /I "."<ndischeck.txt>NUL && TYPE ndischeck.txt
IF EXIST wsockres.txt dnif.exe /I "."<wsockres.txt>NUL && TYPE wsockres.txt
IF EXIST wlogonck.txt dnif.exe /I "."<wlogonck.txt>NUL && TYPE wlogonck.txt
IF EXIST tcpres.txt dnif.exe /I "."<tcpres.txt>NUL && TYPE tcpres.txt
IF EXIST ip6pres.txt dnif.exe /I "."<ip6pres.txt>NUL && TYPE ip6pres.txt
IF EXIST ip6pres2.txt dnif.exe /I "."<ip6pres2.txt>NUL && TYPE ip6pres2.txt
IF EXIST nullres.txt dnif.exe /I "."<nullres.txt>NUL && TYPE nullres.txt
IF EXIST svchck.txt dnif.exe /I "."<svchck.txt>NUL && TYPE svchck.txt
IF EXIST userres1.txt dnif.exe /I "."<userres1.txt>NUL && TYPE userres1.txt
IF EXIST userres1b.txt dnif.exe /I "."<userres1b.txt>NUL && TYPE userres1b.txt
IF EXIST Haxfnd1.txt dnif.exe /I ","<Haxfnd1.txt>NUL && TYPE Haxfnd1.txt
IF EXIST BaseChecked.txt dnif.exe /I "."<BaseChecked.txt>NUL && TYPE BaseChecked.txt
IF EXIST apinres.txt dnif.exe /I "Value"<apinres.txt>NUL && TYPE apinres.txt
IF EXIST user32res.txt dnif.exe /I "."<user32res.txt>NUL && TYPE user32res.txt
IF EXIST sdfilecheck.txt dnif.exe /I "."<sdfilecheck.txt>NUL && TYPE sdfilecheck.txt
echo.
echo Restoring Default Security Values
echo Restoring Default Hosts File
IF EXIST TESTHPFix.txt TYPE TESTHPFix.txt
IF EXIST hpcheck.txt TYPE hpcheck.txt
IF EXIST TESTUC3.TXT TYPE TESTUC3.TXT
IF EXIST TESTsec.txt TYPE TESTsec.txt
IF EXIST midires.txt TYPE midires.txt
IF EXIST SSres.txt TYPE SSres.txt
IF EXIST vacprod.txt TYPE vacprod.txt
IF EXIST Woutres.txt TYPE Woutres.txt
IF EXIST VacAlertres.txt TYPE VacAlertres.txt
	)

editreg.exe /s apps\fix.reg 2>NUL 

echo Restoring Default Security Values
echo Restoring Default Hosts File
echo.
echo Note - Protective Host Files such as MVPS/HP hosts or Spybots
echo        Immunizer feature should be reapplied after using SDFix

> userinfix.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
echo "Userinit"="%windir:\=\\%\\system32\\userinit.exe,"
echo.
	)

For %%G in (
"%AppData%\ntos.exe"
"%temp%\services.exe"
"%temp%\winlogon.exe"
%systemroot%\system\lsass.exe
%systemroot%\system\svchost.exe
%systemroot%\system32\actcontroller.exe
%systemroot%\system32\drivers\services.exe
%systemroot%\system32\drivers\spool.exe
%systemroot%\system32\drivers\spools.exe
%systemroot%\system32\idaw64.exe
%systemroot%\system32\iftuyszv.exe
%systemroot%\system32\ldr.exe
%systemroot%\system32\mrcmgr.exe
%systemroot%\system32\mgmrwmrv.exe
%systemroot%\system32\msupdt.exe
%systemroot%\system32\ntos.exe
%systemroot%\system32\ntss.exe
%systemroot%\system32\ntsvc32.dll
%systemroot%\system32\oembios.exe
%systemroot%\system32\pdbcopy.exe
%systemroot%\system32\rxjddnvj.exe
%systemroot%\system32\sbwltbxa.exe
%systemroot%\system32\Client\svchost32.exe
%systemroot%\system32\svchost32.exe
%systemroot%\system32\sysproc64\
%systemroot%\system32\twext.exe
%systemroot%\system32\uoyzsydz.exe
%systemroot%\system32\winsystem.exe
%systemroot%\system32\wmsdkns.exe
%systemroot%\system32\wsivs.exe
%systemroot%\system32\wsnpoem\
%systemroot%\system32\wsnpoema\
%systemroot%\system32\wsnpoem.exe
%systemroot%\system32\wsnpoema.exe
%systemroot%\system32\xwusuhzh.exe
	) do if exist %%G editreg.exe /s userinfix.reg 2>NUL

if exist TESTProtect2.TXT dnif.exe /i "."<TESTProtect2.TXT>NUL && editreg.exe /s userinfix.reg 2>NUL
IF EXIST Tofseetest2.txt dnif.exe /I "."<Tofseetest2.txt>NUL && editreg.exe /s userinfix.reg 2>NUL
IF EXIST Tofseetest2a.txt dnif.exe /I "."<Tofseetest2a.txt>NUL && editreg.exe /s userinfix.reg 2>NUL
IF EXIST Tofseetest2b.txt dnif.exe /I "."<Tofseetest2b.txt>NUL && editreg.exe /s userinfix.reg 2>NUL

For %%b in (
actcontroller.exe
hlpnod32.exe
idaw64.exe
iftuyszv.exe
ldr.exe
lsass.exe
mrcmgr.exe
mgmrwmrv.exe
msupdt.exe
ntos.exe
ntss.exe
ntsvc32.dll
oembios.exe
pdbcopy.exe
rxjddnvj.exe
sbwltbxa.exe
services.exe
spool.exe
spools.exe
svchost.exe
svchost32.exe
twext.exe
uoyzsydz.exe
winlogon.exe
winsystem.exe
wsivs.exe
wmsdkns.exe
wsnpoem.exe
wsnpoema.exe
xwusuhzh.exe
	) do apps\Csweg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /V Userinit|dnif.exe /I "%%b">NUL && editreg.exe /s userinfix.reg 2>NUL

if [%TypeOS%]==[W2K] goto continue
ver|dnif.exe "Windows 2000">nul && goto continue

:xpfix

apps\Csweg QUERY "HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main" /v "Start Page"|dnif.exe /i "spywarewarning">NUL && editreg.exe /s apps\HPFix7.reg 2>NUL

editreg.exe /s apps\fixXP.reg 2>NUL

apps\Csweg QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Schedule" /v ImagePath|dnif.exe /i "drivers\ctfmon.exe">NUL && (
echo Restoring Default Schedule Service Path>srvcheck.txt
editreg.exe /s apps\FixSchedule.reg 2>NUL
	)

apps\Csweg QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Schedule" /v ImagePath|dnif.exe /i "drivers\spool.exe">NUL && (
echo Restoring Default Schedule Service Path>srvcheck.txt
editreg.exe /s apps\FixSchedule.reg 2>NUL
	)

apps\Csweg QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Schedule" /v ImagePath|dnif.exe /i "drivers\spools.exe">NUL && (
echo Restoring Default Schedule Service Path>srvcheck.txt
editreg.exe /s apps\FixSchedule.reg 2>NUL
	)

apps\Csweg QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Schedule" /v ImagePath|dnif.exe /i "drivers\svchost.exe">NUL && (
echo Restoring Default Schedule Service Path>srvcheck.txt
editreg.exe /s apps\FixSchedule.reg 2>NUL
	)

apps\Csweg QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Schedule" /v ImagePath|dnif.exe /i "drivers\ctfmun.exe">NUL && (
echo Restoring Default Schedule Service Path>srvcheck.txt
editreg.exe /s apps\FixSchedule.reg 2>NUL
	)

apps\Csweg QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Schedule" /v ImagePath|dnif.exe /i "drivers\services.exe">NUL && (
echo Restoring Default Schedule Service Path>srvcheck.txt
editreg.exe /s apps\FixSchedule.reg 2>NUL
	)

apps\Csweg QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CSDVersion|dnif.exe /i "Service Pack 2">NUL && GOTO srvchecker
apps\Csweg QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CSDVersion|dnif.exe /i "Service Pack 3">NUL && GOTO srvchecker

goto svcskip

:srvchecker

apps\Csweg QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc" /v DependOnService|dnif.exe /i "RpcSs">NUL||echo Restoring Missing Security Center Service>>srvcheck.txt && editreg.exe /s apps\Restore_SecurityCenter.reg 2>NUL
apps\Csweg QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess" /v DependOnService|dnif.exe /i "Netman">NUL||echo Restoring Missing SharedAccess Service>>srvcheck.txt && editreg.exe /s apps\Restore_SharedAccess.reg 2>NUL

editreg.exe /s apps\FixXPsp2.reg 2>NUL

:svcskip

IF NOT EXIST %systemroot%\pchealth\helpctr\binaries\msconfig.exe COPY /Y %systemroot%\system32\dllcache\msconfig.exe %systemroot%\pchealth\helpctr\binaries\msconfig.exe >nul && echo msconfig.exe restored from dllcache >>srvcheck.txt
IF NOT EXIST %systemroot%\system32\Restore\rstrui.exe COPY /Y %systemroot%\system32\dllcache\rstrui.exe %systemroot%\system32\Restore\rstrui.exe >nul && echo rstrui.exe restored from dllcache >>srvcheck.txt
IF NOT EXIST %systemroot%\regedit.exe COPY /Y %systemroot%\system32\dllcache\regedit.exe %systemroot%\regedit.exe >nul && echo Missing regedit.exe restored from dllcache >>srvcheck.txt
IF NOT EXIST %systemroot%\regedit.exe COPY /Y apps\replace\regedit.exe %systemroot%\regedit.exe >nul && echo Missing regedit.exe restored from backups >>srvcheck.txt

IF EXIST srvcheck.txt TYPE srvcheck.txt>> Report.txt

:continue

IF EXIST CHECK*.TXT DEL /Q CHECK*.TXT>NUL

apps\Csweg export "HKEY_CLASSES_ROOT\CLSID\{855875B5-93F3-429D-FF34-660B206D897C}" CHECK.TXT
IF EXIST CHECK.TXT dnif.exe /I "@"<CHECK.TXT>CHECK1.TXT
IF EXIST CHECK1.TXT dnif.exe /I "."<CHECK1.TXT>NUL && FOR /F "TOKENS=4 DELIMS=\." %%G in (CHECK1.TXT) DO CALL SET BADDLL=%%G
IF EXIST CHECK1.TXT dnif.exe /I "."<CHECK1.TXT>NUL && IF EXIST %systemroot%\system32\%BADDLL%.dll ECHO %systemroot%\system32\%BADDLL%.dll>>Find.txt

apps\Csweg export "HKEY_CLASSES_ROOT\CLSID\{947254B5-96F3-4A9D-FF34-8466477D897C}" CHECK2.TXT
IF EXIST CHECK2.TXT dnif.exe /I "@"<CHECK2.TXT>CHECK3.TXT
IF EXIST CHECK3.TXT dnif.exe /I "."<CHECK3.TXT>NUL && FOR /F "TOKENS=4 DELIMS=\." %%A in (CHECK3.TXT) DO CALL SET MOFILE=%%A
IF EXIST CHECK3.TXT dnif.exe /I "."<CHECK3.TXT>NUL && IF EXIST %systemroot%\system32\%MOFILE%.dll ECHO %systemroot%\system32\%MOFILE%.dll>>Find.txt

apps\Csweg export "HKEY_CLASSES_ROOT\CLSID\{8D5849C4-93F3-429D-FF34-260A2068897C}" CHECK4.TXT
IF EXIST CHECK4.TXT dnif.exe /I "@"<CHECK4.TXT>CHECK5.TXT
IF EXIST CHECK5.TXT dnif.exe /I "."<CHECK5.TXT>NUL && FOR /F "TOKENS=4 DELIMS=\." %%A in (CHECK5.TXT) DO CALL SET DRDFILE=%%A
IF EXIST CHECK5.TXT dnif.exe /I "."<CHECK5.TXT>NUL && IF EXIST %systemroot%\system32\%DRDFILE%.dll ECHO %systemroot%\system32\%DRDFILE%.dll>>Find.txt

apps\Csweg export "HKEY_CLASSES_ROOT\CLSID\{8D5849A2-93F3-429D-FF34-260A2068897C}" CHECK8.TXT
IF EXIST CHECK8.TXT dnif.exe /I "@"<CHECK8.TXT>CHECK9.TXT
IF EXIST CHECK9.TXT dnif.exe /I "."<CHECK9.TXT>NUL && FOR /F "TOKENS=4 DELIMS=\." %%A in (CHECK9.TXT) DO CALL SET DDXFILE=%%A
IF EXIST CHECK9.TXT dnif.exe /I "."<CHECK9.TXT>NUL && IF EXIST %systemroot%\system32\%DDXFILE%.dll ECHO %systemroot%\system32\%DDXFILE%.dll>>Find.txt

apps\Csweg export "HKEY_CLASSES_ROOT\CLSID\{B5AC49A2-94F3-42BD-F434-2604812C897D}" CHECK10.TXT
IF EXIST CHECK10.TXT dnif.exe /I "@"<CHECK10.TXT>CHECK11.TXT
IF EXIST CHECK11.TXT dnif.exe /I "."<CHECK11.TXT>NUL && FOR /F "TOKENS=4 DELIMS=\." %%G in (CHECK11.TXT) DO CALL SET B5ACDLL=%%G
IF EXIST CHECK11.TXT dnif.exe /I "."<CHECK11.TXT>NUL && IF EXIST %systemroot%\system32\%B5ACDLL%.dll ECHO %systemroot%\system32\%B5ACDLL%.dll>>Find.txt

apps\Csweg export "HKEY_CLASSES_ROOT\CLSID\{B5AF0562-94F3-42BD-F434-2604812C297D}" CHECK12.TXT
IF EXIST CHECK12.TXT dnif.exe /I "@"<CHECK12.TXT>CHECK13.TXT
IF EXIST CHECK13.TXT dnif.exe /I "."<CHECK13.TXT>NUL && FOR /F "TOKENS=4 DELIMS=\." %%G in (CHECK13.TXT) DO CALL SET F0562DLL=%%G
IF EXIST CHECK13.TXT dnif.exe /I "."<CHECK13.TXT>NUL && IF EXIST %systemroot%\system32\%F0562DLL%.dll ECHO %systemroot%\system32\%F0562DLL%.dll>>Find.txt

apps\Csweg export "HKEY_CLASSES_ROOT\CLSID\{C5AF42A3-94F3-42BD-F434-3604812C897D}" CHECK12a.TXT
IF EXIST CHECK12a.TXT dnif.exe /I "@"<CHECK12a.TXT>CHECK13a.TXT
IF EXIST CHECK13a.TXT dnif.exe /I "."<CHECK13a.TXT>NUL && FOR /F "TOKENS=4 DELIMS=\." %%G in (CHECK13a.TXT) DO CALL SET F3604DLL=%%G
IF EXIST CHECK13a.TXT dnif.exe /I "."<CHECK13a.TXT>NUL && IF EXIST %systemroot%\system32\%F3604DLL%.dll ECHO %systemroot%\system32\%F3604DLL%.dll>>Find.txt

apps\Csweg export "HKEY_CLASSES_ROOT\CLSID\{B2AC49A2-94F3-42BD-F434-2604812C897D}" CHECK14.TXT
IF EXIST CHECK14.TXT dnif.exe /I "@"<CHECK14.TXT>CHECK15.TXT
IF EXIST CHECK15.TXT dnif.exe /I "."<CHECK15.TXT>NUL && FOR /F "TOKENS=4 DELIMS=\." %%G in (CHECK15.TXT) DO CALL SET B2AC4=%%G
IF EXIST CHECK15.TXT dnif.exe /I "."<CHECK15.TXT>NUL && IF EXIST %systemroot%\system32\%B2AC4%.dll ECHO %systemroot%\system32\%B2AC4%.dll>>Find.txt

IF EXIST %systemroot%\karina.dat GOTO AppInitstart
IF EXIST %systemroot%\system32\karina.dat GOTO AppInitstart
IF EXIST %systemroot%\karna.dat GOTO AppInitstart
IF EXIST %systemroot%\system32\karna.dat GOTO AppInitstart
IF EXIST %systemroot%\kus109.dat GOTO AppInitstart
IF EXIST %systemroot%\system32\kus109.dat GOTO AppInitstart
IF EXIST %systemroot%\cru629.dat GOTO AppInitstart
IF EXIST %systemroot%\system32\cru629.dat GOTO AppInitstart
IF EXIST %systemroot%\murka.dat GOTO AppInitstart
IF EXIST %systemroot%\system32\murka.dat GOTO AppInitstart
IF EXIST %systemroot%\system32\wowfx.dll GOTO AppInitstart
IF EXIST %systemroot%\system32\ldcore.dll GOTO AppInitstart
IF EXIST %systemroot%\system32\sulimo.dat GOTO AppInitstart
IF EXIST %systemroot%\system32\iSecurity.cpl GOTO AppInitstart
IF EXIST %systemroot%\system32\tourstart.dll GOTO AppInitstart

apps\locate "%systemroot%\SYSTEM32\*.dll" /D- /s:4096! /n /nr|dnif.exe /I ".dll">>TEST200.TXT
IF EXIST TEST200.TXT dnif.exe /I "."<TEST200.TXT>NUL && rtsdnif.exe /m /f:TEST200.TXT "WhAtTheFuck" >> TEST201.TXT 2>NUL
IF EXIST TEST201.TXT dnif.exe /I "."<TEST201.TXT>NUL && rtsdnif.exe /m /f:TEST201.TXT "ReleaseMutex">NUL && GOTO AppInitstart

goto ssnext

:AppInitstart

editreg.exe /s apps\Reset_AppInit_DLLs.reg 2>NUL
ECHO Resetting AppInit_DLLs value >>Report.txt
ECHO.>>Report.txt

:ssnext

echo.>>Report.txt
echo Rebooting>>Report.txt
echo.>>Report.txt

editreg.exe /s apps\FIXCU.reg 2>NUL
editreg.exe /s apps\FIXLM.reg 2>NUL
editreg.exe /s apps\FixBH.reg 2>NUL

IF EXIST %systemroot%\system\lsass.exe editreg.exe /s apps\HPFix.reg 2>NUL
IF EXIST %systemroot%\system\svchost32.exe editreg.exe /s apps\HPFix.reg 2>NUL
IF EXIST %systemroot%\system32\dnsersnd.dll editreg.exe /s apps\FixRedir.reg 2>NUL
IF EXIST %systemroot%\system32\wscmp.dll editreg.exe /s apps\winsec.reg 2>NUL
IF EXIST %systemroot%\system32\dllcache\checkweb.dll editreg.exe /s apps\FixWebCheck.reg

IF EXIST %systemdrive%\log.txt dnif.exe /I "Spy:"<%systemdrive%\log.txt>nul && echo %systemdrive%\log.txt>>Find.txt
IF EXIST %systemdrive%\txt.bin dnif.exe /I "ping"<%systemdrive%\txt.bin>nul && echo %systemdrive%\txt.bin>>Find.txt
IF EXIST "%appdata%\update.log" dnif.exe /I "advancedcleaner"<%appdata%\update.log>nul && echo %appdata%\update.log>>Find.txt

regsvr32 /s shimgvw.dll
regsvr32 /s urlmon.dll

ATTRIB -h -s -r -a "%windir%\SYSTEM32\DRIVERS\ETC\HOSTS" >NUL
COPY /Y "%windir%\SYSTEM32\DRIVERS\ETC\HOSTS" "%CD%\HOSTS" >NUL
DEL /Q "%windir%\SYSTEM32\DRIVERS\ETC\HOSTS" >nul 2>&1

>%windir%\SYSTEM32\DRIVERS\ETC\HOSTS (
echo # Copyright © 1993-1999 Microsoft Corp.
echo #
echo # This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
echo #
echo # This file contains the mappings of IP addresses to host names. Each
echo # entry should be kept on an individual line. The IP address should
echo # be placed in the first column followed by the corresponding host name.
echo # The IP address and the host name should be separated by at least one
echo # space.
echo #
echo # Additionally, comments ^(such as these^) may be inserted on individual
echo # lines or following the machine name denoted by a "#" symbol.
echo #
echo # For example:
echo #
echo # 102.54.94.97 rhino.acme.com # source server
echo # 38.25.63.10 x.acme.com # x client host
echo #
echo 127.0.0.1 localhost
	)

echo.
echo Checking Files 
echo.
echo Please Wait
echo.

for /f "tokens=2* delims=%%" %%g in (
	'apps\Csweg query "hkcu\software\microsoft\windows\currentversion\explorer\user shell folders" /v "Favorites"^|
	dnif.exe /i "Favorites"'
) do call set Favorites=%%%%g%%%%h

for /f "tokens=2* delims=%%" %%g in (
	'apps\Csweg query "hkcu\software\microsoft\windows\currentversion\explorer\user shell folders" /v startup^|
	dnif.exe /i "startup"^|dnif.exe /v /i "system32"'
) do call set start=%%%%g%%%%h

for /f "tokens=2* delims=%%" %%g in (
	'apps\Csweg query "hklm\software\microsoft\windows\currentversion\explorer\user shell folders" /v "Common Startup"^|
	dnif.exe /i "common startup"^|dnif.exe /v /i "system32"'
) do call set allstart=%%%%g%%%%h

for /f "tokens=2* delims=%%" %%g in (
	'apps\Csweg query "hkcu\software\microsoft\windows\currentversion\explorer\user shell folders" /v Desktop^|
	dnif.exe /i "desktop"^|dnif.exe /v /i "system32"'
) do call set desktop=%%%%g%%%%h

for /f "tokens=2* delims=%%" %%g in (
	'apps\Csweg query "hkcu\software\microsoft\windows\currentversion\explorer\user shell folders" /v Programs^|
	dnif.exe /i "Programs"^|dnif.exe /v /i "system32"'
) do call set Programs=%%%%g%%%%h

for /f "tokens=2* delims=%%" %%g in (
	'apps\Csweg query "hkcu\software\microsoft\windows\currentversion\explorer\user shell folders" /v "Start Menu"^|
	dnif.exe /i "Start Menu"^|dnif.exe /v /i "system32"'
) do call set StaMen=%%%%g%%%%h

for /f "tokens=2* delims=%%" %%g in (
	'apps\Csweg query "hklm\software\microsoft\windows\currentversion\explorer\user shell folders" /v "Common AppData"^|
	dnif.exe /i "Common AppData"^|dnif.exe /v /i "system32"'
) do call set commapp=%%%%g%%%%h

for /f "tokens=2* delims=%%" %%g in (
	'apps\Csweg query "hklm\software\microsoft\windows\currentversion\explorer\user shell folders" /v "Common Desktop"^|
	dnif.exe /i "Common Desktop"^|dnif.exe /v /i "system32"'
) do call set commdsk=%%%%g%%%%h

for /f "tokens=2* delims=%%" %%g in (
	'apps\Csweg query "hklm\software\microsoft\windows\currentversion\explorer\user shell folders" /v "Common Start Menu"^|
	dnif.exe /i "Common Start Menu"^|dnif.exe /v /i "system32"'
) do call set commStaMen=%%%%g%%%%h

for /f "tokens=2* delims=%%" %%g in (
	'apps\Csweg query "hklm\software\microsoft\windows\currentversion\explorer\user shell folders" /v "Common Programs"^|
	dnif.exe /i "Common Programs"^|dnif.exe /v /i "system32"'
) do call set commPrograms=%%%%g%%%%h

for /f "tokens=2* delims=%%" %%g in (
	'apps\Csweg query "hklm\software\microsoft\windows\currentversion\explorer\user shell folders" /v "Common Documents"^|
	dnif.exe /i "Common Documents"^|dnif.exe /v /i "system32"'
) do call set commdocs=%%%%g%%%%h

apps\Csweg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"|dnif.exe /I ".exe"|dnif.exe /I "\" >TESTPatched1.txt
apps\Csweg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"|dnif.exe /I ".exe"|dnif.exe /I "\" >>TESTPatched2.txt
for /f "tokens=3 delims=		." %%a in (TESTPatched1.txt) do if exist %%~a.exe echo %%~a.exe >>TESTPatched3.txt
for /f "tokens=3 delims=		." %%a in (TESTPatched2.txt) do if exist %%~a.exe echo %%~a.exe >>TESTPatched3.txt
rtsdnif.exe /m /f:TESTPatched3.txt "users32.dat">>Patched2a.txt
rtsdnif.exe /m /f:TESTPatched3.txt "users64.dat">>Patched2b.txt
rtsdnif.exe /m /f:TESTPatched3.txt "univrs32.dat">>Patched2c.txt

apps\locate "%systemroot%\system32\*.dll" /D- /s:4096! /n|dnif.exe /I ".dll">>TEST1.TXT
rtsdnif.exe /m /f:TEST1.TXT "WhAtTheFuck">>Find.txt 2>NUL
apps\locate "%systemdrive%\*.exe" /D- /n /nr|dnif.exe /I ".exe">>TEST3.TXT
rtsdnif.exe /m /f:TEST3.TXT "ma1x1dd1.game">>Find.txt 2>NUL

apps\locate "%systemroot%\system32\*.xml" /D- /n /nr|dnif.exe /I ".xml">>TEST419.TXT
rtsdnif.exe /m /f:TEST419.TXT "seobiz">>Find.txt
rtsdnif.exe /m /f:TEST419.TXT "viagra">>Find.txt
rtsdnif.exe /m /f:TEST419.TXT "adult">>Find.txt
rtsdnif.exe /m /f:TEST419.TXT "barclays.co.uk">>Find.txt

apps\locate "%systemroot%\e???.exe" /D- /s:94208! /n /nr|dnif.exe /I ".exe">>TESTvacsefile1.txt
apps\locate "%systemroot%\e???.exe" /D- /s:98304! /n /nr|dnif.exe /I ".exe">>TESTvacsefile1.txt
apps\locate "%systemroot%\e???.exe" /D- /s:139264! /n /nr|dnif.exe /I ".exe">>TESTvacsefile1.txt
apps\locate "%systemroot%\e???.exe" /D- /s:143360! /n /nr|dnif.exe /I ".exe">>TESTvacsefile1.txt
apps\locate "%systemroot%\e???.exe" /D- /s:151552! /n /nr|dnif.exe /I ".exe">>TESTvacsefile1.txt
apps\locate "%systemroot%\e???.exe" /D- /s:163840! /n /nr|dnif.exe /I ".exe">>TESTvacsefile1.txt
IF EXIST TESTvacsefile1.txt rtsdnif.exe /m /f:TESTvacsefile1.txt "destructor">>TESTvacsefile2.txt
IF EXIST TESTvacsefile2.txt rtsdnif.exe /m /f:TESTvacsefile2.txt "IsDebuggerPresent">>Find.txt

apps\locate "%systemroot%\system32\*.exe" /D- /0 /n /nr|dnif.exe /I ".exe"|dnif.exe /I /V "UTSCSI.EXE"|dnif.exe /I /V "CMMGR32.EXE">>Find.txt
apps\locate "%systemroot%\system32\*.dll" /D- /0 /n /nr|dnif.exe /I ".exe"|dnif.exe /I /V "NSPRS.DLL"|dnif.exe /I /V "SERAUTH1.DLL"|dnif.exe /I /V "SERAUTH2.DLL"|dnif.exe /I /V "SSPRS.DLL">>Find.txt
apps\locate "%systemroot%\*.exe" /D- /0 /n /nr|dnif.exe /I ".exe">>Find.txt
apps\locate "%systemroot%\*.com" /D- /0 /n /nr|dnif.exe /I ".com">>Find.txt
apps\locate "%systemdrive%\?.dat" /D- /0 /n /nr|dnif.exe /I ".dat">>Find.txt
apps\locate "%systemdrive%\*.exe" /D- /0 /n /nr|dnif.exe /I ".exe"|dnif.exe /I /V "SDFix"|dnif.exe /I /V "Combo">>Find.txt
apps\locate "%userprofile%\*.exe" /D- /0 /n /nr|dnif.exe /I ".exe">>Find.txt
apps\locate "%systemdrive%\*" /D- /s:2! /n /nr>>TEST10a.TXT
rtsdnif.exe /m /f:TEST10a.TXT "ok">> Find.txt
apps\locate "%systemroot%\system32\mdm.exe" /D- /s:40000,60000! /n /nr|dnif.exe /I ".exe">>Find.txt
IF EXIST %systemroot%\KB8888239.log dnif.exe /I "Tarih"<%systemroot%\KB8888239.log>NUL && ECHO %systemroot%\KB8888239.log>>Find.txt
IF EXIST %systemroot%\Install.txt dnif.exe /I "deletefeed.com"<%systemroot%\Install.txt>NUL && ECHO %systemroot%\Install.txt>>Find.txt

echo 25%% Checked

dir /b/s/a-d "%systemroot%\cftmon.exe">>Find.txt 2>nul
dir /b/s/a-d "%systemroot%\msconfig32.exe">>Find.txt 2>nul
dir /b/s/a-d "%systemdrive%\spool.exe">TEST725b.TXT 2>nul
IF EXIST TEST725b.TXT dnif.exe /I "Application Data\spool."<TEST725b.TXT>>Find.txt 2>nul
dir /b/s/a-d "%systemdrive%\Install.dat">TEST725c.TXT 2>nul
IF EXIST TEST725c.TXT dnif.exe /I "Application Data\Install."<TEST725c.TXT>>Find.txt 2>nul
dir /b/s/a-d "%systemdrive%\printer.exe">TEST725d.TXT 2>nul
IF EXIST TEST725d.TXT dnif.exe /I "Application Data\printer."<TEST725d.TXT>>Find.txt 2>nul
dir /b/s/a-d "%systemdrive%\windowsupdate.exe">TEST725e.TXT 2>nul
IF EXIST TEST725e.TXT dnif.exe /I "Application Data"<TEST725e.TXT>>Find.txt 2>nul
dir /b/s/a-d "%systemdrive%\spooll.exe">TEST725f.TXT 2>nul
IF EXIST TEST725f.TXT dnif.exe /I "Application Data\spooll."<TEST725f.TXT>>Find.txt 2>nul

apps\locate "%programfiles%\*.dll" /D- /s:70000,75000 /n|dnif.exe /I ".dll">>TEST758.TXT 2>nul
rtsdnif.exe /m /f:TEST758.TXT "RetrieveAdwareLinks" >>TEST759.TXT 2>NUL
rtsdnif.exe /m /f:TEST759.TXT "InsertAdvertisement" >>TEST760.TXT 2>NUL
rtsdnif.exe /m /f:TEST760.TXT "AfterAdd">>Find.txt 2>nul

IF EXIST %systemroot%\system32\urlmon.exe rtsdnif.exe /m /c:"bot_fuck_xp" %systemroot%\system32\urlmon.exe>>Find.txt 2>nul
apps\locate "%systemroot%\system32\tmp_???.exe" /H /D- /n /nr|dnif.exe /I ".exe">>TESTpincher1.txt 2>nul
apps\locate "%systemroot%\system32\tmp_??.exe" /H /D- /n /nr|dnif.exe /I ".exe">>TESTpincher1.txt 2>nul
apps\locate "%systemroot%\system32\win_???.exe" /H /D- /n /nr|dnif.exe /I ".exe">>TESTpincher1.txt 2>nul
apps\locate "%systemroot%\system32\win_??.exe" /H /D- /n /nr|dnif.exe /I ".exe">>TESTpincher1.txt 2>nul
rtsdnif.exe /m /f:TESTpincher1.txt "inet_ntoa" >>TESTpincher2.txt 2>NUL
rtsdnif.exe /m /f:TESTpincher2.txt "recvfrom" >>TESTpincher3.txt 2>NUL
rtsdnif.exe /m /f:TESTpincher3.txt "getsockname">>Find.txt 2>nul

apps\locate "%systemroot%\system32\defrag.exe" /D- /s:84480! /n /nr|dnif.exe /I ".exe">>Find.txt 2>nul
apps\locate "%systemroot%\system32\winspool.exe" /D- /s:78336! /n /nr|dnif.exe /I ".exe">>Find.txt 2>nul
apps\locate "%systemroot%\system32\windefrag.exe" /D- /s:84480! /n /nr|dnif.exe /I ".exe">>Find.txt 2>nul
apps\locate "%systemdrive%\ftpdll.dll" /D- /s:5120! /n|dnif.exe /I ".dll">>Find.txt 2>nul
apps\locate "%systemroot%\system32\Setup.exe" /D- /s:463153! /n /nr|dnif.exe /I ".exe">>Find.txt 2>nul
apps\locate "%systemroot%\system32\dllcache\iexplore.exe" /D- /s:684032! /n /nr|dnif.exe /I ".exe">>Find.txt 2>nul
apps\locate "%systemroot%\server.exe" /D- /s:168317! /n /nr|dnif.exe /I ".exe">>Find.txt 2>nul

IF EXIST %systemroot%\system32\setup.cmd dnif.exe /I "photoalbum.exe"<%systemroot%\system32\setup.cmd>NUL && echo %systemroot%\system32\setup.cmd>>Find.txt
IF EXIST %systemdrive%\autorun.inf dnif.exe /I "shell"<%systemdrive%\autorun.inf>NUL && echo %systemdrive%\autorun.inf>>Find.txt

apps\locate "%systemroot%\system32\??????.dll" /D- /s:12500,16000 /n|dnif.exe /I ".dll">>TESTbhohelper1.TXT
rtsdnif.exe /m /f:TESTbhohelper1.TXT "E404.e404mgr.1" >>TESTbhohelper2.TXT
rtsdnif.exe /m /f:TESTbhohelper1.TXT "w123.w123mgr.1" >>TESTbhohelper2.TXT
rtsdnif.exe /m /f:TESTbhohelper1.TXT "x123.x123mgr.1" >>TESTbhohelper2.TXT
rtsdnif.exe /m /f:TESTbhohelper1.TXT "y456.y456mgr.1" >>TESTbhohelper2.TXT
rtsdnif.exe /m /f:TESTbhohelper1.TXT "z444.z444mgr.1" >>TESTbhohelper2.TXT

IF EXIST TESTbhohelper2.TXT dnif.exe /I "."<TESTbhohelper2.TXT>NUL && (
For /f "tokens=8 delims=\{}" %%G in (TESTbho.txt) do For /f "tokens=5 delims=\" %%C in (TESTbhohelper2.TXT) do apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\InprocServer32"|dnif.exe /I "%%C">nul && (
apps\Csweg.exe QUERY "HKEY_CLASSES_ROOT\clsid\{%%G}\Typelib"|dnif.exe /I "{"|dnif.exe /I /V "\">>TESTbhohelperTYPELIB1.TXT
TYPE TESTbhohelper2.TXT>>Remlat.txt
For /f "tokens=5 delims=\." %%d in (TESTbhohelper2.TXT) do if exist %systemroot%\system32\%%d\%%d.dll MOVE /Y "%systemroot%\system32\%%d" .\backups >nul && echo Folder %systemroot%\system32\%%d - Removed>>Foldel1.txt
>Repairbhohelper1.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{%%G}]
echo [-HKEY_CLASSES_ROOT\clsid\{%%G}]
For /f "tokens=2 delims=\{}" %%A in (TESTbhohelperTYPELIB1.TXT) do echo [-HKEY_CLASSES_ROOT\TypeLib\{%%A}]
echo.
	)
editreg.exe /s Repairbhohelper1.reg 2>NUL
copy Repairbhohelper1.reg .\backups\Repairbhohelper1.reg >nul
	))
apps\locate "%temp%\*.exe" /D- /n /s:6993! /nr|dnif.exe /I ".exe">TESTVirtualProtect2.TXT
apps\locate "%systemdrive%\*.exe" /D- /n /s:6993! /nr|dnif.exe /I ".exe">>TESTVirtualProtect2.TXT
apps\locate "%systemroot%\system32\*.exe" /D- /n /s:6993! /nr|dnif.exe /I ".exe">>TESTVirtualProtect2.TXT
if exist TESTVirtualProtect2.TXT for /f "tokens=*" %%a in (TESTVirtualProtect2.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "3B98ED3D87BFE128E7B4A65C8F2C6A69">Nul && echo %%a>>Remlat.txt
apps\locate "%systemdrive%\*.exe" /D- /s:7680! /n|dnif.exe /I ".exe">>TESTruss1a.TXT
for /f "tokens=*" %%a in (TESTruss1a.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "1db23ae2c8505d4cb9c7ac2c5ff45dd3">NUL && echo %%a>>Remlat.txt

apps\locate "%systemroot%\system32\msconfig.exe" /D- /n /nr|dnif.exe /I ".exe">>TESTbotsc1.txt
IF EXIST TESTbotsc1.txt rtsdnif.exe /m /f:TESTbotsc1.txt "Themida">>Remlat.txt

apps\locate "%allusersprofile%\Application Data\*.exe" /D- /s:65536! /n |dnif.exe /I ".exe">>TESTts99a.TXT
for /f "tokens=*" %%a in (TESTts99a.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "1B9FF45BF9B14D44C524C1FAECDDF326">NUL && echo %%a>>Find.txt
for /f "tokens=*" %%a in (TESTts99a.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "AAC1E6638AEC176EBF22A94A4095EB89">NUL && echo %%a>>Find.txt
apps\locate "%allusersprofile%\Application Data\*.exe" /D- /s:69632! /n |dnif.exe /I ".exe">>TESTts99b.TXT
for /f "tokens=*" %%a in (TESTts99b.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "1A447062AB54BB9D5259F016C2861F72">NUL && echo %%a>>Find.txt
for /f "tokens=*" %%a in (TESTts99b.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "627DBAE5A8D833965B0C2C283836A6C4">NUL && echo %%a>>Find.txt
for /f "tokens=*" %%a in (TESTts99b.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "7A5F6BE3E4FDCEDFAAEA35B66C7506B6">NUL && echo %%a>>Find.txt
for /f "tokens=*" %%a in (TESTts99b.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "817B9421F2E733C97EF4C80070E7291E">NUL && echo %%a>>Find.txt
for /f "tokens=*" %%a in (TESTts99b.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "8AA6F39B52582723F15F086E1DA3FD36">NUL && echo %%a>>Find.txt
for /f "tokens=*" %%a in (TESTts99b.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "EDA894FC6869642EFBC395988D80B707">NUL && echo %%a>>Find.txt
apps\locate "%allusersprofile%\Application Data\*.exe" /D- /s:77824! /n |dnif.exe /I ".exe">>TESTts99c.TXT
for /f "tokens=*" %%a in (TESTts99c.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "e2fe8a8cb1ec6952ddf315e82b118cb6">NUL && echo %%a>>Find.txt
apps\locate "%allusersprofile%\Application Data\*.exe" /D- /s:73728! /n |dnif.exe /I ".exe">>TESTts99d.TXT
for /f "tokens=*" %%a in (TESTts99d.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "BCAFE309DE44D279513713C45454201D">NUL && echo %%a>>Find.txt
apps\locate "%allusersprofile%\Application Data\*.exe" /D- /s:90112! /n |dnif.exe /I ".exe">>TESTts99e.TXT
for /f "tokens=*" %%a in (TESTts99e.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "42943246f44fcc6bde151318a55acac5">NUL && echo %%a>>Find.txt
apps\locate "%allusersprofile%\Application Data\*.exe" /D- /s:44032! /n |dnif.exe /I ".exe">>TESTts99f.TXT
for /f "tokens=*" %%a in (TESTts99f.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "b62ed23fddf0644ae2af63e9715aea26">NUL && echo %%a>>Find.txt

apps\Csweg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run"|dnif.exe /I ".exe"|dnif.exe /I "%allusersprofile%">TESTZlobPolicy1.txt && (
For /f "tokens=3 delims=	." %%B in (TESTZlobPolicy1.txt) do echo %%B.exe>TESTZlobPolicy2.txt
rtsdnif.exe /m /f:TESTZlobPolicy2.txt "GetCurrentThread">>Find.txt
	)

apps\locate "%systemdrive%\*.exe" /D- /s:36864! /n /nr|dnif.exe /I ".exe">>TESTts100.TXT
for /f "tokens=*" %%a in (TESTts100.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "E9430AD41D8EC2B4C5EF316773E9AD59">NUL && echo %%a>>Find.txt
apps\locate "%systemroot%\system32\*.exe" /D- /s:31664! /n /nr|dnif.exe /I ".exe">>TESTts101.TXT
for /f "tokens=*" %%a in (TESTts101.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "1d5d9da9f19532965b14f01ab9899153">NUL && echo %%a>>Find.txt
apps\locate "%systemroot%\system32\*.exe" /D- /s:41984! /n /nr|dnif.exe /I ".exe">>TESTts102.TXT
for /f "tokens=*" %%a in (TESTts102.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "6b2fab89c940f17ee6c762af52044d8d">NUL && echo %%a>>Find.txt
for /f "tokens=*" %%a in (TESTts102.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "D2191179ACD8FEA509D1D2E83E51D839">NUL && echo %%a>>Find.txt
apps\locate "%systemdrive%\*.exe" /D- /s:138752! /n /nr|dnif.exe /I ".exe">>TESTts104.TXT
apps\locate "%systemroot%\system32\*.exe" /D- /s:138752! /n /nr|dnif.exe /I ".exe">>TESTts104.TXT
for /f "tokens=*" %%a in (TESTts104.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "8ab88d5bdb528abf29f139881ab97b60">NUL && echo %%a>>Find.txt
apps\locate "%systemdrive%\*.exe" /D- /s:34304! /n /nr|dnif.exe /I ".exe">>TESTts105.TXT
for /f "tokens=*" %%a in (TESTts105.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "b3867db01ee8612342e17d9d5e700bde">NUL && echo %%a>>Find.txt
apps\locate "%systemroot%\system32\*.dll" /D- /s:23443! /n /nr|dnif.exe /I ".dll">>TESTts106.TXT
for /f "tokens=*" %%a in (TESTts106.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "16CE482EC279A35C2709E09430822858">NUL && echo %%a>>Find.txt
apps\locate "%systemroot%\system32\*.exe" /D- /s:208896! /n /nr|dnif.exe /I ".exe">>TESTts107.TXT
for /f "tokens=*" %%a in (TESTts107.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "F5D6347BB13B292DE0B67719EABD9158">NUL && echo %%a>>Find.txt
apps\locate "%systemroot%\system32\*.exe" /D- /s:218112! /n /nr|dnif.exe /I ".exe">>TESTts108.TXT
for /f "tokens=*" %%a in (TESTts108.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "F12583A6D2D59F654D6B54B19FF5D876">NUL && echo %%a>>Find.txt
apps\locate "%systemroot%\system32\*.exe" /D- /s:611883! /n /nr|dnif.exe /I ".exe">>TESTts109.TXT
for /f "tokens=*" %%a in (TESTts109.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "0B70D46A6853F51619FC55DF57418E97">NUL && echo %%a>>Find.txt
apps\locate "%systemroot%\system32\*.tmp" /D- /s:106496! /n /nr|dnif.exe /I ".tmp">>TESTts110.TXT
for /f "tokens=*" %%a in (TESTts110.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "69534BEA316938567B5C53E697D21222">NUL && echo %%a>>Find.txt
apps\locate "%systemroot%\system32\*.exe" /D- /s:111024! /n /nr|dnif.exe /I ".exe">>TESTts111.TXT
for /f "tokens=*" %%a in (TESTts111.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "81CFA88720EC99221A9A49624DEE67DE">NUL && echo %%a>>Find.txt
apps\locate "%systemroot%\system32\*.exe" /D- /s:161842! /n /nr|dnif.exe /I ".exe">>TESTts112.TXT
for /f "tokens=*" %%a in (TESTts112.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "256f7480f3f8bddb49c7aa5ed89fc671">NUL && echo %%a>>Find.txt
apps\locate "%systemroot%\system32\*.exe" /D- /s:195072! /n /nr|dnif.exe /I ".exe">>TESTts113.TXT
for /f "tokens=*" %%a in (TESTts113.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "6BA6F24336A4F879C5B7D96DB44E2092">NUL && echo %%a>>Find.txt
apps\locate "%systemroot%\system32\*.exe" /D- /s:937984! /n /nr|dnif.exe /I ".exe">>TESTts114.TXT
for /f "tokens=*" %%a in (TESTts114.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "8DA93779F987E59BA56D0D65FD7D9ECD">NUL && echo %%a>>Find.txt
apps\locate "%systemroot%\system32\winsys.exe" /D- /s:384596! /n /nr|dnif.exe /I ".exe">>TESTts115.TXT
for /f "tokens=*" %%a in (TESTts115.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "D2A386915B090CE9977859FEE60F8452">NUL && echo %%a>>Find.txt
apps\locate "%systemroot%\system32\sysprep.exe" /D- /s:57344! /n /nr|dnif.exe /I ".exe">>Find.txt
apps\locate "%systemdrive%\Setup.exe" /D- /s:857600! /n /nr|dnif.exe /I ".exe">>TESTts116.TXT
for /f "tokens=*" %%a in (TESTts116.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "617005A74AA3C48D0D261C115F6A2345">NUL && echo %%a>>Find.txt

cls
echo.
echo Starting Repairs
echo.
echo Checking Running Processes and Services
echo.
echo.
echo Please Be Patient As This May Take Up To 20 Minutes
echo.
echo Restoring Default Security Values
echo Restoring Default Hosts File
echo.
echo Note - Protective Host Files such as MVPS/HP hosts or Spybots
echo        Immunizer feature should be reapplied after using SDFix
echo.
echo Checking Files
echo.
echo Please Wait
echo.
echo 50%% Checked

apps\locate "%systemroot%\system32\*.exe" /D- /s:225280! /n /nr|dnif.exe /I ".exe">>TESTts117.TXT
for /f "tokens=*" %%a in (TESTts117.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "1D890FF3382CD40AB1642145DFDEBDD4">NUL && echo %%a>>Find.txt
apps\locate "%systemdrive%\*.exe" /D- /s:206365! /n /nr|dnif.exe /I ".exe">>TESTts118.TXT
apps\locate "%systemroot%\system32\*.exe" /D- /s:206365! /n /nr|dnif.exe /I ".exe">>TESTts118.TXT
for /f "tokens=*" %%a in (TESTts118.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "A4A7065114F70D1DCFEA4A30F86EC74">NUL && echo %%a>>Find.txt
apps\locate "%systemroot%\system32\*.exe" /D- /s:239616! /n /nr|dnif.exe /I ".exe">>TESTts119.TXT
for /f "tokens=*" %%a in (TESTts119.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "B4F75389008D9462A55FC4D15764D860">NUL && echo %%a>>Find.txt
apps\locate "%temp%\*.exe" /D- /s:45056! /n /nr|dnif.exe /I ".exe">>TESTts120.TXT
for /f "tokens=*" %%a in (TESTts120.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "926C8492151799EC447912741F61C5B9">NUL && echo %%a>>Find.txt
apps\locate "%systemroot%\system32\sysppu*.dll" /D- /s:8192! /n /nr|dnif.exe /I ".dll">>Find.txt
apps\locate "%temp%\downloader.exe" /D- /s:8192! /n /nr|dnif.exe /I ".exe">>Find.txt
apps\locate "%temp%\loader.exe" /D- /s:12800! /n /nr|dnif.exe /I ".exe">>Find.txt
apps\locate "%temp%\shell32.dll" /D- /s:5120! /n /nr|dnif.exe /I ".exe">>Find.txt
apps\locate "%systemroot%\system32\test1.exe" /D- /s:273000,278000 /n /nr|dnif.exe /I ".dll">>Find.txt
apps\locate "%systemroot%\system32\*.dll" /D- /s:32768! /n /nr|dnif.exe /I ".dll">>TESTts121.TXT
for /f "tokens=*" %%a in (TESTts121.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "B05B0834E8A5484ABA6B066C5ACB9B42">NUL && echo %%a>>Find.txt
apps\locate "%systemroot%\system32\*.exe" /D- /s:63488! /n /nr|dnif.exe /I ".exe">>TESTts122.TXT
for /f "tokens=*" %%a in (TESTts122.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "299844D8AB9284C3CC176CA34AF75396">NUL && echo %%a>>Find.txt
apps\locate "%temp%\*.exe" /D- /s:19968! /n /nr|dnif.exe /I ".exe">>TESTts123.TXT
for /f "tokens=*" %%a in (TESTts123.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "5894BB199F44630B93C2814BBE850176">NUL && echo %%a>>Find.txt
apps\locate "%temp%\*.exe" /D- /s:1536! /n /nr|dnif.exe /I ".exe">>TESTts124.TXT
for /f "tokens=*" %%a in (TESTts124.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "DF5731C6877AF4E4ECD4052F73E8D46E">NUL && echo %%a>>Find.txt
apps\locate "%systemdrive%\*.exe" /D- /s:210! /n /nr|dnif.exe /I ".exe">>TESTts125.TXT
rtsdnif.exe /m /f:TESTts125.TXT "404 Not Found">>Find.txt
apps\locate "%systemroot%\system32\*.exe" /D- /s:173056! /n /nr|dnif.exe /I ".exe">>TESTts126.TXT
for /f "tokens=*" %%a in (TESTts126.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "BDA3B855F43EBF07D627886A15C42BF8">NUL && echo %%a>>Find.txt
apps\locate "%systemroot%\system32\*.exe" /D- /s:62464! /n /nr|dnif.exe /I ".exe">>TESTts127.TXT
for /f "tokens=*" %%a in (TESTts127.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "AD9315AD94F484036FC5F9DEA84F8894">NUL && echo %%a>>Find.txt
apps\locate "%userprofile%\Setup.exe" /D- /s:1183744! /n /nr|dnif.exe /I ".exe">>TESTts128.TXT
for /f "tokens=*" %%a in (TESTts128.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "67B1BD0B4790AE83D57851A3D3BBE6E5">NUL && echo %%a>>Find.txt
apps\locate "%systemdrive%\*.exe" /D- /s:76288! /n /nr|dnif.exe /I ".exe">>TESTts129.TXT
for /f "tokens=*" %%a in (TESTts129.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "EF45192710312AECF5CEFECFD27B019C">NUL && echo %%a>>Find.txt
apps\locate "%systemdrive%\*.exe" /D- /s:52224! /n /nr|dnif.exe /I ".exe">>TESTts130.TXT
for /f "tokens=*" %%a in (TESTts130.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "AF7ED86900DBF42CC51E3502CA029A96">NUL && echo %%a>>Find.txt
apps\locate "%systemdrive%\*.exe" /D- /s:90112! /n /nr|dnif.exe /I ".exe">>TESTts131.TXT
for /f "tokens=*" %%a in (TESTts131.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "3A665A54582F63FAEE80CA745F6B6A1A">NUL && echo %%a>>Find.txt
for /f "tokens=*" %%a in (TESTts131.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "fac10d1e2b3a0b2f5ffa7a3de0a90315">NUL && echo %%a>>Find.txt
apps\locate "%systemroot%\system32\*.exe" /D- /s:847458! /n /nr|dnif.exe /I ".exe">>TESTts132.TXT
for /f "tokens=*" %%a in (TESTts132.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "521DCF4846D771FA671635FF1F847315">NUL && echo %%a>>Find.txt
apps\locate "%systemroot%\system32\*.exe" /D- /s:139278! /n /nr|dnif.exe /I ".exe">>TESTts133.TXT
for /f "tokens=*" %%a in (TESTts133.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "AD40C3FC7F5B980320D06F0F304DBD98">NUL && echo %%a>>Find.txt
apps\locate "%systemroot%\*.exe" /D- /s:49152! /n /nr|dnif.exe /I ".exe">>TESTts134.TXT
for /f "tokens=*" %%a in (TESTts134.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "f67800eee8605143ea6e895d7fb9709a">NUL && echo %%a>>Find.txt
apps\locate "%systemroot%\system32\*.exe" /D- /s:357360! /n /nr|dnif.exe /I ".exe">>TESTts135.TXT
for /f "tokens=*" %%a in (TESTts135.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "2C784740F2E37E6A06F9AEA4B628F4C2">NUL && echo %%a>>Find.txt
apps\locate "%systemroot%\system32\*.exe" /D- /s:37888! /n /nr|dnif.exe /I ".exe">>TESTts136.TXT
for /f "tokens=*" %%a in (TESTts136.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "81BF6AA591346715753FA47BBEA74450">NUL && echo %%a>>Find.txt
apps\locate "%systemroot%\system32\*.dll" /D- /s:20480! /n /nr|dnif.exe /I ".dll">>TESTts137.TXT
for /f "tokens=*" %%a in (TESTts137.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "4C9B154E86FC60078354AA376499C1DD">NUL && echo %%a>>Find.txt
apps\locate "%systemdrive%\*.tmp" /D- /s:11721! /n /nr|dnif.exe /I ".tmp">>TESTts138.TXT
for /f "tokens=*" %%a in (TESTts138.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "849B0A4A2DC1C1EF2F733D6426A828F9">NUL && echo %%a>>Find.txt
apps\locate "%systemdrive%\*.exe" /D- /s:90112! /n /nr|dnif.exe /I ".exe">>TESTts139.TXT
for /f "tokens=*" %%a in (TESTts139.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "127737785A956D1B954F851BACF1A879">NUL && echo %%a>>Find.txt
apps\locate "%systemroot%\system32\*.exe" /D- /s:347136! /n /nr|dnif.exe /I ".exe">>TESTts140.TXT
for /f "tokens=*" %%a in (TESTts140.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "D8F265D9B9D075002D66CC372F54A7C8">NUL && echo %%a>>Find.txt
apps\locate "%systemroot%\system32\*.dll" /D- /s:41472! /n /nr|dnif.exe /I ".dll">>TESTts141.TXT
for /f "tokens=*" %%a in (TESTts141.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "FE876ABF51B9F35DEFED3FACD85D10A0">NUL && echo %%a>>Find.txt
apps\locate "%systemroot%\system32\*.exe" /D- /s:40448! /n /nr|dnif.exe /I ".exe">>TESTts142.TXT
for /f "tokens=*" %%a in (TESTts142.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "08F7DBB609205F0F919F8777D6EA069B">NUL && echo %%a>>Find.txt
apps\locate "%systemdrive%\*.exe" /D- /s:52736! /n /nr|dnif.exe /I ".exe">>TESTts143.TXT
for /f "tokens=*" %%a in (TESTts143.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "E3D572DEAB3EFA2F1B053E604058D4B5">NUL && echo %%a>>Find.txt
apps\locate "%systemdrive%\*.exe" /D- /s:22016! /n /nr|dnif.exe /I ".exe">>TESTts144.TXT
for /f "tokens=*" %%a in (TESTts144.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "93b1445a8d241a6834dd6376152c617f">NUL && echo %%a>>Find.txt
apps\locate "%systemdrive%\*.exe" /D- /s:135896! /n /nr|dnif.exe /I ".exe">>TESTts145.TXT
for /f "tokens=*" %%a in (TESTts145.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "1ABEE96EC79EF3AF45D1DE23197C8C00">NUL && echo %%a>>Find.txt
apps\locate "%systemdrive%\*.exe" /D- /s:5632! /n /nr|dnif.exe /I ".exe">>TESTts146.TXT
for /f "tokens=*" %%a in (TESTts146.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "2E84F8AE237A563842962F31CDA0636C">NUL && echo %%a>>Find.txt
apps\locate "%systemdrive%\*.exe" /D- /s:133120! /n /nr|dnif.exe /I ".exe">>TESTts147.TXT
for /f "tokens=*" %%a in (TESTts147.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "1DDA53847688DE2A9203E7107AD4668F">NUL && echo %%a>>Find.txt
apps\locate "%systemroot%\system32\*.dll" /D- /s:10000! /n /nr|dnif.exe /I ".dll">>TESTts148.TXT
for /f "tokens=*" %%a in (TESTts148.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "467F2A71513350B6C94DA920BA4FB6E8">NUL && echo %%a>>RemLat.txt
for /f "tokens=*" %%a in (TESTts148.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "96B117C91C55E8B5BE6DB75A5FCF334B">NUL && echo %%a>>RemLat.txt
apps\locate "%systemroot%\installer\*.msi" /D- /s:180224! /n /nr|dnif.exe /I ".msi">>TESTts149.TXT
for /f "tokens=*" %%a in (TESTts149.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "C2228E60F5AEDDB82A288273D2FA4EBE">NUL && echo %%a>>Find.txt
apps\locate "%systemroot%\system32\*.exe" /D- /s:96850! /n /nr|dnif.exe /I ".exe">>TESTts150.TXT
for /f "tokens=*" %%a in (TESTts150.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "BD3FC220E3830A3EA41B4E076A36EADA">NUL && echo %%a>>Find.txt
apps\locate "%systemroot%\system32\*.dll" /D- /s:160768! /n /nr|dnif.exe /I ".dll">>TESTts151.TXT
for /f "tokens=*" %%a in (TESTts151.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "1A297E4AE6FA2A5F89D3993B7A6A208F">NUL && echo %%a>>Find.txt
apps\locate "%systemroot%\system32\*.dll" /D- /s:178176! /n /nr|dnif.exe /I ".dll">>TESTts152.TXT
for /f "tokens=*" %%a in (TESTts152.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "4482CBF4312B604CE4C4BB9A202636A4">NUL && echo %%a>>Find.txt

apps\locate "%programfiles%\*.dll" /D- /s:114688! /n|dnif.exe /I ".dll">>TESTtspb1.TXT
for /f "tokens=*" %%a in (TESTtspb1.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "C133A525722822359CCC626AF820FEC0">NUL && echo %%a>>Find.txt
apps\locate "%programfiles%\*.dll" /D- /s:106496! /n|dnif.exe /I ".dll">>TESTtspb2.TXT
for /f "tokens=*" %%a in (TESTtspb2.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "58D4DA21E7AB1ACCCE7D6223686DEBAB">NUL && echo %%a>>Find.txt

apps\locate "%systemroot%\system32\*.dll" /D- /s:115200! /n /nr|dnif.exe /I ".dll">>TESTvun1.TXT
for /f "tokens=*" %%a in (TESTvun1.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "FA08540D642A41134D6BFFDE03D2D00F">NUL && echo %%a>>Find.txt
apps\locate "%systemroot%\system32\*.dll" /D- /s:73216! /n /nr|dnif.exe /I ".dll">>TESTvun2.TXT
for /f "tokens=*" %%a in (TESTvun2.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "798A76025ED66CA03B3AA51E7E364400">NUL && echo %%a>>Find.txt

apps\locate "%systemroot%\system32\*.dll" /D- /s:8704! /n /nr|dnif.exe /I ".dll">>TESTnuklus1.TXT
for /f "tokens=*" %%a in (TESTnuklus1.TXT) do apps\MD5File.exe "%%a"|dnif.exe /I "d6ab675f6a6e2b7e031e6c835b944833">NUL && echo %%a>>Find.txt

ECHO %USERPROFILE%>Checkusersdir1.txt
FOR /F "TOKENS=1,2* DELIMS=\" %%A in (Checkusersdir1.txt) DO CALL SET USRDIR=%%A\%%B>NUL
apps\locate "%USRDIR%\LocalService\Application Data\*.exe" /D- /n /nr|dnif.exe /I ".exe">>Checkusersdir4.txt
dnif.exe /I "C~1\0"<Checkusersdir4.txt>>Find.txt
dnif.exe /I "C~1\1"<Checkusersdir4.txt>>Find.txt
dnif.exe /I "C~1\2"<Checkusersdir4.txt>>Find.txt
dnif.exe /I "C~1\3"<Checkusersdir4.txt>>Find.txt
dnif.exe /I "C~1\4"<Checkusersdir4.txt>>Find.txt
dnif.exe /I "C~1\5"<Checkusersdir4.txt>>Find.txt
dnif.exe /I "C~1\6"<Checkusersdir4.txt>>Find.txt
dnif.exe /I "C~1\7"<Checkusersdir4.txt>>Find.txt
dnif.exe /I "C~1\8"<Checkusersdir4.txt>>Find.txt
dnif.exe /I "C~1\9"<Checkusersdir4.txt>>Find.txt
IF EXIST "%USRDIR%\Nod32Av.exe" echo %USRDIR%\Nod32Av.exe>>FIND.TXT
IF EXIST "%USRDIR%\sspool.exe" echo %USRDIR%\sspool.exe>>FIND.TXT
IF EXIST "%USRDIR%\VNASC.exe" echo %USRDIR%\VNASC.exe>>FIND.TXT
IF EXIST "%USRDIR%\winserv.exe" echo %USRDIR%\winserv.exe>>FIND.TXT
FOR /F "TOKENS=1,2* DELIMS=\" %%C in (Checkusersdir1.txt) DO DIR /B/A:D "%%C\%%D\" >Checkusersdir2.txt
FOR /F "TOKENS=*" %%G in (Checkusersdir2.txt) DO (
IF EXIST "%USRDIR%\%%G\explorer.dll" echo %USRDIR%\%%G\explorer.dll>>Checkusersdir3.txt
IF EXIST "%USRDIR%\%%G\ms_tcp.dll" echo %USRDIR%\%%G\ms_tcp.dll>>Checkusersdir3.txt
IF EXIST "%USRDIR%\%%G\svchost.exe" echo %USRDIR%\%%G\svchost.exe>>Checkusersdir3.txt
IF EXIST "%USRDIR%\%%G\Application Data\Adobe\crc.dat" echo %USRDIR%\%%G\Application Data\Adobe\crc.dat>>Checkusersdir3.txt
IF EXIST "%USRDIR%\%%G\Application Data\Adobe\Manager.exe" echo %USRDIR%\%%G\Application Data\Adobe\Manager.exe>>Checkusersdir3.txt
IF EXIST "%USRDIR%\%%G\Application Data\Adobe\Player.exe" echo %USRDIR%\%%G\Application Data\Adobe\Player.exe>>Checkusersdir3.txt
IF EXIST "%USRDIR%\%%G\Application Data\Adobe\Player.exe.ini" echo %USRDIR%\%%G\Application Data\Adobe\Player.exe.ini>>Checkusersdir3.txt
IF EXIST "%USRDIR%\%%G\Application Data\Adobe\Player.exe.bak" echo %USRDIR%\%%G\Application Data\Adobe\Player.exe.bak>>Checkusersdir3.txt
IF EXIST "%USRDIR%\%%G\Application Data\sysproc64\sysproc32.sys" echo %USRDIR%\%%G\Application Data\sysproc64\sysproc32.sys>>Checkusersdir3.txt 2>nul
IF EXIST "%USRDIR%\%%G\Application Data\sysproc64\sysproc32.sys.cla" echo %USRDIR%\%%G\Application Data\sysproc64\sysproc32.sys.cla>>Checkusersdir3.txt 2>nul
IF EXIST "%USRDIR%\%%G\Application Data\sysproc64\sysproc86.sys" echo %USRDIR%\%%G\Application Data\sysproc64\sysproc86.sys>>Checkusersdir3.txt 2>nul
IF EXIST "%USRDIR%\%%G\Application Data\twain_32\local.ds" echo %USRDIR%\%%G\Application Data\twain_32\local.ds>>Checkusersdir3.txt 2>nul
IF EXIST "%USRDIR%\%%G\Application Data\twain_32\user.ds" echo %USRDIR%\%%G\Application Data\twain_32\user.ds>>Checkusersdir3.txt 2>nul
IF EXIST "%USRDIR%\%%G\Application Data\twain_32\user.ds.cla" echo %USRDIR%\%%G\Application Data\twain_32\user.ds.cla>>Checkusersdir3.txt 2>nul
IF EXIST "%USRDIR%\%%G\Application Data\oembios.exe" echo %USRDIR%\%%G\Application Data\oembios.exe>>Checkusersdir3.txt 2>nul
IF EXIST "%USRDIR%\%%G\Application Data\twext.exe" echo %USRDIR%\%%G\Application Data\twext.exe>>Checkusersdir3.txt 2>nul
IF EXIST "%USRDIR%\%%G\Application Data\wsnpoem\audio.dll" echo %USRDIR%\%%G\Application Data\wsnpoem\audio.dll>>Checkusersdir3.txt 2>nul
IF EXIST "%USRDIR%\%%G\Application Data\wsnpoem\audio.dll.cla" echo %USRDIR%\%%G\Application Data\wsnpoem\audio.dll.cla>>Checkusersdir3.txt 2>nul
IF EXIST "%USRDIR%\%%G\Application Data\wsnpoem\video.dll" echo %USRDIR%\%%G\Application Data\wsnpoem\video.dll>>Checkusersdir3.txt 2>nul
IF EXIST "%USRDIR%\%%G\Cookies\*.ban" apps\locate "%USRDIR%\%%G\Cookies\*.ban" /D- /n /nr|dnif.exe /I ".ban">>Find.txt
IF EXIST "%USRDIR%\%%G\Cookies\*.bin" apps\locate "%USRDIR%\%%G\Cookies\*.bin" /D- /n /nr|dnif.exe /I ".bin">>Find.txt
IF EXIST "%USRDIR%\%%G\Cookies\*.dll" apps\locate "%USRDIR%\%%G\Cookies\*.dll" /D- /n /nr|dnif.exe /I ".dll">>Find.txt
IF EXIST "%USRDIR%\%%G\Cookies\*.db" apps\locate "%USRDIR%\%%G\Cookies\*.db" /D- /n /nr|dnif.exe /I ".db">>Find.txt
IF EXIST "%USRDIR%\%%G\Cookies\*.dl" apps\locate "%USRDIR%\%%G\Cookies\*.dl" /D- /n /nr|dnif.exe /I ".dl">>Find.txt
IF EXIST "%USRDIR%\%%G\Cookies\*._dl" apps\locate "%USRDIR%\%%G\Cookies\*._dl" /D- /n /nr|dnif.exe /I "._dl">>Find.txt
IF EXIST "%USRDIR%\%%G\Cookies\*._sy" apps\locate "%USRDIR%\%%G\Cookies\*._sy" /D- /n /nr|dnif.exe /I "._sy">>Find.txt
IF EXIST "%USRDIR%\%%G\Cookies\*.exe" apps\locate "%USRDIR%\%%G\Cookies\*.exe" /D- /n /nr|dnif.exe /I ".exe">>Find.txt
IF EXIST "%USRDIR%\%%G\Cookies\*.lib" apps\locate "%USRDIR%\%%G\Cookies\*.lib" /D- /n /nr|dnif.exe /I ".lib">>Find.txt
IF EXIST "%USRDIR%\%%G\Cookies\*.pif" apps\locate "%USRDIR%\%%G\Cookies\*.pif" /D- /n /nr|dnif.exe /I ".pif">>Find.txt
IF EXIST "%USRDIR%\%%G\Cookies\*.reg" apps\locate "%USRDIR%\%%G\Cookies\*.reg" /D- /n /nr|dnif.exe /I ".reg">>Find.txt
IF EXIST "%USRDIR%\%%G\Cookies\*.scr" apps\locate "%USRDIR%\%%G\Cookies\*.scr" /D- /n /nr|dnif.exe /I ".scr">>Find.txt
IF EXIST "%USRDIR%\%%G\Cookies\*.sys" apps\locate "%USRDIR%\%%G\Cookies\*.sys" /D- /n /nr|dnif.exe /I ".sys">>Find.txt
IF EXIST "%USRDIR%\%%G\Cookies\*.vbs" apps\locate "%USRDIR%\%%G\Cookies\*.vbs" /D- /n /nr|dnif.exe /I ".vbs">>Find.txt
	)
IF EXIST Checkusersdir3.txt TYPE Checkusersdir3.txt|dnif.exe /I /V "system32">>FIND.TXT

apps\locate "%systemdrive%\Setup_*.exe" /n /nr /O:"&W"|dnif.exe /I ".exe">>TestVacSetup1.txt
dnif.exe /I "."<TestVacSetup1.txt>NUL && for /f "tokens=*" %%a in (TestVacSetup1.txt) do dnif.exe /I "Setup_ver1.1"<TestVacSetup1.txt>nul && echo %%~a>>Find.txt

dir /b/s/a-d "%systemroot%\promowp3.html">>TESTADS1.TXT 2>nul
IF EXIST TESTADS1.TXT dnif.exe /I "."<TESTADS1.txt>NUL && for /f "tokens=3 delims=\" %%a in (TESTADS1.txt) do (
IF EXIST %systemroot%\%%a\1.png ECHO %systemroot%\%%a\1.png>>Find.txt
IF EXIST %systemroot%\%%a\2.png ECHO %systemroot%\%%a\2.png>>Find.txt
IF EXIST %systemroot%\%%a\3.png ECHO %systemroot%\%%a\3.png>>Find.txt
IF EXIST %systemroot%\%%a\4.png ECHO %systemroot%\%%a\4.png>>Find.txt
IF EXIST %systemroot%\%%a\5.png ECHO %systemroot%\%%a\5.png>>Find.txt
IF EXIST %systemroot%\%%a\6.png ECHO %systemroot%\%%a\6.png>>Find.txt
IF EXIST %systemroot%\%%a\7.png ECHO %systemroot%\%%a\7.png>>Find.txt
IF EXIST %systemroot%\%%a\8.png ECHO %systemroot%\%%a\8.png>>Find.txt
IF EXIST %systemroot%\%%a\9.png ECHO %systemroot%\%%a\9.png>>Find.txt
IF EXIST %systemroot%\%%a\bottom-rc.gif ECHO %systemroot%\%%a\bottom-rc.gif>>Find.txt
IF EXIST %systemroot%\%%a\config.png ECHO %systemroot%\%%a\config.png>>Find.txt
IF EXIST %systemroot%\%%a\content.png ECHO %systemroot%\%%a\content.png>>Find.txt
IF EXIST %systemroot%\%%a\download.gif ECHO %systemroot%\%%a\download.gif>>Find.txt
IF EXIST %systemroot%\%%a\frame-bg.gif ECHO %systemroot%\%%a\frame-bg.gif>>Find.txt
IF EXIST %systemroot%\%%a\frame-bottom-left.gif ECHO %systemroot%\%%a\frame-bottom-left.gif>>Find.txt
IF EXIST %systemroot%\%%a\frame-h1bg.gif ECHO %systemroot%\%%a\frame-h1bg.gif>>Find.txt
IF EXIST %systemroot%\%%a\head.png ECHO %systemroot%\%%a\head.png>>Find.txt
IF EXIST %systemroot%\%%a\icon.png ECHO %systemroot%\%%a\icon.png>>Find.txt
IF EXIST %systemroot%\%%a\indexwp.html ECHO %systemroot%\%%a\indexwp.html>>Find.txt
IF EXIST %systemroot%\%%a\main.css ECHO %systemroot%\%%a\main.css>>Find.txt
IF EXIST %systemroot%\%%a\memory-prots.png ECHO %systemroot%\%%a\memory-prots.png>>Find.txt
IF EXIST %systemroot%\%%a\net.png ECHO %systemroot%\%%a\net.png>>Find.txt
IF EXIST %systemroot%\%%a\pc.gif ECHO %systemroot%\%%a\pc.gif>>Find.txt
IF EXIST %systemroot%\%%a\pc-mag.gif ECHO %systemroot%\%%a\pc-mag.gif>>Find.txt
IF EXIST %systemroot%\%%a\poloska1.png ECHO %systemroot%\%%a\poloska1.png>>Find.txt
IF EXIST %systemroot%\%%a\poloska2.png ECHO %systemroot%\%%a\poloska2.png>>Find.txt
IF EXIST %systemroot%\%%a\poloska3.png ECHO %systemroot%\%%a\poloska3.png>>Find.txt
IF EXIST %systemroot%\%%a\promowp1.html ECHO %systemroot%\%%a\promowp1.html>>Find.txt
IF EXIST %systemroot%\%%a\promowp2.html ECHO %systemroot%\%%a\promowp2.html>>Find.txt
IF EXIST %systemroot%\%%a\promowp3.html ECHO %systemroot%\%%a\promowp3.html>>Find.txt
IF EXIST %systemroot%\%%a\promowp4.html ECHO %systemroot%\%%a\promowp4.html>>Find.txt
IF EXIST %systemroot%\%%a\promowp5.html ECHO %systemroot%\%%a\promowp5.html>>Find.txt
IF EXIST %systemroot%\%%a\reg.png ECHO %systemroot%\%%a\reg.png>>Find.txt
IF EXIST %systemroot%\%%a\repair.png ECHO %systemroot%\%%a\repair.png>>Find.txt
IF EXIST %systemroot%\%%a\scr-1.png ECHO %systemroot%\%%a\scr-1.png>>Find.txt
IF EXIST %systemroot%\%%a\scr-2.png ECHO %systemroot%\%%a\scr-2.png>>Find.txt
IF EXIST %systemroot%\%%a\start.png ECHO %systemroot%\%%a\start.png>>Find.txt
IF EXIST %systemroot%\%%a\styles.css ECHO %systemroot%\%%a\styles.css>>Find.txt
IF EXIST %systemroot%\%%a\top-rc.gif ECHO %systemroot%\%%a\top-rc.gif>>Find.txt
IF EXIST %systemroot%\%%a\vline.gif ECHO %systemroot%\%%a\vline.gif>>Find.txt
IF EXIST %systemroot%\%%a\wp.png ECHO %systemroot%\%%a\wp.png>>Find.txt
	)

IF EXIST TEST*.TXT DEL /Q TEST*.TXT >NUL

apps\locate "%systemdrive%\z.dat" /N /D-|dnif.exe /I ".dat">>Dat1.txt
apps\locate "%systemdrive%\x.dat" /N /D-|dnif.exe /I ".dat">>Dat1.txt
IF EXIST Dat1.txt dnif.exe /I "."<Dat1.txt>NUL && For /F "TOKENS=*" %%A IN (Dat1.txt) Do TYPE %%A >>Data.txt

> FileList1.txt (
echo "%Favorites%\Search Online.url"
echo "%allstart%\autorun.exe"
echo "%allstart%\autos.exe"
echo "%allstart%\dllhost.exe"
echo "%allstart%\icq.exe"
echo "%allstart%\icq agent.exe"
echo "%allstart%\imglog.exe"
echo "%allstart%\javaxmd.exe"
echo "%allstart%\JVM0.exe"
echo "%allstart%\jvms.exe"
echo "%allstart%\lsass.exe"
echo "%allstart%\mmedia.exe"
echo "%allstart%\msconfig.exe"
echo "%allstart%\mxjxde.exe"
echo "%allstart%\ntrmv.exe"
echo "%allstart%\rundll.exe.lnk"
echo "%allstart%\Start Shopper Link System Tray App.lnk"
echo "%allstart%\svchost.exe"
echo "%allstart%\taskmgr.exe"
echo "%allstart%\Uninstall.exe"
echo "%allstart%\update.exe"
echo "%allstart%\Wincbr.exe"
echo "%allstart%\winlogin.exe"
echo "%allstart%\Winlogon.exe"
echo "%allstart%\winupdbc.exe"
echo "%allstart%\wmsncs.exe"
echo "%allstart%\wsass32.exe"
echo "%allstart%\wupdmgr.exe"
IF EXIST %systemroot%\system32\msmapi?x32.exe echo "%start%\.lnk"
echo "%start%\csrss.lnk"
echo "%start%\d.exe"
echo "%start%\doc.lnk"
echo "%start%\findfast.exe"
echo "%start%\infos.exe"
echo "%start%\lsass.lnk"
echo "%start%\microsoftupdater.exe"
echo "%start%\MY_C4D.jpg"
echo "%start%\Rapid Antivirus.lnk"
echo "%start%\rBot.exe"
echo "%start%\Spruce - Auto Update.lnk"
echo "%start%\svchost.exe"
echo "%start%\system.exe"
echo "%start%\TA_Start.lnk"
echo "%start%\taskman.exe"
echo "%start%\Think-Adz.lnk"
echo "%start%\userinit.exe"
echo "%start%\winamp.exe"
echo "%start%\winlogon.lnk"
echo "%programfiles%\.autoreg"
echo "%programfiles%\a.zip"
echo "%programfiles%\antiviirus.exe"
echo "%programfiles%\AAV\aav0.dat"
echo "%programfiles%\AAV\aav1.dat"
echo "%programfiles%\AAV\aav.cpl"
echo "%programfiles%\AAV\aav.exe"
echo "%programfiles%\AAV\aav.ooo"
echo "%programfiles%\AAV\Uninstall.exe"
echo "%programfiles%\AVM\avm0.dat"
echo "%programfiles%\AVM\avm1.dat"
echo "%programfiles%\AVM\avm.cpl"
echo "%programfiles%\AVM\avm.exe"
echo "%programfiles%\AVM\avm.ooo"
echo "%programfiles%\b.zip"
echo "%programfiles%\c.zip"
echo "%programfiles%\cam2\cam2.exe"
echo "%programfiles%\cam2\logg.dat"
echo "%programfiles%\Components\Component.exe"
echo "%programfiles%\csrss.exe"
echo "%programfiles%\A.ico"
echo "%programfiles%\B.ico"
echo "%programfiles%\B\w.exe"
echo "%programfiles%\bho.exe"
echo "%programfiles%\dsa\dsa.exe"
echo "%programfiles%\dsa\klog.dat"
echo "%programfiles%\EXPLORER.EXE"
echo "%programfiles%\final.exe"
echo "%programfiles%\frost\logg.dat"
echo "%programfiles%\frost\ver.exe"
echo "%programfiles%\Ganeralos\ain.dat"
echo "%programfiles%\Ganeralos\kiral.exe"
echo "%Programfiles%\Google\bipsetup.mcd"
echo "%Programfiles%\Google\exsetup.mcd"
echo "%programfiles%\hlpsrv.exe"
echo "%programfiles%\Internet Explorer\clbcatq.dll"
echo "%programfiles%\Internet Explorer\clbcat.dll"
echo "%programfiles%\Internet Explorer\keys.srv"
echo "%programfiles%\Internet Explorer\KeyViewer.exe"
echo "%programfiles%\Internet Explorer\setupapi.dll"
echo "%programfiles%\Internet Explorer\svchost.exe"
echo "%programfiles%\Loader.exe"
echo "%programfiles%\lsass.exe"
echo "%programfiles%\Macromedia\svchost.exe"
echo "%programfiles%\Macromedia\klog.dat"
echo "%programfiles%\Messenger\klog.dat"
echo "%programfiles%\Messenger\msn.dll"
echo "%programfiles%\Messenger\MSN.exe"
echo "%programfiles%\Messenger\update.dat"
echo "%programfiles%\Messenger\Update.exe"
echo "%programfiles%\Micros\svhoost.exe"
echo "%programfiles%\Microsoft\svhost32.exe"
echo "%programfiles%\Microsoft Help\Microsoft.System.Help.dll"
echo "%programfiles%\Microsoft Help\Microsoft.System.Help.Library.dll"
echo "%programfiles%\Microsoft Help\Microsoft.System.Help.Object.dll"
echo "%programfiles%\MSA\msa0.dat"
echo "%programfiles%\MSA\msa1.dat"
echo "%programfiles%\MSA\MSA.cpl"
echo "%programfiles%\MSA\MSA.exe"
echo "%programfiles%\MSA\MSA.ooo.vir"
echo "%programfiles%\MsConfigs\MsConfigs.exe"
echo "%ProgramFiles%\MSN Messenger\Device Manager\Loc\1774\acx.jog"
echo "%ProgramFiles%\MSN Messenger\Device Manager\Loc\1774\msvbvm60.dll"
echo "%ProgramFiles%\MSN Messenger\Device Manager\Loc\1774\mswinsck.ocx"
echo "%ProgramFiles%\MSN Messenger\Device Manager\Loc\1774\pub.jog"
echo "%ProgramFiles%\MSN Messenger\Device Manager\Loc\1774\Setup.exe"
echo "%ProgramFiles%\MSN Messenger\klog.dat"
echo "%ProgramFiles%\MSN Messenger\msn.exe"
echo "%programfiles%\Network Monitor\netmon.exe"
echo "%programfiles%\outlook\outlook.exe"
echo "%programfiles%\outlook\p.zip"
echo "%programfiles%\outlook\v.tmp"
echo "%programfiles%\Outlook Express\klog.dat"
echo "%programfiles%\Outlook Express\oemig32.exe"
echo "%programfiles%\Outlook Express\setup05s.exe"
echo "%programfiles%\Outlook Express\setup40.exe"
echo "%programfiles%\Outlook Express\default.dat"
echo "%programfiles%\s2f.exe"
echo "%programfiles%\SAV\sav0.dat"
echo "%programfiles%\SAV\sav1.dat"
echo "%programfiles%\SAV\sav.cpl"
echo "%programfiles%\SAV\sav.exe"
echo "%programfiles%\SAV\sav.ooo.vir"
echo "%programfiles%\serial.dat"
echo "%programfiles%\serial.zip"
echo "%programfiles%\Services.exe"
echo "%programfiles%\Setup.exe"
echo "%programfiles%\smss.exe"
echo "%programfiles%\smss.bin"
echo "%programfiles%\spoolsv.exe"
echo "%programfiles%\spoolsv.bin"
echo "%programfiles%\stc\csv5p070.exe"
echo "%programfiles%\svchosts.exe"
echo "%programfiles%\system32\explorer.exe"
echo "%programfiles%\SYSTEM33\logg.dat"
echo "%programfiles%\SYSTEM33\RUNDILL32.exe"
echo "%programfiles%\TinyProxy\TinyProxy.exe"
echo "%programfiles%\Track_03.exe"
echo "%programfiles%\ucleaner_setup.exe"
echo "%programfiles%\udefender_setup.exe"
echo "%programfiles%\Valuei\nando.exe"
echo "%programfiles%\Valuei\klog.dat"
echo "%programfiles%\Video.exe"
echo "%programfiles%\WAV\Uninstall.exe"
echo "%programfiles%\WAV\wav0.dat"
echo "%programfiles%\WAV\wav1.dat"
echo "%programfiles%\WAV\wav.cpl"
echo "%programfiles%\WAV\wav.exe"
echo "%programfiles%\WAV\wav.ooo"
echo "%programfiles%\Windows\klog.dat"
echo "%programfiles%\Windows\microsoft.exe"
echo "%programfiles%\Windows\svchost.exe"
echo "%programfiles%\Windows Media Player\svchost.exe"
echo "%programfiles%\Windows Media Player\svchost.exe"
echo "%programfiles%\wmp\wmp.exe"
echo "%programfiles%\wunauclt.zip"
echo "%programfiles%\wunauclt.tbe"
echo "%programfiles%\xloadnet\xloadnet.exe"
echo "%commonprogramfiles%\dbmio32.dll"
echo "%commonprogramfiles%\Carlson\carlton"
echo "%commonprogramfiles%\Carlson\carlton.exe"
echo "%commonprogramfiles%\delsim\del.exe"
echo "%commonprogramfiles%\inst32\inst32.exe"
echo "%commonprogramfiles%\msmgr32.dll"
echo "%commonprogramfiles%\Microsoft Shared\MSINFO\lasses.exe"
echo "%commonprogramfiles%\Microsoft Shared\MSINFO\rejoice2007.exe"
echo "%commonprogramfiles%\Microsoft Shared\MSINFO\systen32.exe"
echo "%commonprogramfiles%\PnpManager\upnpmngr.exe"
echo "%commonprogramfiles%\svchost.exe"
echo "%commonprogramfiles%\System\btorrent16.exe"
echo "%commonprogramfiles%\System\commond.pif"
echo "%commonprogramfiles%\System\dbmmgr32.dll"
echo "%commonprogramfiles%\System\DBOT.exe"
echo "%commonprogramfiles%\System\easypwnt.exe"
echo "%commonprogramfiles%\System\McAfee.exe"
echo "%commonprogramfiles%\System\microsoft.exe"
echo "%commonprogramfiles%\System\MSASP32.exe"
echo "%commonprogramfiles%\System\MSDEVS30.exe"
echo "%commonprogramfiles%\System\msdevl.exe"
echo "%commonprogramfiles%\System\msnsa32.exe"
echo "%commonprogramfiles%\System\mssecsys.exe"
echo "%commonprogramfiles%\System\MSWVR32.exe"
echo "%commonprogramfiles%\System\Nod32Av.exe"
echo "%commonprogramfiles%\System\reghost.exe"
echo "%commonprogramfiles%\System\reghost32.exe"
echo "%commonprogramfiles%\System\sfcmonit.exe"
echo "%commonprogramfiles%\System\ssc.exe"
echo "%commonprogramfiles%\System\steam.exe"
echo "%commonprogramfiles%\System\svchost.exe"
echo "%commonprogramfiles%\System\svchosts.exe"
echo "%commonprogramfiles%\System\sys_vd4.dat"
echo "%commonprogramfiles%\System\SystemUpgrade.exe"
echo "%commonprogramfiles%\System\update.exe"
echo "%commonprogramfiles%\System\usnsvc.exe"
echo "%commonprogramfiles%\System\VNASC.exe"
echo "%commonprogramfiles%\System\win32update.exe"
echo "%commonprogramfiles%\System\winsc.exe"
echo "%commonprogramfiles%\System\Winsec.exe"
echo "%commonprogramfiles%\System\WinSecUp.exe"
echo "%commonprogramfiles%\System\wmsncs.exe"
echo "%commonprogramfiles%\update\update.exe"
echo "%commonprogramfiles%\WD\bakup.dat"
echo "%commonprogramfiles%\WD\winIogon.exe"
echo "%appdata%\.rdr.ini"
echo "%appdata%\acstrlsp.ocx"
echo "%appdata%\addon.dat"
echo "%appdata%\addons.dat"
echo "%appdata%\ain.dat"
echo "%appdata%\Adobe\mdp.dll"
echo "%appdata%\Adobe\rundtl.exe"
echo "%appdata%\antivirus.exe"
echo "%appdata%\cftmon.exe"
echo "%appdata%\epack.dat"
echo "%appdata%\Google\sccmsk.dll"
echo "%appdata%\installer_en.exe"
echo "%appdata%\installer_en[1].exe"
echo "%appdata%\mcrupdate.exe"
echo "%appdata%\Microsoft\Internet Explorer\Quick Launch\AntiMalware2009.lnk"
echo "%appdata%\Microsoft\Internet Explorer\Quick Launch\AntiSpyCheck 2.1.lnk"
echo "%appdata%\Microsoft\Internet Explorer\Quick Launch\AntiSpywareXP2009.lnk"
echo "%appdata%\Microsoft\Internet Explorer\Quick Launch\Antivirus 2009.lnk"
echo "%appdata%\Microsoft\Internet Explorer\Quick Launch\AntivirusPro2009.lnk"
echo "%appdata%\Microsoft\Internet Explorer\Quick Launch\AntiVirus Lab 2009 2.1.lnk"
echo "%appdata%\Microsoft\Internet Explorer\Quick Launch\Antivirus XP 2008.lnk"
echo "%appdata%\Microsoft\Internet Explorer\Quick Launch\Malware Protector 2008.lnk"
echo "%appdata%\Microsoft\Internet Explorer\Quick Launch\MPatrolPRO.lnk"
echo "%appdata%\Microsoft\Internet Explorer\Quick Launch\WinIFixer.lnk"
echo "%appdata%\Microsoft\Internet Explorer\Quick Launch\SpyDevastator 1.32.lnk"
echo "%appdata%\Microsoft\Internet Explorer\Quick Launch\Start UltimateCleaner 2007.lnk"
echo "%appdata%\Microsoft\Internet Explorer\Quick Launch\VirusHeat 4.3.lnk"
echo "%appdata%\Microsoft\Internet Explorer\Quick Launch\VirusHeat 4.4.lnk"
echo "%appdata%\Microsoft\Internet Explorer\Quick Launch\VirusIsolator.lnk"
echo "%appdata%\Microsoft\Internet Explorer\Quick Launch\VirusResponse Lab 2009 2.1.lnk"
echo "%appdata%\Microsoft\Internet Explorer\Quick Launch\XP_AntiSpyware.lnk"
echo "%appdata%\Microsoft.ServiceCategories.xsd"
echo "%appdata%\Microsoft.SQLCE.6.0.xsd"
echo "%appdata%\Microsoft.SQLCE.6.1.xsd"
echo "%appdata%\Microsoft.WindowsMobile.xsd"
echo "%appdata%\Microsoft\Windows\msdred.exe"
echo "%appdata%\n.ini"
echo "%appdata%\NetMon\domains.txt"
echo "%appdata%\NetMon\log.txt"
echo "%appdata%\redir.dll"
echo "%appdata%\Saddons.dat"
echo "%appdata%\sysdefender.exe"
echo "%appdata%\smss.exe"
echo "%appdata%\smv32.dat"
echo "%appdata%\sp1\a.tmp"
echo "%appdata%\sp1\luapvs.dll"
echo "%appdata%\sp2\qaccess.dll"
echo "%appdata%\spoolsvc.dll"
echo "%appdata%\sg.dll"
echo "%appdata%\spyguarder.exe"
echo "%appdata%\temp.dll"
echo "%appdata%\TmpRecentIcons\Advanced Antivirus.lnk"
echo "%appdata%\TmpRecentIcons\AntiMalware2009.lnk"
echo "%appdata%\TmpRecentIcons\Micro Antivirus 2009.lnk"
echo "%appdata%\TmpRecentIcons\MS Antivirus.lnk"
echo "%appdata%\TmpRecentIcons\System Antivirus 2008.lnk"
echo "%appdata%\TmpRecentIcons\Total Secure 2009.lnk"
echo "%appdata%\TmpRecentIcons\VirusRemover2008.lnk"
echo "%appdata%\TmpRecentIcons\Vista Antivirus 2008.lnk"
echo "%appdata%\TmpRecentIcons\Windows Antivirus.lnk"
echo "%desktop%\.url"
echo "%desktop%\Advanced Antivirus.lnk"
echo "%desktop%\AntiMalwareGuard.lnk"
echo "%desktop%\AntiSpyCheck 2.1.lnk"
echo "%desktop%\antispyknight.lnk"
echo "%desktop%\AntispyStorm.lnk"
echo "%desktop%\AntiSpywareExpert.lnk"
echo "%desktop%\AntiSpywareXP2009.lnk"
echo "%desktop%\Antivir64.lnk"
echo "%desktop%\antivirus-2008.lnk"
echo "%desktop%\antivirus-2008pro.lnk"
echo "%desktop%\Antivirus 2009.lnk"
echo "%desktop%\AntiVirus Lab 2009 2.1.lnk"
echo "%desktop%\Antivirus Master.lnk"
echo "%desktop%\Antivirus XP 2008.lnk"
echo "%desktop%\antvrs.exe"
echo "%desktop%\blackbird.jpg"
echo "%desktop%\Best BDSM P0rn.url"
echo "%desktop%\BEST ZOO PORN.url"
echo "%desktop%\BraveSentry.lnk"
echo "%desktop%\Casino.url"
echo "%desktop%\EditorFKWP1.5.exe"
echo "%desktop%\EditorFKWP2.0.exe"
echo "%desktop%\EXTREME FUCK.url"
echo "%desktop%\F.exe"
echo "%desktop%\filemanagerclient.exe"
echo "%desktop%\Files Secure 2.1.lnk"
echo "%desktop%\Files Secure 2.2.lnk"
echo "%desktop%\FREE STUFF.url"
echo "%desktop%\fkwp1.5.exe"
echo "%desktop%\fkwp2.0.exe"
echo "%desktop%\fwebd.exe"
echo "%desktop%\FWebdEditor.exe"
echo "%desktop%\GAY and LESBIAN.url"
echo "%desktop%\GAY FETISH SEX.url"
echo "%desktop%\GAY PORN.url"
echo "%desktop%\IE AntiVirus 3.2.lnk"
echo "%desktop%\IE AntiVirus 3.3.lnk"
echo "%desktop%\inject.dll"
echo "%desktop%\Malware Bell 3.2.lnk"
echo "%desktop%\MicroAntivirus.lnk"
echo "%desktop%\Micro Antivirus 2009.lnk"
echo "%desktop%\MS Antivirus.lnk"
echo "%desktop%\MS Antivirus XP.lnk"
echo "%desktop%\NAKED LADIES.url"
echo "%desktop%\NASTY VIDEOS.url"
echo "%desktop%\NUDE PICS.url"
echo "%desktop%\nod32.txt"
echo "%desktop%\PC Clean Pro.lnk"
echo "%desktop%\PCPrivacyCleaner.lnk"
echo "%desktop%\PEEP SHOW.url"
echo "%desktop%\PersonalAntiSpy.lnk"
echo "%desktop%\PORN DVDs.url"
echo "%desktop%\Power-Antivirus-2009.lnk"
echo "%desktop%\QUALITY PORN.url"
echo "%desktop%\Rapid Antivirus.lnk"
echo "%desktop%\sccmsk.dll"
echo "%desktop%\Search Online.url"
echo "%desktop%\SecureCleaner.lnk"
echo "%desktop%\services.exe"
echo "%desktop%\SpyDevastator.lnk"
echo "%desktop%\SpyGuarder.lnk"
echo "%desktop%\SpyMaxx.lnk"
echo "%desktop%\SpyShredder.lnk"
echo "%desktop%\System Antivirus 2008.lnk"
echo "%desktop%\svchost.exe"
echo "%desktop%\SystemDefender.lnk"
echo "%desktop%\System Doctor.lnk"
echo "%desktop%\TheSpyBot.lnk"
echo "%desktop%\TITS AND ASS.url"
echo "%desktop%\Total Secure 2009.lnk"
echo "%desktop%\Trojan.Win32.BlackBird.exe"
echo "%desktop%\vipantispyware.lnk"
echo "%desktop%\VirusHeat 4.3.lnk"
echo "%desktop%\VirusHeat 4.4.lnk"
echo "%desktop%\VirusIsolator.lnk"
echo "%desktop%\VirusRemover2008.lnk"
echo "%desktop%\VirusResponse Lab 2009 2.1.lnk"
echo "%desktop%\Vista Antivirus 2008.lnk"
echo "%desktop%\WinAntispyware2008.lnk"
echo "%desktop%\Windows Antivirus 2008.lnk"
echo "%desktop%\WinX Security Center.lnk"
echo "%desktop%\XP_AntiSpyware.lnk"
echo "%desktop%\XP Antivirus 2008.lnk"
echo "%desktop%\tmp.dat"
echo "%desktop%\tmp.exe"
echo "%userprofile%\~.exe"
echo "%userprofile%\$$$$$$$$.bat"
echo "%userprofile%\aria.txt"
echo "%userprofile%\auto.txt"
echo "%userprofile%\evmacash.exe"
echo "%userprofile%\Favorites\Online Security Test.url"
echo "%userprofile%\Google\bipsetup.mcd" 
echo "%userprofile%\Google\exsetup.mcd" 
echo "%userprofile%\ie_ban.exe"
echo "%userprofile%\iexpIore.exe"
echo "%userprofile%\install.exe"
echo "%userprofile%\Local Settings\alg.exe"
echo "%userprofile%\Local Settings\Application Data\Microsoft\Windows\msdred.exe"
echo "%userprofile%\lsass.exe"
echo "%userprofile%\nax.exe"
echo "%userprofile%\new.txt"
echo "%userprofile%\news.txt"
echo "%userprofile%\nod32.txt"
echo "%userprofile%\ntuser.exe"
echo "%userprofile%\PrintHood\addon.dat"
echo "%userprofile%\real.txt"
echo "%userprofile%\scchost.exe"
echo "%userprofile%\scvhost.exe"
echo "%userprofile%\svchosts.exe"
echo "%userprofile%\services.exe"
echo "%userprofile%\smss.exe"
echo "%userprofile%\smss.bin"
echo "%userprofile%\spooldr.ini"
echo "%userprofile%\spoolsv.exe"
echo "%userprofile%\spoolsv.bin"
echo "%StaMen%\AntiSpyCheck 2.1.lnk"
echo "%StaMen%\AntiVirus Lab 2009 2.1.lnk"
echo "%StaMen%\Search Online.url"
echo "%StaMen%\SpyDevastator 1.32.lnk"
echo "%StaMen%\VirusResponse Lab 2009 2.1.lnk"
echo "%Programs%\Startup\Deewoo.lnk"
echo "%Programs%\Startup\DW_Start.lnk"
echo "%Programs%\Files Secure 2.1.lnk"
echo "%Programs%\Files Secure 2.2.lnk"
echo "%Programs%\IE AntiVirus 3.2.lnk"
echo "%Programs%\IE AntiVirus 3.3.lnk"
echo "%Programs%\Malware Bell 3.2.lnk"
echo "%Programs%\Online Security Guide.lnk"
echo "%Programs%\svchost.lnk"
echo "%Programs%\Total Secure 2009.lnk"
echo "%userprofile%\boss4.exe"
echo "%userprofile%\dis.exe"
echo "%userprofile%\svc32.dll"
echo "%userprofile%\svchost.exe"
echo "%userprofile%\svchosts.exe"
echo "%userprofile%\waverevenue.exe"
echo "%userprofile%\win.exe"
echo "%userprofile%\winlogon.exe"
echo "%userprofile%\winmain.exe"
echo "%userprofile%\x.dat"
echo "%userprofile%\z.dat"
echo "%commapp%\services\services.dll"
echo "%commdsk%\AntiMalware2009.lnk"
echo "%commdsk%\AntispyStorm.lnk"
echo "%commdsk%\AntivirusFiable"
echo "%commdsk%\Antivirus XP 2008.lnk"
echo "%commdsk%\AV2010.lnk"
echo "%commdsk%\AXPFixer.lnk"
echo "%commdsk%\Best BDSM P0rn.url"
echo "%commdsk%\Gay Fetish Sex.url"
echo "%commdsk%\Malware Protector 2008.lnk"
echo "%commdsk%\MPatrolPRO.lnk"
echo "%commdsk%\Secure ExpertCleaner.lnk"
echo "%commdsk%\Secure FileShredder.lnk"
echo "%commdsk%\PCTotalDefender.lnk"
echo "%commdsk%\SpyMaxx.lnk"
echo "%commdsk%\VirusEffaceur.lnk"
echo "%commdsk%\VirusGarde.lnk"
echo "%commdsk%\WinIFixer.lnk"
echo "%commdsk%\XPSecurityCenter.lnk"
echo "%allusersprofile%\Clean2.exe"
echo "%allusersprofile%\del.lnk"
echo "%commStaMen%\carlton"
echo "%commStaMen%\del.lnk"
echo "%commStaMen%\Personal Defender 2009.lnk"
echo "%commPrograms%\AntiMalware2009.lnk"
echo "%commPrograms%\Antivirus XP 2008.lnk"
echo "%commPrograms%\Malware Patrol PRO.lnk"
echo "%commPrograms%\Malware Protector 2008.lnk"
echo %temp%\~~install.dll
echo %temp%\0.exe
echo %temp%\1.exe
echo %temp%\123.info
echo %temp%\123.update
echo %temp%\1\svchost.exe
echo %temp%\2\svchost.exe
echo %temp%\3\svchost.exe
echo %temp%\4\svchost.exe
echo %temp%\5\svchost.exe
echo %temp%\6\svchost.exe
echo %temp%\7\svchost.exe
echo %temp%\8\svchost.exe
echo %temp%\9\svchost.exe
echo %temp%\01.exe
echo %temp%\0GmZOfM.exe
echo %temp%\57329.exe
echo %temp%\08.php
echo %temp%\08.php.bat
echo %temp%\79_003.exe
echo %temp%\87124.exe
echo %temp%\16syn.exe
echo %temp%\32agent.exe
echo %temp%\32sys.exe
echo %temp%\ac8zt2.dat
echo %temp%\activation_key
echo %temp%\AdobeCS4Keygen.exe
echo %temp%\agentsv.exe
echo %temp%\atmadm2.exe
echo %temp%\avto.exe
echo %temp%\avto1.exe
echo %temp%\avto2.exe
echo %temp%\baracudanew.exe
echo %temp%\Binaries1.zip
echo %temp%\Binaries2.zip
echo %temp%\Binaries3.zip
echo %temp%\bindsrv2.exe
echo %temp%\BOTBINARY_.EXE
echo %temp%\budget.xpi
echo %temp%\calc.exe
echo %temp%\codec.exe
echo %temp%\Crack.exe
echo %temp%\Csrssc.exe
echo %temp%\dc.exe
echo %temp%\ddos1.exe
echo %temp%\desktop_background.zip
echo %temp%\device.exe
echo %temp%\direct3d.exe
echo %temp%\dllhost.exe
echo %temp%\dllsrv32.exe
echo %temp%\dssc32.exe
echo %temp%\dssec.exe
echo %temp%\E-Greetings.exe
echo %temp%\exe.exe
echo %temp%\explorer.exe
echo %temp%\explorer32.exe
echo %temp%\finder.exe 
echo %temp%\foto.zip
echo %temp%\girls_1024x768.jpeg
echo %temp%\goo.exe
echo %temp%\host32.exe
echo %temp%\host64.exe
echo %temp%\hostserver.exe
echo %temp%\ieobj.dll
echo %temp%\iexplore.exe
echo %temp%\ins.exe
echo %temp%\ipconfig.exe
echo %temp%\iservice.exe
echo %temp%\istat.exe
echo %temp%\kernInst.exe
echo %temp%\kernel.sys
echo %temp%\KeyGen-photo.exe
echo %temp%\kjj.exe
echo %temp%\liar3.exe
echo %temp%\liar5.exe
echo %temp%\linux
echo %temp%\load3.exe
echo %temp%\lol.exe
echo %temp%\lprn32.exe
echo %temp%\lsass.exe
echo %temp%\lwpwer.exe
echo %temp%\media.php
echo %temp%\media.php.bat
echo %temp%\Messanger.bat
echo %temp%\mljul1.exe
echo %temp%\monlook.exe
echo %temp%\monmon.exe
echo %temp%\mozzi.exe
echo %temp%\mpxpass.exe
echo %temp%\msfont32.dll
echo %temp%\msnmsgr.exe
echo %temp%\msnmsgs.exe
echo %temp%\msnworm.exe
echo %temp%\mso13.exe
echo %temp%\msprint.exe
echo %temp%\myspace-pics.zip
echo %temp%\myconfig.php.bat
echo %temp%\my_fotos.exe
echo %temp%\nav_cracker.exe
echo %temp%\new_US.exe
echo %temp%\new-photos.zip
echo %temp%\newstead.exe
echo %temp%\new5_285.exe
echo %temp%\notepad.exe
echo %temp%\nyps4.exe
echo %temp%\part.exe
echo %temp%\payload.exe
echo %temp%\PersonalAntiSpySetup.exe
echo %temp%\pin.vbs
echo %temp%\pinnew.exe
echo %temp%\plugin746.exe
echo %temp%\podmena.exe
echo %temp%\powerwin.exe
echo %temp%\printsrv32.exe
echo %temp%\ProductPath\pgs.exe
echo %temp%\pwrmgr.exe
echo %temp%\removalfile.bat
echo %temp%\rasesnet.exe
echo %temp%\restore.sys
echo %temp%\rip2.exe
echo %temp%\runme.exe
echo %temp%\rsyncini.exe
echo %temp%\s1265.php
echo %temp%\s1265.php.bat
echo %temp%\scan.exe
echo %temp%\scksexde.exe
echo %temp%\services.exe
echo %temp%\Setup+Patch.exe
echo %temp%\seve.exe
echo %temp%\sfsrv.exe
echo %temp%\smss.exe
echo %temp%\snapsnet.exe
echo %temp%\soft.exe
echo %temp%\software.php
echo %temp%\software.php.bat
echo %temp%\spoolsv32.exe
echo %temp%\spywaredetect.exe
echo %temp%\stdlan.exe
echo %temp%\stmhosts.exe
echo %temp%\stmhste.exe
echo %temp%\svc.dll
echo %temp%\svc.exe
echo %temp%\svchost.dll
echo %temp%\svchost.exe
echo %temp%\svch0st.exe
echo %temp%\svchots.exe
echo %temp%\svchots.rgn
echo %temp%\syn16.exe
echo %temp%\synlook.exe
echo %temp%\sys32.exe
echo %temp%\SysConf.conf
echo %temp%\sys.exe
echo %temp%\Sys.htm
echo %temp%\Sysreg.dll
echo %temp%\SystemDoctor2006FreeInstall.exe
echo %temp%\tada.exe
echo %temp%\taskmgr.exe
echo %temp%\temp_01.exe
echo %temp%\TEMP01.RAR
echo %temp%\temp.vbs
echo %temp%\TEMP1.ZIP
echo %temp%\tmpfile0.bat
echo %temp%\tmpfile1.bat
echo %temp%\uNkbot.exe
echo %temp%\Video.exe
echo %temp%\vidxcore.dll
echo %temp%\vistasp1.exe
echo %temp%\vpncore.exe
echo %temp%\wavvsnet.exe
echo %temp%\win32.exe
echo %temp%\winavft.exe
echo %temp%\windows_update.exe
echo %temp%\winlogan.exe
echo %temp%\winlogen.exe
echo %temp%\winlogon.bat
echo %temp%\winlogun.exe
echo %temp%\winpole32.exe
echo %temp%\winpower.exe
echo %temp%\WinReanimator.exe
echo %temp%\winsto.exe
echo %temp%\winsyst32.exe
echo %temp%\winxp_sp3.exe
echo %temp%\wnd.exe
echo %temp%\wuauclt.exe
echo %temp%\xpsp3.exe
echo %temp%\yazzsnet.exe
echo %temp%\zu.exe
echo %temp%\Zupastik.exe
echo %systemdrive%\.exe
echo %systemdrive%\!!!!!.exe
echo %systemdrive%\_xr.bat
echo %systemdrive%\__oddysee.sys
echo %systemdrive%\0xf9.exe
echo %systemdrive%\12.EXE
echo %systemdrive%\124.exe-crypted.exe
echo %systemdrive%\1918.exe
echo %systemdrive%\4113.bat
echo %systemdrive%\756.bat
echo %systemdrive%\A.tmp
echo %systemdrive%\a1c.bat
echo %systemdrive%\aaa.cab
echo %systemdrive%\abcdefg.bat
echo %systemdrive%\ADupdate.exe
echo %systemdrive%\adware.exe
echo %systemdrive%\aklr.exe
echo %systemdrive%\al3twy.txt
echo %systemdrive%\antivir.exe
echo %systemdrive%\antivirus.exe
echo %systemdrive%\aol.exe
echo %systemdrive%\aol-updates.exe
echo %systemdrive%\aolsoftware.exe
echo %systemdrive%\as.txt
echo %systemdrive%\asd.txt
echo %systemdrive%\aspr_keys.ini
echo %systemdrive%\auto.exe
echo %systemdrive%\autoex.dll
echo %systemdrive%\autoexcs.dll
echo %systemdrive%\autoexec.dll
echo %systemdrive%\autorun.exe
echo %systemdrive%\autorun.PNF
echo %systemdrive%\ax.exe
echo %systemdrive%\Backup_Drivers\svchost.exe
echo %systemdrive%\blah.exe
echo %systemdrive%\bootini.exe
echo %systemdrive%\bot.log
echo %systemdrive%\bot.exe
echo %systemdrive%\chh.exe
echo %systemdrive%\claro.exe
echo %systemdrive%\cmd.exe
echo %systemdrive%\command.exe
echo %systemdrive%\cpy.bat
echo %systemdrive%\creative.exe
echo %systemdrive%\csrss.exe
echo %systemdrive%\d1.exe
echo %systemdrive%\d2.exe
echo %systemdrive%\data.exe
echo %systemdrive%\date.log
echo %systemdrive%\dbg.txt
echo %systemdrive%\ddggs.exe
echo %systemdrive%\debugsssssssss.txt
echo %systemdrive%\delextra.exe
echo %systemdrive%\dgfte.exe
echo %systemdrive%\dgs.exe
echo %systemdrive%\dipset.exe
echo %systemdrive%\dmgr.exe
echo "%systemdrive%\Documents and Settings\LocalService\Desktop\Online Security Test.url"
echo "%systemdrive%\Documents and Settings\LocalService\Favorites\Online Security Test.url"
echo %systemdrive%\DriverLoad\windrv.exe
echo %systemdrive%\ds.exe
echo %systemdrive%\dsrss.exe
echo %systemdrive%\elk.exe
echo %systemdrive%\empa.exe
echo %systemdrive%\END
echo %systemdrive%\exo32.exe
echo %systemdrive%\explorer.exe
echo %systemdrive%\ezStub.exe
echo %systemdrive%\fdgfd.exe
echo %systemdrive%\fdhfd.exe
echo %systemdrive%\findfast.exe
echo %systemdrive%\Foto_celular.scr
echo %systemdrive%\Foto_celular.zip
echo %systemdrive%\fsfs.exe
echo %systemdrive%\funfiles.exe
echo %systemdrive%\funny_pic.scr
echo %systemdrive%\glossary.exe
echo %systemdrive%\gt.exe
echo %systemdrive%\hellmsn.exe
echo %systemdrive%\hi.exe
echo "%systemdrive%\h0t pr0n.jpg"
echo %systemdrive%\hwftnai.exe
echo %systemdrive%\i.mages.zip
echo %systemdrive%\ibiocpq.exe
echo %systemdrive%\ieupdate.exe
echo %systemdrive%\ie_updater.exe
echo %systemdrive%\ie_updates2r.exe
echo %systemdrive%\iexplore.exe
echo %systemdrive%\iexplorer.exe
echo %systemdrive%\install\credits.bat
echo %systemdrive%\install\ghost.exe
echo %systemdrive%\install\install.exe
echo %systemdrive%\int_rem.bat
echo %systemdrive%\ircmsg.txt
echo %systemdrive%\irsrss.exe
echo %systemdrive%\javaapplets.exe
echo %systemdrive%\javaapplet.exe
echo %systemdrive%\javanet.exe
echo %systemdrive%\jpb.exe
echo %systemdrive%\jconsole.exe
echo %systemdrive%\jhfr.exe
echo %systemdrive%\KB295792.exe
echo %systemdrive%\kernel32.exe
echo %systemdrive%\kg.exe
echo %systemdrive%\lala.exe
echo %systemdrive%\lich.exe
echo %systemdrive%\limewirepro.exe
echo %systemdrive%\LittleSys32Rec.exe
echo %systemdrive%\lo.exe 
echo %systemdrive%\loaders.exe
echo %systemdrive%\logn.exe
echo %systemdrive%\lol.exe 
echo %systemdrive%\loser.exe
echo %systemdrive%\loser2.exe
echo %systemdrive%\lox.exe
echo %systemdrive%\lsass.exe
echo %systemdrive%\mguard.exe
echo %systemdrive%\microsoft.dll
echo %systemdrive%\microsoft.exe
echo %systemdrive%\microsoft\svchost.exe
echo %systemdrive%\mismsni.exe
echo %systemdrive%\mrisvc.exe
echo %systemdrive%\MS0ffice.exe
echo %systemdrive%\MS32.exe
echo %systemdrive%\msclt.exe
echo %systemdrive%\msejavaupdt32.exe
echo %systemdrive%\msfk.exe
echo %systemdrive%\msi32java.exe
echo %systemdrive%\msident.exe
echo %systemdrive%\msijavaupdt32.exe
echo %systemdrive%\msjava.exe
echo %systemdrive%\msjavames.exe
echo %systemdrive%\msjavaxps.exe
echo %systemdrive%\msn.exe
echo %systemdrive%\msnstart.bat
echo %systemdrive%\mstn.exe
echo %systemdrive%\my_photo2005.scr
echo %systemdrive%\myDelm.bat
echo %systemdrive%\necg.exe.bak
echo %systemdrive%\net.exe
echo %systemdrive%\nethlpr.exe
echo %systemdrive%\new.exe
echo "%systemdrive%\New Folder.exe"
echo %systemdrive%\noexistfile.txt
echo %systemdrive%\nois.log
echo %systemdrive%\ntlds.exe
echo %systemdrive%\office.exe
echo %systemdrive%\onces.exe
echo %systemdrive%\osndyrn.exe
echo %systemdrive%\owned.txt
echo %systemdrive%\pit.exe
echo %systemdrive%\pizza.exe
echo %systemdrive%\prkc.exe
echo %systemdrive%\prkc\kler.exe
echo %systemdrive%\prkc\relpk.exe
echo %systemdrive%\prkc\service.bat
echo %systemdrive%\ProRat.exe
echo %systemdrive%\prosys32.exe
echo %systemdrive%\qbsoqyl.exe
echo %systemdrive%\qnflkotm.dll
echo %systemdrive%\readme-info.txt
echo %systemdrive%\Recycled\userinit.exe
echo %systemdrive%\RECYCLER\msnmnsgr.exe
echo %systemdrive%\RECYCLER\msnservice.exe
echo %systemdrive%\RECYCLER\msnupdate.exe
echo %systemdrive%\RECYCLER\n
echo %systemdrive%\RECYCLER\nvscvse.exe
echo %systemdrive%\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\autorun.exe
echo %systemdrive%\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\dll32.exe
echo %systemdrive%\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\drv32.exe
echo %systemdrive%\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\emacs.exe
echo %systemdrive%\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\grinder.exe
echo %systemdrive%\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\helper.exe
echo %systemdrive%\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\iexplorer.exe
echo %systemdrive%\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ipse32.exe
echo %systemdrive%\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\iqe32.exe
echo %systemdrive%\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\isee.exe
echo %systemdrive%\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise.exe
echo %systemdrive%\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe
echo %systemdrive%\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\isew32.exe
echo %systemdrive%\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\isi32.exe
echo %systemdrive%\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\isys32.exe
echo %systemdrive%\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\iuhx32.exe
echo %systemdrive%\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\keygen.exe
echo %systemdrive%\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\msnmgnr.exe
echo %systemdrive%\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\raping.exe
echo %systemdrive%\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\spoolsv.exe
echo %systemdrive%\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\system.exe
echo %systemdrive%\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\sys32.exe
echo %systemdrive%\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\win32.exe
echo %systemdrive%\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\winhelp.exe
echo %systemdrive%\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\winse32.exe
echo %systemdrive%\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\xop32.exe
echo %systemdrive%\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1015\svchost.exe
echo %systemdrive%\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1033\vmmgr.exe
echo %systemdrive%\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\a.reg
echo %systemdrive%\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\aIRCversions.txt
echo %systemdrive%\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\aliases.ini
echo %systemdrive%\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\Connecter.ini
echo %systemdrive%\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\control.ini
echo %systemdrive%\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\csrss.exe
echo %systemdrive%\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\ENGINE.ini
echo %systemdrive%\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\fullname.txt
echo %systemdrive%\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\fura.txt
echo %systemdrive%\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\ident.txt
echo %systemdrive%\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\identd.txt
echo %systemdrive%\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\instsrv.exe
echo %systemdrive%\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\IRC.ICO
echo %systemdrive%\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\mirc.exe
echo %systemdrive%\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\mirc.ico
echo %systemdrive%\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\mirc.ini
echo %systemdrive%\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\mirc.reg
echo %systemdrive%\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\mynick.txt
echo %systemdrive%\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\Nick.ini
echo %systemdrive%\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\perform.ini
echo %systemdrive%\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\popups.txt
echo %systemdrive%\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\remote.ini
echo %systemdrive%\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\script.ini
echo %systemdrive%\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\script1.ini
echo %systemdrive%\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\Servere.ini
echo %systemdrive%\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\servers.ini
echo %systemdrive%\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\Starter.ini
echo %systemdrive%\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\sup.exe
echo %systemdrive%\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\svchost.exe
echo %systemdrive%\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\users.ini
echo %systemdrive%\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\vchanger.dat
echo %systemdrive%\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\version.mrc
echo %systemdrive%\RECYCLER\te32.exe
echo %systemdrive%\RECYCLER\winupdate.exe
echo %systemdrive%\RECYCLER\winupdate32.exe
echo %systemdrive%\Recyclers\svchost.exe
echo %systemdrive%\regxpcom.exe
echo %systemdrive%\res.txt
echo %systemdrive%\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe
echo %systemdrive%\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\lovely.exe
echo %systemdrive%\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\msnmsngr.exe
echo %systemdrive%\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\rise.exe
echo %systemdrive%\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\Taquito.exe
echo %systemdrive%\rlog.txt
echo %systemdrive%\RMZ.EXE
echo %systemdrive%\R~A~M~Z.EXE
echo %systemdrive%\runner.bat
echo %systemdrive%\s32.exe
echo %systemdrive%\SCVOST.EXE
echo %systemdrive%\sdffs.exe
echo %systemdrive%\sdg.exe
echo %systemdrive%\sdgs.exe
echo %systemdrive%\see_this!!.scr 
echo %systemdrive%\Server.exe
echo %systemdrive%\services.exe
echo %systemdrive%\Settings\arm65.dll
echo %systemdrive%\Settings\arm80.dll
echo %systemdrive%\sfsfs.exe
echo %systemdrive%\shdg.exe
echo %systemdrive%\SHL.EXE
echo %systemdrive%\shost.exe
echo %systemdrive%\sirh0t_changes_ur_hostfile.bat
echo %systemdrive%\site.exe
echo %systemdrive%\smp.bat
echo %systemdrive%\SMS.EXE
echo %systemdrive%\smss.exe
echo %systemdrive%\Sock.exe
echo "%systemdrive%\Sohbet Chat.lnk"
echo %systemdrive%\sp1.exe
echo %systemdrive%\sp2ini.pif
echo %systemdrive%\spbot.log.txt
echo %systemdrive%\sstray.exe
echo %systemdrive%\steampwd_upx_save2file.exe
echo %systemdrive%\Support.Scr
echo %systemdrive%\svcccc.exe
echo %systemdrive%\svchost.com
echo %systemdrive%\svchost.exe
echo %systemdrive%\svchost2.exe
echo %systemdrive%\svchosts.exe
echo %systemdrive%\svcosvt.exe
echo %systemdrive%\svcovt.exe
echo %systemdrive%\svhost.exe
echo %systemdrive%\Sysdll.dll
echo %systemdrive%\sysdrv.bat
echo %systemdrive%\sysini.bat
echo %systemdrive%\sysload.pif
echo %systemdrive%\syst.exe
echo %systemdrive%\system.dll
echo %systemdrive%\system.exe
echo %systemdrive%\system32.exe
echo %systemdrive%\Systemloader.exe
echo %systemdrive%\systems.dll
echo %systemdrive%\t.rar
echo %systemdrive%\tasksmgr.exe
echo %systemdrive%\temp\svchost.exe
echo %systemdrive%\Temp.htm
echo %systemdrive%\term.bat
echo %systemdrive%\tmp.reg
echo %systemdrive%\Temp.zip
echo %systemdrive%\tempdel.bat
echo %systemdrive%\tm
echo %systemdrive%\Tmp\Isass.exe
echo %systemdrive%\tre.bat
echo %systemdrive%\tskmgr.exe
echo %systemdrive%\uniq
echo %systemdrive%\unknown.bat
echo %systemdrive%\updata.exe
echo %systemdrive%\usb.exe
echo %systemdrive%\usb2.exe
echo %systemdrive%\usb22.exe
echo %systemdrive%\usbg22.exe
echo %systemdrive%\userinit.exe
echo %systemdrive%\v
echo %systemdrive%\vwnskbot.dll
echo %systemdrive%\video.com
echo %systemdrive%\vont.exe
echo %systemdrive%\wfexqnrp.dll
echo %systemdrive%\win0.exe
echo %systemdrive%\win23.exe
echo %systemdrive%\winavft.exe
echo %systemdrive%\windfe.exe
echo %systemdrive%\Windows.exe
echo %systemdrive%\WINDOWSPacuks.doc
echo %systemdrive%\WindowsXPContorl.exe
echo %systemdrive%\winla\winla.exe
echo %systemdrive%\winlo.exe
echo %systemdrive%\winlogon.exe
echo %systemdrive%\winself.exe
echo %systemdrive%\winser.exe
echo %systemdrive%\winservnt32.exe
echo %systemdrive%\winskd.exe
echo %systemdrive%\winsp_xp.com
echo %systemdrive%\winsp1.exe
echo %systemdrive%\winstall.exe
echo %systemdrive%\wintemp.log
echo %systemdrive%\WINUPDATE.EXE
echo %systemdrive%\winxplogon.sys
echo %systemdrive%\wmisrv.exe
echo %systemdrive%\wmplayer.dll
echo %systemdrive%\wrapper.exe
echo %systemdrive%\wsusupd.exe
echo %systemdrive%\wuA32.exe
echo %systemdrive%\wunosjava.exe
echo %systemdrive%\wvbegpqs.dll
echo %systemdrive%\xpjavams.exe
echo %systemdrive%\x
echo %systemdrive%\x.dat
echo %systemdrive%\x.txt
echo %systemdrive%\xz.bat
echo %systemdrive%\z.dat
echo %systemdrive%\z.rar
echo %systemdrive%\z.tmp
echo %systemdrive%\z.txt
echo %systemroot%\a.bat
echo %systemroot%\059573.exe
echo %systemroot%\1222\explorer.exe 
echo %systemroot%\203937.exe
echo %systemroot%\2pack.exe
echo %systemroot%\9129837.exe
echo %systemroot%\47681727.exe
echo %systemroot%\__adware1__.dll
echo %systemroot%\__adware2__.dll
echo %systemroot%\__bho_dll__.dll
echo %systemroot%\_ctflog.exe
echo %systemroot%\_explore.exe
echo %systemroot%\_inetinfomon.exe
echo %systemroot%\_logo1.exe
echo %systemroot%\_mpm.exe
echo %systemroot%\_service.exe
echo %systemroot%\_winlog.exe
echo %systemroot%\1.exe
echo %systemroot%\123messenger.per
echo %systemroot%\180ax.exe
echo %systemroot%\2.tmp
echo %systemroot%\2020search.dll
echo %systemroot%\2020search2.dll
echo %systemroot%\3.exe
echo %systemroot%\444.471
echo %systemroot%\444.471.exe
echo %systemroot%\764.exe
echo %systemroot%\7search.dll
echo %systemroot%\abass.config
echo %systemroot%\abass.exe
echo %systemroot%\ABox.bup
echo "%systemroot%\absolute key logger.lnk"
echo %systemroot%\access2007a.exe
echo %systemroot%\accesss.exe
echo %systemroot%\acersv.exe
echo %systemroot%\accwiz.exe
echo %systemroot%\accwiz.exe~
echo %systemroot%\aconti.exe
echo %systemroot%\aconti.ini
echo %systemroot%\aconti.log
echo %systemroot%\aconti.sdb
echo %systemroot%\acontidialer.txt
echo %systemroot%\AcroIEHelper.dll
echo %systemroot%\Acronis.exe
echo %systemroot%\adbar.dll
echo %systemroot%\adgpfoxs.dll
echo %systemroot%\admgcx.dll
echo %systemroot%\admggxp.dll
echo %systemroot%\adminlogg.txt
echo %systemroot%\adminiecc.dll
echo %systemroot%\adminiecc.exe
echo %systemroot%\admintxt.txt
echo %systemroot%\AdobeR.exe
echo %systemroot%\adsoowf.dll
echo %systemroot%\advpn.dll
echo %systemroot%\advrepdow.dll
echo %systemroot%\advrepgds.dll
echo %systemroot%\advrepgpd.dll
echo %systemroot%\advrepkon.dll
echo %systemroot%\advrepnok.dll
echo %systemroot%\advreprwd.dll
echo %systemroot%\advrepvto.dll
echo %systemroot%\advsort.dll
echo %systemroot%\af.exe
echo %systemroot%\aflqfkw.dll
echo %systemroot%\afxlspw.dll
echo %systemroot%\afxp.dll
echo %systemroot%\agl.exe
echo %systemroot%\agpqlrfm.exe
echo %systemroot%\agrlmvp.dll
echo %systemroot%\ahelpa.dll
echo %systemroot%\alg.exe
echo %systemroot%\alg32.exe
echo %systemroot%\alofkmn.dll
echo %systemroot%\alt.exe
echo %systemroot%\altvxvm.dll
echo %systemroot%\alxvdvm.dll
echo %systemroot%\ampkfst.dll
echo %systemroot%\antiv.exe
echo %systemroot%\Antivirus1
echo %systemroot%\Antivirus.exe
echo %systemroot%\antivirus32.exe
echo %systemroot%\antivirusdll
echo %systemroot%\apacka.exe
echo %systemroot%\apdqnxp.dll
echo %systemroot%\apphelp32.dll
echo %systemroot%\aplication\Intals.exe
echo %systemroot%\AppPatch\aolhost.exe
echo %systemroot%\AppPatch\mdm.exe
echo %systemroot%\AppPatch\msiexec.exe
echo %systemroot%\apoxqwfv.exe
echo %systemroot%\aromis.exe
echo %systemroot%\aromis.config
echo %systemroot%\asdasdasd.exe
echo %systemroot%\asferror32.dll
echo %systemroot%\aslpmqk.dll
echo %systemroot%\aspsrv.exe
echo %systemroot%\astctl32.ocx
echo %systemroot%\astra32.exe
echo %systemroot%\asus.exe
echo %systemroot%\asvdnmo.dll
echo %systemroot%\asver.ger
echo %systemroot%\aswmklt.dll
echo %systemroot%\asycfilt32.dll
echo %systemroot%\atapid.exe
echo %systemroot%\ateqoflr.exe
echo %systemroot%\atfxqogp.dll
echo %systemroot%\athprxy32.dll
echo %systemroot%\ati2dvaa32.dll
echo %systemroot%\ati2dvag32.dll
echo %systemroot%\atip.exe
echo %systemroot%\au1.exe
echo %systemroot%\audiosrv32.dll
echo %systemroot%\ausctv32a.dll
echo %systemroot%\auth.exe
echo %systemroot%\autodisc32.dll
echo %systemroot%\autorun.inf
echo %systemroot%\AutoUpdateWin31.dll
echo %systemroot%\AutoUpdateWin32.exe
echo %systemroot%\AutoUpdateWin33.exe
echo %systemroot%\avantage32.exe
echo %systemroot%\Avconsol.exe
echo %systemroot%\avgav.exe
echo %systemroot%\avifile32.dll
echo %systemroot%\avisynthex32.dll
echo %systemroot%\aviwrap32.dll
echo %systemroot%\avll32.exe
echo %systemroot%\avp.exe
echo %systemroot%\avpcc.dll
echo %systemroot%\avrscan.exe
echo %systemroot%\avscan.exe
echo %systemroot%\avserv.exe
echo %systemroot%\avsrv32.exe
echo %systemroot%\Avsynmgr.exe
echo %systemroot%\axrfgvek.dll
echo %systemroot%\b999.exe
echo %systemroot%\Back_On.exe
echo %systemroot%\bandserv.dll
echo %systemroot%\bang.exe
echo %systemroot%\base64.tmp
echo %systemroot%\bck3.dat
echo %systemroot%\bdir\sdflkj3.exe
echo %systemroot%\bdkpfxqw.dll
echo %systemroot%\bdmanager.dll
echo %systemroot%\bdmnopx.dll
echo %systemroot%\bdn.com
echo %systemroot%\bfrgnos.dll
echo %systemroot%\bgntlvo.dll
echo %systemroot%\bgrlsmn.dll
echo %systemroot%\bgrqfetx.dll
echo %systemroot%\bhagent.exe
echo %systemroot%\biglow.config
echo %systemroot%\biglow.exe
echo %systemroot%\bigoris.exe
echo %systemroot%\bigoris.config
echo %systemroot%\bindmod.dll
echo %systemroot%\binret.exe
echo %systemroot%\bitdefender.exe
echo %systemroot%\bjam.dll
echo %systemroot%\bklgvsf.dll
echo %systemroot%\bkqxdons.dll
echo %systemroot%\bldy.config
echo %systemroot%\bmfcr43.dll
echo %systemroot%\bmlvqkn.dll
echo %systemroot%\bokja.exe
echo %systemroot%\bokpkov.dll
echo %systemroot%\bolenja.exe
echo %systemroot%\bolenjx.exe
echo %systemroot%\bonrep.dll
echo %systemroot%\bonsws.dll
echo %systemroot%\boot.exe
echo %systemroot%\bot.exe
echo %systemroot%\botcrx.exe
echo %systemroot%\bqxomdo.dll
echo %systemroot%\brastk.exe
echo %systemroot%\braviax.exe
echo %systemroot%\Britney_Spears_jpg.zip
echo %systemroot%\browse.exe
echo %systemroot%\browser.exe
echo %systemroot%\browserad.dll
echo %systemroot%\browsers.dll
echo %systemroot%\btmsre.exe
echo %systemroot%\btpqkmo.dll
echo %systemroot%\btrklfr.dll
echo %systemroot%\BTStack.exe
echo %systemroot%\btwdin.exe
echo %systemroot%\btwindin32.exe
echo %systemroot%\buritos.exe
echo %systemroot%\bvtqfvx.dll
echo %systemroot%\bxlrvps.dll
echo %systemroot%\bxsbang.dll
echo %systemroot%\bxsnvqt.dll
echo %systemroot%\cache.dat
echo %systemroot%\Casino.ico
echo %systemroot%\cbinst$.exe
echo %systemroot%\cc.exe
echo %systemroot%\ccSvcHst.exe
echo %systemroot%\cdfs.exe
echo %systemroot%\cdnsize32.dll
echo %systemroot%\cdsm32.dll
echo %systemroot%\CDSpeed.exe
echo %systemroot%\changeurl_30.dll
echo %systemroot%\Chans.dll
echo %systemroot%\chckntfs.exe
echo %systemroot%\chcp.exe
echo %systemroot%\chfmon.exe
echo %systemroot%\chkdsk.exe
echo %systemroot%\chkdsk32_.exe
echo %systemroot%\chkntfs.exe
echo %systemroot%\cknrl.asm
echo %systemroot%\Christmas-2007
echo %systemroot%\cleanme.bat
echo %systemroot%\cleanmgr.exe
echo %systemroot%\clfmon.exe
echo %systemroot%\clmcs.exe
echo %systemroot%\clrssn.exe
echo %systemroot%\cndr32a.dll
echo %systemroot%\comusg.exe
echo %systemroot%\cmd.com
echo %systemroot%\cmonsvc322.exe
echo %systemroot%\cmsetac.dll
echo %systemroot%\com.exe
echo %systemroot%\comdlj32.dll
echo %systemroot%\comdlg\ntmon.exe
echo %systemroot%\comdlg64.dll
echo %systemroot%\COMMAND\explorer.exe
echo %systemroot%\commgr32.dll
echo %systemroot%\comp.exe
echo %systemroot%\comrepl32.exe
echo %systemroot%\comreplsvc.exe
echo %systemroot%\cmsetac.dll
echo %systemroot%\conf.inf
echo %systemroot%\config.exe
echo %systemroot%\Config\csrss.exe
echo %systemroot%\config\install\aliases.ini
echo %systemroot%\config\install\hex.exe
echo %systemroot%\config\install\mirc.ini
echo %systemroot%\config\install\moo.dll
echo %systemroot%\config\install\moodll.mrc
echo %systemroot%\config\install\nt.dll
echo %systemroot%\config\install\remote.ini
echo %systemroot%\config\install\services.exe
echo %systemroot%\config\install\svchost.exe
echo %systemroot%\config\install\x.mrc
echo %systemroot%\Config\lsass.exe
echo %systemroot%\Config\service.exe
echo %systemroot%\config\svchost.exe
echo %systemroot%\cpan.dll
echo %systemroot%\cpu.exe
echo %systemroot%\cpuserv.dll
echo %systemroot%\cpuserv.exe
echo %systemroot%\crcss.exe
echo %systemroot%\crock+mock.config
echo %systemroot%\crss32.exe
echo %systemroot%\CRSVS.exe
echo %systemroot%\cru629.dat
echo %systemroot%\csrs.exe
echo %systemroot%\CSRSA.exe
echo %systemroot%\csrsc.exe
echo %systemroot%\csrss.exe
echo %systemroot%\csrss1.dll
echo %systemroot%\csrsx.exe
echo %systemroot%\cssr.exe
echo %systemroot%\cssrs.exe
echo %systemroot%\cssrss.exe
echo %systemroot%\csssrss.exe
echo %systemroot%\ctflog.exe
echo %systemroot%\ctfmon.exe
echo %systemroot%\ctfmon32.dll
echo %systemroot%\ctfmon32.exe
echo %systemroot%\ctrlpan.dll
echo %systemroot%\ctrmode.exe
echo %systemroot%\Cursors\aim6.exe
echo %systemroot%\Cursors\aoldebugs.exe
echo %systemroot%\Cursors\lsasrv.exe
echo %systemroot%\Cursors\netmsvc.exe
echo %systemroot%\cygwin.exe
echo %systemroot%\czsrv.exe
echo %systemroot%\dat.txt
echo %systemroot%\daverx.exe
echo %systemroot%\daxtime.dll
echo %systemroot%\dbmio32.dll
echo %systemroot%\dcmhelp.exe
echo %systemroot%\dcxxygx.exe
echo %systemroot%\ddesupport.dll
echo %systemroot%\ddkret.dll
echo %systemroot%\ddubbv.exe
echo %systemroot%\deamon.exe
echo %systemroot%\debug64\services.exe
echo %systemroot%\debug64\smss.exe
echo %systemroot%\Debug\aolspy.exe
echo %systemroot%\Debug\explorer.exe
echo %systemroot%\Debug\secsrv.exe
echo %systemroot%\DebugMan.exe
echo %systemroot%\DebugManager.exe
echo %systemroot%\default.htm
echo %systemroot%\db32.txt
echo %systemroot%\deskcfg.dat
echo %systemroot%\deskcfg.tmp
echo %systemroot%\desktop.html
echo %systemroot%\devic.exe
echo %systemroot%\devicer.exe
echo %systemroot%\devices.exe
echo %systemroot%\devldr32.exe
echo %systemroot%\dgksvbpn.dll
echo %systemroot%\dhcp.exe
echo %systemroot%\didduid.ini
echo %systemroot%\dipset.exe
echo %systemroot%\dispatcher.exe
echo %systemroot%\directx.exe
echo %systemroot%\directx32.exe
echo %systemroot%\disnisa.config
echo %systemroot%\disnisa.exe
echo %systemroot%\display\newver.txt
echo %systemroot%\display\services.exe
echo %systemroot%\display\smss.exe
echo %systemroot%\div32.dll
echo %systemroot%\DivXsm.exe
echo %systemroot%\dkwqgnbe.dll
echo %systemroot%\dlhost.exe
echo %systemroot%\Dll.dll
echo %systemroot%\dll\rundll32.exe
echo %systemroot%\dllhost.exe
echo %systemroot%\dllhstsrv.exe
echo %systemroot%\dllisp.exe
echo %systemroot%\dllmgr64.exe
echo %systemroot%\dllwin.exe
echo %systemroot%\dmrproc.exe
echo %systemroot%\Dnmee33.exe
echo %systemroot%\dnsrelay.dll
echo %systemroot%\dnsxx.exe
echo %systemroot%\domain-access-time.txt
echo %systemroot%\dp0.dll
echo %systemroot%\dpevflbg.dll
echo %systemroot%\Download\svhost32.exe
echo "%systemroot%\Downloaded Program Files\smss.exe"
echo "%systemroot%\Downloaded Program Files\svchost.exe"
echo %systemroot%\dracee.exe
echo %systemroot%\drsetup.exe
echo %systemroot%\drvsvp.dll
echo %systemroot%\dsaip32b.dll
echo %systemroot%\dsktbwfe.dll
echo %systemroot%\dsrss.exe
echo %systemroot%\dsserv.exe
echo %systemroot%\dtseqrxk.dll
echo %systemroot%\duocore.dll
echo %systemroot%\duocore.dll.bak
echo %systemroot%\dupadupam2.exe
echo %systemroot%\dvvid32.exe
echo %systemroot%\dwltqnmx.exe
echo %systemroot%\dwnrpofk.dll
echo %systemroot%\dxdiag.dll
echo %systemroot%\edfqvrw.dll
echo %systemroot%\editpad.exe
echo %systemroot%\egodktf.dll
echo %systemroot%\ehSched.exe
echo %systemroot%\eiRecvr.exe
echo %systemroot%\ekvgsnw.dll
echo %systemroot%\ekxdvft.dll
echo %systemroot%\elfwgps.dll
echo %systemroot%\ellod.id
echo %systemroot%\elRecvr.exe
echo %systemroot%\email.txt
echo %systemroot%\emlkdvo.dll
echo %systemroot%\emnvoqgx.exe
echo %systemroot%\emotigt.dll
echo %systemroot%\emotrlq.dll
echo %systemroot%\encod.exe
echo %systemroot%\encrits.exe
echo %systemroot%\enlfxgw.dll
echo %systemroot%\enqvwkp.dll
echo %systemroot%\ensfolr.dll
echo %systemroot%\enu-hotfix912840.exe
echo %systemroot%\epxonwo.dll
echo %systemroot%\eqvwamkl.dll
echo %systemroot%\erpobmsw.dll
echo %systemroot%\etc\services.exe
echo %systemroot%\etlrlws.dll
echo %systemroot%\eventlowg.dll
echo %systemroot%\evgratsm.dll
echo %systemroot%\ewrssvw.dll
echo %systemroot%\expl0rer.exe
echo %systemroot%\expIorer.exe
echo %systemroot%\explore.exe
echo %systemroot%\explorer32.exe
echo %systemroot%\explorer..exe
echo %systemroot%\exploror.exe
echo %systemroot%\EXPLORERI.exe
echo %systemroot%\explrer.exe
echo %systemroot%\expro.dll
echo %systemroot%\extctrl.dll
echo %systemroot%\faceback.exe
echo %systemroot%\farkrish.config
echo %systemroot%\farkrish.exe
echo %systemroot%\fastsmell.config
echo %systemroot%\fastsmell.exe
echo %systemroot%\fbxrqtwn.exe
echo %systemroot%\fdkowvbp.dll
echo %systemroot%\fdxbameg.dll
echo %systemroot%\fetchuserid.exe
echo %systemroot%\FFFFSSSS.BAT
echo %systemroot%\ffvrdgt.exe
echo %systemroot%\fhfmm.exe
echo %systemroot%\fhfmm-Uninstaller.exe
echo %systemroot%\files.exe
echo %systemroot%\final.jpg
echo %systemroot%\firefox.exe
echo %systemroot%\firefoxpgm.exe
echo %systemroot%\firewall.exe
echo %systemroot%\fkdnrwsv.dll
echo %systemroot%\fkebanrw.exe
echo %systemroot%\fknxwqf.exe
echo %systemroot%\fkxvkns.exe
echo %systemroot%\Flash_Game.zip
echo %systemroot%\flt.dll
echo %systemroot%\fmsxwqs.exe
echo %systemroot%\fn.xt
echo %systemroot%\folder.exe
echo %systemroot%\Fonts\aolupd.exe
echo %systemroot%\Fonts\chanflood.mrc
echo %systemroot%\Fonts\clone.mrc
echo %systemroot%\Fonts\commands.txt
echo %systemroot%\Fonts\Crack.exe
echo %systemroot%\Fonts\edih.dll
echo %systemroot%\Fonts\Explored.exe
echo %systemroot%\Fonts\kernel33.exe
echo %systemroot%\Fonts\lsass.exe
echo %systemroot%\Fonts\mirc.ini
echo %systemroot%\Fonts\moo.dll
echo %systemroot%\Fonts\ms32.sys
echo %systemroot%\Fonts\portredirect.mrc 
echo %systemroot%\Fonts\remote.ini
echo %systemroot%\Fonts\Setup.exe
echo %systemroot%\Fonts\script.ini
echo %systemroot%\Fonts\svchost.exe
echo %systemroot%\Fonts\taksmgr.exe
echo %systemroot%\Fonts\updater.exe
echo %systemroot%\Fonts\winboot.bin
echo %systemroot%\Fonts\winconf.mrc
echo %systemroot%\Fonts\whvlxd.dat
echo %systemroot%\Fonts\whvlxd.exe
echo %systemroot%\Fonts\wmsncs.exe
echo %systemroot%\four444444.exe
echo %systemroot%\foxflpd.exe
echo %systemroot%\fqbewlna.dll
echo %systemroot%\fqspogw.exe
echo %systemroot%\fqwmwdn.exe
echo "%systemroot%\Free Online Dating.ico"
echo %systemroot%\Free_Winks.zip
echo %systemroot%\frplprg.exe
echo %systemroot%\fsrpknov.dll
echo %systemroot%\fsxloqf.exe
echo %systemroot%\ftp.txt
echo %systemroot%\fuckit.exe
echo %systemroot%\funniest.exe
echo %systemroot%\funny.exe
echo %systemroot%\fvkwdrt.exe
echo %systemroot%\FVProtect.exe
echo %systemroot%\fvqkfsp.exe
echo %systemroot%\fvxqfwq.exe
echo %systemroot%\fwbmz.dll
echo %systemroot%\fwnet64.exe
echo %systemroot%\fxstaller.exe
echo %systemroot%\fxtqdrl.exe
echo %systemroot%\gallery.exe
echo %systemroot%\gettfo.exe
echo %systemroot%\gcac.exe
echo %systemroot%\gcsvc.exe
echo %systemroot%\gfmnaaa.dll
echo %systemroot%\ghg8aw3lo.exe
echo %systemroot%\Girl_On_Cam.zip
echo %systemroot%\gksraemq.dll
echo %systemroot%\gktxaspm.dll
echo %systemroot%\glg\server.exe
echo %systemroot%\glok+serv.config
echo %systemroot%\gnnaknar.exe
echo %systemroot%\gnowmebk.dll
echo %systemroot%\gogora.config
echo %systemroot%\gordo1.exe
echo %systemroot%\gordo2.exe
echo %systemroot%\gormet.dll
echo %systemroot%\gpefaowr.exe
echo %systemroot%\qrbgltos.dll
echo %systemroot%\grinders.config
echo %systemroot%\grinders.exe
echo %systemroot%\grswptdl.exe
echo %systemroot%\guarty.exe
echo %systemroot%\gxvpsafm.dll
echo %systemroot%\harvest.exe
echo %systemroot%\hcwprn.exe
echo %systemroot%\HDAudio
echo %systemroot%\hdtip.dll
echo %systemroot%\helloserv.config
echo %systemroot%\helloserv.exe
echo %systemroot%\help.exe
echo %systemroot%\Help\agt037b.hlp
echo %systemroot%\Help\amsxm.ahp
echo %systemroot%\Help\aolupd.exe
echo %systemroot%\Help\directx.exe
echo %systemroot%\Help\imapi.exe
echo %systemroot%\Help\mxs.hl
echo %systemroot%\Help\nsecvc.exe
echo %systemroot%\Help\svchost.exe
echo %systemroot%\Help\temp.pid
echo %systemroot%\Help\vmnetdhcp.exe
echo %systemroot%\Help\wcmsvc.exe
echo %systemroot%\Help\wpnsvc.exe
echo %systemroot%\helpcvs.exe
echo %systemroot%\HEREB.exe
echo %systemroot%\HEREBABYs.exe
echo %systemroot%\herjek.config
echo %systemroot%\herjek.exe
echo %systemroot%\hinhem.scr
echo %systemroot%\hjoqor.dll
echo %systemroot%\hkcmd.exe
echo %systemroot%\hkr32.asm
echo %systemroot%\homepage.html
echo %systemroot%\hook.txt
echo %systemroot%\HookLib.dll
echo %systemroot%\host.exe
echo %systemroot%\hostctrl.dll
echo %systemroot%\hosts
echo %systemroot%\hotporn.exe
echo %systemroot%\hp32.ini
echo %systemroot%\hpeg.dll
echo %systemroot%\hstsys.dll
echo %systemroot%\htssv32.exe
echo %systemroot%\htunistock.dll
echo %systemroot%\hupsrv.dll
echo %systemroot%\i386\csrss.exe
echo %systemroot%\i.exe
echo %systemroot%\iau1.exe
echo %systemroot%\icmp1.exe
echo %systemroot%\ie.exe
echo %systemroot%\ie-hook.txt
echo %systemroot%\ie_32.exe
echo %systemroot%\iebrowser.dll
echo %systemroot%\iecontext.dll
echo %systemroot%\iedebug.dll
echo %systemroot%\iedll.exe
echo %systemroot%\iedns.dll
echo %systemroot%\iedr.exe
echo %systemroot%\iedrives.dll
echo %systemroot%\iedrv.exe
echo %systemroot%\iedrvctrl.exe
echo %systemroot%\iedw.exe
echo %systemroot%\IefxTray.exe
echo %systemroot%\ieguard.dll
echo %systemroot%\ielocales.dll
echo %systemroot%\iemon.exe
echo %systemroot%\ieproxy.dll
echo %systemroot%\ieredir.exe
echo %systemroot%\iereport.dll
echo %systemroot%\ieserver.exe
echo %systemroot%\iesettings.dll
echo %systemroot%\iesetupi.exe
echo %systemroot%\iesup.dll
echo %systemroot%\iesupport.dll
echo %systemroot%\ietools.dll
echo %systemroot%\ieupdr.exe
echo %systemroot%\ievpnctrl.dll
echo %systemroot%\iexpl0re.exe
echo %systemroot%\iexplor.exe
echo %systemroot%\iexplore.exe
echo %systemroot%\iexploree.dll
echo %systemroot%\iexplorer.exe
echo "%systemroot%\iexplorer.exe --system"
echo %systemroot%\iexplorer7.exe
echo %systemroot%\iexplorr23.dll
echo %systemroot%\iis\iesetup.exe
echo %systemroot%\iisctrl.exe
echo %systemroot%\imagen004
echo %systemroot%\index.exe
echo %systemroot%\index.html
echo %systemroot%\inetinf.exe
echo %systemroot%\inetinfomon.exe
echo %systemroot%\INETSVC.EXE
echo %systemroot%\inf\msio32.dll
echo %systemroot%\inf\rundll32.exe
echo %systemroot%\inf\svch0st.exe
echo %systemroot%\inf\ultra.inf
echo %systemroot%\Inf\vcdb32.dll
echo %systemroot%\inform.dat
echo %systemroot%\ImgBurn.exe
echo %systemroot%\initial.bat
echo %systemroot%\inserv.exe
echo %systemroot%\install\mail.exe
echo %systemroot%\install245.exe
echo %systemroot%\installer.exe
echo %systemroot%\installer.exe_
echo %systemroot%\Installer\id53.exe
echo %systemroot%\instdrv.exe
echo %systemroot%\Intel\rundll32.exe
echo %systemroot%\internet.exe
echo %systemroot%\ipcbind.exe
echo %systemroot%\ipwypkmg.dll
echo %systemroot%\ipwypktx.dll
echo %systemroot%\ipwyprkg.dll
echo %systemroot%\ipwyptfg.dll
echo %systemroot%\ipwypwpk.dll
echo %systemroot%\irfnga.exe
echo %systemroot%\isampi.exe
echo %systemroot%\isas\newver.txt
echo %systemroot%\isas\services.exe
echo %systemroot%\isas\smss.exe
echo %systemroot%\ita.exe
echo %systemroot%\itunes.exe
echo %systemroot%\iTuneshelp.exe
echo %systemroot%\iTunesMusic.exe
echo %systemroot%\iuengine32.exe
echo %systemroot%\JavaPlatform
echo %systemroot%\jd2002.dll
echo %systemroot%\jetctrl.dll
echo %systemroot%\jokvip.exe
echo %systemroot%\jokwmp.dll
echo %systemroot%\k.txt
echo %systemroot%\kaglor.config
echo %systemroot%\kar.exe
echo %systemroot%\karina.dat
echo %systemroot%\karna.dat
echo %systemroot%\kasvc.exe
echo %systemroot%\kavir.exe
echo %systemroot%\kbdb32.dll
echo %systemroot%\kbdctrl.dll
echo %systemroot%\kbdfi32.dll
echo %systemroot%\kbdsvc.exe
echo %systemroot%\kbdtuq.dll
echo %systemroot%\kbui32.dll
echo %systemroot%\kes.exe
echo %systemroot%\kiasys.dll
echo %systemroot%\kkcomp$.exe
echo %systemroot%\kkcomp.dll
echo %systemroot%\kkcomp.exe
echo %systemroot%\klog.dat
echo %systemroot%\knxsrgte.exe
echo %systemroot%\koly.txt
echo %systemroot%\kopmet.dll
echo %systemroot%\ksacre.exe
echo %systemroot%\ktd32.atm
echo %systemroot%\kthemup.exe
echo %systemroot%\kus109.dat
echo %systemroot%\kvnab$.exe
echo %systemroot%\kvnab.dll
echo %systemroot%\kvnab.exe
echo %systemroot%\kvxqmtre.dll
echo %systemroot%\ky.sxc
echo %systemroot%\jusched.exe
echo %systemroot%\lala.txt
echo %systemroot%\lala2.txt
echo %systemroot%\lanbg.exe
echo %systemroot%\LBTSERV.EXE
echo %systemroot%\LBTWiz.exe
echo %systemroot%\lcass.exe
echo %systemroot%\ldr.exe
echo %systemroot%\leorop.dll
echo %systemroot%\leosrv.dll
echo %systemroot%\lfn.exe
echo %systemroot%\lfstbwvd.dll
echo %systemroot%\libHide.dll
echo %systemroot%\libor.exe
echo %systemroot%\licencia.txt
echo %systemroot%\liqad$.exe
echo %systemroot%\liqad.dll
echo %systemroot%\liqad.exe
echo %systemroot%\liqui.dll
echo %systemroot%\liqui.exe
echo %systemroot%\liqui-Uninstaller.exe
echo %systemroot%\liibr.exe
echo %systemroot%\linkinfo.dll
echo %systemroot%\litmus\lssas.exe
echo %systemroot%\litmus\MSGSRV32.exe
echo %systemroot%\livemessenger.com
echo %systemroot%\livemsngs.exe
echo %systemroot%\live.messenger.com
echo %systemroot%\lnvegaow.exe
echo %systemroot%\loader.exe
echo %systemroot%\lofFile.exe
echo %systemroot%\logic.exe
echo %systemroot%\logins32.exe
echo %systemroot%\logitech.exe
echo %systemroot%\LogMSP.txt
echo %systemroot%\logo.exe
echo %systemroot%\lomxeqsn.exe
echo %systemroot%\loser2.exe
echo %systemroot%\LOT66225.exe
echo %systemroot%\lsa.txt
echo %systemroot%\lsas.exe
echo %systemroot%\lsasrv.exe
echo %systemroot%\lsass.exe
echo %systemroot%\lssas1.exe
echo %systemroot%\lsass16.exe
echo %systemroot%\lsass32.exe
echo %systemroot%\lsasss.exe
echo %systemroot%\lsiss.exe
echo %systemroot%\lsrvc.exe
echo %systemroot%\lsuss.exe
echo %systemroot%\mahmud.exe
echo %systemroot%\mail.exe
echo %systemroot%\mainms.vpi
echo %systemroot%\main_uninstaller.exe
echo %systemroot%\Manager.exe
echo %systemroot%\mapi.exe
echo %systemroot%\mcache32.exe
echo %systemroot%\mcmmng32.exe
echo %systemroot%\mcsecure.exe
echo %systemroot%\Mctray.exe
echo %systemroot%\mdm.exe
echo %systemroot%\mdtgkswr.exe
echo %systemroot%\me2007.zip
echo %systemroot%\media\aim.exe
echo %systemroot%\Media\aolconf.exe
echo %systemroot%\Media\aolsw.exe
echo %systemroot%\Media\Call32.exe
echo %systemroot%\Media\csrss.exe
echo %systemroot%\Media\dbmmgr32.dll
echo %systemroot%\Media\hptools.exe
echo %systemroot%\Media\microsoft.exe
echo %systemroot%\Media\mplay32.dll
echo %systemroot%\Media\smartwarxyu.dll
echo %systemroot%\Media\SysteM.exe
echo %systemroot%\mediaply32.exe
echo %systemroot%\medichi.exe
echo %systemroot%\medichi2.exe
echo %systemroot%\megavid.cdt
echo %systemroot%\melt1.bat
echo %systemroot%\messengerr.exe
echo %systemroot%\messengersystem.exe
echo %systemroot%\mexcrl.exe
echo %systemroot%\mgglp.bat
echo %systemroot%\mgrab.exe
echo %systemroot%\mgrs.exe
echo %systemroot%\mgsvflkw.dll
echo %systemroot%\mgxfebsq.dll
echo %systemroot%\Microsoft.sys
echo %systemroot%\mirar.exe
echo %systemroot%\mIRC.ini
echo %systemroot%\mkrndofl.dll
echo %systemroot%\mmall.exe
echo %systemroot%\mmp.exe
echo %systemroot%\monhop.exe
echo %systemroot%\mono.exe
echo %systemroot%\movctrlflm.dll
echo %systemroot%\movctrlfqd.dll
echo %systemroot%\movctrlknq.dll
echo %systemroot%\movctrlnkd.dll
echo %systemroot%\movctrlqtn.dll
echo %systemroot%\movctrlswd.dll
echo %systemroot%\movctrlwxq.dll
echo %systemroot%\mpfanvqg.dll
echo %systemroot%\mpm.exe
echo %systemroot%\mqgldfvo.exe
echo %systemroot%\Mrshield.exe
echo %systemroot%\mrvtdpqe.exe
echo %systemroot%\msa64chk.dll
echo %systemroot%\MSACCESS.exe
echo %systemroot%\msacm32.drv
echo %systemroot%\msagent\rundll32.exe
echo %systemroot%\msagent\server.exe
echo %systemroot%\msagent\svhost.exe
echo %systemroot%\msapasrc.dll
echo %systemroot%\MSASCu.exe
echo %systemroot%\MSATL32.exe
echo %systemroot%\msauc.exe
echo %systemroot%\msav.exe
echo %systemroot%\msavc.exe
echo %systemroot%\msavc32.exe
echo %systemroot%\msavsc.dll
echo %systemroot%\Mscfg.exe
echo %systemroot%\mscmtl32.exe
echo %systemroot%\mscnfg.exe
echo %systemroot%\msconfd.dll
echo %systemroot%\msconfig.com
echo %systemroot%\msconfig32x.exe
echo %systemroot%\mscore.dll
echo %systemroot%\mscrypt.dll
echo %systemroot%\msctrl.dll
echo %systemroot%\msdates.exe
echo %systemroot%\msdde.dll
echo %systemroot%\msddx.dll
echo %systemroot%\msdevmgr32.exe
echo %systemroot%\msdotfix.exe
echo %systemroot%\msdn32.dll
echo %systemroot%\msdn.dll
echo %systemroot%\msdns.dll
echo %systemroot%\msdred.exe
echo %systemroot%\msdred.tir
echo %systemroot%\msdrv.exe
echo %systemroot%\msdrvctrl.exe
echo %systemroot%\msdtc.exe
echo %systemroot%\msduo2.dll
echo %systemroot%\mservice1.exe
echo %systemroot%\msexplore.exe
echo %systemroot%\msexploren.exe
echo %systemroot%\msfw.dll
echo %systemroot%\mshome.exe
echo %systemroot%\mshost.exe
echo %systemroot%\mshosts.exe
echo %systemroot%\MsHS64.exe
echo %systemroot%\msgaol.exe
echo %systemroot%\msiau1.dll
echo %systemroot%\msie.dll
echo %systemroot%\msiemon.dll
echo %systemroot%\msimn.exe
echo %systemroot%\msisv.exe
echo %systemroot%\msiutil.exe
echo %systemroot%\msjwer.dll
echo %systemroot%\MSLicense.txt
echo %systemroot%\mslocales.exe
echo %systemroot%\mslog.exe
echo %systemroot%\MsLS32.exe
echo %systemroot%\MsLX32.exe
echo %systemroot%\msmacro32.exe
echo %systemroot%\msmdev.dll
echo %systemroot%\msmduo.dll
echo %systemroot%\MSmedia.exe
echo %systemroot%\Msmgs.exe
echo %systemroot%\msmhost.dll
echo %systemroot%\msmp.exe
echo %systemroot%\msmsgr.exe
echo %systemroot%\msnmsrg.exe
echo %systemroot%\msmsgrs.exe
echo %systemroot%\msn\klog.dat
echo %systemroot%\msn\mtnlsn.exe
echo %systemroot%\msn\svchost.exe
echo %systemroot%\msn\windows.dat
echo %systemroot%\msn.com
echo %systemroot%\MSN.exe
echo %systemroot%\msn64.exe
echo %systemroot%\msn93.exe
echo %systemroot%\msnav32.ax
echo %systemroot%\msncomm.exe
echo %systemroot%\msnconfig.exe
echo %systemroot%\msndn.exe
echo %systemroot%\msnexploren.exe
echo %systemroot%\msngr.exe
echo %systemroot%\msngrsm.exe
echo %systemroot%\Msnhelper.exe
echo %systemroot%\msnhp32.dll
echo %systemroot%\msnmesseng.exe
echo %systemroot%\msnmessangern.exe
echo %systemroot%\msnmsg.exe
echo %systemroot%\msnmsgq.exe
echo %systemroot%\msnmsgesser.exe
echo %systemroot%\msnmsgr.exe
echo %systemroot%\msnmsgs.exe
echo %systemroot%\msnmngs.exe
echo %systemroot%\msnmsur.exe
echo %systemroot%\msnsmg.exe
echo %systemroot%\msnpd.exe
echo %systemroot%\msnplugin.exe
echo %systemroot%\msnserver.exe
echo %systemroot%\msnsgr.exe
echo %systemroot%\msnsrv.exe
echo %systemroot%\msnupdate.zip
echo %systemroot%\msnwebmgr.exe
echo %systemroot%\msoevc.exe
echo %systemroot%\msole.dll
echo %systemroot%\mspathfinder
echo %systemroot%\MSPF.EXE
echo %systemroot%\mspphe.dll
echo %systemroot%\msput.exe
echo %systemroot%\msqdevl1.exe
echo %systemroot%\msqnx.dll
echo %systemroot%\msras1.exe
echo %systemroot%\msrvs32.exe
echo %systemroot%\mss.exe
echo %systemroot%\mssadv.dll
echo %systemroot%\msscan.dll
echo %systemroot%\msscomd.exe
echo %systemroot%\mssecu.exe
echo %systemroot%\msserv.config
echo %systemroot%\msserv.exe
echo %systemroot%\msserv32.exe
echo %systemroot%\Msshield.exe
echo %systemroot%\mssm32.exe
echo %systemroot%\mssmart.dll
echo %systemroot%\mssmbios.exe
echo %systemroot%\mssmp.exe
echo %systemroot%\mssmp32.exe
echo %systemroot%\mssmpp.exe
echo %systemroot%\mssmppp.exe
echo %systemroot%\mssms.dll
echo %systemroot%\msspi.dll
echo %systemroot%\mssq.exe
echo %systemroot%\mssql.dll
echo %systemroot%\mssql.exe
echo %systemroot%\mssrv.EXE
echo %systemroot%\msvbs32.dll
echo %systemroot%\mssvc32.exe
echo %systemroot%\mssvr.exe
echo %systemroot%\mssys.exe
echo %systemroot%\MSTask.exe
echo %systemroot%\mstinit.exe
echo %systemroot%\mstwain32.exe
echo %systemroot%\msupdate.exe
echo %systemroot%\msupdater.exe
echo %systemroot%\msupdater.config
echo %systemroot%\msvb.dll
echo %systemroot%\msvbn.exe
echo %systemroot%\msvbs32.dll
echo %systemroot%\msvecurity.config
echo %systemroot%\msvecurity.exe
echo %systemroot%\msvidc32.dll
echo %systemroot%\msvupdater.exe
echo %systemroot%\msvupdater.config
echo %systemroot%\mswinmt.sys
echo %systemroot%\mswinudpmgr32.exe
echo %systemroot%\msword.exe
echo %systemroot%\mswsc10.dll
echo %systemroot%\mswsc20.dll
echo %systemroot%\Msxrs.exe
echo %systemroot%\mtgm.exe
echo %systemroot%\mtwirl32.dll
echo %systemroot%\muotr.so
echo %systemroot%\murka.dat
echo %systemroot%\mustafx.exe
echo %systemroot%\mustafx2.exe
echo %systemroot%\mvsql.exe
echo %systemroot%\mxduo.dll
echo %systemroot%\myspace-facebook.zip
echo %systemroot%\mywallpaper.bmp
echo %systemroot%\naPrdMgr.exe
echo %systemroot%\navapsvc.exe
echo %systemroot%\nivavir.config
echo %systemroot%\navsvc.exe
echo %systemroot%\nbsrv.exe
echo %systemroot%\neksolda.dll
echo %systemroot%\neltabxw.exe
echo %systemroot%\neobus.dll
echo %systemroot%\neos.exe
echo %systemroot%\NeroCheck.dll
echo %systemroot%\NeroCheck.exe
echo %systemroot%\net.com
echo %systemroot%\netadv.dll
echo %systemroot%\netaps2.txt
echo %systemroot%\netconf32.exe
echo %systemroot%\nethop.exe
echo %systemroot%\netserv.exe
echo %systemroot%\netsup.dll
echo %systemroot%\netsvc.exe
echo %systemroot%\netwks32.exe
echo %systemroot%\new.txt
echo %systemroot%\NEW.exe
echo %systemroot%\newset2.exe
echo %systemroot%\ngd.dll
echo %systemroot%\ngwstxfd.dll
echo %systemroot%\nkit.dll
echo %systemroot%\nmcuninstall.exe
echo %systemroot%\nmwegbsf.dll
echo %systemroot%\nodkrn23.exe
echo %systemroot%\nods.exe
echo %systemroot%\nopctrl.dll
echo %systemroot%\nopzet.dll
echo %systemroot%\norlatmx.exe
echo %systemroot%\noskrnl.config
echo %systemroot%\noskrnl.exe
echo %systemroot%\notepad32.exe
echo %systemroot%\npqtsrak.exe
echo %systemroot%\nqgpedlr.dll
echo %systemroot%\nretcip.exe
echo %systemroot%\nsduo.dll
echo %systemroot%\nssfrch.dll
echo %systemroot%\nssrv.exe
echo %systemroot%\nsvdec.exe
echo %systemroot%\NT\nrcs.exe
echo %systemroot%\NT\1.tmp
echo %systemroot%\ntdev.exe
echo %systemroot%\ntdtcstp.dll
echo %systemroot%\ntfyapp.config
echo %systemroot%\ntfyapp.exe
echo %systemroot%\ntivirus.exe
echo %systemroot%\ntlsrv.exe
echo %systemroot%\ntmaspi32.dll
echo %systemroot%\NtmsData\klog.dat
echo %systemroot%\NtmsData\klsdw.exe
echo %systemroot%\ntnut.exe
echo %systemroot%\ntrmv.exe
echo %systemroot%\ntservice.exe
echo %systemroot%\ntspkfnd.dll
echo %systemroot%\ntspkfxt.dll
echo %systemroot%\ntspklqs.dll
echo %systemroot%\ntspkmxl.dll
echo %systemroot%\ntspknlg.dll
echo %systemroot%\ntspksgp.dll
echo %systemroot%\ntvdm.exe
echo %systemroot%\nucle.exe
echo %systemroot%\nvchost.exe
echo %systemroot%\nvcsc23.exe
echo %systemroot%\Nvds.exe
echo %systemroot%\nvidcgui.exe
echo %systemroot%\nvsvc32.exe
echo %systemroot%\nvsvca32.exe
echo %systemroot%\nvudlsp.exe
echo %systemroot%\nwan.dat
echo %systemroot%\nzbd.exe
echo %systemroot%\oadkxrts.exe
echo %systemroot%\OASJJ\DESTAY.ecxe
echo %systemroot%\ocgrep.dll
echo %systemroot%\ofice.exe
echo %systemroot%\offlog.txt
echo %systemroot%\ogxtsepr.dll
echo %systemroot%\okmdepgb.dll
echo %systemroot%\olehelp.exe
echo %systemroot%\olgdqarf.exe
echo %systemroot%\olnmraew.dll
echo %systemroot%\omlbpkaw.dll
echo %systemroot%\one11111.exe
echo %systemroot%\onfwbsak.dll
echo %systemroot%\openssh.exe
echo %systemroot%\opera.exe
echo %systemroot%\oprevfqv.dll
echo %systemroot%\oprevmqp.dll
echo %systemroot%\oprevnpx.dll
echo %systemroot%\oprevpfm.dll
echo %systemroot%\oprevtdp.dll
echo %systemroot%\oprevxlw.dll
echo %systemroot%\optnet.dll
echo %systemroot%\orgnavi.dll
echo %systemroot%\osa9.exe
echo %systemroot%\ossmart.dll
echo %systemroot%\oswinupdate.exe
echo %systemroot%\outIook.exe
echo %systemroot%\OutlookExpress.exe
echo %systemroot%\Outlook32.exe
echo %systemroot%\Pacuks
echo %systemroot%\pandsf.dll
echo %systemroot%\pbar.dll
echo %systemroot%\pbsysie.dll
echo %systemroot%\pc.exe
echo %systemroot%\pccard.exe
echo %systemroot%\pchealth\aolspy.exe
echo %systemroot%\pchealth\helpctr\binaries\lsass.exe
echo %systemroot%\pchealth\helpctr\binaries\secdrive.exe
echo %systemroot%\pchealth\helpctr\binaries\svchost.exe
echo %systemroot%\pchealth\helpctr\binaries\system.exe
echo %systemroot%\pchealth\helpctr\binaries\VTkMgr.exe
echo %systemroot%\pchealth\helpctr\binaries\VTskMgr.exe
echo %systemroot%\pcsrv.exe
echo %systemroot%\pctdf.exe
echo %systemroot%\pctools.dll
echo %systemroot%\pdf.exe
echo %systemroot%\pdoskegl.dll
echo %systemroot%\pebgkxwq
echo %systemroot%\pebgkxwq.exe
echo %systemroot%\peltodgx.dll
echo %systemroot%\perfmon.exe
echo "%systemroot%\photo album2007.pif"
echo %systemroot%\pic.zip
echo %systemroot%\pif\did.exe
echo %systemroot%\pkgadd.exe
echo %systemroot%\plugin1.dat
echo %systemroot%\pmkret.dll
echo %systemroot%\pmsoarbf.dll
echo %systemroot%\pntqkflv.dll
echo "%systemroot%\Poison Ivy Cryptor.exe"
echo %systemroot%\Policies.dll
echo %systemroot%\PolicyVerifier.exe
echo %systemroot%\ponto.DLL
echo %systemroot%\poolsv.exe
echo %systemroot%\popnetdpt.dll
echo %systemroot%\popnetgdv.dll
echo %systemroot%\popnetgqt.dll
echo %systemroot%\popnetkqw.dll
echo %systemroot%\popnetksd.dll
echo %systemroot%\popnetmtq.dll
echo %systemroot%\popnetnfv.dll
echo %systemroot%\popnetnlf.dll
echo %systemroot%\popnetnmo.dll
echo %systemroot%\popnetnpr.dll
echo %systemroot%\popnetxog.dll
echo %systemroot%\pppconfig.dll
echo %systemroot%\PrdMgr.exe
echo %systemroot%\Prefetch\explorer.exe
echo %systemroot%\preredir.exe
echo %systemroot%\protect.exe
echo %systemroot%\ps16sys.dll
echo %systemroot%\pskt.ini
echo %systemroot%\pssmart.dll
echo %systemroot%\pssms.dll
echo %systemroot%\psure.exe
echo %systemroot%\pvnsmfor.dll
echo %systemroot%\pxgdslro.dll
echo %systemroot%\qadovnel.dll
echo %systemroot%\qalkfxor.dll
echo %systemroot%\qdertu.exe
echo %systemroot%\qdnkewfa.dll
echo %systemroot%\qegbdmwf.dll
echo %systemroot%\qkeftmxn.exe
echo %systemroot%\qmafxprs.dll
echo %systemroot%\qndsfmao.dll
echo %systemroot%\qnflkotm.dll
echo %systemroot%\qnxplugin.dll
echo %systemroot%\QQ.dll
echo %systemroot%\QQ.exe
echo %systemroot%\qservice.exe
echo %systemroot%\Qtime.exe
echo %systemroot%\qttasks.exe
echo %systemroot%\qtvglped.dll
echo %systemroot%\quicken.exe
echo %systemroot%\QuickTime.exe
echo %systemroot%\qvdntlmw.dll
echo %systemroot%\r_bifrose.exe
echo %systemroot%\rafbsvnx.dll
echo %systemroot%\ras1.dll
echo %systemroot%\rasqervy.dll
echo %systemroot%\Rav.dll
echo %systemroot%\Rav.exe
echo %systemroot%\Rayfell.exe
echo %systemroot%\rayiou.exe
echo %systemroot%\rbot.exe
echo %systemroot%\RBuilder.exe
echo %systemroot%\rcimlby.exe
echo %systemroot%\realplayers.exe
echo %systemroot%\realupdate.exe
echo %systemroot%\rekayt.reg
echo %systemroot%\Recyclers\svchost.exe
echo %systemroot%\refsdm.dll
echo %systemroot%\reg.reg
echo %systemroot%\regadd.exe
echo %systemroot%\regdll.exe
echo %systemroot%\regent.exe
echo %systemroot%\regfix32.exe
echo %systemroot%\register.exe
echo %systemroot%\regstrmon.exe
echo %systemroot%\REGSVR.EXE
echo %systemroot%\relocater.exe
echo %systemroot%\rem.bat
echo %systemroot%\repair\aolspy.exe
echo %systemroot%\repair\cmsvc.exe
echo %systemroot%\repair\nfosvc.exe
echo %systemroot%\repair\svchost.exe
echo %systemroot%\repair\svcpost.exe
echo %systemroot%\Resource\svchost.exe
echo %systemroot%\retadpu.exe.bin
echo %systemroot%\retnsrp.dll
echo %systemroot%\r-k.exe
echo %systemroot%\rmvgor.dll
echo %systemroot%\rnopbfgt.dll
echo %systemroot%\rnxntup.exe
echo %systemroot%\rootkit.exe
echo %systemroot%\rosqxvmn.dll
echo %systemroot%\rpcss.exe
echo %systemroot%\rpmserv.exe
echo %systemroot%\rqbmvpso.dll
echo %systemroot%\rs.txt
echo %systemroot%\rscc.dll
echo %systemroot%\rskl.dll
echo %systemroot%\rspoolv.exe
echo %systemroot%\rsscap.dll
echo %systemroot%\rstrui.exe
echo %systemroot%\rsver.dll
echo %systemroot%\rtqmekwg.exe
echo %systemroot%\rtsplgob.dll
echo %systemroot%\rtvscan.exe
echo %systemroot%\run32dll.exe
echo %systemroot%\rundll.exe
echo %systemroot%\rundll16.exe
echo %systemroot%\rundll17.exe
echo %systemroot%\rundl132.exe
echo %systemroot%\rundll32.exe
echo %systemroot%\rundll32.vbe
echo %systemroot%\rundll42.exe
echo %systemroot%\runsql.exe
echo %systemroot%\runtfs32.exe
echo %systemroot%\RVHIOST.exe
echo %systemroot%\rvoelbxt.exe
echo %systemroot%\rwlfsdmk.dll
echo %systemroot%\s.exe
echo %systemroot%\s_menu.exe
echo %systemroot%\s32.txt
echo %systemroot%\s3cure.exe
echo %systemroot%\saiemod.dll
echo %systemroot%\salm.exe
echo %systemroot%\sapnet.dll
echo %systemroot%\sawkip.exe
echo %systemroot%\schedhlp.exe
echo %systemroot%\schost.exe
echo %systemroot%\sconf32.dll
echo %systemroot%\screenshot.exe
echo %systemroot%\scrss32.dll
echo %systemroot%\scvc.exe
echo %systemroot%\scvhost.exe
echo %systemroot%\SCVHSOT.exe
echo %systemroot%\scvrun.exe
echo %systemroot%\scvshosts.exe
echo %systemroot%\SCVVC.exe
echo %systemroot%\SCVVHSOT.exe
echo %systemroot%\sdfinacs.dll
echo %systemroot%\sdfixwcs.dll
echo %systemroot%\sdhch.exe
echo %systemroot%\sdktemp.exe
echo %systemroot%\sdrmod.dll
echo %systemroot%\search_res.txt
echo %systemroot%\searchword.dll
echo %systemroot%\SecretStub.exe
echo %systemroot%\secureprocs32.exe
echo %systemroot%\SecureWin31.dll
echo %systemroot%\SecureWin32.exe
echo %systemroot%\SecureWin33.exe
echo %systemroot%\security\lsass.exe
echo %systemroot%\seeshost.exe
echo %systemroot%\serial.txt
echo %systemroot%\serv5.exe
echo %systemroot%\serv32.exe
echo %systemroot%\server.dll
echo %systemroot%\serveraa.exe
echo %systemroot%\service
echo %systemroot%\service.dll
echo %systemroot%\service.exe
echo %systemroot%\service32.exe
echo %systemroot%\service5.exe
echo %systemroot%\service52.exe
echo %systemroot%\servicean.exe
echo %systemroot%\ServicePackFiles\mm.exe
echo %systemroot%\ServicePackFiles\mm.pid
echo %systemroot%\ServicePackFiles\mm.pidar
echo %systemroot%\ServicePackFiles\services.exe
echo %systemroot%\ServicePackFiles\winlogon.exe
echo %systemroot%\serviser.exe
echo %systemroot%\services.dll
echo %systemroot%\services.exe
echo %systemroot%\services32.dll
echo %systemroot%\services32.exe
echo %systemroot%\servicesetup.exe
echo %systemroot%\servicess.exe
echo %systemroot%\servicestub.exe
echo %systemroot%\servicez.exe
echo %systemroot%\Servico.exe
echo %systemroot%\servidevice.exe
echo %systemroot%\servstat32x.exe
echo %systemroot%\SetPoint.exe
echo %systemroot%\setup\fx.exe
echo %systemroot%\setup\s.exe
echo %systemroot%\settn.dll
echo %systemroot%\sfhgj.exe
echo %systemroot%\Sfwwin32.dll
echo %systemroot%\sgoblxtm.dll
echo %systemroot%\shch.exe
echo %systemroot%\shdef.exe
echo %systemroot%\shdocpe.dll
echo %systemroot%\shdocpl.dll
echo %systemroot%\shell.exe
echo %systemroot%\Shelldaemon.exe
echo %systemroot%\shost.exe
echo %systemroot%\shwol.dll
echo %systemroot%\sistem.exe
echo %systemroot%\slysom.exe
echo %systemroot%\smanager.7.exe
echo %systemroot%\smcss.exe
echo %systemroot%\smdat32a.sys
echo %systemroot%\smgr.exe
echo %systemroot%\smsc.exe
echo %systemroot%\smscc.exe
echo %systemroot%\smsys.dat
echo %systemroot%\snd2d3d.exe
echo %systemroot%\socks_bot.dll
echo %systemroot%\sofos16x.dll
echo %systemroot%\sofos32x.dll
echo %systemroot%\soundmgr.exe
echo %systemroot%\spnkfwad.exe
echo %systemroot%\spwoqbmv.exe
echo %systemroot%\sqvgnrpx.dll
echo %systemroot%\sshost.exe
echo "%systemroot%\Standart Stealer.exe"
echo %systemroot%\stcloader.exe
echo %systemroot%\SteamCracker.exe
echo %systemroot%\stfngdvw.dll
echo %systemroot%\sv.exe
echo %systemroot%\svc.exe
echo %systemroot%\svcchost.exe
echo %systemroot%\svchos-upd.exe
echo %systemroot%\svchosl.exe
echo %systemroot%\svchost.com
echo %systemroot%\svchost.dll
echo %systemroot%\svchost.ini
echo %systemroot%\svchost.exe
echo %systemroot%\svchost.exe~
echo %systemroot%\svch0st.cfg
echo %systemroot%\svch0st.exe
echo %systemroot%\svchostie.exe
echo %systemroot%\svchostq.exe
echo %systemroot%\svchostr.exe
echo %systemroot%\svchosts.exe
echo %systemroot%\svchost32
echo %systemroot%\svchost32.exe
echo %systemroot%\svchostKey.DLL
echo %systemroot%\svchostq.exe
echo %systemroot%\svchosy.exe
echo %systemroot%\svchst.exe
echo %systemroot%\svcinit.exe
echo %systemroot%\svcmgr32.exe
echo %systemroot%\svcr.exe
echo %systemroot%\svcrhost.exe
echo %systemroot%\svcshost.exe
echo %systemroot%\svcss.exe
echo %systemroot%\svcswin.exe
echo %systemroot%\svhchosts.exe
echo %systemroot%\svhcost.exe
echo %systemroot%\svhda.exe
echo %systemroot%\svhost.dll
echo %systemroot%\svhost.exe
echo %systemroot%\svhoster.exe
echo %systemroot%\svhosts.exe
echo %systemroot%\svhst32.exe
echo %systemroot%\SVICHOST.exe
echo %systemroot%\SVICHHOST.exe
echo %systemroot%\SVICHOOST.exe
echo %systemroot%\svorbmke.exe
echo %systemroot%\srvcm.exe
echo %systemroot%\svschost.exe
echo %systemroot%\svshost.dll
echo %systemroot%\svshost.exe
echo %systemroot%\svshost1.exe
echo %systemroot%\svslogon.exe
echo %systemroot%\svw.exe
echo %systemroot%\svx.exe
echo %systemroot%\svzhost.exe
echo %systemroot%\svzip.exe
echo %systemroot%\swchost.exe
echo %systemroot%\sxfnewqb.dll
echo %systemroot%\sxgnsvuxct.exe
echo %systemroot%\sxjecknqhu.exe
echo %systemroot%\sxmaokgf.exe
echo %systemroot%\sxnwhbvrzc.exe
echo %systemroot%\sxpgknrwva.exe
echo %systemroot%\sxpjbwvahn.exe
echo %systemroot%\sychost32.exe
echo %systemroot%\sylldlm.exe
echo %systemroot%\symproc32
echo %systemroot%\symproc32.exe
echo %systemroot%\syom.exe
echo %systemroot%\sys.log
echo %systemroot%\sys32.exe
echo %systemroot%\sys32exploer.dll
echo %systemroot%\sysabmpmfr.exe
echo %systemroot%\sysahbecjh.exe
echo %systemroot%\sysatjsicj.exe
echo %systemroot%\sysavxjgdu.exe
echo %systemroot%\sysawechod.exe
echo %systemroot%\sysawpbkvnq.exe
echo %systemroot%\SYSCFG16.EXE
echo %systemroot%\syscheck.exe
echo %systemroot%\syscore.dll
echo %systemroot%\sysdll.exe
echo %systemroot%\sysdk.exe
echo %systemroot%\sysdx.dll
echo %systemroot%\syshost.dll
echo %systemroot%\sysin.scr
echo %systemroot%\sysInf.dat
echo %systemroot%\sysingB32.dll
echo %systemroot%\sysinit.ini
echo %systemroot%\sysldr32.exe
echo %systemroot%\sysmgr64.exe
echo %systemroot%\sysmt.exe
echo %systemroot%\sysnet32.exe
echo %systemroot%\sysnxcphmgy.exe
echo %systemroot%\sysosa.dll
echo %systemroot%\syspr.prx
echo %systemroot%\syspyukrazv.exe
echo %systemroot%\sysqkmwfedz.exe
echo %systemroot%\sysqrnxstju.exe
echo %systemroot%\sysqyzwud.exe
echo %systemroot%\sysrss32.exe
echo %systemroot%\sysrxmfdksp.exe
echo %systemroot%\syssfzvakqg.exe
echo %systemroot%\syssngbeh.exe
echo %systemroot%\systeem.exe
echo %systemroot%\System.dll
echo %systemroot%\System.exe
echo %systemroot%\system.txt
echo %systemroot%\systemax32.exe
echo %systemroot%\Systemt.exe
echo %systemroot%\system32.exe
echo %systemroot%\systemcritical.exe
echo %systemroot%\SystemDebug.exe
echo %systemroot%\systemdevices.exe
echo %systemroot%\systemKey.DLL
echo %systemroot%\systemza32.exe
echo %systemroot%\system\3.reg
echo %systemroot%\system\aliases.ini
echo %systemroot%\system\aliases1.ini
echo %systemroot%\system\ampsvc.exe
echo %systemroot%\system\bamtsc32.dll
echo %systemroot%\system\bedtsc32.dll
echo %systemroot%\system\bfdtsc32.dll
echo %systemroot%\system\bimtcs32.dll
echo %systemroot%\system\bomtcs32.dll
echo %systemroot%\system\bpimts32.dll
echo %systemroot%\system\bplctw32.dll
echo %systemroot%\system\bpmdm32.dll
echo %systemroot%\system\bpmtcs32.dll
echo %systemroot%\system\bqmtcs32.dll
echo %systemroot%\system\bremct32.dll
echo %systemroot%\system\brfmct32.dll
echo %systemroot%\system\brmdlg32.dll
echo %systemroot%\system\brwctl32.dll
echo %systemroot%\system\bspctl32.dll
echo %systemroot%\system\btlmct32.dll
echo %systemroot%\system\bumtcs32.dll
echo %systemroot%\system\bvmtcs32.dll
echo %systemroot%\system\bzmtcs32.dll
echo %systemroot%\system\chin.exe
echo %systemroot%\system\cmd.exe
echo %systemroot%\system\comcrt32.dll
echo %systemroot%\system\control.ini
echo %systemroot%\system\csdact32.dll
echo %systemroot%\system\csrcs.exe
echo %systemroot%\system\csrrs.exe
echo %systemroot%\system\csrss.exe
echo %systemroot%\system\ctlcrt32.dll
echo %systemroot%\system\ctldlg32.dll
echo %systemroot%\system\ctlsdlg.dll
echo %systemroot%\system\ctlvxd32.dll
echo %systemroot%\system\ctmctl32.dll
echo %systemroot%\system\cudact32.dll
echo %systemroot%\system\cvdact32.dll
echo %systemroot%\system\cwdact32.dll
echo %systemroot%\system\d
echo %systemroot%\system\DBoT.exe
echo %systemroot%\system\del.exe
echo %systemroot%\system\delnew.exe
echo %systemroot%\system\dlgctl32.dll
echo %systemroot%\system\dllhost.exe
echo %systemroot%\system\DSDEV.EXE
echo %systemroot%\system\dswctl32.dll
echo %systemroot%\system\dtsimg32.dll
echo %systemroot%\system\dtsmsc32.dll
echo %systemroot%\system\ehSched.exe
echo %systemroot%\system\explorer.exe
echo %systemroot%\system\flood.txt
echo %systemroot%\system\fnl_photoDesktop_lg_7.jpg
echo %systemroot%\system\gowtae32.dll
echo %systemroot%\system\helper.exe
echo %systemroot%\system\hmqtse32.dll
echo %systemroot%\system\hnqtse32.dll
echo %systemroot%\system\hqttse32.dll
echo %systemroot%\system\lsass.exe
echo %systemroot%\system\melt1.bat
echo %systemroot%\system\mmtaskclean.log
echo %systemroot%\system\MSVCRT.exe
echo %systemroot%\system\msvc32s.exe
echo %systemroot%\system\msvs32s.exe
echo %systemroot%\system\nadlocop.exe
echo %systemroot%\system\NOTEPAD.exe
echo %systemroot%\system\run.exe
echo %systemroot%\system\smsc.exe
echo %systemroot%\system\smsc32.exe
echo %systemroot%\system\smscg.exe
echo %systemroot%\system\smss.exe
echo %systemroot%\system\smvss.exe
echo %systemroot%\system\Spool.exe
echo %systemroot%\system\sservice.exe
echo %systemroot%\system\svchost.exe
echo %systemroot%\system\svchost32.exe
echo %systemroot%\system\system.exe
echo %systemroot%\system\temp1.exe
echo %systemroot%\system\temp2.exe
echo %systemroot%\system\Update.exe
echo %systemroot%\system\whcstd32.dll
echo %systemroot%\system\win.com
echo %systemroot%\system\win.ini
echo %systemroot%\system\win32.exe
echo %systemroot%\system\win32in.dll
echo %systemroot%\system\win32out.dll
echo %systemroot%\system\wincrt32.dll
echo %systemroot%\system\winlogin.exe
echo %systemroot%\system\winlogon.exe
echo %systemroot%\system\winupdate.exe
echo %systemroot%\system\wjccts32.dll
echo %systemroot%\system\wjcstd32.dll
echo %systemroot%\system\wkccts32.dll
echo %systemroot%\system\wksscvs.exe
echo %systemroot%\system\wkcstd32.dll
echo %systemroot%\system\wlcstd32.dll
echo %systemroot%\system\wlcstp32.dll
echo %systemroot%\system\worm2007.exe
echo %systemroot%\system\wmccts32.dll
echo %systemroot%\system\wmcctv32.dll
echo %systemroot%\system\wmcstd32.dll
echo %systemroot%\system\wmdcfg32.dll
echo %systemroot%\system\wmdcst32.dll
echo %systemroot%\system\wmecst32.dll
echo %systemroot%\system\wmhcst32.dll
echo %systemroot%\system\wmzcts32.dll
echo %systemroot%\system\wndcrt32.dll
echo %systemroot%\system\wpccts32.dll
echo %systemroot%\system\wupdmgr.exe
echo %systemroot%\system\wxccts32.dll
echo %systemroot%\system\wycctd32.dll
echo %systemroot%\system\yaddress.ico
echo %systemroot%\system\YMworm.exe
echo "%systemroot%\system\You Have Been HaCkeD By Me.jpg"
echo %systemroot%\system\zcleaner.bat
echo %systemroot%\system32RatBot.exe
echo %systemroot%\system32WXBP.exe
echo %systemroot%\system32WXBP.001
echo %systemroot%\system32WXBP.002
echo %systemroot%\system32WXBP.006
echo %systemroot%\system32WXBP.007
echo "%systemroot%\system32\ .bat"
echo %systemroot%\system32\.dll
echo %systemroot%\system32\.exe
echo %systemroot%\system32\...explore.xe
echo %systemroot%\system32\~xsx.log
echo %systemroot%\system32\_Proxy.dll
echo %systemroot%\system32\_scui.cpl
echo %systemroot%\system32\_svchost.exe
echo %systemroot%\system32\_win.exe
echo %systemroot%\system32\___synmgr.exe
echo %systemroot%\system32\1037b.sys
echo %systemroot%\system32\1037t.dll
echo %systemroot%\system32\1042c.exe
echo %systemroot%\system32\1133\Wvram13.exe
echo %systemroot%\system32\120237\120237.dll
echo %systemroot%\system32\124909\124909.dll
echo %systemroot%\system32\146955\146955.dll
echo %systemroot%\system32\158117\158117.dll
echo %systemroot%\system32\172135\172135.dll
echo %systemroot%\system32\2060\svchst.exe
echo %systemroot%\system32\209789\209789.dll
echo %systemroot%\system32\214075\214075.dll
echo %systemroot%\system32\215651\215651.dll
echo %systemroot%\system32\219725\219725.dll
echo %systemroot%\system32\238044\238044.dll
echo %systemroot%\system32\242112\242112.dll
echo %systemroot%\system32\247880\247880.dll
echo %systemroot%\system32\251851\251851.dll
echo %systemroot%\system32\286858\286858.dll
echo %systemroot%\system32\299914\299914.dll
echo %systemroot%\system32\304434\304434.dll
echo %systemroot%\system32\311496\311496.dll
echo %systemroot%\system32\312191\312191.dll
echo %systemroot%\system32\349168\349168.dll
echo %systemroot%\system32\371186\371186.dll
echo %systemroot%\system32\375013\375013.dll
echo %systemroot%\system32\382077\382077.dll
echo %systemroot%\system32\394559\394559.dll
echo %systemroot%\system32\403445\403445.dll
echo %systemroot%\system32\432591\432591.dll
echo %systemroot%\system32\433424\433424.dll
echo %systemroot%\system32\441465\441465.dll
echo %systemroot%\system32\443059\443059.dll
echo %systemroot%\system32\459849\459849.dll
echo %systemroot%\system32\461942\461942.dll
echo %systemroot%\system32\512686\512686.dll
echo %systemroot%\system32\514852\514852.dll
echo %systemroot%\system32\518963\518963.dll
echo %systemroot%\system32\527631\527631.dll
echo %systemroot%\system32\561756\561756.dll
echo %systemroot%\system32\565379\565379.dll
echo %systemroot%\system32\566828\566828.dll
echo %systemroot%\system32\590075\590075.dll
echo %systemroot%\system32\609856\609856.dll
echo %systemroot%\system32\624855\624855.dll
echo %systemroot%\system32\639774\639774.dll
echo %systemroot%\system32\673351\673351.dll
echo %systemroot%\system32\675873\675873.dll
echo %systemroot%\system32\689371\689371.dll
echo %systemroot%\system32\690974\690974.dll
echo %systemroot%\system32\717305\717305.dll
echo %systemroot%\system32\729732\729732.dll
echo %systemroot%\system32\734914\734914.dll
echo %systemroot%\system32\736876\736876.dll
echo %systemroot%\system32\750623\750623.dll
echo %systemroot%\system32\752300\752300.dll
echo %systemroot%\system32\763444\763444.dll
echo %systemroot%\system32\774563\774563.dll
echo %systemroot%\system32\778670\778670.dll
echo %systemroot%\system32\784953\784953.dll
echo %systemroot%\system32\788877\788877.dll
echo %systemroot%\system32\792536\792536.dll
echo %systemroot%\system32\795367\795367.dll
echo %systemroot%\system32\804031\804031.dll
echo %systemroot%\system32\814810\814810.dll
echo %systemroot%\system32\818646\818646.dll
echo %systemroot%\system32\824223\824223.dll
echo %systemroot%\system32\834668\834668.dll
echo %systemroot%\system32\846888\846888.dll
echo %systemroot%\system32\848700\848700.dll
echo %systemroot%\system32\851174\851174.dll
echo %systemroot%\system32\857060\857060.dll
echo %systemroot%\system32\892267\892267.dll
echo %systemroot%\system32\905757\905757.dll
echo %systemroot%\system32\907465\907465.dll
echo %systemroot%\system32\912525\912525.dll
echo %systemroot%\system32\916992\916992.dll
echo %systemroot%\system32\931928\931928.dll
echo %systemroot%\system32\959563\959563.dll
echo %systemroot%\system32\960932\960932.dll
echo %systemroot%\system32\977751\977751.dll
echo %systemroot%\system32\995937\995937.dll
echo %systemroot%\system32\00xstemp.exe
echo %systemroot%\system32\0x57.exe
echo %systemroot%\system32\1.htm
echo %systemroot%\system32\1.exe
echo %systemroot%\system32\1033\rundll.exe
echo %systemroot%\system32\1037v.exe
echo %systemroot%\system32\1nternet.exe
echo %systemroot%\system32\1u7.exe
echo %systemroot%\system32\2pac.txt
echo %systemroot%\system32\3.exe
echo %systemroot%\system32\32svchost.exe
echo %systemroot%\system32\482146.exe
echo %systemroot%\system32\4w4y
echo %systemroot%\system32\5ystem.exe
echo %systemroot%\system32\87354753411123211122534452667798.data
echo %systemroot%\system32\87354753411123211122534452667798.log
echo %systemroot%\system32\a
echo %systemroot%\system32\a2
echo %systemroot%\system32\a3dxx.dll
echo %systemroot%\system32\a3dx8.dll
echo %systemroot%\system32\aaupdt.exe
echo %systemroot%\system32\AAV.cpl
echo %systemroot%\system32\abc.exe
echo %systemroot%\system32\ABC2007.exe
echo %systemroot%\system32\ABCD.exe
echo %systemroot%\system32\abcdefg.bat
echo %systemroot%\system32\abv.exe
echo %systemroot%\system32\abvsvc.exe
echo %systemroot%\system32\Access.exe
echo %systemroot%\system32\accs.txt
echo %systemroot%\system32\ace16win.dll
echo %systemroot%\system32\AClient.dll
echo %systemroot%\system32\acnsvc.exe
echo %systemroot%\system32\acpmonsrv.exe
echo %systemroot%\system32\acrmon32.exe
echo %systemroot%\system32\AcroCLinker.dll
echo %systemroot%\system32\acroup32.exe
echo %systemroot%\system32\actcontroller.exe
echo %systemroot%\system32\activeds.exe
echo %systemroot%\system32\ActiveScan.exe
echo %systemroot%\system32\activeX.exe
echo %systemroot%\system32\AdAware.exe
echo %systemroot%\system32\adir.dll
echo %systemroot%\system32\adirka.dll
echo %systemroot%\system32\adirka.exe
echo %systemroot%\system32\adirss.exe
echo %systemroot%\system32\admdll.dll
echo %systemroot%\system32\AdobeR.exe
echo %systemroot%\system32\adssite-remove.exe
echo %systemroot%\system32\adult.txt
echo %systemroot%\system32\adv.txt
echo %systemroot%\system32\adv32.exe
echo %systemroot%\system32\advpackx.exe
echo %systemroot%\system32\advvpi32.dll
echo %systemroot%\system32\adzgalore-remove.exe
echo %systemroot%\system32\aewwwa2.dll
echo %systemroot%\system32\AFinding.exe
echo %systemroot%\system32\ag1.exe
echo %systemroot%\system32\ag3nt.exe
echo %systemroot%\system32\Age_of_Innocence.exe
echo %systemroot%\system32\agen.sys
echo %systemroot%\system32\agentf.sys
echo %systemroot%\system32\aggs.exe
echo %systemroot%\system32\agl23.exe
echo %systemroot%\system32\agldoc32.com
echo %systemroot%\system32\agtsvc.exe
echo %systemroot%\system32\ahmed
echo %systemroot%\system32\ahmed.exe
echo %systemroot%\system32\aIg.exe
echo %systemroot%\system32\aim.exe
echo %systemroot%\system32\aimplg.exe
echo %systemroot%\system32\aimsgr.exe
echo %systemroot%\system32\aimwindowsv.exe
echo %systemroot%\system32\aivskurq.dll
echo %systemroot%\system32\albateam.exe
echo %systemroot%\system32\ajsha5.exe
echo %systemroot%\system32\akttzn.exe
echo %systemroot%\system32\akun54.dll
echo %systemroot%\system32\alert_icon.gif
echo %systemroot%\system32\alg2k.exe
echo %systemroot%\system32\alg32.exe
echo %systemroot%\system32\alga32.exe
echo %systemroot%\system32\algg.exe
echo %systemroot%\system32\alggg.bak
echo %systemroot%\system32\alggg.exe
echo %systemroot%\system32\algos32.exe
echo %systemroot%\system32\algose32.exe
echo %systemroot%\system32\algs.exe
echo %systemroot%\system32\algsys.exe
echo %systemroot%\system32\aliases.ini
echo %systemroot%\system32\alirexe
echo %systemroot%\system32\alivefor.dll
echo %systemroot%\system32\allworld.exe
echo %systemroot%\system32\alm7tas.exe
echo %systemroot%\system32\alog.txt
echo %systemroot%\system32\alota.exe
echo %systemroot%\system32\alrsvco.exe
echo %systemroot%\system32\alserv32.exe
echo %systemroot%\system32\alsys.exe
echo %systemroot%\system32\amcompatn.sys
echo %systemroot%\system32\amp.ini
echo %systemroot%\system32\ams.exe
echo %systemroot%\system32\amsn.exe
echo %systemroot%\system32\amsnmgr.exe
echo %systemroot%\system32\amsnmsgs.exe
echo %systemroot%\system32\anlServ.exe
echo %systemroot%\system32\annooa.exe
echo %systemroot%\system32\anticipator.dll
echo %systemroot%\system32\antihunt.exe
echo %systemroot%\system32\antiv.exe
echo %systemroot%\system32\antivir.exe
echo %systemroot%\system32\antivir32.exe
echo %systemroot%\system32\antivirus.exe
echo %systemroot%\system32\aolup.exe
echo %systemroot%\system32\aolupdater.exe
echo %systemroot%\system32\apend.exe
echo %systemroot%\system32\apigrab.dll
echo %systemroot%\system32\appleo.dll
echo %systemroot%\system32\appserv.exe
echo %systemroot%\system32\apsvc.exe
echo %systemroot%\system32\aqls32.exe
echo %systemroot%\system32\arcac.exe
echo %systemroot%\system32\arcac.exe.bak
echo %systemroot%\system32\archive.exe
echo %systemroot%\system32\arci.exe
echo %systemroot%\system32\ariert.dll
echo %systemroot%\system32\arse.exe
echo %systemroot%\system32\asddffrr.dll
echo %systemroot%\system32\asdfsa.exe
echo %systemroot%\system32\asgasg.exe
echo %systemroot%\system32\ashDsp.exe
echo %systemroot%\system32\asicrun.exe
echo %systemroot%\system32\asl.god
echo %systemroot%\system32\aspimgr.exe
echo %systemroot%\system32\asplug.dll
echo %systemroot%\system32\aspr_keys.ini
echo %systemroot%\system32\asrupdate.exe
echo %systemroot%\system32\asus.exe
echo %systemroot%\system32\AswBHO.dll
echo %systemroot%\system32\aswwer.dll
echo %systemroot%\system32\atgban.dll
echo %systemroot%\system32\ATIDD.dll
echo %systemroot%\system32\atievx.exe
echo %systemroot%\system32\atigfx.exe
echo %systemroot%\system32\atividx.exe
echo %systemroot%\system32\atiwarez.exe
echo %systemroot%\system32\atixdrivesx.exe
echo %systemroot%\system32\atixvdm.exe
echo %systemroot%\system32\atmtd.dll
echo %systemroot%\system32\atmtd.dll._
echo %systemroot%\system32\atsxyzd.sys
echo %systemroot%\system32\attrib.ini
echo %systemroot%\system32\audi32.exe
echo %systemroot%\system32\audiobg.exe
echo %systemroot%\system32\audiocfg.exe
echo %systemroot%\system32\autoexe.exe
echo %systemroot%\system32\AutomaticUpdates.exe
echo %systemroot%\system32\autorun.ini
echo %systemroot%\system32\autosys.exe
echo %systemroot%\system32\AutoUpdateWin32.exe
echo %systemroot%\system32\av.dat
echo %systemroot%\system32\av.exe
echo %systemroot%\system32\avecv.eyh
echo %systemroot%\system32\avgemcu.exe
echo %systemroot%\system32\avgenc.exe
echo %systemroot%\system32\avkir.exe
echo %systemroot%\system32\avm.cpl
echo %systemroot%\system32\avntify.exe
echo %systemroot%\system32\avp.exe
echo %systemroot%\system32\avrsvc.exe
echo %systemroot%\system32\AVupdate32.exe
echo %systemroot%\system32\Awesome32.exe
echo %systemroot%\system32\AWG.exe
echo %systemroot%\system32\awtoolb.dll
echo %systemroot%\system32\azery1.dll
echo %systemroot%\system32\b
echo %systemroot%\system32\b.gif
echo %systemroot%\system32\b0bq4n.exe
echo %systemroot%\system32\b7r63.exe
echo %systemroot%\system32\backsys.sys
echo %systemroot%\system32\backtomsn.gif
echo %systemroot%\system32\backtomsn.jpg
echo %systemroot%\system32\backup.exe
echo %systemroot%\system32\backup\backup.exe
echo %systemroot%\system32\bagetionwll.dll
echo %systemroot%\system32\balset.dll
echo %systemroot%\system32\banis.dll
echo %systemroot%\system32\bannerm.dll
echo %systemroot%\system32\barka.dll
echo %systemroot%\system32\barty.dll
echo %systemroot%\system32\base64exe.sys
echo %systemroot%\system32\base64zip.sys
echo %systemroot%\system32\Basic_14_process.exe
echo %systemroot%\system32\BAZOOKA\server.exe
echo %systemroot%\system32\bb.dat
echo %systemroot%\system32\bb1.dat
echo %systemroot%\system32\bcwsvc.exe
echo %systemroot%\system32\bear1.dll
echo %systemroot%\system32\bee.exe
echo %systemroot%\system32\berg2.dll
echo %systemroot%\system32\bf4p.exe
echo "%systemroot%\system32\BG ASS.EXE"
echo %systemroot%\system32\bho.dll
echo %systemroot%\system32\Bi\gfgrg.exe
echo %systemroot%\system32\bid32.dll
echo "%systemroot%\system32\BiFrOsT Dr.MOT v0.1.exe"
echo %systemroot%\system32\biggy.exe
echo %systemroot%\system32\bikini.exe
echo %systemroot%\system32\bin29a.log
echo %systemroot%\system32\bio2.exe
echo %systemroot%\system32\bix.exe
echo %systemroot%\system32\bkd.exe
echo %systemroot%\system32\blackster.scr
echo %systemroot%\system32\blablabla.exe
echo %systemroot%\system32\blah.exe
echo %systemroot%\system32\blastclnnn.exe
echo %systemroot%\system32\bling.exe
echo %systemroot%\system32\blf.exe
echo %systemroot%\system32\bload.exe
echo %systemroot%\system32\bloodred.exe
echo %systemroot%\system32\bloodred.zip
echo %systemroot%\system32\bmonq.exe
echo %systemroot%\system32\bnc.mrc
echo %systemroot%\system32\bdn.com
echo %systemroot%\system32\bns.dat
echo %systemroot%\system32\bnsock.dll
echo %systemroot%\system32\boa.dat
echo %systemroot%\system32\boa1.dat
echo %systemroot%\system32\boat32.exe
echo %systemroot%\system32\bodrowis.dll
echo %systemroot%\system32\body.html
echo %systemroot%\system32\body.plain
echo %systemroot%\system32\bolenja.exe
echo %systemroot%\system32\bolenjx.exe
echo %systemroot%\system32\bootchk.exe
echo %systemroot%\system32\bootcli.exe
echo %systemroot%\system32\bootconf.exe
echo %systemroot%\system32\bootconfig.exe
echo %systemroot%\system32\bootini.exe
echo %systemroot%\system32\bootk.exe
echo %systemroot%\system32\bootload.exe
echo %systemroot%\system32\bootloader.exe
echo %systemroot%\system32\bootserver.exe
echo %systemroot%\system32\bootservice.exe
echo %systemroot%\system32\Bootsfv.exe
echo %systemroot%\system32\bootst.exe
echo %systemroot%\system32\bootsv.exe
echo %systemroot%\system32\bootvfy.exe
echo %systemroot%\system32\bootvid.cpl
echo %systemroot%\system32\bootwiz.exe
echo %systemroot%\system32\bordsho.dll
echo %systemroot%\system32\borjomi.dll
echo %systemroot%\system32\borrow11.dll
echo %systemroot%\system32\bortaj32.dll
echo %systemroot%\system32\bot.exe
echo %systemroot%\system32\bpk.exe
echo %systemroot%\system32\bpk.dat
echo %systemroot%\system32\bpkhk.dll
echo %systemroot%\system32\bpkr.exe
echo %systemroot%\system32\bpkwb.dll
echo %systemroot%\system32\brastk.exe
echo %systemroot%\system32\braviax.exe
echo %systemroot%\system32\bronto.dll
echo %systemroot%\system32\browsearch.dll
echo %systemroot%\system32\browser32.exe
echo %systemroot%\system32\browser64.exe
echo %systemroot%\system32\browser128.exe
echo %systemroot%\system32\Browsr32.exe
echo %systemroot%\system32\browsr64.exe
echo %systemroot%\system32\brvrav32.exe
echo %systemroot%\system32\Brwsr32.exe
echo %systemroot%\system32\Brwsr64.exe
echo %systemroot%\system32\bsm.dll
echo %systemroot%\system32\bsn32.dll
echo %systemroot%\system32\bsndcom.dll
echo %systemroot%\system32\bsva-egihsg52.exe
echo %systemroot%\system32\bt\Systemx.exe
echo %systemroot%\system32\btask.dll
echo %systemroot%\system32\btaskv.dll
echo %systemroot%\system32\btasv.dll
echo %systemroot%\system32\btorrent.exe
echo %systemroot%\system32\btserv.exe
echo %systemroot%\system32\BttnServ.exe
echo %systemroot%\system32\builders.exe
echo %systemroot%\system32\bulgan.dll
echo %systemroot%\system32\burito.ini
echo %systemroot%\system32\buritos.exe
echo %systemroot%\system32\burre.dll
echo %systemroot%\system32\BVvcDtyPuol.exe
echo %systemroot%\system32\c_205987.nls
echo %systemroot%\system32\c_205996.nls
echo %systemroot%\system32\c__0593.nls 
echo %systemroot%\system32\c__10983.nls 
echo %systemroot%\system32\c__2303.nls 
echo %systemroot%\system32\c__23732.nls 
echo %systemroot%\system32\c__3478.nls 
echo %systemroot%\system32\c__3479.nls 
echo %systemroot%\system32\c__3480.nls 
echo %systemroot%\system32\c__3481.nls 
echo %systemroot%\system32\c__3482.nls 
echo %systemroot%\system32\c__34895.nls 
echo %systemroot%\system32\c__374.nls 
echo %systemroot%\system32\c__3948.nls 
echo %systemroot%\system32\c3224m.dll
echo %systemroot%\system32\c34m.dll
echo %systemroot%\system32\c5q1.dll
echo %systemroot%\system32\caam\caam.exe
echo %systemroot%\system32\caam\klog.dat
echo %systemroot%\system32\calc.exe.tmp
echo %systemroot%\system32\calc32.exe
echo %systemroot%\system32\callps.dll
echo %systemroot%\system32\camacttiv.exe
echo %systemroot%\system32\capgycva.exe
echo %systemroot%\system32\car.exe
echo %systemroot%\system32\cariba.dll
echo %systemroot%\system32\casino1.ico
echo %systemroot%\system32\casino2.ico
echo %systemroot%\system32\casino3.ico
echo %systemroot%\system32\CbEvtSvc.exe
echo %systemroot%\system32\cbrowse.dll
echo %systemroot%\system32\cc2.cc
echo %systemroot%\system32\CcEvtSvc.exe
echo %systemroot%\system32\CdbgEvtSvc.exe
echo %systemroot%\system32\cDN\cvserchka.exe
echo %systemroot%\system32\cDe\vba35gui.exe
echo %systemroot%\system32\cdp.exe
echo %systemroot%\system32\cdrss.exe
echo %systemroot%\system32\cflmon.exe
echo %systemroot%\system32\cfmon.exe
echo %systemroot%\system32\cftpn0ne.exe
echo %systemroot%\system32\Chans.dll
echo %systemroot%\system32\cheeto.exe
echo %systemroot%\system32\chh.exe
echo %systemroot%\system32\chk_disk.exe
echo %systemroot%\system32\chkdsker.exe
echo %systemroot%\system32\chkdsks.exe
echo %systemroot%\system32\chkext.exe
echo %systemroot%\system32\chkntf.exe
echo %systemroot%\system32\Chwmcop.dll
echo %systemroot%\system32\ci1gnt.exe
echo %systemroot%\system32\ciadvs.exe
echo %systemroot%\system32\CiaStream.dll
echo %systemroot%\system32\CID
echo %systemroot%\system32\cihost.exe
echo %systemroot%\system32\cim5654m.dll
echo %systemroot%\system32\cimm.dll
echo %systemroot%\system32\ciserv.exe
echo %systemroot%\system32\cisrv.exe
echo %systemroot%\system32\cisvr.exe
echo %systemroot%\system32\ckl009.dat
echo %systemroot%\system32\classifields.gif
echo %systemroot%\system32\clbcat.dll
echo %systemroot%\system32\clcbt.exe
echo %systemroot%\system32\clcl16.exe
echo %systemroot%\system32\clean.config
echo %systemroot%\system32\cleanmg.exe
echo %systemroot%\system32\clfsw.dll
echo %systemroot%\system32\cli.exe
echo %systemroot%\system32\clicker.dll
echo %systemroot%\system32\Client\svchost32.exe
echo %systemroot%\system32\clipmg.exe
echo %systemroot%\system32\clipsrvc.exe
echo %systemroot%\system32\clipsv.exe
echo %systemroot%\system32\clipuser32.dll
echo %systemroot%\system32\clisrv.exe
echo %systemroot%\system32\close_icon.gif
echo %systemroot%\system32\cmd.com
echo %systemroot%\system32\cmd16.exe
echo %systemroot%\system32\cmd32.exe
echo %systemroot%\system32\cmds.exe
echo %systemroot%\system32\cmds.txt
echo %systemroot%\system32\cmh.exe
echo %systemroot%\system32\cmman32.exe
echo %systemroot%\system32\cmnocfg.xml
echo %systemroot%\system32\cmnocfg.xml.dat
echo %systemroot%\system32\cmnvc.exe
echo %systemroot%\system32\cmosvc.exe
echo %systemroot%\system32\cmsrrs.exe
echo %systemroot%\system32\cnen.exe
echo %systemroot%\system32\cnfgld32.exe
echo %systemroot%\system32\co.dll
echo %systemroot%\system32\co0l.exe
echo %systemroot%\system32\cocon.dll
echo %systemroot%\system32\CodecBHO.dll
echo %systemroot%\system32\codif123.dll
echo %systemroot%\system32\cogniti.dll
echo %systemroot%\system32\colwindos.exe
echo %systemroot%\system32\Com\ccapl.exe
echo %systemroot%\system32\Com\ccapl16.exe
echo %systemroot%\system32\Com\ccapl32.exe
echo %systemroot%\system32\Com\commngr.exe
echo %systemroot%\system32\Com\comngr.exe
echo %systemroot%\system32\Com\comrel.exe
echo %systemroot%\system32\Com\comserv.exe
echo %systemroot%\system32\Com\filemon.exe
echo %systemroot%\system32\Com\fsecur.exe
echo %systemroot%\system32\com\klog.dat
echo %systemroot%\system32\com\lssas.exe
echo %systemroot%\system32\Com\netst.exe
echo %systemroot%\system32\Com\rundll.exe
echo %systemroot%\system32\Com\rundll32.exe
echo %systemroot%\system32\Com\shield.exe
echo %systemroot%\system32\Com\shield32.exe
echo %systemroot%\system32\Com\svchost.dll
echo %systemroot%\system32\Com\svchost.exe
echo %systemroot%\system32\Com\SVCHOSTKEY.DLL
echo %systemroot%\system32\Com\sd32dll.exe
echo %systemroot%\system32\Com\sddriver.exe
echo %systemroot%\system32\Com\sysproc.exe
echo %systemroot%\system32\Com\system.exe
echo %systemroot%\system32\Com\termsvr.exe
echo %systemroot%\system32\Com\traysys.exe
echo %systemroot%\system32\Com\vhosts.exe
echo %systemroot%\system32\Com\virprot.exe
echo %systemroot%\system32\Com\vmount.exe
echo %systemroot%\system32\Com\vptray.exe
echo %systemroot%\system32\Com\vptraya.exe
echo %systemroot%\system32\Com\vstudio.exe
echo %systemroot%\system32\Com\WIAcs.exe
echo %systemroot%\system32\coman.dll
echo %systemroot%\system32\coman2.dll
echo %systemroot%\system32\comcbx2.dll
echo %systemroot%\system32\comd32.dll
echo %systemroot%\system32\comdlg64.dll
echo %systemroot%\system32\comdlg77.dll
echo %systemroot%\system32\comi.dll
echo %systemroot%\system32\comi2.dll
echo %systemroot%\system32\comippwa.exe
echo %systemroot%\system32\Command.HTM
echo %systemroot%\system32\commands.xml
echo %systemroot%\system32\commert.dll
echo %systemroot%\system32\commnet8.dll
echo %systemroot%\system32\complete.exe
echo %systemroot%\system32\compq32.exe
echo %systemroot%\system32\comsa32.sys
echo %systemroot%\system32\comsatac.dll
echo %systemroot%\system32\comzcinc.exe
echo %systemroot%\system32\condt32.dll
echo %systemroot%\system32\condw32.dll
echo %systemroot%\system32\conf.dat
echo %systemroot%\system32\conf.xml
echo %systemroot%\system32\conf1.dat
echo "%systemroot%\system32\config\systemprofile\Desktop\Antivirus XP 2008.lnk"
echo %systemroot%\system32\config\svchost.exe
echo %systemroot%\system32\configldr.exe
echo %systemroot%\system32\configure.exe
echo %systemroot%\system32\CONlME.EXE
echo %systemroot%\system32\contrld.dll
echo %systemroot%\system32\control.ini
echo %systemroot%\system32\cookie.dat
echo %systemroot%\system32\cookie1.dat
echo %systemroot%\system32\coposes.dll
echo %systemroot%\system32\copq.exe
echo %systemroot%\system32\coq.dll
echo %systemroot%\system32\coreduo.dll
echo %systemroot%\system32\cores.exe
echo %systemroot%\system32\corosm.dll
echo %systemroot%\system32\cortals.dll
echo %systemroot%\system32\cotton1.dll
echo %systemroot%\system32\cPaner.com
echo %systemroot%\system32\cPanere.exe
echo %systemroot%\system32\Cpl32ver.exe
echo %systemroot%\system32\cpmp32.exe
echo %systemroot%\system32\cprs.exe
echo %systemroot%\system32\cpstorage.exe
echo %systemroot%\system32\cpu.exe
echo %systemroot%\system32\cpvhost.exe
echo %systemroot%\system32\cr3m.dll
echo %systemroot%\system32\crack.exe
echo %systemroot%\system32\crcss.exe
echo %systemroot%\system32\creative.exe
echo %systemroot%\system32\credigui.dll
echo %systemroot%\system32\crehcjid.dll
echo %systemroot%\system32\crim.dll
echo %systemroot%\system32\crizak.exe
echo %systemroot%\system32\crm.dll
echo %systemroot%\system32\cronos.exe
echo %systemroot%\system32\crp386.exe
echo %systemroot%\system32\crsrs.exe
echo %systemroot%\system32\crss
echo %systemroot%\system32\crss.exe
echo %systemroot%\system32\crss3.exe
echo %systemroot%\system32\crssc.exe
echo %systemroot%\system32\crsss.exe
echo %systemroot%\system32\crsss64.exe
echo %systemroot%\system32\crssxp.exe
echo %systemroot%\system32\crtmon.exe
echo %systemroot%\system32\crtss.exe
echo %systemroot%\system32\cru629.dat
echo %systemroot%\system32\crubat.dll
echo %systemroot%\system32\crypt32rt.dll
echo %systemroot%\system32\crypts.dll
echo %systemroot%\system32\cryptsa.dll
echo %systemroot%\system32\CryptUI32.dll
echo %systemroot%\system32\cs.dat
echo %systemroot%\system32\cscan.dat
echo %systemroot%\system32\cscentfy.dll
echo %systemroot%\system32\cscripts.exe
echo %systemroot%\system32\csdata32.exe
echo %systemroot%\system32\csm.txt
echo %systemroot%\system32\csmn.exe
echo %systemroot%\system32\csnss.exe
echo %systemroot%\system32\csrcs.exe
echo %systemroot%\system32\csrhost.exe
echo %systemroot%\system32\csrmss.exe
echo %systemroot%\system32\csrs.exe
echo %systemroot%\system32\csrrs.exe
echo %systemroot%\system32\csrsrv.exe
echo %systemroot%\system32\csrssv.exe
echo %systemroot%\system32\csrvss.exe
echo %systemroot%\system32\csscv.exe
echo %systemroot%\system32\cssrs.exe
echo %systemroot%\system32\cssrss.exe
echo %systemroot%\system32\cssrssv.exe
echo %systemroot%\system32\cssys.dll
echo %systemroot%\system32\csts.exe
echo %systemroot%\system32\csvc.exe
echo %systemroot%\system32\csvhost.exe
echo %systemroot%\system32\ctccw32.dll
echo %systemroot%\system32\ctf.exe
echo %systemroot%\system32\ctfcom.exe
echo %systemroot%\system32\CTFMDN.exe
echo %systemroot%\system32\ctfm0Unz.exe
echo %systemroot%\system32\ctfmom.exe
echo %systemroot%\system32\ctfmona.exe
echo %systemroot%\system32\ctfmonb.bmp
echo %systemroot%\system32\ctfmoom.exe
echo %systemroot%\system32\ctfn0n3z.exe
echo %systemroot%\system32\ctfnom.exe
echo %systemroot%\system32\ctfnon.exe
echo %systemroot%\system32\CTHELPER32.EXE
echo %systemroot%\system32\ctpmon.exe
echo %systemroot%\system32\ctray.exe
echo %systemroot%\system32\ctrl.manifest
echo %systemroot%\system32\ctss.exe
echo %systemroot%\system32\ctwsvc.exe
echo %systemroot%\system32\cukert.dll
echo %systemroot%\system32\cunamei.dll
echo %systemroot%\system32\cunta.dll
echo %systemroot%\system32\cUpdate.exe
echo %systemroot%\system32\cupid1.dll
echo %systemroot%\system32\cutix.exe
echo %systemroot%\system32\cvisvc.exe
echo %systemroot%\system32\cvsys.exe
echo %systemroot%\system32\CxEvtSvc.exe
echo %systemroot%\system32\cygwn32.dll
echo %systemroot%\system32\cymdda.dll
echo %systemroot%\system32\czf.exe
echo %systemroot%\system32\czrzns.exe
echo %systemroot%\system32\d
echo %systemroot%\system32\d.dll
echo %systemroot%\system32\d_service.exe
echo %systemroot%\system32\d30ssr.dll
echo %systemroot%\system32\d6k3S.exe
echo %systemroot%\system32\d6k3S
echo %systemroot%\system32\d9xdr.dll
echo %systemroot%\system32\da.exe
echo %systemroot%\system32\daoprint.dll
echo %systemroot%\system32\DAP.exe
echo %systemroot%\system32\Dark\server.exe
echo %systemroot%\system32\dasda.com
echo %systemroot%\system32\dass.dll
echo %systemroot%\system32\data1.exe
echo %systemroot%\system32\data2.exe
echo %systemroot%\system32\datacorez.exe
echo %systemroot%\system32\dbldrv.dll
echo %systemroot%\system32\dbxdrv.dll
echo %systemroot%\system32\dcads-remove.exe
echo %systemroot%\system32\dccplus.dll
echo %systemroot%\system32\dcmhlp.exe
echo %systemroot%\system32\dcmsxe.exe
echo %systemroot%\system32\dcomcnf.exe
echo %systemroot%\system32\dcpavss.exe
echo %systemroot%\system32\dcphnet.dll
echo %systemroot%\system32\dcrick.dll
echo %systemroot%\system32\dcz.exe
echo %systemroot%\system32\ddddd.exe
echo %systemroot%\system32\ddesharer.exe
echo %systemroot%\system32\ddios.dll
echo %systemroot%\system32\ddios2.dll
echo %systemroot%\system32\ddr7xm.dll
echo %systemroot%\system32\debug.dll
echo %systemroot%\system32\debug.tmp
echo %systemroot%\system32\defrasw.dll
echo %systemroot%\system32\Del.bat
echo %systemroot%\system32\delFSF.bat
echo %systemroot%\system32\delme.bat
echo %systemroot%\system32\delself.bat
echo %systemroot%\system32\delxp.exe
echo %systemroot%\system32\demo.xt
echo %systemroot%\system32\derservice.exe
echo %systemroot%\system32\descript.lnk
echo %systemroot%\system32\desktop.exe
echo %systemroot%\system32\detsvc.exe
echo %systemroot%\system32\devenv.exe
echo %systemroot%\system32\devicehnd.exe
echo %systemroot%\system32\deviceio.exe
echo %systemroot%\system32\devicesec.exe
echo %systemroot%\system32\dev-point.exe
echo %systemroot%\system32\dffvvvvvv.dll
echo %systemroot%\system32\dfmmaps.exe
echo %systemroot%\system32\dfrgfat32.exe
echo %systemroot%\system32\dfrgfrat.exe
echo %systemroot%\system32\dhcp.manifest
echo %systemroot%\system32\dhcpserv.dll
echo %systemroot%\system32\dhcpserv.exe
echo %systemroot%\system32\di.gif
echo %systemroot%\system32\di1.gif
echo %systemroot%\system32\dial23.exe
echo %systemroot%\system32\diperto.ini
echo %systemroot%\system32\direct3dx.dll
echo %systemroot%\system32\DirectX\d3dx9_62.exe
echo %systemroot%\system32\directx.exe
echo %systemroot%\system32\directxat.exe
echo %systemroot%\system32\directxbt.exe
echo %systemroot%\system32\directxclick.exe
echo %systemroot%\system32\directxclickers.exe
echo %systemroot%\system32\directxd.exe
echo %systemroot%\system32\directxnew.exe
echo %systemroot%\system32\directxpushup.exe
echo %systemroot%\system32\DirectXset.exe
echo %systemroot%\system32\directxxx32.exe
echo %systemroot%\system32\dirx9.exe
echo %systemroot%\system32\disctrl.exe
echo %systemroot%\system32\diskdr.dll
echo %systemroot%\system32\disksave.exe
echo %systemroot%\system32\display.exe
echo %systemroot%\system32\disvc.exe
echo %systemroot%\system32\DIVXPloyer.exe
echo %systemroot%\system32\divxrs.dll
echo %systemroot%\system32\divxupdate.exe
echo %systemroot%\system32\dlds0.exe
echo %systemroot%\system32\dlds1.exe
echo %systemroot%\system32\dlds2.exe
echo %systemroot%\system32\dlds3.exe
echo %systemroot%\system32\dlds4.exe
echo %systemroot%\system32\dlds5.exe
echo %systemroot%\system32\dlds6.exe
echo %systemroot%\system32\dlds7.exe
echo %systemroot%\system32\dlds8.exe
echo %systemroot%\system32\dlds9.exe
echo %systemroot%\system32\dlha\mstask32.com
echo %systemroot%\system32\Dll.dll
echo %systemroot%\system32\dll.exe
echo %systemroot%\system32\dl32.exe
echo %systemroot%\system32\dlfksdld.exe
echo %systemroot%\system32\dllcache\ageofempires.exe
echo %systemroot%\system32\dllcache\avastpro.exe
echo %systemroot%\system32\dllcache\BitDefender.exe
echo %systemroot%\system32\dllcache\checkweb.dll
echo %systemroot%\system32\dllcache\cpsd.exe
echo %systemroot%\system32\dllcache\cvchost.exe
echo %systemroot%\system32\dllcache\cybershots.exe
echo %systemroot%\system32\dllcache\cychost.exe
echo %systemroot%\system32\dllcache\desyncx.exe
echo %systemroot%\system32\dllcache\Dirhost.com
echo %systemroot%\system32\dllcache\domzost.exe
echo %systemroot%\system32\dllcache\dragonage.exe
echo %systemroot%\system32\dllcache\dservices.exe
echo %systemroot%\system32\dllcache\dvdhost.exe
echo %systemroot%\system32\dllcache\fecs.com
echo %systemroot%\system32\dllcache\fifa2007.exe
echo %systemroot%\system32\dllcache\ffchost.exe
echo %systemroot%\system32\dllcache\Futureal.exe
echo %systemroot%\system32\dllcache\grand.exe
echo %systemroot%\system32\dllcache\hitro.pif
echo %systemroot%\system32\dllcache\hosmnot.exe
echo %systemroot%\system32\dllcache\ivchost.exe
echo %systemroot%\system32\dllcache\jucheck.exe
echo %systemroot%\system32\dllcache\jhost.exe
echo %systemroot%\system32\dllcache\klog.dat
echo %systemroot%\system32\dllcache\knchost.exe
echo %systemroot%\system32\dllcache\lkmhost.exe
echo %systemroot%\system32\dllcache\lpohost.exe
echo %systemroot%\system32\dllcache\mainwin32.exe
echo %systemroot%\system32\dllcache\Mariner.exe
echo %systemroot%\system32\dllcache\mfxbox.exe
echo %systemroot%\system32\dllcache\mirc.ini
echo %systemroot%\system32\dllcache\mlqm.exe
echo %systemroot%\system32\dllcache\mm50krnl.exe
echo %systemroot%\system32\dllcache\mravsc32.exe
echo %systemroot%\system32\dllcache\msagent.exe
echo %systemroot%\system32\dllcache\mscom.exe
echo %systemroot%\system32\dllcache\msds.exe
echo %systemroot%\system32\dllcache\msfav32.exe
echo %systemroot%\system32\dllcache\mshcp.exe
echo %systemroot%\system32\dllcache\msi.exe
echo %systemroot%\system32\dllcache\msiupdate32.exe
echo %systemroot%\system32\dllcache\mslogon.exe
echo %systemroot%\system32\dllcache\mslw.exe
echo %systemroot%\system32\dllcache\msnmsgr.exe
echo %systemroot%\system32\dllcache\msscmc43.exe
echo %systemroot%\system32\dllcache\mssecure32.exe
echo %systemroot%\system32\dllcache\msterminal.exe
echo %systemroot%\system32\dllcache\mswan.exe
echo %systemroot%\system32\dllcache\mswincom32.exe
echo %systemroot%\system32\dllcache\msvps.exe
echo %systemroot%\system32\dllcache\newhost.exe
echo %systemroot%\system32\dllcache\nsch0st.exe
echo %systemroot%\system32\dllcache\ppchost.exe
echo %systemroot%\system32\dllcache\prsc32.exe
echo %systemroot%\system32\dllcache\qhotsew.exe
echo %systemroot%\system32\dllcache\qichost.exe
echo %systemroot%\system32\dllcache\qxchost.exe
echo %systemroot%\system32\dllcache\rigdun.com
echo %systemroot%\system32\dllcache\rschost.exe
echo %systemroot%\system32\dllcache\Rtsecar.exe
echo %systemroot%\system32\dllcache\rtsecas.exe
echo %systemroot%\system32\dllcache\seagatecom.exe
echo %systemroot%\system32\dllcache\servers.ini
echo %systemroot%\system32\dllcache\shvhost.exe
echo %systemroot%\system32\dllcache\snchost.exe
echo %systemroot%\system32\dllcache\spoolms.exe
echo %systemroot%\system32\dllcache\ssls.exe
echo %systemroot%\system32\dllcache\starwin32.exe
echo %systemroot%\system32\dllcache\starwksvc.exe
echo %systemroot%\system32\dllcache\suchost.exe
echo %systemroot%\system32\dllcache\svcshoter.exe
echo %systemroot%\system32\dllcache\svhba.exe
echo %systemroot%\system32\dllcache\svhda.exe
echo %systemroot%\system32\dllcache\svqhost.exe
echo %systemroot%\system32\dllcache\sxch0st.exe
echo %systemroot%\system32\dllcache\sxchost.exe
echo %systemroot%\system32\dllcache\syspool.exe
echo %systemroot%\system32\dllcache\thesims2.exe
echo %systemroot%\system32\dllcache\tsorfib.exe
echo %systemroot%\system32\dllcache\updtftpini.exe
echo %systemroot%\system32\dllcache\upload
echo %systemroot%\system32\dllcache\upload.exe
echo %systemroot%\system32\dllcache\upnt.exe
echo %systemroot%\system32\dllcache\vvvhost.exe
echo %systemroot%\system32\dllcache\WErcx.exe
echo %systemroot%\system32\dllcache\winegne.exe
echo %systemroot%\system32\dllcache\wingptd.exe
echo %systemroot%\system32\dllcache\winmga.exe
echo %systemroot%\system32\dllcache\winmwta.exe
echo %systemroot%\system32\dllcache\winnthosts.exe
echo %systemroot%\system32\dllcache\winrcn.exe
echo %systemroot%\system32\dllcache\winshosts.exe
echo %systemroot%\system32\dllcache\winsno.exe
echo %systemroot%\system32\dllcache\winsntp.exe
echo %systemroot%\system32\dllcache\winsony.exe
echo %systemroot%\system32\dllcache\wintcpi.exe
echo %systemroot%\system32\dllcache\wintcps.exe
echo %systemroot%\system32\dllcache\winvps.exe
echo %systemroot%\system32\dllcache\winxptcp.exe
echo %systemroot%\system32\dllcache\wkactview.exe
echo %systemroot%\system32\dllcache\wks-nt-xp.exe
echo %systemroot%\system32\dllcache\wksrvs.exe
echo %systemroot%\system32\dllcache\wkssvc.exe
echo %systemroot%\system32\dllcache\wuautcl.exe
echo %systemroot%\system32\dllcache\ZoneAlarm.exe
echo %systemroot%\system32\dllccpaw.exe
echo %systemroot%\system32\dllcon.exe
echo %systemroot%\system32\dllhost32.exe
echo %systemroot%\system32\dllhost32.dll
echo %systemroot%\system32\dllhosts.dll
echo %systemroot%\system32\dllhst.exe
echo %systemroot%\system32\dllman.exe
echo %systemroot%\system32\dllmanager32.exe
echo %systemroot%\system32\dllmemhost.exe
echo %systemroot%\system32\dllmon64.exe
echo %systemroot%\system32\dllmonitor.exe
echo %systemroot%\system32\dllrun.exe
echo %systemroot%\system32\dllrun32.exe
echo %systemroot%\system32\dllsecure.exe
echo %systemroot%\system32\dllsrc.exe
echo %systemroot%\system32\dllsuspend.exe
echo %systemroot%\system32\dllsys64.exe
echo %systemroot%\system32\dload.exe
echo %systemroot%\system32\dmdskmg.dll
echo %systemroot%\system32\dml.exe
echo %systemroot%\system32\dnsersnd.dll
echo %systemroot%\system32\dnservice.exe
echo %systemroot%\system32\dnsmgr.exe
echo %systemroot%\system32\dnssvc.exe
echo %systemroot%\system32\dobo.exe
echo %systemroot%\system32\dop.dat
echo %systemroot%\system32\down.dll
echo %systemroot%\system32\down1.dll
echo %systemroot%\system32\down_arrow.gif
echo %systemroot%\system32\Downdll.dll
echo %systemroot%\system32\download.ini
echo %systemroot%\system32\DownLoadDLL.dll
echo %systemroot%\system32\dpcsvc.exe
echo %systemroot%\system32\dpl.txt
echo %systemroot%\system32\dr.gif
echo %systemroot%\system32\dr1.gif
echo %systemroot%\system32\draven.exe
echo %systemroot%\system32\dpcproxy.exe
echo %systemroot%\system32\drive.exe
echo %systemroot%\system32\drive01.dll
echo %systemroot%\system32\drivedate.exe
echo %systemroot%\system32\driverbuild.ocx
echo %systemroot%\system32\drivemngr.sys
echo %systemroot%\system32\driver.exe
echo %systemroot%\system32\drivers.exe
echo %systemroot%\system32\drivers\atixd.exe
echo %systemroot%\system32\drivers\atmapi.sys
echo %systemroot%\system32\drivers\btwdins.exe
echo %systemroot%\system32\drivers\core.cache.dsk
echo %systemroot%\system32\drivers\csrss.exe
echo %systemroot%\system32\drivers\ctfmon.exe
echo %systemroot%\system32\drivers\ctfmun.exe
echo %systemroot%\system32\drivers\DP.sys
echo %systemroot%\system32\drivers\drivers.exe
echo %systemroot%\system32\drivers\etc\hosts.bho
echo %systemroot%\system32\drivers\etc\hosts.tim
echo %systemroot%\system32\drivers\etc\id.exe
echo %systemroot%\system32\drivers\etc\install.exe
echo %systemroot%\system32\drivers\etc\wlog.dat
echo %systemroot%\system32\drivers\etc\mirc.ini
echo %systemroot%\system32\drivers\etc\reg.dll
echo %systemroot%\system32\drivers\etc\remote.ini
echo %systemroot%\system32\drivers\etc\rundll.exe
echo %systemroot%\system32\drivers\etc\Services.exe
echo %systemroot%\system32\drivers\etc\svchost.exe
echo %systemroot%\system32\drivers\etc\svchosts.exe
echo %systemroot%\system32\drivers\etc\vir.exe
echo %systemroot%\system32\drivers\etc\win.com
echo %systemroot%\system32\drivers\etc\win.exe
echo %systemroot%\system32\drivers\etc\x.exe
echo %systemroot%\system32\drivers\etc\xdcc.ini
echo %systemroot%\system32\drivers\flolo.exe
echo %systemroot%\system32\drivers\FmMgr.exe
echo %systemroot%\system32\drivers\hosts
echo %systemroot%\system32\drivers\Intel\convertxdccfile.exe
echo %systemroot%\system32\drivers\Intel\cygcrypt-0.dll
echo %systemroot%\system32\drivers\Intel\cygwin1.dll
echo %systemroot%\system32\drivers\Intel\microsoft.exe
echo %systemroot%\system32\drivers\Intel\mybot.log
echo %systemroot%\system32\drivers\Intel\mybot.pid
echo %systemroot%\system32\drivers\Intel\mybot.state
echo %systemroot%\system32\drivers\Intel\mybot.state~
echo %systemroot%\system32\drivers\Intel\mybot.txt
echo %systemroot%\system32\drivers\Intel\mybot.txt~
echo %systemroot%\system32\drivers\Intel\sample.config
echo %systemroot%\system32\drivers\Intel\Service2.exe
echo %systemroot%\system32\drivers\KWatch1.sys
echo %systemroot%\system32\drivers\LBTWiz.exe
echo %systemroot%\system32\drivers\lsass.exe
echo %systemroot%\system32\drivers\lssrv.exe
echo %systemroot%\system32\drivers\MSKSVRTSS.EXE
echo %systemroot%\system32\drivers\MSKSVRVS.EXE
echo %systemroot%\system32\drivers\msliksurserv.sys
echo %systemroot%\system32\drivers\MTVSCMXT.EXE
echo %systemroot%\system32\drivers\MTVSCMXT.rgn
echo %systemroot%\system32\drivers\mzqdd.exe
echo %systemroot%\system32\drivers\ntndis.exe
echo %systemroot%\system32\drivers\nvscv32.exe
echo %systemroot%\system32\drivers\PrdMgr.exe
echo %systemroot%\system32\drivers\regmon.exe
echo %systemroot%\system32\drivers\regvcs.exe
echo %systemroot%\system32\drivers\rsrvmon.exe
echo %systemroot%\system32\drivers\service.exe
echo %systemroot%\system32\drivers\setup\cmd.txt
echo %systemroot%\system32\drivers\setup\downloader\downloader.exe
echo %systemroot%\system32\drivers\setup\hosts\hosts.exe
echo %systemroot%\system32\drivers\setup\hosts\hostsmon.exe
echo %systemroot%\system32\drivers\setup\hosts\server.txt
echo %systemroot%\system32\drivers\setup\irc\irc.exe
echo %systemroot%\system32\drivers\setup\irc\server.txt
echo %systemroot%\system32\drivers\setup\manager.exe
echo %systemroot%\system32\drivers\setup\mswinsck.ocx
echo %systemroot%\system32\drivers\setup\servers.txt
echo %systemroot%\system32\drivers\setup\startup.reg
echo %systemroot%\system32\drivers\smss.exe
echo %systemroot%\system32\drivers\spcolsv.exe
echo %systemroot%\system32\drivers\spoclss.exe
echo %systemroot%\system32\drivers\spoclsv.exe
echo %systemroot%\system32\drivers\spo0lsv.exe
echo %systemroot%\system32\drivers\Spoolsv.exe
echo %systemroot%\system32\drivers\sppoolsv.exe
echo %systemroot%\system32\drivers\svchost.exe
echo %systemroot%\system32\drivers\symvcs.sys
echo %systemroot%\system32\drivers\sysproc.sys
echo %systemroot%\system32\drivers\System.exe
echo %systemroot%\system32\drivers\taskmgr.exe
echo %systemroot%\system32\drivers\ucbcg.exe
echo %systemroot%\system32\drivers\uzcx.exe
echo %systemroot%\system32\drivers\vspf5.sys
echo %systemroot%\system32\drivers\vspf_hk5.sys
echo %systemroot%\system32\drivers\win32.exe
echo %systemroot%\system32\drivers\winlogon.exe
echo %systemroot%\system32\drivers\wmiapsrvs.exe
echo %systemroot%\system32\drivers\wmq.exe
echo %systemroot%\system32\drivers\wuaclt.exe
echo %systemroot%\system32\drivers\wuact.exe
echo %systemroot%\system32\drivers\wuauclt.exe
echo %systemroot%\system32\drivex.exe
echo %systemroot%\system32\drmupgd.exe
echo %systemroot%\system32\droute.dll
echo %systemroot%\system32\drsys32.exe
echo %systemroot%\system32\drv32dta\pstore.txt
echo %systemroot%\system32\drv32dta\tmp.tmp
echo %systemroot%\system32\drvdug.dll
echo %systemroot%\system32\drvdugr.dll
echo %systemroot%\system32\drvmod.dll
echo %systemroot%\system32\drvmodr.dll
echo %systemroot%\system32\drvsoh.dll
echo %systemroot%\system32\drvsohr.dll
echo %systemroot%\system32\drweb32.dll
echo %systemroot%\system32\ds.dat
echo %systemroot%\system32\dsass.exe
echo %systemroot%\system32\DSDEV.EXE
echo %systemroot%\system32\dsmwsv.dll
echo %systemroot%\system32\dsuiexq.dll
echo %systemroot%\system32\dsxmm.dll
echo %systemroot%\system32\DTBoT.exe
echo %systemroot%\system32\dtrIV.dat
echo %systemroot%\system32\DtrIVk.dll
echo %systemroot%\system32\duis.txt
echo %systemroot%\system32\dv.exe
echo %systemroot%\system32\dvcsecure.exe
echo %systemroot%\system32\dvcsetup.exe
echo %systemroot%\system32\dvdupgd.exe
echo %systemroot%\system32\dvssvc.exe
echo %systemroot%\system32\dwwnw64r.exe
echo %systemroot%\system32\dyndns.exe
echo %systemroot%\system32\dwdsregt.exe
echo %systemroot%\system32\DXC_B5.exe
echo %systemroot%\system32\dxdlg32.exe
echo %systemroot%\system32\dxdmain.exe
echo %systemroot%\system32\dxo.exe
echo %systemroot%\system32\e1.dll
echo %systemroot%\system32\e1.exe
echo %systemroot%\system32\e2.exe
echo %systemroot%\system32\e2rt1.dll
echo %systemroot%\system32\ezStub.exe
echo %systemroot%\system32\eclipse.exe
echo %systemroot%\system32\EcrandeMoi2.exe
echo %systemroot%\system32\eddd11.dll
echo %systemroot%\system32\eddesp.exe
echo %systemroot%\system32\edtxfst.sys
echo %systemroot%\system32\eim.exe
echo %systemroot%\system32\eishci.dll
echo %systemroot%\system32\eltcelcius.exe
echo %systemroot%\system32\email.txt
echo %systemroot%\system32\emdm.exe
echo %systemroot%\system32\emesx.dll
echo %systemroot%\system32\emre1.exe
echo %systemroot%\system32\emsn.exe
echo %systemroot%\system32\enrik.exe
echo %systemroot%\system32\enule.exe
echo %systemroot%\system32\enviados2.sys
echo %systemroot%\system32\errorcheg.exe
echo %systemroot%\system32\ert.dll
echo %systemroot%\system32\ertw1.dll
echo %systemroot%\system32\Erun.pif
echo %systemroot%\system32\es.dat
echo %systemroot%\system32\eseesss.dll
echo %systemroot%\system32\ESHOPEE.exe
echo %systemroot%\system32\esijavaupdt32.exe
echo %systemroot%\system32\esxplos.dll
echo %systemroot%\system32\ethernet.exe
echo %systemroot%\system32\eupsvc.exe
echo %systemroot%\system32\eurodol.dll
echo %systemroot%\system32\evaddeode.dll
echo %systemroot%\system32\EvEnR.exe
echo %systemroot%\system32\eventmgr.exe
echo %systemroot%\system32\eventsry.exe
echo %systemroot%\system32\eventwvr.exe
echo %systemroot%\system32\EvtEngn.exe
echo %systemroot%\system32\exe.exe
echo %systemroot%\system32\execute.exe
echo %systemroot%\system32\exn.exe
echo %systemroot%\system32\exp1ore.dll
echo %systemroot%\system32\exp1ore.exe
echo %systemroot%\system32\explorer.dll
echo %systemroot%\system32\expIorer.exe
echo %systemroot%\system32\expl0rer.exe
echo %systemroot%\system32\expl0rer.pif
echo %systemroot%\system32\explore.exe
echo %systemroot%\system32\Explored.exe
echo %systemroot%\system32\explorer32.exe
echo %systemroot%\system32\explorer.exe
echo %systemroot%\system32\explorer..exe
echo %systemroot%\system32\Explorerr.exe
echo %systemroot%\system32\explorers.exe
echo %systemroot%\system32\EXPLORERZ.EXE
echo %systemroot%\system32\exploresys.exe
echo %systemroot%\system32\explorewin.exe
echo %systemroot%\system32\explorxp.exe
echo %systemroot%\system32\explrer.exe
echo %systemroot%\system32\f0dns.exe
echo %systemroot%\system32\fada.exe
echo %systemroot%\system32\fancy.exe
echo %systemroot%\system32\fandorin.dll
echo %systemroot%\system32\faxneti.exe
echo %systemroot%\system32\fci.exe
echo %systemroot%\system32\fdre.dxc
echo %systemroot%\system32\FeedMerge.dll
echo %systemroot%\system32\feeeww1.dll
echo %systemroot%\system32\FEnR.exe
echo %systemroot%\system32\ferfeww1.dll
echo %systemroot%\system32\ferma12.dll
echo %systemroot%\system32\fertbuk.dll
echo %systemroot%\system32\fert12.dll
echo %systemroot%\system32\fertili.dll
echo %systemroot%\system32\fets.dat
echo %systemroot%\system32\ffe.e
echo %systemroot%\system32\ffer2222.dll
echo %systemroot%\system32\ffservice.exe
echo %systemroot%\system32\fghjjd_.dll
echo %systemroot%\system32\fgwsqe_.dll
echo %systemroot%\system32\fhm.exe
echo %systemroot%\system32\file.exe
echo %systemroot%\system32\file2.exe
echo %systemroot%\system32\filehelps.exe
echo %systemroot%\system32\FileName.exe
echo %systemroot%\system32\filesbase.bin
echo %systemroot%\system32\filsemd.exe
echo %systemroot%\system32\finance.txt
echo %systemroot%\system32\FireExplore.exe
echo %systemroot%\system32\firefox.exe
echo %systemroot%\system32\firewall.exe
echo %systemroot%\system32\firewallav.dll
echo %systemroot%\system32\First
echo %systemroot%\system32\First.exe
echo %systemroot%\system32\first_file.exe
echo %systemroot%\system32\fisheg.dll
echo %systemroot%\system32\fixed.exe
echo %systemroot%\system32\fixin.exe
echo %systemroot%\system32\fixweb.exe
echo %systemroot%\system32\fkeqwex.dll
echo %systemroot%\system32\flashm1.dll
echo %systemroot%\system32\fllnm.exe
echo %systemroot%\system32\flog.txt
echo %systemroot%\system32\fi_opa.dll
echo %systemroot%\system32\floop32.dll
echo %systemroot%\system32\flowcycle.exe
echo %systemroot%\system32\flowcycles.exe
echo %systemroot%\system32\flushdns.exe
echo %systemroot%\system32\fn.xt
echo %systemroot%\system32\fnhoje
echo %systemroot%\system32\fnl_photoDesktop_lg_7.jpg
echo %systemroot%\system32\fontviewer.exe
echo %systemroot%\system32\fooool.exe
echo %systemroot%\system32\fopdn.dll
echo %systemroot%\system32\form.txt
echo %systemroot%\system32\foto_celular.scr
echo %systemroot%\system32\foto_celular.zip
echo %systemroot%\system32\fowlr.dll
echo %systemroot%\system32\FrameWork.exe
echo %systemroot%\system32\FreeS3x.exe
echo %systemroot%\system32\frmwrk.exe
echo %systemroot%\system32\fservice.exe
echo %systemroot%\system32\fsys.exe
echo %systemroot%\system32\FTPDev.exe
echo %systemroot%\system32\ftpsystem.dll
echo %systemroot%\system32\Fuck.exe
echo %systemroot%\system32\fucker.jpg
echo %systemroot%\system32\fufffy.exe
echo %systemroot%\system32\funnymovies.txt
echo %systemroot%\system32\fxscomex.exe
echo %systemroot%\system32\fwcheck.exe
echo %systemroot%\system32\g97.exe
echo %systemroot%\system32\Gadu-Gadu.exe
echo %systemroot%\system32\game.rar
echo %systemroot%\system32\game.zip
echo %systemroot%\system32\gangsta.exe
echo %systemroot%\system32\gay.exe
echo %systemroot%\system32\gcasServ32.exe
echo %systemroot%\system32\gcomd32.dll
echo %systemroot%\system32\gdid32.dll
echo %systemroot%\system32\gEEEyrpsy23.dll
echo %systemroot%\system32\geroez1.dll
echo %systemroot%\system32\getsn32.dll
echo %systemroot%\system32\GetWaylayer32.exe
echo %systemroot%\system32\geyrr.dll
echo %systemroot%\system32\ggf.exe
echo %systemroot%\system32\ghh.exe
echo %systemroot%\system32\gl.txt
echo %systemroot%\system32\global_virus_table.bin
echo %systemroot%\system32\glossary.exe
echo %systemroot%\system32\gontas.dll
echo %systemroot%\system32\gooels.dll
echo %systemroot%\system32\google.exe
echo %systemroot%\system32\google.htm
echo %systemroot%\system32\GoogleBot.exe
echo %systemroot%\system32\googlecb.dll
echo %systemroot%\system32\googlech.dll
echo %systemroot%\system32\googleci.dll
echo %systemroot%\system32\googleed.dll
echo %systemroot%\system32\GO0GLEFREE.EXE
echo %systemroot%\system32\Googlesetup.exe
echo %systemroot%\system32\GoogleUpdater.exe
echo %systemroot%\system32\gorem2.dll
echo %systemroot%\system32\gories.dll
echo %systemroot%\system32\gorsys32.dll
echo %systemroot%\system32\Gothic.exe
echo %systemroot%\system32\gpupdater.exe
echo %systemroot%\system32\grim1.dll
echo %systemroot%\system32\grplscd.exe
echo %systemroot%\system32\gruws.dll
echo %systemroot%\system32\gspotbot.exe
echo %systemroot%\system32\guard.exe
echo %systemroot%\system32\guardpc.exe
echo %systemroot%\system32\gummy.exe
echo %systemroot%\system32\gwin32.dll
echo %systemroot%\system32\gyrpsy23.dll
echo %systemroot%\system32\gzipmod.dll
echo %systemroot%\system32\h@tkeysh@@k.dll
echo %systemroot%\system32\h4ckn3t.exe
echo %systemroot%\system32\halifax1.dll
echo %systemroot%\system32\halifax2.dll
echo %systemroot%\system32\hanz.exe
echo %systemroot%\system32\hard1.dll
echo %systemroot%\system32\haskel32.dll
echo %systemroot%\system32\hatle.dll
echo %systemroot%\system32\hbsppe.exe
echo %systemroot%\system32\hck.exe
echo %systemroot%\system32\he.exe
echo %systemroot%\system32\head2.exe
echo %systemroot%\system32\header_bg.gif
echo %systemroot%\system32\headers.mail
echo %systemroot%\system32\help.txt
echo %systemroot%\system32\helper.dll
echo %systemroot%\system32\helper1.dll
echo %systemroot%\system32\helper.sys
echo %systemroot%\system32\helperam1.exe
echo %systemroot%\system32\helperhelpsys.exe
echo %systemroot%\system32\helperhelpsyss.exe
echo %systemroot%\system32\helperlmdm.exe
echo %systemroot%\system32\helpermfcee.exe
echo %systemroot%\system32\helpermfceee.exe
echo %systemroot%\system32\helpermdmd.exe
echo %systemroot%\system32\helpermdmdd.exe
echo %systemroot%\system32\helpermlm4.exe
echo %systemroot%\system32\helperqttsk.exe
echo %systemroot%\system32\helpersrrvc.exe
echo %systemroot%\system32\helperssc.exe
echo %systemroot%\system32\helpersscc.exe
echo %systemroot%\system32\helpersrvc.exe
echo %systemroot%\system32\helpersrvd.exe
echo %systemroot%\system32\helpersrvdc.exe
echo %systemroot%\system32\helperssrvc.exe
echo %systemroot%\system32\helpersysem.exe
echo %systemroot%\system32\helpersysems.exe
echo %systemroot%\system32\helps.exe
echo %systemroot%\system32\helpsys.exe
echo %systemroot%\system32\helpsyss.exe
echo %systemroot%\system32\helpw86.exe
echo %systemroot%\system32\hf_en-US.js
echo %systemroot%\system32\hgni_ecol.dll
echo %systemroot%\system32\hi.sfc
echo %systemroot%\system32\Hide32.exe
echo %systemroot%\system32\hidrwupd.dll
echo %systemroot%\system32\hjkkddwv.dll
echo %systemroot%\system32\hkcom32.dll
echo %systemroot%\system32\hl.dat
echo %systemroot%\system32\kl80.bin
echo %systemroot%\system32\hljwugsf.bin
echo %systemroot%\system32\Hndldt.ini
echo %systemroot%\system32\hnetviw.dll
echo %systemroot%\system32\hnew32.dll
echo %systemroot%\system32\hoexk.dll
echo %systemroot%\system32\home.htm
echo %systemroot%\system32\hook.dll
echo %systemroot%\system32\hoproxy.dll
echo %systemroot%\system32\hork.exe
echo %systemroot%\system32\host.exe
echo %systemroot%\system32\hostbooter.exe
echo %systemroot%\system32\hp-1003.exe
echo %systemroot%\system32\hpd98.sys
echo %systemroot%\system32\hpprint.exe
echo %systemroot%\system32\HPSrvPrt.exe
echo %systemroot%\system32\hpsvc.exe
echo %systemroot%\system32\hrpdcf.bin
echo %systemroot%\system32\hs.exe
echo %systemroot%\system32\hst32.dll
echo %systemroot%\system32\html32.dll
echo %systemroot%\system32\HWAPI.exe
echo %systemroot%\system32\hwclock.exe
echo %systemroot%\system32\hxiwlgpm.dat
echo %systemroot%\system32\hxiwlgpm.exe
echo %systemroot%\system32\hyperconn.dll
echo %systemroot%\system32\hyperser.dll
echo %systemroot%\system32\hypertrm.exe
echo %systemroot%\system32\i
echo %systemroot%\system32\i_explorer.exe
echo %systemroot%\system32\IAmSad.exe
echo %systemroot%\system32\iasos.dll
echo %systemroot%\system32\Iassss.exe
echo %systemroot%\system32\iaxcfg32.dll
echo %systemroot%\system32\ib2.dll
echo %systemroot%\system32\ib3.dll
echo %systemroot%\system32\ib4.dll
echo %systemroot%\system32\ib5.dll
echo %systemroot%\system32\ib6.dll
echo %systemroot%\system32\ib7.dll
echo %systemroot%\system32\ib8.dll
echo %systemroot%\system32\ib10.dll
echo %systemroot%\system32\ib14.dll
echo %systemroot%\system32\ib15.dll
echo %systemroot%\system32\ibrv.exe
echo %systemroot%\system32\ibudu.dll
echo %systemroot%\system32\ibuntu.dll
echo %systemroot%\system32\ibutu.dll
echo "%systemroot%\system32\IceCold ReLoaded.exe"
echo %systemroot%\system32\icf.exe
echo %systemroot%\system32\IconChanger.exe
echo %systemroot%\system32\IconChanger40.exe
echo %systemroot%\system32\icon_warning.gif
echo %systemroot%\system32\icmui32.dll
echo %systemroot%\system32\icq6.exe
echo %systemroot%\system32\id_cost.dol
echo %systemroot%\system32\idaw64.exe
echo %systemroot%\system32\ie.exe
echo %systemroot%\system32\ie4uini.exe
echo %systemroot%\system32\iebt.dll
echo %systemroot%\system32\iebtmm.exe
echo %systemroot%\system32\iecvsupdate.exe
echo %systemroot%\system32\IEDefender.dll
echo %systemroot%\system32\IEexplore32.exe
echo %systemroot%\system32\ieexplorer32.exe
echo %systemroot%\system32\IEFilter.dll
echo %systemroot%\system32\ieking.dll
echo %systemroot%\system32\ieschedule.exe
echo %systemroot%\system32\iesearch.dll
echo %systemroot%\system32\iesec.exe
echo %systemroot%\system32\IEserv.exe
echo %systemroot%\system32\ieservicesupd.exe
echo %systemroot%\system32\iesetup7b.exe
echo %systemroot%\system32\ieupdate.exe
echo %systemroot%\system32\ieupdates.exe
echo %systemroot%\system32\iexpllore.exe
echo %systemroot%\system32\iexpl3re.exe
echo %systemroot%\system32\iexploler.exe
echo %systemroot%\system32\iexplor.exe
echo %systemroot%\system32\iexplore.exe
echo %systemroot%\system32\iexplore32.exe
echo %systemroot%\system32\IExplore326.exe
echo %systemroot%\system32\iexpl0re.exe
echo %systemroot%\system32\iexplore.pif
echo %systemroot%\system32\IEXPL0RER.exe
echo %systemroot%\system32\iexplorer.dll
echo %systemroot%\system32\iexplorer.exe
echo %systemroot%\system32\iexplorer32.exe
echo %systemroot%\system32\iexploreupd.exe
echo %systemroot%\system32\iexpolere.exe
echo %systemroot%\system32\iexpresser.exe
echo %systemroot%\system32\ifconfig.exe
echo %systemroot%\system32\iftuyszv.exe
echo %systemroot%\system32\igfxsrvc32.exe
echo %systemroot%\system32\ignoredomainsbase.bin
echo %systemroot%\system32\ignorefilesbase.bin
echo %systemroot%\system32\ignoreregsbase.bin
echo %systemroot%\system32\iHelper.dll 
echo %systemroot%\system32\iislsrv.exe
echo %systemroot%\system32\imag.exe
echo %systemroot%\system32\image.jpg
echo %systemroot%\system32\images.gif
echo %systemroot%\system32\imchat.exe
echo %systemroot%\system32\imglog.exe
echo %systemroot%\system32\imglong.exe
echo %systemroot%\system32\imservice.exe
echo %systemroot%\system32\in.DLL
echo %systemroot%\system32\in.exe
echo %systemroot%\system32\inet.exe
echo %systemroot%\system32\inet.ocx
echo %systemroot%\system32\inetdump.exe
echo %systemroot%\system32\inetsrv\antivir.exe
echo %systemroot%\system32\inetsrv\crs.exe
echo %systemroot%\system32\inetsrv\crsss.exe
echo %systemroot%\system32\inetsrv\csrs.exe
echo %systemroot%\system32\inetsrv\direct.exe
echo %systemroot%\system32\inetsrv\host32.exe
echo %systemroot%\system32\inetsrv\host32srv.exe
echo %systemroot%\system32\inetsrv\msnmsgr.exe
echo %systemroot%\system32\inetsrv\rpcall.exe
echo %systemroot%\system32\inetsrv\scvhost.exe
echo %systemroot%\system32\inetsrv\sdhost.exe
echo %systemroot%\system32\inetsrv\servc.exe
echo %systemroot%\system32\inetsrv\servcs.exe
echo %systemroot%\system32\inetsrv\service.exe
echo %systemroot%\system32\inetsrv\services.exe
echo %systemroot%\system32\inetsrv\servu.exe
echo %systemroot%\system32\inetsrv\stacture.exe
echo %systemroot%\system32\inetsrv\svchosts.exe
echo %systemroot%\system32\inetsrv\svhost.exe
echo %systemroot%\system32\inetsrv\smc.exe
echo %systemroot%\system32\inetsrv\smDS.exe
echo %systemroot%\system32\inetsrv\smss.exe
echo %systemroot%\system32\inetsrv\smsss.exe
echo %systemroot%\system32\inetsrv\sql.exe
echo %systemroot%\system32\inetsrv\srhost.exe
echo %systemroot%\system32\inetsrv\ssms.exe
echo %systemroot%\system32\inetsrv\sys.exe
echo %systemroot%\system32\inetsrv\sys32.exe
echo %systemroot%\system32\inetsrv\system.exe
echo %systemroot%\system32\inetsrv\tray.exe
echo %systemroot%\system32\inetsrv\WIAcss.exe
echo %systemroot%\system32\inetsrv\win.exe
echo %systemroot%\system32\inetsrv\Win32.exe
echo %systemroot%\system32\inetsrv\winlog.exe
echo %systemroot%\system32\inetsrv\winlogin.exe
echo %systemroot%\system32\inetsrv\winlogins.exe
echo %systemroot%\system32\inetsrv\winlogon.exe
echo %systemroot%\system32\inetsrv\winlogons.exe
echo %systemroot%\system32\inetsync.exe
echo %systemroot%\system32\info.exe
echo %systemroot%\system32\info.txt
echo %systemroot%\system32\infoDLL.exe
echo %systemroot%\system32\init_sys.config
echo %systemroot%\system32\INITIATE.EXE
echo %systemroot%\system32\initserv.exe
echo %systemroot%\system32\initsvc.exe
echo %systemroot%\system32\inject.dll
echo %systemroot%\system32\INKEY.DLL
echo %systemroot%\system32\inst.dat
echo %systemroot%\system32\instcat.dll
echo %systemroot%\system32\intel.exe
echo %systemroot%\system32\intenat.exe
echo %systemroot%\system32\internal.exe
echo %systemroot%\system32\internet.exe
echo %systemroot%\system32\internet32.exe
echo %systemroot%\system32\internet64.exe
echo %systemroot%\system32\internet128.exe
echo %systemroot%\system32\internetdat.exe
echo %systemroot%\system32\interns32.dll
echo %systemroot%\system32\intlprinters.exe
echo %systemroot%\system32\intranet.exe
echo %systemroot%\system32\iocndtl.exe
echo %systemroot%\system32\iphelp.dll
echo %systemroot%\system32\iplogsec.exe
echo %systemroot%\system32\iPodFix.exe
echo %systemroot%\system32\iPodFixer.exe
echo %systemroot%\system32\ips6mon.dll
echo %systemroot%\system32\ipsecs.exe
echo %systemroot%\system32\ipsec7.exe
echo %systemroot%\system32\ipsec6mon.dll
echo %systemroot%\system32\ipsecndis.sys
echo %systemroot%\system32\ipsecpooler.exe
echo %systemroot%\system32\ipservice32.exe
echo %systemroot%\system32\ipv4mons.dll
echo %systemroot%\system32\ipv6devs.dll
echo %systemroot%\system32\ipv6mond.dll
echo %systemroot%\system32\ipv6monh.dll
echo %systemroot%\system32\ipv6moni.dll
echo %systemroot%\system32\ipv6monj.dll
echo %systemroot%\system32\ipv6monk.dll
echo %systemroot%\system32\ipv6monl.dll
echo %systemroot%\system32\ipv6monm.dll
echo %systemroot%\system32\ipv6monn.dll
echo %systemroot%\system32\ipv6mono.dll
echo %systemroot%\system32\ipv6monp.dll
echo %systemroot%\system32\ipv6monq.dll
echo %systemroot%\system32\ipv6monr.dll
echo %systemroot%\system32\ipv6mons.dll
echo %systemroot%\system32\ipv6mopk.dll
echo %systemroot%\system32\ipv6mops.dll
echo %systemroot%\system32\ipv6mopz.dll
echo %systemroot%\system32\ipv6mote.dll
echo %systemroot%\system32\ipv6motq.dll
echo %systemroot%\system32\ipvpnbridge.sys
echo %systemroot%\system32\ipxrouter.exe
echo %systemroot%\system32\irdvxc.exe
echo %systemroot%\system32\IRQconf.exe
echo %systemroot%\system32\is67718.exe
echo %systemroot%\system32\Isass.exe
echo %systemroot%\system32\isass32.exe
echo %systemroot%\system32\ischot.exe
echo %systemroot%\system32\isdd.dll
echo %systemroot%\system32\iSecurity.cpl
echo %systemroot%\system32\ispinstall.exe
echo %systemroot%\system32\isys32.exe
echo %systemroot%\system32\itla.exe
echo %systemroot%\system32\itmanhc.exe
echo %systemroot%\system32\ituneshelper32.exe
echo %systemroot%\system32\iusr.exe
echo %systemroot%\system32\iwinapp.exe
echo %systemroot%\system32\j2.exe
echo %systemroot%\system32\jamesbond.exe
echo %systemroot%\system32\jaupdate.exe
echo %systemroot%\system32\java128.exe
echo %systemroot%\system32\Java32.com
echo %systemroot%\system32\javaapplet.exe
echo %systemroot%\system32\javaapplets.exe
echo %systemroot%\system32\javahelper.exe
echo %systemroot%\system32\javanet.exe
echo %systemroot%\system32\javasctp.exe
echo %systemroot%\system32\javasy.dll
echo %systemroot%\system32\jbhook.dll
echo %systemroot%\system32\jbuild.exe
echo %systemroot%\system32\jconsole.exe
echo %systemroot%\system32\jester1.exe
echo %systemroot%\system32\jetaccss.dll
echo %systemroot%\system32\jewel.png
echo %systemroot%\system32\jkcom32.dll
echo %systemroot%\system32\jscript.exe
echo %systemroot%\system32\jubswwe
echo %systemroot%\system32\jusched.exe
echo %systemroot%\system32\jvcsvc32.exe
echo %systemroot%\system32\JVM0.exe
echo %systemroot%\system32\jwmngr.exe
echo %systemroot%\system32\jmwnw64l.exe
echo %systemroot%\system32\jxl.exe
echo %systemroot%\system32\jzcom32.dll
echo %systemroot%\system32\k.dat
echo %systemroot%\system32\k86.bin
echo %systemroot%\system32\kalleny.config
echo %systemroot%\system32\karina.dat
echo %systemroot%\system32\karna.dat
echo %systemroot%\system32\kasperskyLabs32.exe
echo %systemroot%\system32\kasperskyLive32.exe
echo %systemroot%\system32\kav.exe
echo %systemroot%\system32\kaxs.dat
echo %systemroot%\system32\KB15oooo.exe
echo %systemroot%\system32\kbdsdf.dll
echo %systemroot%\system32\kbx.exe
echo %systemroot%\system32\kcopt.dll
echo %systemroot%\system32\kd.txt
echo %systemroot%\system32\kek.exe
echo %systemroot%\system32\kernel.exe
echo %systemroot%\system32\Kernel32.exe
echo %systemroot%\system32\kernel8.exe
echo %systemroot%\system32\kernaldrn.exe
echo %systemroot%\system32\KernelDrv.exe
echo %systemroot%\system32\kernels1118.exe
echo %systemroot%\system32\kernels32.exe
echo %systemroot%\system32\kernels8.exe
echo %systemroot%\system32\kernels88.exe
echo %systemroot%\system32\kernelwind32.exe
echo %systemroot%\system32\kernelwind64.exe
echo %systemroot%\system32\kernnel.exe
echo %systemroot%\system32\keyboard.exe
echo %systemroot%\system32\keylog.txt
echo %systemroot%\system32\keymaker.exe
echo %systemroot%\system32\KeySpy.dll
echo %systemroot%\system32\keystrokes.html
echo %systemroot%\system32\kfest.exe
echo %systemroot%\system32\KillAll.bat
echo %systemroot%\system32\killer.exe
echo %systemroot%\system32\kirjtkkd.config
echo %systemroot%\system32\kjsoft64.dll
echo %systemroot%\system32\kknwg.dll
echo %systemroot%\system32\kl.exe
echo %systemroot%\system32\klog.dat
echo %systemroot%\system32\klog.dll
echo %systemroot%\system32\klog.log
echo %systemroot%\system32\klsock.dll
echo %systemroot%\system32\knifelot.dll
echo %systemroot%\system32\knmld.dll
echo %systemroot%\system32\kolie.exe
echo %systemroot%\system32\koos.exe
echo %systemroot%\system32\korkyst.dll
echo %systemroot%\system32\kotiss.dll
echo %systemroot%\system32\kprof
echo %systemroot%\system32\kr_done1
echo %systemroot%\system32\krnlx86.exe
echo "%systemroot%\system32\k.s.a - YONBU.exe"
echo %systemroot%\system32\ksvcl.dll
echo %systemroot%\system32\KT06.pif
echo %systemroot%\system32\ktask.dll
echo %systemroot%\system32\ktaskr.dll
echo %systemroot%\system32\ktasr.dll
echo %systemroot%\system32\kus109.dat
echo %systemroot%\system32\kwinrodv.exe
echo %systemroot%\system32\kwpm.dll
echo %systemroot%\system32\l_sb.css
echo %systemroot%\system32\l_sb_c.js
echo %systemroot%\system32\l1nksys.exe
echo %systemroot%\system32\lanmanwrk.exe
echo %systemroot%\system32\lass.exe
echo %systemroot%\system32\lasse.exe
echo %systemroot%\system32\lbbd32.dll
echo %systemroot%\system32\lboot32.dll
echo %systemroot%\system32\lcass.exe
echo %systemroot%\system32\lcrss.exe
echo %systemroot%\system32\lcsrv16.exe
echo %systemroot%\system32\lcss.exe
echo %systemroot%\system32\lcyss.exe
echo %systemroot%\system32\ldapi32.exe
echo %systemroot%\system32\ldcore.dll
echo %systemroot%\system32\ldinfo.ldr
echo %systemroot%\system32\ldr.exe
echo %systemroot%\system32\ldr1E.tmp
echo %systemroot%\system32\lemsrv.exe
echo %systemroot%\system32\lexmark.exe
echo %systemroot%\system32\lexplore.exe
echo %systemroot%\system32\lgm.dat
echo %systemroot%\system32\lhssass.exe
echo %systemroot%\system32\liar3.exe
echo %systemroot%\system32\liar5.exe
echo %systemroot%\system32\libcinet.exe
echo %systemroot%\system32\libcintle2.dll
echo %systemroot%\system32\libcintles3.dll
echo %systemroot%\system32\libmsns.dll
echo %systemroot%\system32\libweb.dll
echo %systemroot%\system32\libwinets.dll
echo %systemroot%\system32\lich.dat
echo %systemroot%\system32\lich.exe
echo %systemroot%\system32\lil32\swchost.exe
echo %systemroot%\system32\linksys.exe
echo %systemroot%\system32\lista2.sys
echo %systemroot%\system32\livemessenger.exe
echo %systemroot%\system32\livemsgr.exe
echo %systemroot%\system32\livemsngr.exe
echo %systemroot%\system32\livesrvs.exe
echo %systemroot%\system32\lkdsrngj.exe
echo %systemroot%\system32\lkjgf.exe
echo %systemroot%\system32\lkjhgfds.dll
echo %systemroot%\system32\lncom_.exe
echo %systemroot%\system32\lnternet.exe
echo %systemroot%\system32\lnternet32.exe
echo %systemroot%\system32\LimeWire.exe
echo %systemroot%\system32\listc.exe
echo %systemroot%\system32\livecal.exe
echo %systemroot%\system32\lldsrego.exe
echo %systemroot%\system32\lnwin.exe
echo %systemroot%\system32\loadcfg32.exe
echo %systemroot%\system32\loader.exe
echo %systemroot%\system32\loaderxp.exe
echo %systemroot%\system32\loadplg.dll
echo %systemroot%\system32\localhost.exe
echo %systemroot%\system32\lockstock.dll
echo %systemroot%\system32\lockx.exe
echo %systemroot%\system32\log.dat
echo %systemroot%\system32\logbot.txt
echo %systemroot%\system32\LogCrypt.dll
echo %systemroot%\system32\logmen.exe
echo %systemroot%\system32\logonagt.exe
echo %systemroot%\system32\lol.dll
echo %systemroot%\system32\lol.exe
echo %systemroot%\system32\lolla.exe
echo %systemroot%\system32\lomctl32.dll
echo %systemroot%\system32\lorinhib.dll
echo %systemroot%\system32\lm.dat
echo %systemroot%\system32\lmdm.exe
echo %systemroot%\system32\lmns.exe
echo %systemroot%\system32\lmss.exe
echo %systemroot%\system32\loadplg.dll
echo %systemroot%\system32\loadsftpf.dat
echo %systemroot%\system32\login.exe
echo %systemroot%\system32\logon.exe
echo %systemroot%\system32\loval32.exe
echo %systemroot%\system32\LPVideo.dll
echo %systemroot%\system32\lrdsrngm.exe
echo %systemroot%\system32\lrito.ini
echo %systemroot%\system32\lrsys.exe
echo %systemroot%\system32\lsa.exe
echo %systemroot%\system32\lsa.txt
echo %systemroot%\system32\lsass.pif
echo %systemroot%\system32\lsass2.exe
echo %systemroot%\system32\lsass2k.exe
echo %systemroot%\system32\lsass32.exe
echo %systemroot%\system32\lsasss.exe
echo %systemroot%\system32\lsays.exe
echo %systemroot%\system32\lsasx.exe
echo %systemroot%\system32\lservice.exe
echo %systemroot%\system32\lshost.exe
echo %systemroot%\system32\lsiss.exe
echo %systemroot%\system32\lsivs.exe
echo %systemroot%\system32\lsrv.exe
echo %systemroot%\system32\lssas.exe
echo %systemroot%\system32\lssass.exe
echo %systemroot%\system32\lssc.exe
echo %systemroot%\system32\lsscs.exe
echo %systemroot%\system32\lssrv.exe
echo %systemroot%\system32\lssys.exe
echo %systemroot%\system32\lsvhostwinlk.exe
echo %systemroot%\system32\lsvss.exe
echo %systemroot%\system32\lsyss.exe
echo %systemroot%\system32\lt.res
echo %systemroot%\system32\luapvs.dll
echo %systemroot%\system32\Lune.exe
echo %systemroot%\system32\lviss.exe
echo %systemroot%\system32\lvsrev.exe
echo %systemroot%\system32\lxes.exe
echo %systemroot%\system32\lxsys.exe
echo %systemroot%\system32\M23.exe
echo %systemroot%\system32\ma_search_1.gif
echo %systemroot%\system32\mac.dll
echo %systemroot%\system32\mac1.dll
echo %systemroot%\system32\macaaq.dll
echo %systemroot%\system32\maccoffe.dll
echo %systemroot%\system32\macdav1.dll
echo %systemroot%\system32\macidwe.exe
echo %systemroot%\system32\madjaro.dll
echo %systemroot%\system32\magnum.dll
echo %systemroot%\system32\maibak.dll
echo %systemroot%\system32\MailSpectre.exe
echo %systemroot%\system32\mail_worm.exe
echo %systemroot%\system32\Main2.exe
echo %systemroot%\system32\mancstmgr.exe
echo %systemroot%\system32\MangmentMGR.exe
echo %systemroot%\system32\maps.gif
echo %systemroot%\system32\mar132.dll
echo %systemroot%\system32\marasm.dll
echo %systemroot%\system32\markew.dll
echo %systemroot%\system32\markoov123.dll
echo %systemroot%\system32\marwin32.dll
echo %systemroot%\system32\masterc.dll
echo %systemroot%\system32\Mastercard32.exe
echo %systemroot%\system32\masyan.dll
echo %systemroot%\system32\matahsw.dll
echo %systemroot%\system32\matorm.dll
echo %systemroot%\system32\mbti.exe
echo %systemroot%\system32\mc.dat
echo %systemroot%\system32\mcac.dll
echo %systemroot%\system32\mcacr.dll
echo %systemroot%\system32\mcafeee.exe
echo %systemroot%\system32\MccTrayApp.exe
echo %systemroot%\system32\mcntmtdl.exe
echo %systemroot%\system32\mcrsvc.exe
echo %systemroot%\system32\mcrupdate.exe
echo %systemroot%\system32\mctsc.exe
echo %systemroot%\system32\mcwsvc.exe
echo %systemroot%\system32\mdat32.exe
echo %systemroot%\system32\mdfg.odl
echo %systemroot%\system32\mdmd.exe
echo %systemroot%\system32\mdmdd.exe
echo %systemroot%\system32\mdms.exe
echo %systemroot%\system32\mdn.exe
echo %systemroot%\system32\mdnex.exe
echo %systemroot%\system32\medup012.dll
echo %systemroot%\system32\medup020.dll
echo %systemroot%\system32\MEGATRON.ini
echo %systemroot%\system32\melt1.bat
echo %systemroot%\system32\memdump.exe
echo %systemroot%\system32\memoryshr.exe
echo %systemroot%\system32\memorystorm.exe
echo %systemroot%\system32\memretain.exe
echo %systemroot%\system32\memrun.exe
echo %systemroot%\system32\memshare.exe
echo %systemroot%\system32\memshr.exe
echo %systemroot%\system32\mensagem.exe
echo %systemroot%\system32\Meseger.exe
echo %systemroot%\System32\Messanger\msn.exe
echo %systemroot%\System32\Messanger\klog.dat
echo %systemroot%\System32\Messanger\logg.dat
echo %systemroot%\system32\messenger\klog.dat
echo %systemroot%\system32\messenger\msn.exe
echo %systemroot%\system32\Messenger.exe
echo %systemroot%\system32\Messenger32.exe
echo %systemroot%\system32\messengerlive.exe
echo %systemroot%\system32\messengerr.exe
echo %systemroot%\system32\mfc42dx1.dll
echo %systemroot%\system32\mfcee.exe
echo %systemroot%\system32\mfceee.exe
echo %systemroot%\system32\mfs.exe
echo %systemroot%\system32\mgglp.bat
echo %systemroot%\system32\mgmrwmrv.exe
echo %systemroot%\system32\mgtcxedzc.dll
echo %systemroot%\system32\mguard.exe
echo %systemroot%\system32\miBot.exe
echo %systemroot%\system32\MicroAV.cpl
echo %systemroot%\system32\micront.exe
echo %systemroot%\system32\micropoft.exe
echo %systemroot%\system32\micropr.dll
echo %systemroot%\system32\Microsoft.exe
echo %systemroot%\system32\Microsoft\backup.ftp
echo %systemroot%\system32\Microsoft\backup.tftp
echo %systemroot%\system32\Microsoft\svchost.exe
echo %systemroot%\system32\microsoft32dll.exe
echo %systemroot%\system32\microsoftserv\klog.dat
echo %systemroot%\system32\microsoftserv\mircosoft3.exe
echo "%systemroot%\system32\Microsoft Setup Initializazion"
echo "%systemroot%\system32\Microsoft Update"
echo %systemroot%\system32\microsoftupd.exe
echo %systemroot%\system32\milehighads-remove.exe
echo %systemroot%\system32\milis.dll
echo %systemroot%\system32\militar.dll
echo %systemroot%\system32\mimpatch.exe
echo %systemroot%\system32\mininet.dll
echo %systemroot%\system32\mioed.dll
echo %systemroot%\system32\mirc.ico
echo %systemroot%\system32\mirc.ini
echo %systemroot%\system32\mIRC.exe
echo %systemroot%\system32\mixers.exe
echo %systemroot%\system32\mldmm.exe
echo %systemroot%\system32\mlm4.exe
echo %systemroot%\system32\mmdmm.exe
echo %systemroot%\system32\mmp.exe
echo %systemroot%\system32\mmsctl32.dll
echo %systemroot%\system32\mmsdb32.dll
echo %systemroot%\system32\mmspng.exe
echo %systemroot%\system32\mmsvc32.exe
echo %systemroot%\system32\mn.dll
echo %systemroot%\system32\mngr.exe
echo %systemroot%\system32\mnhpot.exe
echo %systemroot%\system32\mnmsrv.exe
echo %systemroot%\system32\mnsmp.exe
echo %systemroot%\system32\mnwsvc.exe
echo %systemroot%\system32\module.exe
echo %systemroot%\system32\moex.dll
echo %systemroot%\system32\moishar.dll
echo %systemroot%\system32\Monitored1.dat
echo %systemroot%\system32\moo.dll
echo %systemroot%\system32\mophix.dll
echo %systemroot%\system32\more.gif
echo %systemroot%\system32\mountr.dll
echo %systemroot%\system32\mousecrm.exe
echo %systemroot%\system32\mousehs.exe
echo %systemroot%\system32\mozila.exe
echo %systemroot%\system32\mozilla.exe
echo %systemroot%\system32\mp\dvsid140.exe 
echo %systemroot%\system32\mp2Ld.exe
echo %systemroot%\system32\mpcsvc.exe
echo %systemroot%\system32\mplayer3.exe
echo %systemroot%\system32\mpn.exe
echo %systemroot%\system32\mpreg.exe
echo %systemroot%\system32\mpt.exe
echo %systemroot%\system32\mpxa.exe
echo %systemroot%\system32\mqtsvc.exe
echo %systemroot%\system32\mrcmgr.exe
echo %systemroot%\system32\mrdsregp.exe
echo %systemroot%\system32\mrdt.log
echo %systemroot%\system32\mrisvc.exe
echo %systemroot%\system32\mrsvctr.exe
echo %systemroot%\system32\mrtmoons.exe
echo %systemroot%\system32\ms_tcp.dll
echo %systemroot%\system32\ms-doss.exe
echo %systemroot%\system32\MS045-XP2.exe
echo %systemroot%\system32\ms32.exe
echo %systemroot%\system32\ms32.sys
echo %systemroot%\system32\MSA.cpl
echo %systemroot%\system32\msa.exe
echo %systemroot%\system32\msacm32.exe
echo %systemroot%\system32\msaconf.exe
echo %systemroot%\system32\MSADNIN.exe
echo %systemroot%\system32\msams.exe
echo %systemroot%\system32\msansspc.dll
echo %systemroot%\system32\msantivir.exe
echo %systemroot%\system32\msapi.exe
echo %systemroot%\system32\msapps.exe
echo %systemroot%\system32\msasn.exe
echo %systemroot%\system32\MSASP32.exe
echo %systemroot%\system32\msasvc.exe
echo %systemroot%\system32\msauth.exe
echo %systemroot%\system32\msbd32.dll
echo %systemroot%\system32\MSbz32.exe
echo %systemroot%\system32\msccsed.exe
echo %systemroot%\system32\mscert.dll
echo %systemroot%\system32\mscgy.exe
echo %systemroot%\system32\MscheldB.exe
echo %systemroot%\system32\Mscheldncx.exe
echo %systemroot%\system32\mschkdf.exe
echo %systemroot%\system32\msclient.exe
echo %systemroot%\system32\msclients.exe
echo %systemroot%\system32\msclock.exe
echo %systemroot%\system32\msclt.exe
echo %systemroot%\system32\msconftb.sys
echo %systemroot%\system32\msconsole.exe
echo %systemroot%\system32\mscont32.dll
echo %systemroot%\system32\mscorews.dll
echo %systemroot%\system32\mscnt.dll
echo %systemroot%\system32\mscntrl.exe
echo %systemroot%\system32\mscp.exe
echo %systemroot%\system32\mscomt32.exe
echo %systemroot%\system32\msconfg.exe
echo %systemroot%\system32\msconfigs.exe
echo %systemroot%\system32\msconfigsu.exe
echo %systemroot%\system32\msconflg.exe
echo %systemroot%\system32\mscrs.exe
echo %systemroot%\system32\mscvs.exe
echo %systemroot%\system32\msdatabase.exe
echo %systemroot%\system32\msdbgm.exe
echo %systemroot%\system32\msdconfig.exe
echo %systemroot%\system32\msdefender.exe
echo %systemroot%\system32\msdev.exe
echo %systemroot%\system32\msdevelop.exe
echo %systemroot%\system32\msdhcp.exe
echo %systemroot%\system32\MSDHCP32.exe
echo %systemroot%\system32\msdhcprs.exe
echo %systemroot%\system32\msdll.exe
echo %systemroot%\system32\msdn.exe
echo %systemroot%\system32\msdn-nt.exe
echo %systemroot%\system32\MSDNSD32.exe
echo %systemroot%\system32\msdnxp.exe
echo %systemroot%\system32\MSDOS.PIF
echo %systemroot%\system32\MSdos32.exe
echo %systemroot%\system32\msdriver.exe
echo %systemroot%\system32\msdtc32.dll
echo %systemroot%\system32\msdts.exe
echo %systemroot%\system32\msdun.dll
echo %systemroot%\system32\msdun.exe
echo %systemroot%\system32\mseacx.exe
echo %systemroot%\system32\msedit32.exe
echo %systemroot%\system32\msejavaupdt32.exe
echo %systemroot%\system32\msengine.exe
echo %systemroot%\system32\msese.exe
echo %systemroot%\system32\msexe.exe
echo %systemroot%\system32\MSEXECP32.exe
echo %systemroot%\system32\msexplore.exe
echo %systemroot%\system32\msft.txt
echo %systemroot%\system32\msftksvc.exe
echo %systemroot%\system32\msftp.exe
echo %systemroot%\system32\msgconfigre.exe
echo %systemroot%\system32\msgconfigrs.exe
echo %systemroot%\system32\msgfix.exe
echo %systemroot%\system32\msgnlive.exe
echo %systemroot%\system32\msgnms.exe
echo %systemroot%\system32\msgp.exe
echo %systemroot%\system32\msgrlive.exe
echo %systemroot%\system32\Msgrss.exe
echo %systemroot%\system32\Msgrss.exe.bat
echo %systemroot%\system32\msguard.exe
echo %systemroot%\system32\msgzl.exe
echo %systemroot%\system32\mshearts.dll
echo %systemroot%\system32\mshelp.exe
echo %systemroot%\system32\mshost.exe
echo %systemroot%\system32\mshotmon.exe
echo %systemroot%\system32\mshpc.dll
echo %systemroot%\system32\mshtha.exe
echo %systemroot%\system32\mshtmllib.dll
echo %systemroot%\system32\mshujsys.exe
echo %systemroot%\system32\msi32info.exe
echo %systemroot%\system32\msi32java.exe
echo %systemroot%\system32\msicll.exe
echo %systemroot%\system32\msiconf.exe
echo %systemroot%\system32\msident.exe
echo %systemroot%\system32\msidxdia.exe
echo %systemroot%\system32\MSIEHelper.dll
echo %systemroot%\system32\msiesetup.exe
echo %systemroot%\system32\MSIEx.exe
echo %systemroot%\system32\msiexec16.exe
echo %systemroot%\system32\msiexecs.dll
echo %systemroot%\system32\msiexecs.exe
echo %systemroot%\system32\msiexecu.exe
echo %systemroot%\system32\msijavaupdt32.exe
echo %systemroot%\system32\msindc.dll
echo %systemroot%\system32\msinet.exe
echo %systemroot%\system32\msinm.exe
echo %systemroot%\system32\msinnt.exe
echo %systemroot%\system32\Msinstall\msfolder.exe
echo %systemroot%\system32\msipsvc.exe
echo %systemroot%\system32\msixec32.exe
echo %systemroot%\system32\MSIXU.DLL
echo %systemroot%\system32\MSlti32.exe
echo %systemroot%\system32\msjava.exe
echo %systemroot%\system32\msjavames.exe
echo %systemroot%\system32\msjavaxps.exe
echo %systemroot%\system32\msjwer.exe
echo %systemroot%\system32\msjwer.hts
echo %systemroot%\system32\mskvtns.dll
echo %systemroot%\system32\msl.exe
echo %systemroot%\system32\mslctlg.dll
echo %systemroot%\system32\msldr.dll
echo %systemroot%\system32\msliksurcredo.dll
echo %systemroot%\system32\msliksurdns.dll
echo %systemroot%\system32\Msloader32.exe
echo %systemroot%\system32\mslogsvr.ini
echo %systemroot%\system32\mslvm.exe
echo %systemroot%\system32\msmanager.exe
echo %systemroot%\system32\msmapiax32.exe
echo %systemroot%\system32\msmapibx32.exe
echo %systemroot%\system32\msnaupdater.exe
echo %systemroot%\system32\msnbm32.exe
echo %systemroot%\system32\msnclicfg.exe
echo %systemroot%\system32\msmcrt.dll
echo %systemroot%\system32\msmediaq.dll
echo %systemroot%\system32\msmgr.exe
echo %systemroot%\system32\msmgslive.exe
echo %systemroot%\system32\msmisso.exe
echo %systemroot%\system32\msmmi.exe
echo %systemroot%\system32\msmpserv.exe
echo %systemroot%\system32\msmrtmon.exe
echo %systemroot%\system32\msms.exe
echo %systemroot%\system32\msmsg.exe
echo %systemroot%\system32\msmsger.exe
echo %systemroot%\system32\msmsgr.exe
echo %systemroot%\system32\msmsgs.exe
echo %systemroot%\system32\MSMSN32.exe
echo %systemroot%\system32\msmsngr.exe
echo %systemroot%\system32\msmsnserv.exe
echo %systemroot%\system32\msmsnserver.exe
echo %systemroot%\system32\msmsrvc.exe
echo %systemroot%\system32\msn\klog.dat
echo %systemroot%\system32\msn\msn.exe
echo %systemroot%\system32\msn.dll
echo %systemroot%\system32\msn.exe
echo %systemroot%\system32\msn.htm
echo %systemroot%\system32\msn16.exe
echo %systemroot%\system32\msn32.exe
echo %systemroot%\system32\msnapp.exe
echo %systemroot%\system32\msnapplet.exe
echo %systemroot%\system32\msnav32.ax
echo %systemroot%\system32\msnbho.dll
echo %systemroot%\system32\msnbooster.exe
echo %systemroot%\system32\msnchecker.exe
echo %systemroot%\system32\msnclient.exe
echo %systemroot%\system32\msnclients.exe
echo %systemroot%\system32\msnclimgr.exe
echo %systemroot%\system32\msncnfmgr.exe
echo %systemroot%\system32\msncommgr.exe
echo %systemroot%\system32\msncon.exe
echo %systemroot%\system32\msndbcli.exe
echo %systemroot%\system32\msndebugs.exe
echo %systemroot%\system32\msndp.exe
echo %systemroot%\system32\msnfilecfg.exe
echo %systemroot%\system32\msnfileshare.exe
echo %systemroot%\system32\msnfix.exe
echo %systemroot%\system32\msngerf.exe
echo %systemroot%\system32\msngersd.exe
echo %systemroot%\system32\msngr.exe
echo %systemroot%\system32\MSNGR32.com
echo %systemroot%\system32\msnhost.exe
echo %systemroot%\system32\msnhostn.exe
echo %systemroot%\system32\msni.exe
echo %systemroot%\system32\msninbox.exe
echo %systemroot%\system32\msninet.exe
echo %systemroot%\system32\msnka0lids.exe
echo %systemroot%\system32\msnlive.exe
echo %systemroot%\system32\msnlivegs.exe
echo %systemroot%\system32\msnloader.exe
echo %systemroot%\system32\msnlvclient.exe
echo %systemroot%\system32\msnmagr.exe
echo %systemroot%\system32\msnmanegers.exe
echo %systemroot%\system32\msnmcgrs.exe
echo %systemroot%\system32\msnmesenger.exe
echo %systemroot%\system32\msnmesgr.exe
echo %systemroot%\system32\msnmessage7.7.exe
echo %systemroot%\system32\MSNMEssenger.exe
echo %systemroot%\system32\msnmessengerlive.exe
echo %systemroot%\system32\msnmesseng.exe
echo %systemroot%\system32\msnmessgs.exe
echo %systemroot%\system32\msnmgnr.exe
echo %systemroot%\system32\msnmgr.exe
echo %systemroot%\system32\msnmgrsv.exe
echo %systemroot%\system32\msnmgsr.exe
echo %systemroot%\system32\msnmrgs.exe
echo %systemroot%\system32\msnmrigr.exe
echo %systemroot%\system32\msnms.exe
echo %systemroot%\system32\msnmsg.exe
echo %systemroot%\system32\msnmsgem.exe
echo %systemroot%\system32\msnmsger.exe
echo %systemroot%\system32\MsnMsgr.exe
echo %systemroot%\system32\msnmsgs.exe
echo %systemroot%\system32\msnmsgsm.exe
echo %systemroot%\system32\msnmsgsman.exe
echo %systemroot%\system32\msnmsgsmn.exe
echo %systemroot%\system32\msnmsngr.exe
echo %systemroot%\system32\msnmsngrlive.exe
echo %systemroot%\system32\msnmssgr.exe
echo %systemroot%\system32\MsnMsr.exe
echo %systemroot%\system32\msnn.exe
echo %systemroot%\system32\msnnet.exe
echo %systemroot%\system32\msnngerplus.exe
echo %systemroot%\system32\msnnmaneger.exe
echo %systemroot%\system32\msnnsg.exe
echo %systemroot%\system32\msnp2pmgr.exe
echo %systemroot%\system32\msnpla.exe
echo %systemroot%\system32\msnplus.exe
echo %systemroot%\system32\msnpopblck.exe
echo %systemroot%\system32\msnpro.exe
echo %systemroot%\system32\msmq2inst.exe
echo %systemroot%\system32\msnq3insller.exe
echo %systemroot%\system32\msnqmgr.exe
echo %systemroot%\system32\msnrouter.exe
echo %systemroot%\system32\msnrpcmgr.exe
echo %systemroot%\system32\msnrxmgr.exe
echo %systemroot%\system32\msns.exe
echo %systemroot%\system32\MSNSA32.dll
echo %systemroot%\system32\msnscps.dll
echo %systemroot%\system32\msnse.exe
echo %systemroot%\system32\msnsecure.exe
echo %systemroot%\system32\msnserv.exe
echo %systemroot%\system32\msnserve.exe
echo %systemroot%\system32\msnserver.exe
echo %systemroot%\system32\msnservex.exe
echo %systemroot%\system32\msnservice.exe
echo %systemroot%\system32\msnservicer.exe
echo %systemroot%\system32\msnservices.exe
echo %systemroot%\system32\msnsetmg.exe
echo %systemroot%\system32\msnsettings.exe
echo %systemroot%\system32\msnsetup.exe
echo %systemroot%\system32\msnsgs.exe
echo %systemroot%\system32\msnsharewiz.exe
echo %systemroot%\system32\msnsoftware.exe
echo %systemroot%\system32\msnsrv.exe
echo %systemroot%\system32\msnssgr.exe
echo %systemroot%\system32\msnsrv.exe
echo %systemroot%\system32\msnstarter.exe
echo %systemroot%\system32\msnstartup.exe
echo %systemroot%\system32\msnsupdate.exe
echo %systemroot%\system32\msnsvc.exe
echo %systemroot%\system32\msntc0.exe
echo %systemroot%\system32\msntc1.exe
echo %systemroot%\system32\msntc2.exe
echo %systemroot%\system32\msntc3.exe
echo %systemroot%\system32\msntc4.exe
echo %systemroot%\system32\msntc5.exe
echo %systemroot%\system32\msnupdate.exe
echo %systemroot%\system32\msnupdater.exe
echo %systemroot%\system32\msnupdates.exe
echo %systemroot%\system32\msnupdbt.exe
echo %systemroot%\system32\msnupdcli.exe
echo %systemroot%\system32\msnupdsv.exe
echo %systemroot%\system32\msnupnp.exe
echo %systemroot%\system32\msnuser.exe
echo %systemroot%\system32\msnuserv.exe
echo %systemroot%\system32\msnusr.exe
echo %systemroot%\system32\msnworm.exe
echo %systemroot%\system32\msnxpcli.exe
echo %systemroot%\system32\msoff.exe
echo %systemroot%\system32\msofficew.exe
echo %systemroot%\system32\msofrs32.sys
echo %systemroot%\system32\msogl.dll
echo %systemroot%\system32\msole32.exe
echo %systemroot%\system32\mspainter.exe
echo %systemroot%\system32\mspcdcom.exe
echo %systemroot%\system32\mspoolg.dll
echo %systemroot%\system32\MSPRCSS32.exe
echo %systemroot%\system32\msprotect.exe
echo %systemroot%\system32\msq23.exe
echo %systemroot%\system32\msq32.exe
echo %systemroot%\system32\msql23.exe
echo %systemroot%\system32\msram.dll
echo %systemroot%\system32\msratnit.dll
echo %systemroot%\system32\msratniw.dll
echo %systemroot%\system32\msrcmd.exe
echo %systemroot%\system32\msrctlg.dll
echo %systemroot%\system32\msrdc.exe
echo %systemroot%\system32\msreged32.exe
echo %systemroot%\system32\msresource.exe
echo %systemroot%\system32\msrmsvc.exe
echo %systemroot%\system32\msrp32.exe
echo %systemroot%\system32\msrpc32.exe
echo %systemroot%\system32\msrpcd.exe
echo %systemroot%\system32\msrun32.exe
echo %systemroot%\system32\MSSCF32.exe
echo %systemroot%\system32\msscntr32.exe
echo %systemroot%\system32\mssdh.exe
echo %systemroot%\system32\MSsec32.exe
echo %systemroot%\system32\mssecu.exe
echo %systemroot%\system32\mssecure.exe
echo %systemroot%\system32\mssecures.exe
echo %systemroot%\system32\mssee.exe
echo %systemroot%\system32\msserv32.exe
echo %systemroot%\system32\mssetupconf.exe
echo %systemroot%\system32\mssgl2.exe
echo %systemroot%\system32\mssmmspgr.exe
echo %systemroot%\system32\mssmp.exe
echo %systemroot%\system32\mssmpp.exe
echo %systemroot%\system32\mssmppp.exe
echo %systemroot%\system32\mssngear.exe
echo %systemroot%\system32\mssnger.exe
echo %systemroot%\system32\mssofts.exe
echo %systemroot%\system32\msspooler.exe
echo %systemroot%\system32\mssqlsnt.exe
echo %systemroot%\system32\mssrv32.exe
echo %systemroot%\system32\MSsslServer.exe
echo %systemroot%\system32\msssrv.exe
echo %systemroot%\system32\msstc.exe
echo %systemroot%\system32\mssvc.exe
echo %systemroot%\system32\mssvcc.exe
echo %systemroot%\system32\mssw32.exe
echo %systemroot%\system32\mssym.exe
echo %systemroot%\system32\mssync20.exe
echo %systemroot%\system32\mssync20.tlb
echo %systemroot%\system32\mstasker.exe
echo %systemroot%\system32\mstasks.exe
echo %systemroot%\system32\mstdmc.exe
echo %systemroot%\system32\MStli32s.exe
echo %systemroot%\system32\mstc.exe
echo %systemroot%\system32\msthost.exe
echo %systemroot%\system32\msthosts.exe
echo %systemroot%\system32\mstinitial.exe
echo %systemroot%\system32\mstscex.dll
echo %systemroot%\system32\mstsdsc.exe
echo %systemroot%\system32\mstscc.exe
echo %systemroot%\system32\mstskmgr.exe
echo %systemroot%\system32\msttl.exe
echo %systemroot%\system32\mstunnel.exe
echo %systemroot%\system32\msupdt.exe
echo %systemroot%\system32\msupd.exe
echo %systemroot%\system32\msupdate.dll
echo %systemroot%\system32\msupdate.exe
echo %systemroot%\system32\msupdates.exe
echo %systemroot%\system32\msupdtck.exe
echo %systemroot%\system32\msupdte.exe
echo %systemroot%\system32\msups.exe
echo %systemroot%\system32\msvbcr40.dll
echo %systemroot%\system32\msvc32.dll
echo %systemroot%\system32\msvc32.dl_
echo %systemroot%\system32\msvce.exe
echo %systemroot%\system32\msvce32.exe
echo %systemroot%\system32\msvcbm.exe
echo %systemroot%\system32\msvchost.exe
echo %systemroot%\system32\msvcrt2.dll
echo %systemroot%\system32\msvcrtd.exe
echo %systemroot%\system32\msvcvp.dll
echo %systemroot%\system32\msvcs.exe
echo %systemroot%\system32\msvctl32.dll
echo %systemroot%\system32\msvmjava.exe
echo %systemroot%\system32\msvrcs.exe
echo %systemroot%\system32\msvss.exe
echo %systemroot%\system32\msw32.exe
echo %systemroot%\system32\MSWDNS32.exe
echo %systemroot%\system32\mswindtc.exe
echo %systemroot%\system32\MSWin.dat
echo %systemroot%\system32\mswin32.exe
echo %systemroot%\system32\mswins.exe
echo %systemroot%\system32\mswintls.exe
echo %systemroot%\system32\mswinup.exe
echo %systemroot%\system32\MSWLD32.exe
echo %systemroot%\system32\MSWORD.exe
echo %systemroot%\system32\mswns32.exe
echo %systemroot%\system32\MSWSA32.exe
echo %systemroot%\system32\mswsc.exe
echo %systemroot%\system32\MSWSCK32.exe
echo %systemroot%\system32\mswsus.exe
echo %systemroot%\system32\MSWTASK32.exe
echo %systemroot%\system32\mswupdate32.exe
echo %systemroot%\system32\msx64.exe
echo %systemroot%\system32\msxml71.dll
echo %systemroot%\system32\msxml9r.dll
echo %systemroot%\system32\msyahooaa.dll
echo %systemroot%\system32\msyahooeh.dll
echo %systemroot%\system32\msyahooah.dll
echo %systemroot%\system32\msyahooa1.dll
echo %systemroot%\system32\msyahooa2.dll
echo %systemroot%\system32\mt_32.dll
echo %systemroot%\system32\mtr2.exe
echo %systemroot%\system32\mtsdm.exe
echo %systemroot%\system32\mtserv.exe
echo %systemroot%\system32\mui\rasmvc.exe
echo %systemroot%\system32\multikz.exe
echo %systemroot%\system32\muose.exe
echo %systemroot%\system32\murka.dat
echo %systemroot%\system32\murtex.dll
echo %systemroot%\system32\muscira.dll
echo %systemroot%\system32\muslki.dll
echo %systemroot%\system32\mustafx.exe
echo %systemroot%\system32\mustafx2.exe
echo %systemroot%\system32\mvnesc.exe
echo %systemroot%\system32\mvx.dat
echo %systemroot%\system32\mwin32.exe
echo %systemroot%\system32\mxpsp.exe
echo %systemroot%\system32\mxs.exe
echo %systemroot%\system32\mybot.log
echo %systemroot%\system32\mybot.pid
echo %systemroot%\system32\mybot.state
echo %systemroot%\system32\mydata.txt
echo %systemroot%\system32\myfile.exe
echo %systemroot%\system32\mymsnusr.exe
echo %systemroot%\system32\my.pfx
echo %systemroot%\system32\Mysia.exe
echo %systemroot%\system32\mysidesearch_sidebar.dll
echo %systemroot%\system32\mysidesearch_sidebar_uninstall.exe
echo %systemroot%\system32\mysnlive.exe
echo %systemroot%\system32\mysqlwin32.exe
echo %systemroot%\system32\myss_sb.dll
echo %systemroot%\system32\myss_sb_uninstall.exe
echo %systemroot%\system32\mysvcc.exe
echo %systemroot%\system32\msyahooaa.dll
echo %systemroot%\system32\mywriter32.exe
echo %systemroot%\system32\mznmgr.exe
echo %systemroot%\system32\n.ini
echo %systemroot%\system32\n2.ini
echo %systemroot%\system32\namesver.dll
echo %systemroot%\system32\napi32.exe
echo %systemroot%\system32\narsvc.exe
echo %systemroot%\system32\natkssn.dll
echo %systemroot%\system32\nav32.exe
echo %systemroot%\system32\navscnr.exe
echo %systemroot%\system32\navsys.exe
echo %systemroot%\system32\nbdos.exe
echo %systemroot%\system32\nbthlp.exe
echo %systemroot%\system32\nbsystem.exe
echo %systemroot%\system32\ncntnkwd.exe
echo %systemroot%\system32\ncvs32.exe
echo %systemroot%\system32\ndetect.exe
echo %systemroot%\system32\NDISSck32.exe
echo %systemroot%\system32\ne.exe
echo %systemroot%\system32\NeroFil.EXE
echo %systemroot%\system32\nerofree.com
echo %systemroot%\system32\net32a.exe
echo %systemroot%\system32\net32b.exe
echo %systemroot%\system32\neta.exe
echo %systemroot%\system32\netapi.exe
echo %systemroot%\system32\netbeans.exe
echo %systemroot%\system32\netbios.exe
echo %systemroot%\system32\netbioy.exe
echo %systemroot%\system32\netcxcfm.exe
echo %systemroot%\system32\netd.dll
echo %systemroot%\system32\netddeclnt.exe
echo %systemroot%\system32\netddesrv.exe
echo %systemroot%\system32\netdll32.exe
echo %systemroot%\system32\netfix32.exe
echo %systemroot%\system32\netid.exe
echo %systemroot%\system32\Netlib.exe
echo %systemroot%\system32\netlib32.exe
echo %systemroot%\system32\netlprto.exe
echo %systemroot%\system32\Netmon.exe
echo %systemroot%\system32\netmonit.dll
echo %systemroot%\system32\netmsg.exe
echo %systemroot%\system32\netode.exe
echo %systemroot%\system32\netrap.exe
echo %systemroot%\system32\netscape.exe
echo %systemroot%\system32\netservs.exe
echo %systemroot%\system32\netshield.exe
echo %systemroot%\system32\netsrv.exe
echo %systemroot%\system32\netstat.com
echo %systemroot%\system32\netstat.dll
echo %systemroot%\system32\netsvc.exe
echo %systemroot%\system32\netthrot.exe
echo %systemroot%\system32\netupdate32.exe
echo %systemroot%\system32\netvhost.exe
echo %systemroot%\system32\network.exe
echo %systemroot%\system32\networknbh.exe
echo "%systemroot%\system32\Network DEE.exe"
echo %systemroot%\system32\NeUpgrade.exe
echo %systemroot%\system32\newdll.exe
echo %systemroot%\system32\newdll2.exe
echo %systemroot%\system32\news.gif
echo %systemroot%\system32\newsd32.exe
echo %systemroot%\system32\newsystem25.dll
echo %systemroot%\system32\ngpsvc.exe
echo %systemroot%\system32\ngrfn.exe
echo %systemroot%\system32\nhatquanglan20.exe
echo %systemroot%\system32\nhatquanglan11.exe
echo %systemroot%\system32\nHTMLn_2.95.dll
echo %systemroot%\system32\nice.exe
echo %systemroot%\system32\nicks.txt
echo %systemroot%\system32\ninsvc.exe
echo %systemroot%\system32\NiroFile.exe
echo %systemroot%\system32\NiroFilter.exe
echo %systemroot%\system32\nlc.exe
echo %systemroot%\system32\nlsmon.exe
echo %systemroot%\system32\NMBgMonitor.exe
echo %systemroot%\system32\nmvcs.exe
echo %systemroot%\system32\nncsvc.exe
echo %systemroot%\system32\nndsvc.exe
echo %systemroot%\system32\nod.exe
echo %systemroot%\system32\nod6.exe
echo %systemroot%\system32\nod23.exe
echo %systemroot%\system32\nod32.dll
echo %systemroot%\system32\nod32.exe
echo %systemroot%\system32\nod64.exe
echo %systemroot%\system32\nod6dr4.exe
echo %systemroot%\system32\nodd.exe
echo %systemroot%\system32\nodwr.exe
echo %systemroot%\system32\nokia32.dll
echo %systemroot%\system32\nokiacheck.exe
echo %systemroot%\system32\n0m.exe
echo %systemroot%\system32\Nobicyt.exe
echo %systemroot%\system32\nonmar32.dll
echo %systemroot%\system32\norantivirus.exe
echo %systemroot%\system32\nordsys.exe
echo %systemroot%\system32\nortn32.dll
echo %systemroot%\system32\norton.exe
echo %systemroot%\system32\Norton2005Update.exe
echo %systemroot%\system32\nortonav.dll
echo %systemroot%\system32\nortonav.exe
echo %systemroot%\system32\notepad32.exe
echo %systemroot%\system32\notice.dll
echo %systemroot%\system32\notiffy.dll
echo %systemroot%\system32\npcsvc.exe
echo %systemroot%\system32\npesvc.exe
echo %systemroot%\system32\NPFMONTR.exe
echo %systemroot%\system32\nppsvc.exe
echo %systemroot%\system32\npssvc.exe
echo %systemroot%\system32\nqdsregp.exe
echo %systemroot%\system32\ns.txt
echo %systemroot%\system32\NSecurity.exe
echo %systemroot%\system32\nservice.exe
echo %systemroot%\system32\nsmon.exe
echo %systemroot%\system32\nspsvc.exe
echo %systemroot%\system32\nsvce32.exe
echo %systemroot%\system32\ntapi.exe
echo %systemroot%\system32\ntcvx32.dll
echo %systemroot%\system32\ntdrv.exe
echo %systemroot%\system32\ntdvll
echo %systemroot%\system32\ntdvll.exe
echo %systemroot%\system32\nteusodp.exe
echo %systemroot%\system32\ntframe.exe
echo %systemroot%\system32\ntfscrypt.exe
echo %systemroot%\system32\ntfsdi.txt
echo %systemroot%\system32\ntfsloc.exe
echo %systemroot%\system32\ntld.bin
echo %systemroot%\system32\ntnut32.exe
echo %systemroot%\system32\ntoepad.exe
echo %systemroot%\system32\nton.exe
echo %systemroot%\system32\ntps.exe
echo %systemroot%\system32\ntsf.exe
echo %systemroot%\system32\NTSpool.dat
echo %systemroot%\system32\NTSpool.exe
echo %systemroot%\system32\ntss.exe
echo %systemroot%\system32\ntsvr.exe
echo %systemroot%\system32\ntsys32.exe
echo %systemroot%\system32\ntsystem.exe
echo %systemroot%\system32\ntswrl32.dll
echo %systemroot%\system32\ntupdsrv.exe
echo %systemroot%\system32\nuid1.dll
echo %systemroot%\system32\nundll32.exe
echo %systemroot%\system32\nusrmgr.exe
echo %systemroot%\system32\nSvcAppFilter.exe
echo %systemroot%\system32\nvidia.exe
echo %systemroot%\system32\nvidiav32.exe
echo %systemroot%\system32\Nvpss.exe
echo %systemroot%\system32\nvsc32.exe
echo %systemroot%\system32\nvsec.exe
echo %systemroot%\system32\nvsvc86.exe
echo %systemroot%\system32\nvsvcd.exe
echo %systemroot%\system32\nvsys32.exe
echo %systemroot%\system32\nvsys86.exe
echo %systemroot%\system32\nwcss32.exe
echo %systemroot%\system32\nwinmmdt.exe
echo %systemroot%\system32\NzILvzb679.ini
echo %systemroot%\system32\nzm.exe
echo %systemroot%\system32\nzm23.exe
echo %systemroot%\system32\o
echo %systemroot%\system32\o-o-b.exe
echo %systemroot%\system32\ocntnkdn.exe
echo %systemroot%\system32\ODBCJET.exe
echo %systemroot%\system32\odbcw_15.dll
echo %systemroot%\system32\oddysee.exe
echo %systemroot%\system32\Offlce.exe
echo %systemroot%\system32\offlog.txt
echo %systemroot%\system32\oins.exe
echo %systemroot%\system32\oirijshr.ini
echo %systemroot%\system32\oleauth32.dll
echo %systemroot%\system32\ongsvc.exe
echo %systemroot%\system32\oope\kmdmns2.exe
echo %systemroot%\system32\openglx.exe
echo %systemroot%\system32\openSSL32.exe
echo %systemroot%\system32\opera.exe
echo %systemroot%\system32\oriieke.ini
echo %systemroot%\system32\ortyeras.config
echo %systemroot%\system32\os.exe
echo %systemroot%\system32\osndyrn.exe
echo %systemroot%\system32\osskhbd.exe
echo %systemroot%\system32\other.txt
echo %systemroot%\system32\outlook.exe
echo %systemroot%\system32\outlookexpressupdate.exe
echo %systemroot%\system32\p2hhr.bat
echo %systemroot%\system32\p2pnetwork.exe
echo %systemroot%\system32\p2pnetworking.exe
echo %systemroot%\system32\paars.ini
echo %systemroot%\system32\pac.txt
echo %systemroot%\system32\pacoba.exe
echo %systemroot%\system32\pag.exe
echo %systemroot%\system32\paradise.dll
echo %systemroot%\system32\param32.txt
echo %systemroot%\system32\parety.dll
echo %systemroot%\system32\park31.dll
echo %systemroot%\system32\paruisd.dll
echo %systemroot%\system32\passport.gif
echo %systemroot%\system32\patch.exe
echo "%systemroot%\system32\patch camfrog5.0.exe"
echo %systemroot%\system32\pathname.dll
echo %systemroot%\system32\pathname.exe
echo %systemroot%\system32\pcedit.exe
echo %systemroot%\system32\pdate.exe
echo %systemroot%\system32\pdll.dll
echo %systemroot%\system32\pe2.exe
echo %systemroot%\system32\pecker.dll
echo %systemroot%\system32\peers.ini
echo %systemroot%\system32\perfs.txt
echo %systemroot%\system32\perfs.exe
echo %systemroot%\system32\perfz9368.dat
echo %systemroot%\system32\pernfmon.exe
echo %systemroot%\system32\pgql.exe
echo %systemroot%\system32\pgnmr.exe
echo %systemroot%\system32\pharma.txt
echo %systemroot%\system32\photoalbum.rar
echo %systemroot%\system32\photoalbum.zip
echo %systemroot%\system32\photos_syshosts.dll
echo %systemroot%\system32\pidfenon.dll
echo %systemroot%\system32\piji.exe
echo %systemroot%\system32\ping.com
echo %systemroot%\system32\pixman.exe
echo %systemroot%\system32\pk.bin
echo %systemroot%\system32\pkguard32.exe
echo %systemroot%\system32\pla.ax
echo %systemroot%\system32\plms.exe
echo %systemroot%\system32\plscd.exe
echo %systemroot%\system32\plsitctl.exe
echo %systemroot%\system32\plugin1.dat
echo %systemroot%\system32\plugor.dll
echo %systemroot%\system32\pmsvcr.exe
echo %systemroot%\system32\pns32.dll
echo %systemroot%\system32\poison.sys
echo %systemroot%\system32\polyair.exe
echo %systemroot%\system32\pontas.dll
echo %systemroot%\system32\poof
echo %systemroot%\system32\poolmc.exe
echo %systemroot%\system32\poolsc.exe
echo %systemroot%\system32\popmgr.exe
echo %systemroot%\system32\popspig
echo %systemroot%\system32\popupkill.exe
echo %systemroot%\system32\ppl.exe
echo %systemroot%\system32\ppnsvc.exe
echo %systemroot%\system32\ppret2.dll
echo %systemroot%\system32\pr\chkdsc23.exe
echo %systemroot%\system32\prcsvc.exe
echo %systemroot%\system32\prefinal.exe
echo %systemroot%\system32\prevx.exe
echo %systemroot%\system32\prinsvc.exe
echo %systemroot%\system32\printer.exe
echo %systemroot%\system32\printers.exe
echo %systemroot%\system32\ProAntiVirus.exe
echo %systemroot%\system32\procc32.exe
echo %systemroot%\system32\process32.exe
echo %systemroot%\system32\procins.dll
echo %systemroot%\system32\prodigy323.dll
echo %systemroot%\system32\prodigys323.dll
echo %systemroot%\system32\profile.exe
echo %systemroot%\system32\protect.dll
echo %systemroot%\system32\protector.exe
echo %systemroot%\system32\provsvc.exe
echo %systemroot%\system32\proxy.exe
echo %systemroot%\system32\proxysys.exe
echo %systemroot%\system32\prsvr.exe
echo %systemroot%\system32\pruas.exe
echo %systemroot%\system32\prxsmr.dll
echo %systemroot%\system32\ps.dat
echo %systemroot%\system32\ps.inf
echo %systemroot%\system32\ps1.dat
echo %systemroot%\system32\ps1.exe
echo %systemroot%\system32\psecure.exe
echo %systemroot%\system32\psof1.exe
echo %systemroot%\system32\psoft1.exe
echo %systemroot%\system32\psybnc321.exe
echo %systemroot%\system32\psycho.exe
echo %systemroot%\system32\psmcsh.exe
echo %systemroot%\system32\psncc32.exe
echo %systemroot%\system32\pstcp32.exe
echo %systemroot%\system32\psx.dll
echo %systemroot%\system32\psyBNC215.exe
echo %systemroot%\system32\psyche.exe
echo %systemroot%\system32\PsycheEnqueue.exe
echo %systemroot%\system32\ptco.dll
echo %systemroot%\system32\Px.ax
echo %systemroot%\system32\pxcrt.dll
echo %systemroot%\system32\putin1.dll
echo %systemroot%\system32\pvphost.exe
echo %systemroot%\system32\pwinsndt.exe
echo %systemroot%\system32\q24m.dll
echo %systemroot%\system32\q2d23we4m.dll
echo %systemroot%\system32\q333wrm.dll
echo %systemroot%\system32\Q8See.exe
echo %systemroot%\system32\qdfog.qov
echo %systemroot%\system32\qdfog.qov~
echo %systemroot%\system32\qmedia.exe
echo %systemroot%\system32\qmopt.dll
echo %systemroot%\system32\qtask.exe
echo %systemroot%\system32\qtplugin.exe
echo %systemroot%\system32\qttsk.exe
echo %systemroot%\system32\qualysguard.exe
echo %systemroot%\system32\qviexio3.dat
echo %systemroot%\system32\qwdsfref.dll
echo %systemroot%\system32\qwe123434.dll
echo %systemroot%\system32\qwert1.dll
echo %systemroot%\system32\qwerty12.exe
echo %systemroot%\system32\qwertybot.exe
echo %systemroot%\system32\qwesddddd.dll
echo %systemroot%\system32\qwinlmdq.exe
echo %systemroot%\system32\qwww1m.dll
echo %systemroot%\system32\R0chis.exe
echo %systemroot%\system32\r222fer34da2.dll
echo %systemroot%\system32\r223e.dll
echo %systemroot%\system32\RabioSetup.exe
echo %systemroot%\system32\radiek1.dll
echo %systemroot%\system32\radnom.exe
echo %systemroot%\system32\ra1.dll
echo %systemroot%\system32\ra21s1.dll
echo %systemroot%\system32\raboic.dll
echo %systemroot%\system32\rafba.dll
echo %systemroot%\system32\ramsfeld1.dll
echo %systemroot%\system32\ramtask.dll
echo %systemroot%\system32\ramtmb.dll
echo %systemroot%\system32\rasman32.exe
echo %systemroot%\system32\rasmoesa.dll
echo %systemroot%\system32\rasmvc.exe
echo %systemroot%\system32\rasqervy.dll
echo %systemroot%\system32\rastyu.dll
echo %systemroot%\system32\RatBot.exe
echo %systemroot%\system32\razeorc.dll
echo %systemroot%\system32\rBot.exe
echo %systemroot%\system32\rbsgam.dll
echo %systemroot%\system32\rbsgem.dll
echo %systemroot%\system32\rc.dat
echo %systemroot%\system32\rcacr.dll
echo %systemroot%\system32\rceewesdca1.dll
echo %systemroot%\system32\rcpdu.dll
echo %systemroot%\system32\rcsdca1.dll
echo %systemroot%\system32\rcsoft32.dll
echo %systemroot%\system32\rdfhost.dll
echo %systemroot%\system32\rdihost.dll
echo %systemroot%\system32\rdshost.dll
echo %systemroot%\system32\re_.dll
echo %systemroot%\system32\re4s.exe
echo %systemroot%\system32\read.exe
echo %systemroot%\system32\readysrv.exe
echo %systemroot%\system32\real.exe
echo %systemroot%\system32\real.txt
echo %systemroot%\system32\realaudio32.exe
echo %systemroot%\system32\RealPlay.exe
echo %systemroot%\system32\realplayer2.exe
echo %systemroot%\system32\Realtek.exe
echo %systemroot%\system32\RealtekAC.exe
echo %systemroot%\system32\Realteks.exe
echo %systemroot%\system32\reccon.dll
echo %systemroot%\system32\recsl.exe
echo %systemroot%\system32\recyclecl.exe
echo %systemroot%\system32\reg.reg
echo %systemroot%\system32\regadd.exe
echo %systemroot%\system32\regapi32.dll
echo %systemroot%\system32\regbase.bin
echo %systemroot%\system32\regc64.dll
echo %systemroot%\system32\regedit.com
echo %systemroot%\system32\regedit32.exe
echo %systemroot%\system32\reginv.dll
echo %systemroot%\system32\registry32.exe
echo %systemroot%\system32\regm64.dll
echo %systemroot%\system32\regscan.exe
echo %systemroot%\system32\regsvr.exe
echo %systemroot%\system32\REG1.exe
echo %systemroot%\system32\reg32.exe
echo %systemroot%\system32\regs32.exe
echo %systemroot%\system32\regserv.exe
echo %systemroot%\system32\regsrv.exe
echo %systemroot%\system32\regsvrs32.exe
echo %systemroot%\system32\Regsys.exe
echo %systemroot%\system32\relccxs.exe
echo %systemroot%\system32\rem.dll
echo %systemroot%\system32\remote.ini
echo %systemroot%\system32\remote.exe
echo %systemroot%\system32\remove_spyware_button.gif
echo %systemroot%\system32\repaired\svchost.bat
echo %systemroot%\system32\repl.dll
echo %systemroot%\system32\rerolpxei.dat
echo %systemroot%\system32\rerolpxei.le
echo %systemroot%\system32\resID\produtl481.exe
echo %systemroot%\system32\resmsvc.exe
echo %systemroot%\system32\resnm16
echo %systemroot%\system32\Resource\klog.dat
echo %systemroot%\system32\Resource\wblinds.exe
echo %systemroot%\system32\Resource\wga.exe
echo %systemroot%\system32\restorem.dll
echo %systemroot%\system32\resvs.exe
echo %systemroot%\system32\rewritex.dll
echo %systemroot%\system32\rgtndz.dll
echo %systemroot%\system32\rhdsa.exe
echo %systemroot%\system32\rhs.bin
echo %systemroot%\system32\Rhost32.exe
echo %systemroot%\system32\RichVideoCodec.dll
echo %systemroot%\system32\rightonadz-uninst.exe
echo %systemroot%\system32\rinsv.exe
echo %systemroot%\system32\riotz.exe
echo %systemroot%\system32\ritz8.dll
echo %systemroot%\system32\rkwnw64j.exe
echo %systemroot%\system32\rmasvc.exe
echo %systemroot%\system32\rmbsvc.exe
echo %systemroot%\system32\rmd.dll
echo %systemroot%\system32\rmsex.dll
echo %systemroot%\system32\rnsys.exe
echo %systemroot%\system32\roadmap16.dll 
echo %systemroot%\system32\romtmb.dll
echo %systemroot%\system32\root.pfx
echo %systemroot%\system32\rossix.dll
echo %systemroot%\system32\rotoon.dll
echo %systemroot%\system32\router.exe
echo %systemroot%\system32\routing.exe
echo %systemroot%\system32\rozmchild.dll
echo %systemroot%\system32\rp32.dll
echo %systemroot%\system32\rp8xrc.dat
echo %systemroot%\system32\rpcc.0ll
echo %systemroot%\system32\rpcc.dll
echo %systemroot%\system32\rpcc.exe
echo %systemroot%\system32\rpccd.dll
echo %systemroot%\system32\rpcclient.exe
echo %systemroot%\system32\rpclocator.exe
echo %systemroot%\system32\Rpcmon.exe
echo %systemroot%\system32\Rpcs.dll
echo %systemroot%\system32\Rpcs.exe
echo %systemroot%\system32\Rpcse.dll
echo %systemroot%\system32\Rpcse.exe
echo %systemroot%\system32\RpcSs.exe
echo %systemroot%\system32\RpcSss.dll
echo %systemroot%\system32\RpcSss.exe
echo %systemroot%\system32\Rpcsu.dll
echo %systemroot%\system32\Rpcsu.exe
echo %systemroot%\system32\rpcsvc.exe
echo %systemroot%\system32\Rpcsx.dll
echo %systemroot%\system32\Rpcsx.exe
echo %systemroot%\system32\rpgsvc.exe
echo %systemroot%\system32\rppcs.dll
echo %systemroot%\system32\rreesssvv.dll
echo %systemroot%\system32\rsbmsc.exe
echo %systemroot%\system32\rserv.exe
echo %systemroot%\system32\rsewwssewe_.dll
echo %systemroot%\system32\rsh.dll
echo %systemroot%\system32\rsssewe_.dll
echo %systemroot%\system32\rst.exe
echo %systemroot%\system32\rtc.dat
echo %systemroot%\system32\rtreywem.dll
echo %systemroot%\system32\rtsbsvc.exe
echo %systemroot%\system32\rtvcscan.exe
echo %systemroot%\system32\rtypiclor.dll
echo %systemroot%\system32\run32dll.exe
echo %systemroot%\system32\runapidll.exe
echo %systemroot%\system32\rs32net.exe
echo %systemroot%\system32\rsbmsc.exe
echo %systemroot%\system32\rserv.exe
echo %systemroot%\system32\rsewwssewe_.dll
echo %systemroot%\system32\rsssewe_.dll
echo %systemroot%\system32\rst.exe
echo %systemroot%\system32\rswsvc.exe
echo %systemroot%\system32\rt25.exe
echo %systemroot%\system32\rtreywem.dll
echo %systemroot%\system32\rtvcscan.exe
echo %systemroot%\system32\rtywem.dll
echo %systemroot%\system32\run.exe
echo %systemroot%\system32\run32dll.exe
echo %systemroot%\system32\runapidll.exe
echo %systemroot%\system32\rundII32
echo %systemroot%\system32\rundII32.exe
echo %systemroot%\system32\rundl32.exe
echo %systemroot%\system32\Rundl1.exe
echo %systemroot%\system32\rundll.exe
echo %systemroot%\system32\rundll32.dll
echo %systemroot%\system32\rundll64.exe
echo %systemroot%\system32\rundll128.exe
echo %systemroot%\system32\runjava.exe
echo %systemroot%\system32\RUNME.bat
echo %systemroot%\system32\runs.pif
echo %systemroot%\system32\runsvc.exe
echo %systemroot%\system32\runtime.exe
echo %systemroot%\system32\rvasvc.exe
echo %systemroot%\system32\RVHIOST.exe
echo %systemroot%\system32\Rvhost32.exe
echo %systemroot%\system32\rwera21s1.dll
echo %systemroot%\system32\rwosvc.exe
echo %systemroot%\system32\rwpsvc.exe
echo %systemroot%\system32\rwwnw64d.exe
echo %systemroot%\system32\rx.exe
echo %systemroot%\system32\rxbot2.exe
echo %systemroot%\system32\rxhost.exe
echo %systemroot%\system32\rxjddnvj.exe
echo %systemroot%\system32\s10506.exe
echo %systemroot%\system32\s1231sewe_.dll
echo %systemroot%\system32\s1df23e_.dll
echo %systemroot%\system32\s2.exe
echo %systemroot%\system32\s32.txt
echo %systemroot%\system32\S3R521.dll
echo %systemroot%\system32\sac32.dll
echo %systemroot%\system32\SADASDA.exe
echo %systemroot%\system32\safemode.exe
echo %systemroot%\system32\salvage.exe
echo %systemroot%\system32\sansv.exe
echo %systemroot%\system32\saqevre.exe
echo %systemroot%\system32\sarvice.exe
echo %systemroot%\system32\sasasas.exe
echo %systemroot%\system32\satfns.exe
echo %systemroot%\system32\sav.cpl
echo %systemroot%\system32\sbdhost.exe
echo %systemroot%\system32\SbiCvy.exe
echo %systemroot%\system32\sbmdl.dll
echo %systemroot%\system32\sbsm.exe
echo %systemroot%\system32\sbmntr.exe
echo %systemroot%\system32\sboot.exe
echo %systemroot%\system32\sbufke.dll
echo %systemroot%\system32\sbwltbxa.exe
echo %systemroot%\system32\sc2.dll
echo %systemroot%\system32\scacr.dll
echo %systemroot%\system32\scandskx.exe
echo %systemroot%\system32\scarddlg.dat
echo %systemroot%\system32\sccpn.exe
echo %systemroot%\system32\scekrnl.exe
echo %systemroot%\system32\scerpt.dll
echo %systemroot%\system32\scetim.dll
echo %systemroot%\system32\Scheduler.exe
echo %systemroot%\system32\schost.exe
echo %systemroot%\system32\scit.exe
echo %systemroot%\system32\scmhost.exe
echo %systemroot%\system32\scntqkdm.exe
echo %systemroot%\system32\scorti.exe
echo %systemroot%\system32\scrigz.exe
echo %systemroot%\system32\script.ini
echo %systemroot%\system32\scrgrd.exe
echo %systemroot%\system32\scrss.exe
echo %systemroot%\system32\scrtvc32.exe
echo %systemroot%\system32\scshost.exe
echo %systemroot%\system32\scsoft.exe
echo %systemroot%\system32\scui.cpl
echo %systemroot%\system32\scvhost
echo %systemroot%\system32\scvhost.exe
echo %systemroot%\system32\scvhost32.exe
echo %systemroot%\system32\scvhosting.exe
echo %systemroot%\system32\scvhosts.exe
echo %systemroot%\system32\scvhsot.exe
echo %systemroot%\system32\scvideo.exe
echo %systemroot%\system32\scvshosts.exe
echo %systemroot%\system32\scvvhost.exe
echo %systemroot%\system32\scvvhosthk.dll
echo %systemroot%\system32\scvvhostr.exe
echo %systemroot%\system32\scvvhostwb.dll
echo %systemroot%\system32\SCVVHSOT.exe
echo %systemroot%\system32\sdcom.exe
echo %systemroot%\system32\sddcss.exe
echo %systemroot%\system32\sdfinacs.dll
echo %systemroot%\system32\sdfixwcs.dll
echo %systemroot%\system32\SDK0mCORE.exe
echo %systemroot%\system32\sdktemp.exe
echo %systemroot%\system32\sdservss.exe
echo %systemroot%\system32\sdshost.exe
echo %systemroot%\system32\SDSEWEW.EXE
echo %systemroot%\system32\sdvlibswr.exe
echo %systemroot%\system32\se.exe
echo %systemroot%\system32\search.dll
echo %systemroot%\system32\search.css
echo %systemroot%\system32\sec.htm
echo %systemroot%\system32\seccent.exe
echo %systemroot%\system32\second_file.exe
echo %systemroot%\system32\secserver.exe
echo %systemroot%\system32\secservice.exe
echo %systemroot%\system32\secsvc.exe
echo %systemroot%\system32\SecSystem.exe
echo %systemroot%\system32\secure.exe
echo %systemroot%\system32\secure32.exe
echo %systemroot%\system32\securemon.exe
echo %systemroot%\system32\securesec.exe
echo %systemroot%\system32\securessl.exe
echo %systemroot%\system32\securesys.exe
echo %systemroot%\system32\Security.exe
echo %systemroot%\system32\secuity_center_logo.gif
echo %systemroot%\system32\securty22.exe
echo %systemroot%\system32\serial.txt
echo %systemroot%\system32\serial.exe
echo %systemroot%\system32\serious.exe
echo %systemroot%\system32\serv32.exe
echo %systemroot%\system32\serv454.exe
echo %systemroot%\system32\servcr.exe
echo %systemroot%\system32\server.dll
echo %systemroot%\system32\server.exe
echo %systemroot%\system32\server2.exe
echo %systemroot%\system32\servers.ini
echo %systemroot%\system32\serviccs.exe
echo %systemroot%\system32\service.exe
echo %systemroot%\system32\service1.dll
echo %systemroot%\system32\service32.dll
echo %systemroot%\system32\service32.exe
echo %systemroot%\system32\servicedll.exe
echo %systemroot%\system32\ServiceHost32.exe
echo %systemroot%\system32\servicemgrz.exe
echo %systemroot%\system32\servicemon.exe
echo %systemroot%\system32\servicemp.exe
echo %systemroot%\system32\Services\server.exe
echo %systemroot%\system32\servicess.exe
echo %systemroot%\system32\servicez.exe
echo %systemroot%\system32\servicz.exe
echo %systemroot%\system32\servl.dll
echo %systemroot%\system32\servl2.dll
echo %systemroot%\system32\servpanel.exe
echo %systemroot%\system32\servupdate.exe
echo %systemroot%\system32\sescmgr.exe
echo %systemroot%\system32\sess.exe
echo %systemroot%\system32\sesvc.exe
echo %systemroot%\system32\set32.dll
echo %systemroot%\system32\setting.ini
echo %systemroot%\system32\settings.dll
echo %systemroot%\system32\SetPoints.exe
echo %systemroot%\system32\Setup\install.dll
echo %systemroot%\system32\Setup\install.exe
echo %systemroot%\system32\Setup\setup.exe
echo %systemroot%\system32\Setup\setup.ico
echo %systemroot%\system32\SetupCmd.exe
echo %systemroot%\system32\setups.bak
echo %systemroot%\system32\sewins.exe
echo %systemroot%\system32\sexcam.exe
echo %systemroot%\system32\sfdhost.exe
echo %systemroot%\system32\sffer2222.dll
echo %systemroot%\system32\sfl.txt
echo %systemroot%\system32\sfmrr.r
echo %systemroot%\system32\sft.res
echo %systemroot%\system32\Sfwwin32.dll
echo %systemroot%\system32\sgvrfy32.exe
echo %systemroot%\system32\shchostv.exe
echo %systemroot%\system32\shdocpe.dll
echo %systemroot%\system32\shell31.dll
echo %systemroot%\system32\shell32.exe
echo %systemroot%\system32\shelldrv
echo %systemroot%\system32\shelldrv.exe
echo %systemroot%\system32\shellexp.exe
echo %systemroot%\system32\Shellexpl.exe
echo %systemroot%\system32\shellext\add.txt
echo %systemroot%\system32\shellext\aliases.ini
echo %systemroot%\system32\shellext\away.txt
echo %systemroot%\system32\shellext\channels.txt
echo %systemroot%\system32\shellext\conn.ini
echo %systemroot%\system32\shellext\control.ini
echo %systemroot%\system32\shellext\czvhost.exe
echo %systemroot%\system32\shellext\engine.ini
echo %systemroot%\system32\shellext\flood.txt
echo %systemroot%\system32\shellext\fullname.txt
echo %systemroot%\system32\shellext\greet.ini
echo %systemroot%\system32\shellext\ident.txt
echo %systemroot%\system32\shellext\injuraturi.txt
echo %systemroot%\system32\shellext\IRC.ICO
echo %systemroot%\system32\shellext\kick.txt
echo %systemroot%\system32\shellext\mirc.ini
echo %systemroot%\system32\shellext\nick.txt
echo %systemroot%\system32\shellext\operator.ini
echo %systemroot%\system32\shellext\partmsg.ini
echo %systemroot%\system32\shellext\perform.ini
echo %systemroot%\system32\shellext\remote.ini
echo %systemroot%\system32\shellext\scr.ini
echo %systemroot%\system32\shellext\servers.ini
echo %systemroot%\system32\shellext\updater.ini
echo %systemroot%\system32\shellsw.exe
echo %systemroot%\system32\shost.exe
echo %systemroot%\system32\shovth.exe
echo %systemroot%\system32\shrhost.exe
echo %systemroot%\system32\shwizard.exe
echo %systemroot%\system32\siemens32.dll
echo %systemroot%\system32\silesence.dll
echo %systemroot%\system32\simcard1.dll
echo %systemroot%\system32\sincim32.dll
echo %systemroot%\system32\SIPSPI32.dll
echo %systemroot%\system32\sisetup.exe
echo %systemroot%\system32\synstat.exe
echo %systemroot%\system32\sipov.dll
echo %systemroot%\system32\skfhost.exe
echo %systemroot%\system32\skiedx1.dll
echo %systemroot%\system32\sklh.dat
echo %systemroot%\system32\skna455101.exe
echo %systemroot%\system32\skrb32.dll
echo %systemroot%\system32\skuns.dat
echo %systemroot%\system32\skyp.exe
echo %systemroot%\system32\sleep32.dll
echo %systemroot%\system32\slrhost.exe
echo %systemroot%\system32\slrss.exe
echo %systemroot%\system32\slsass.exe
echo %systemroot%\system32\slvhost.exe
echo %systemroot%\system32\slwpi.dll
echo %systemroot%\system32\smb32.dll
echo %systemroot%\system32\smbvhost.exe
echo %systemroot%\system32\smcntlwio.exe
echo %systemroot%\system32\smcs.exe
echo %systemroot%\system32\smhost.exe
echo %systemroot%\system32\smp\msrc.exe
echo %systemroot%\system32\smrrs.exe
echo %systemroot%\system32\sms.exe
echo %systemroot%\system32\smsbvl32.exe
echo %systemroot%\system32\smsc.exe
echo %systemroot%\system32\smssb.exe
echo %systemroot%\system32\smss32.exe
echo %systemroot%\system32\smsss.exe
echo %systemroot%\system32\SmsSystem32.exe
echo %systemroot%\system32\smtp32.exe
echo %systemroot%\system32\smuhdd.dll
echo %systemroot%\system32\smmss.exe
echo %systemroot%\system32\smvhost.exe
echo %systemroot%\system32\smwin32.dll 
echo %systemroot%\system32\sn.txt
echo %systemroot%\system32\sncntr.exe
echo %systemroot%\system32\sndcfg16.exe
echo %systemroot%\system32\sndcom.dll
echo %systemroot%\system32\SndMAX.exe
echo %systemroot%\system32\sndvolumes.exe
echo %systemroot%\system32\snlogsvc.exe
echo %systemroot%\system32\sntsvc.exe
echo %systemroot%\system32\snvc.exe
echo %systemroot%\system32\so1.dll
echo %systemroot%\system32\sobicyt.exe
echo %systemroot%\system32\socketa.dll
echo %systemroot%\system32\sockins32.dll
echo %systemroot%\system32\sockots64.dll
echo %systemroot%\system32\socksys.dll
echo %systemroot%\system32\sockver1.dll
echo %systemroot%\system32\sockver2.dll
echo %systemroot%\system32\soem.dll
echo %systemroot%\system32\soert1.dll
echo %systemroot%\system32\soff.pif
echo %systemroot%\system32\sofork.dll
echo %systemroot%\system32\soft1.dll
echo %systemroot%\system32\software.inf
echo %systemroot%\system32\SoftwareUpdates.exe
echo %systemroot%\system32\soierw.dll
echo %systemroot%\system32\soinc.dll
echo %systemroot%\system32\soing1.dll
echo %systemroot%\system32\soirrd.dll
echo %systemroot%\system32\solhost.exe
echo %systemroot%\system32\somato.dll
echo %systemroot%\system32\somelot.dll
echo %systemroot%\system32\sony.exe
echo %systemroot%\system32\sooo2.exe
echo %systemroot%\system32\sooo3.exe
echo %systemroot%\system32\sores2.dll
echo %systemroot%\system32\soros11.dll
echo %systemroot%\system32\sorryfo1.dll
echo %systemroot%\system32\soscks32.exe
echo %systemroot%\system32\sounddrivers.exe
echo %systemroot%\system32\soundman.exe
echo %systemroot%\system32\soundvol32.exe
echo %systemroot%\system32\sours.dll
echo %systemroot%\system32\sox7.exe
echo %systemroot%\system32\sp2svc.exe
echo %systemroot%\system32\sp2vc.exe
echo %systemroot%\system32\spack2.exe
echo %systemroot%\system32\spc.pfx
echo %systemroot%\system32\spfhost.exe
echo %systemroot%\system32\SP00lSV.exe
echo %systemroot%\system32\spoo1sv.exe
echo %systemroot%\system32\spool11.exe
echo %systemroot%\system32\spool12.exe
echo %systemroot%\system32\spool13.exe
echo %systemroot%\system32\spool14.exe
echo %systemroot%\system32\spool15.exe
echo %systemroot%\system32\spool16.exe
echo %systemroot%\system32\spool17.exe
echo %systemroot%\system32\spool18.exe
echo %systemroot%\system32\spool19.exe
echo %systemroot%\system32\spool20.exe
echo %systemroot%\system32\spool21.exe
echo %systemroot%\system32\spool22.exe
echo %systemroot%\system32\spool23.exe
echo %systemroot%\system32\spool24.exe
echo %systemroot%\system32\spool25.exe
echo %systemroot%\system32\spool26.exe
echo %systemroot%\system32\spool27.exe
echo %systemroot%\system32\spool28.exe
echo %systemroot%\system32\spool29.exe
echo %systemroot%\system32\spool30.exe
echo %systemroot%\system32\spool87.exe
echo %systemroot%\system32\spooIsv.exe
echo %systemroot%\system32\spool\cmd.exe
echo %systemroot%\System32\spool\drivers\wmsncs.exe
echo %systemroot%\system32\spool\hpprintqueue.exe
echo %systemroot%\system32\spool\notepad.exe
echo %systemroot%\system32\spool.exe
echo %systemroot%\system32\spoolc.exe
echo %systemroot%\system32\spoolcs.exe
echo %systemroot%\system32\spoolcv.exe
echo %systemroot%\system32\spooldr.ini
echo %systemroot%\system32\spooldr.exe
echo %systemroot%\system32\spoolmon.dll
echo %systemroot%\system32\spoolnt.exe
echo %systemroot%\system32\spools.exe
echo %systemroot%\system32\spoolsac.exe
echo %systemroot%\system32\spoolsae.exe
echo %systemroot%\system32\spoolsc.exe
echo %systemroot%\system32\spoolsmc.exe
echo %systemroot%\system32\spoolsrv.exe
echo %systemroot%\system32\spoolsrvc.exe
echo %systemroot%\system32\spoolsvc.exe
echo %systemroot%\system32\spoolsvc32.exe
echo %systemroot%\system32\spoolsvv.exe
echo %systemroot%\system32\spoolvc.exe
echo %systemroot%\system32\spoolvs.exe
echo %systemroot%\system32\spoolvse.exe
echo %systemroot%\system32\spoolvvv.exe
echo %systemroot%\system32\spooslv.exe
echo %systemroot%\system32\spoovlss.exe
echo %systemroot%\system32\sps32.exe
echo %systemroot%\system32\spykiller.exe
echo %systemroot%\system32\spywarewarning.mht
echo %systemroot%\system32\spywarewarning2.mht
echo %systemroot%\system32\sqd.exe
echo %systemroot%\system32\sql.exe
echo %systemroot%\system32\sqla.dll
echo %systemroot%\system32\sqlcer.exe
echo %systemroot%\system32\sqlhandler.exe
echo %systemroot%\system32\sqlservice.exe
echo %systemroot%\system32\SrchBtn.gif
echo %systemroot%\system32\sres32.exe
echo %systemroot%\system32\srmhost.exe
echo %systemroot%\system32\srrvc.exe
echo %systemroot%\system32\srshost.exe
echo %systemroot%\system32\srshostu.exe
echo %systemroot%\system32\srsvc.exe
echo %systemroot%\system32\srv
echo %systemroot%\system32\srvc.dll
echo %systemroot%\system32\srvc.exe
echo %systemroot%\system32\srvcc.exe
echo %systemroot%\system32\srvchost.exe
echo %systemroot%\system32\srvd.exe
echo %systemroot%\system32\srvdc.exe
echo %systemroot%\system32\srvdll.exe
echo %systemroot%\system32\srvhost.exe
echo %systemroot%\system32\srwhost.exe
echo %systemroot%\system32\ssa.dll
echo %systemroot%\system32\ssc.exe
echo %systemroot%\system32\sscc.exe
echo %systemroot%\system32\sscs.exe
echo %systemroot%\system32\SSCVIHOST.exe
echo %systemroot%\system32\SSCVIIHOST.exe
echo %systemroot%\system32\sservice.exe
echo %systemroot%\system32\ssl.exe
echo %systemroot%\system32\sslcert.exe
echo %systemroot%\system32\sslms.exe
echo %systemroot%\system32\ssmc.exe
echo %systemroot%\system32\ssms.exe
echo %systemroot%\system32\ssmss.exe
echo %systemroot%\system32\ssockcpl.exe
echo %systemroot%\system32\ssopure.exe
echo %systemroot%\system32\ssrsc.exe
echo %systemroot%\system32\ssrvc.exe
echo %systemroot%\system32\ssurf022.dll
echo %systemroot%\system32\ssvchost.com
echo %systemroot%\system32\ssvchost.exe
echo %systemroot%\system32\SSVICHOSST.exe
echo %systemroot%\system32\ssvschost.sys
echo %systemroot%\system32\ssvsol.exe
echo %systemroot%\system32\ssvvcchhoosst.exe
echo %systemroot%\system32\ssymman.dll
echo %systemroot%\system32\ssyst3m32.exe
echo %systemroot%\system32\stani.dll
echo %systemroot%\system32\start0s.exe
echo %systemroot%\system32\start2.exe
echo %systemroot%\system32\start32.exe
echo %systemroot%\system32\stat.bin
echo %systemroot%\system32\stdafx.exe
echo %systemroot%\system32\stdhost.exe
echo %systemroot%\system32\steam.exe
echo %systemroot%\system32\sthosts.exe
echo %systemroot%\system32\stonedrv.exe
echo %systemroot%\system32\storeras.dat
echo %systemroot%\system32\strike12.dll
echo %systemroot%\system32\strike45.dll
echo %systemroot%\system32\Studio.exe
echo %systemroot%\system32\stylem1.dll
echo %systemroot%\system32\subset.exe
echo %systemroot%\system32\suchost.exe
echo %systemroot%\system32\sucker.exe
echo %systemroot%\system32\sulimo.dat
echo %systemroot%\system32\suns.dat
echo %systemroot%\system32\sup.bat
echo %systemroot%\system32\sup.reg
echo %systemroot%\system32\super.txt
echo %systemroot%\system32\superiorads-uninst.exe
echo %systemroot%\system32\supstar1.dll
echo %systemroot%\system32\surina.dll
echo %systemroot%\system32\susioe.dll
echo %systemroot%\system32\suspects.exe
echo %systemroot%\system32\suspend.exe
echo %systemroot%\system32\suvhost.exe
echo %systemroot%\system32\sv32.exe
echo %systemroot%\system32\svbhost.exe
echo %systemroot%\system32\svc32.dll
echo %systemroot%\system32\svc32.exe
echo %systemroot%\system32\svc332.dll
echo %systemroot%\system32\svcbrun.exe
echo %systemroot%\system32\svcbrunner.exe
echo %systemroot%\system32\svccert.exe
echo %systemroot%\system32\svcchost.exe
echo %systemroot%\system32\svcchosst.exe
echo %systemroot%\system32\svccv.exe
echo %systemroot%\system32\svcd\svchost.exe
echo %systemroot%\system32\svcdll.exe
echo %systemroot%\system32\svcdllhost.exe
echo %systemroot%\system32\svcdllhst.exe
echo %systemroot%\system32\svcguide.exe
echo %systemroot%\system32\svcguides.exe
echo %systemroot%\system32\svch.exe
echo %systemroot%\system32\svch0st.exe
echo %systemroot%\system32\svch6.exe
echo %systemroot%\system32\svchosi.exe
echo %systemroot%\system32\svchost.t__
echo %systemroot%\system32\svchost.tmp
echo %systemroot%\system32\svchest.exe
echo %systemroot%\system32\svchest.reg
echo %systemroot%\system32\svchost.dll
echo %systemroot%\system32\svchost2.exe
echo %systemroot%\system32\svchost32.exe
echo %systemroot%\system32\svchosting.exe
echo %systemroot%\system32\svchoes.exe
echo %systemroot%\system32\svchosl.exe
echo %systemroot%\system32\svchost2.exe
echo %systemroot%\system32\svchostp.exe
echo %systemroot%\system32\svchosts.exe
echo %systemroot%\system32\svchostt.exe
echo %systemroot%\system32\svchostt32.exe
echo %systemroot%\system32\svchostw.exe
echo %systemroot%\system32\svchostx.exe
echo %systemroot%\system32\svchozt.exe
echo %systemroot%\system32\SCVHSOT.exe
echo %systemroot%\system32\svchst.exe
echo %systemroot%\system32\svchxuf.exe
echo %systemroot%\system32\svcjog.exe
echo %systemroot%\system32\svcjogg.exe
echo %systemroot%\system32\svcjoger.exe
echo %systemroot%\system32\svcjogging.exe
echo %systemroot%\system32\svcjoging.exe
echo %systemroot%\system32\svclcheck.exe
echo %systemroot%\system32\svclogon.exe
echo %systemroot%\system32\svcmanager.exe
echo %systemroot%\system32\svcmgr32.exe
echo %systemroot%\system32\SvcNm
echo %systemroot%\system32\svcost.exe
echo %systemroot%\system32\svcosvt.exe
echo %systemroot%\system32\svcp.csv
echo %systemroot%\system32\svcroot.dll
echo %systemroot%\system32\svcroot.exe
echo %systemroot%\system32\svcshost.dll
echo %systemroot%\system32\svcshost.exe
echo %systemroot%\system32\svcsys.exe
echo %systemroot%\system32\svcthreading.exe
echo %systemroot%\system32\svcthreads.exe
echo %systemroot%\system32\svctowers.exe
echo %systemroot%\system32\svctowing.exe
echo %systemroot%\system32\svcupdcli.exe
echo %systemroot%\system32\svcvhost.exe
echo %systemroot%\system32\svcvlw32.exe
echo %systemroot%\system32\svcwin32.exe
echo %systemroot%\system32\svdhost.exe
echo %systemroot%\system32\svehost.exe
echo %systemroot%\system32\svghost.exe
echo %systemroot%\system32\svhcost.exe
echo %systemroot%\system32\svhda.exe
echo %systemroot%\system32\svhhda.exe
echo %systemroot%\system32\svhhost.exe
echo %systemroot%\system32\svho.exe
echo %systemroot%\system32\svhost.exe
echo %systemroot%\system32\svhost32.exe
echo %systemroot%\system32\svhosts.exe
echo %systemroot%\system32\svhostser.exe
echo %systemroot%\system32\svho0st98.exe
echo %systemroot%\system32\svhostes.exe
echo %systemroot%\system32\svhvchost.exe
echo %systemroot%\system32\SVICHHOST.exe
echo %systemroot%\system32\SVICHOOST.exe
echo %systemroot%\system32\svlhost.exe
echo %systemroot%\system32\svohost.exe
echo %systemroot%\system32\svmanager.exe
echo %systemroot%\system32\svmgr.exe
echo %systemroot%\system32\svmhost.exe
echo %systemroot%\system32\svmp.exe
echo %systemroot%\system32\svost.exe
echo %systemroot%\system32\svrhost.exe
echo %systemroot%\system32\svscache.exe
echo %systemroot%\system32\svscheld.exe
echo %systemroot%\system32\svschost.exe
echo %systemroot%\system32\svschost.sys
echo %systemroot%\system32\svshost.exe
echo %systemroot%\system32\svshost.exe~
echo %systemroot%\system32\svshost.dll
echo %systemroot%\system32\svshosts.exe
echo %systemroot%\system32\svsmanager.exe
echo %systemroot%\system32\svsnet.exe
echo %systemroot%\system32\svsnt.exe
echo %systemroot%\system32\svuhost.exe
echo %systemroot%\system32\svxhost.exe
echo %systemroot%\system32\swin32.dll
echo %systemroot%\system32\swchost.exe
echo %systemroot%\system32\swphost.exe
echo %systemroot%\system32\sxe.exe
echo %systemroot%\system32\sxes.exe
echo %systemroot%\system32\sxmg4.dll
echo %systemroot%\system32\sxml.exe
echo %systemroot%\system32\sychost.exe
echo %systemroot%\system32\SyGate.exe
echo %systemroot%\system32\syiuv.exe
echo %systemroot%\system32\symantec32.exe
echo %systemroot%\system32\Symantex.exe
echo %systemroot%\system32\symbootcfg.exe
echo %systemroot%\system32\symclient.exe
echo %systemroot%\system32\symclisvc.exe
echo %systemroot%\system32\symconfig.exe
echo %systemroot%\system32\symlcserv.exe
echo %systemroot%\system32\symdb32.dll
echo %systemroot%\system32\symdbsvr.exe
echo %systemroot%\system32\symdebugs.exe
echo %systemroot%\system32\symlasvc.exe
echo %systemroot%\system32\symldsm.exe
echo %systemroot%\system32\symlcsrv.exe
echo %systemroot%\system32\symldsv.exe
echo %systemroot%\system32\symldvc.exe
echo %systemroot%\system32\symldvd.exe
echo %systemroot%\system32\symloadcfg.exe
echo %systemroot%\system32\symlserv.exe
echo %systemroot%\system32\symlsma.exe
echo %systemroot%\system32\symlsmc.exe
echo %systemroot%\system32\symlsmd.exe
echo %systemroot%\system32\symlsmr.exe
echo %systemroot%\system32\symlsnreg.exe
echo %systemroot%\system32\symlsrc.exe
echo %systemroot%\system32\symlsrd.exe
echo %systemroot%\system32\symlsrp.exe
echo %systemroot%\system32\symlsrv.exe
echo %systemroot%\system32\symlsrw.exe
echo %systemroot%\system32\symlsrx.exe
echo %systemroot%\system32\symlssdb.exe
echo %systemroot%\system32\symlssdr.exe
echo %systemroot%\system32\symlssm.exe
echo %systemroot%\system32\symon.exe
echo %systemroot%\system32\symmec.exe
echo %systemroot%\system32\symsnreg.exe
echo %systemroot%\system32\syncinups.exe
echo %systemroot%\system32\synet-ud.exe
echo %systemroot%\system32\sys.bat
echo %systemroot%\system32\sys.dat
echo %systemroot%\system32\sys.exe
echo %systemroot%\system32\sys.ini
echo %systemroot%\system32\sys_32.dll
echo %systemroot%\system32\sys_2.dll
echo %systemroot%\system32\sys21.exe
echo %systemroot%\system32\sys32.exe
echo %systemroot%\system32\sys57.exe
echo %systemroot%\system32\sysamp.exe
echo %systemroot%\system32\sysatw.exe
echo %systemroot%\system32\sysays.exe
echo %systemroot%\system32\sysbase32.dll
echo %systemroot%\system32\sysbrw32.exe
echo %systemroot%\system32\syscfg32.exe
echo %systemroot%\system32\syscgboot.exe
echo %systemroot%\system32\syscgmgr.exe
echo %systemroot%\system32\syschk.exe
echo %systemroot%\system32\syscontrl.exe
echo %systemroot%\system32\syscorehd.exe
echo %systemroot%\system32\syscoremem.exe
echo %systemroot%\system32\Sysctrls.exe
echo %systemroot%\system32\syscv.exe
echo %systemroot%\system32\SysCVMS.exe
echo %systemroot%\system32\syscxd32.exe
echo %systemroot%\system32\sysdaemon.exe
echo %systemroot%\system32\sysdbmg.exe
echo %systemroot%\system32\sysdbroot.exe
echo %systemroot%\system32\sysdevice.exe
echo %systemroot%\system32\SysDrefIWv2.exe
echo %systemroot%\system32\sysdriver.exe
echo %systemroot%\system32\sysdtc32.exe
echo %systemroot%\system32\sysecurex.exe
echo %systemroot%\system32\sysem.exe
echo %systemroot%\system32\sysems.exe
echo %systemroot%\system32\Sysexplr.exe
echo %systemroot%\system32\sysfldr.dll
echo %systemroot%\system32\syshost.exe
echo %systemroot%\system32\syshelps.dll
echo %systemroot%\system32\syshosts.dll
echo %systemroot%\system32\sysinfo.exe
echo %systemroot%\system32\sysingB32.dll
echo %systemroot%\system32\sysintmemory.exe
echo %systemroot%\system32\sysl.exe
echo %systemroot%\system32\sysldr32.exe
echo %systemroot%\system32\syslinks2.dll
echo %systemroot%\system32\sysloadcnf.exe
echo %systemroot%\system32\syslodr.exe
echo %systemroot%\system32\sysm\smssm.exe
echo %systemroot%\system32\sysman.exe
echo %systemroot%\system32\sysmem.exe
echo %systemroot%\system32\SysMgr.exe
echo %systemroot%\system32\sysmngr.exe
echo %systemroot%\system32\sysmon.exe
echo %systemroot%\system32\sysmon32.exe
echo %systemroot%\system32\sysmsgr32.exe
echo %systemroot%\system32\sysmsn.exe
echo %systemroot%\system32\sysmsvc.exe
echo %systemroot%\system32\sysmu_Hook.dll
echo %systemroot%\system32\sysmu.dll
echo %systemroot%\system32\sysmu.exe
echo %systemroot%\system32\syspoint.dll
echo %systemroot%\system32\syspoints.dll
echo %systemroot%\system32\syspools.exe
echo %systemroot%\system32\SysPr.prx
echo %systemroot%\system32\sysprinters.dll
echo %systemroot%\system32\sysrcvr246.dll
echo %systemroot%\system32\sysregi.exe
echo %systemroot%\system32\sysrest32.exe
echo %systemroot%\system32\sysrestore32.exe
echo %systemroot%\system32\sysretain.exe
echo %systemroot%\system32\sysrgmgr.exe
echo %systemroot%\system32\SYSrowdl32.exe
echo %systemroot%\system32\sysservice.dll
echo %systemroot%\system32\sysservice.exe
echo %systemroot%\system32\syssinfos.exe
echo %systemroot%\system32\syssrv.exe
echo %systemroot%\system32\syssrv.sys
echo %systemroot%\system32\syssv.exe
echo %systemroot%\system32\sysreg11.exe
echo %systemroot%\system32\sysreq.exe
echo %systemroot%\system32\Syst3m32.exe
echo %systemroot%\system32\syst3ms.exe
echo %systemroot%\system32\systcontrl.exe
echo %systemroot%\system32\systcntl.exe
echo %systemroot%\system32\system.exe
echo %systemroot%\system32\system12.exe
echo %systemroot%\system32\system32.dll
echo %systemroot%\system32\system32.exe
echo %systemroot%\system32\system33.exe
echo %systemroot%\system32\system34.exe
echo %systemroot%\system32\system43.exe
echo %systemroot%\system32\system52.exe
echo %systemroot%\system32\systemc.dll
echo %systemroot%\system32\systemac.dll
echo %systemroot%\system32\systembin.exe
echo %systemroot%\system32\systemcntl.exe
echo "%systemroot%\system32\System Conf\klog.dat"
echo "%systemroot%\system32\System Conf\loadwindows.exe"
echo %systemroot%\system32\systemdv.exe
echo %systemroot%\system32\systemdtm.exe
echo %systemroot%\system32\Systemfiles\klog.dat
echo %systemroot%\system32\Systemfiles\taskmgr.exe
echo %systemroot%\system32\systemi.exe
echo %systemroot%\system32\systeminit.exe
echo %systemroot%\system32\systemip.exe
echo %systemroot%\system32\systemKey.DLL
echo %systemroot%\system32\systemos.exe
echo %systemroot%\system32\systempre.exe
echo %systemroot%\system32\systems
echo %systemroot%\system32\systems.exe
echo %systemroot%\system32\systems_.exe
echo %systemroot%\system32\systemx32.exe
echo %systemroot%\system32\systemxp.exe
echo %systemroot%\system32\systemw32.exe
echo %systemroot%\system32\systen32.exe
echo %systemroot%\system32\systerm.exe
echo %systemroot%\system32\systern.exe
echo %systemroot%\system32\systesrt32.dll
echo %systemroot%\system32\systime.exe
echo %systemroot%\system32\systr.exe
echo %systemroot%\system32\systrays.exe
echo %systemroot%\system32\systs.exe
echo %systemroot%\system32\systs.exe~
echo %systemroot%\system32\SysUpdate.exe
echo %systemroot%\system32\sysvers.exe
echo %systemroot%\system32\sysviews.dll
echo %systemroot%\system32\sysvx.exe
echo %systemroot%\system32\sysw.dll
echo %systemroot%\system32\sysw1.dll
echo %systemroot%\system32\syswin32.exe
echo %systemroot%\system32\sytray.exe
echo %systemroot%\system32\szsvc.exe
echo %systemroot%\system32\t3st.bmp
echo %systemroot%\system32\taack.dat
echo %systemroot%\system32\taack.exe
echo %systemroot%\system32\taksmanager.exe
echo %systemroot%\system32\taksmrg.exe
echo %systemroot%\system32\Tapi32init.exe
echo %systemroot%\system32\tar.exe
echo %systemroot%\system32\tardeme2.dll
echo %systemroot%\system32\tardm2.dll
echo %systemroot%\system32\targetedbanner-uninst.exe
echo %systemroot%\system32\tasgmger.exe
echo %systemroot%\system32\Task.exe
echo %systemroot%\system32\taskbar.exe
echo %systemroot%\system32\taskdir.dll
echo %systemroot%\system32\taskdir.exe
echo %systemroot%\system32\taskdir~.exe
echo %systemroot%\system32\taskdll32.exe
echo %systemroot%\system32\taskdrv32.exe
echo %systemroot%\system32\taskgmgr.exe
echo %systemroot%\system32\taskgmr.exe
echo %systemroot%\system32\taskkill.com
echo %systemroot%\system32\taskldr.exe
echo %systemroot%\system32\tasklist.com
echo %systemroot%\system32\taskmanager.exe
echo %systemroot%\system32\taskmaneger.exe
echo %systemroot%\system32\taskmang.exe
echo %systemroot%\system32\taskmangr.exe
echo %systemroot%\system32\taskmegr.exe
echo %systemroot%\system32\taskmg.exe
echo %systemroot%\system32\taskmgn.exe
echo %systemroot%\system32\taskmgr1.exe
echo %systemroot%\system32\taskmgr2.exe
echo %systemroot%\system32\taskmgr32.exe
echo %systemroot%\system32\taskmgrkip.exe
echo %systemroot%\system32\taskmnegr.exe
echo %systemroot%\system32\taskmng.exe
echo %systemroot%\system32\taskmngr.exe
echo %systemroot%\system32\taskmngr32.exe
echo %systemroot%\system32\taskmqr.exe
echo %systemroot%\system32\taskmqrs.exe
echo %systemroot%\system32\taskmrg.exe
echo %systemroot%\system32\taskngr.exe
echo %systemroot%\system32\taskrg.exe
echo %systemroot%\system32\tasmgr.exe
echo %systemroot%\system32\tb.dr
echo %systemroot%\system32\tccpip.exe
echo %systemroot%\system32\tconn1.dll
echo %systemroot%\system32\tcpip.exe
echo %systemroot%\system32\tcpipmon.exe
echo %systemroot%\system32\tcprp.dll
echo %systemroot%\system32\tcpxp.exe
echo %systemroot%\system32\tdxdowkc.exe
echo %systemroot%\system32\te.dat
echo %systemroot%\system32\Tecompntwx.exe
echo %systemroot%\system32\tehyrd12.dll
echo %systemroot%\system32\telcoms.exe
echo %systemroot%\system32\telecomes.exe
echo %systemroot%\system32\temp.exe
echo %systemroot%\system32\temp#01.exe
echo %systemroot%\system32\tempes.exe
echo %systemroot%\system32\tempfn.dll
echo %systemroot%\system32\terminals.exe
echo %systemroot%\system32\termsv.exe
echo %systemroot%\system32\tesit.exe
echo %systemroot%\system32\test2.exe
echo %systemroot%\system32\teste.exe
echo %systemroot%\system32\testtestt.exe
echo %systemroot%\system32\tfn0ne.exe
echo %systemroot%\system32\tgs.dll
echo %systemroot%\system32\TH.exe
echo %systemroot%\system32\thsml.exe
echo %systemroot%\system32\thun.dll
echo %systemroot%\system32\thun32.dll
echo %systemroot%\system32\Tilecom32.com
echo %systemroot%\system32\Tilecomfc.com
echo %systemroot%\system32\Tilecomfree.com
echo %systemroot%\system32\Tilecomgm.com
echo %systemroot%\system32\Tilecomnu.com
echo %systemroot%\system32\Tilecomten.com
echo %systemroot%\system32\Tilecomtop.com
echo %systemroot%\system32\Tilecomwar.com
echo %systemroot%\system32\Tilehome.com
echo %systemroot%\system32\Tilesoft.com
echo %systemroot%\system32\Tilesys.com
echo %systemroot%\system32\timeapr32.exe
echo %systemroot%\system32\tinox1.dll
echo %systemroot%\system32\titos.dll
echo %systemroot%\system32\tkcom32.dll
echo %systemroot%\system32\tl.exe
echo %systemroot%\system32\tlhelp32.dll
echo %systemroot%\system32\tlove2.dll
echo %systemroot%\system32\tmp.dat
echo %systemroot%\system32\tmp.exe
echo %systemroot%\system32\TmpX.exe
echo %systemroot%\system32\tns.dll
echo %systemroot%\system32\tns1.dll
echo %systemroot%\system32\tochss.dll
echo %systemroot%\system32\toolbar_bg.gif
echo %systemroot%\system32\toolbar_corner_left.gif
echo %systemroot%\system32\toolbar_corner_right.gif
echo %systemroot%\system32\torm.dll
echo %systemroot%\system32\torm1.dll
echo %systemroot%\system32\torrent.exe
echo %systemroot%\system32\torsion23.exe
echo %systemroot%\system32\totour.exe
echo %systemroot%\system32\tourstart.dll
echo %systemroot%\system32\tqurity.exe
echo %systemroot%\system32\tracert.com
echo %systemroot%\system32\traysys.exe
echo %systemroot%\system32\tremir.bin
echo %systemroot%\system32\trident.dll
echo %systemroot%\system32\trmupdate.exe
echo %systemroot%\system32\troj.cfg
echo %systemroot%\system32\truetype.exe
echo %systemroot%\system32\tsklist32.exe
echo %systemroot%\system32\tskman3.exe
echo %systemroot%\system32\tskmgr.exe
echo %systemroot%\system32\tskmngr.exe
echo %systemroot%\system32\tskscd.exe
echo %systemroot%\system32\tsstop.exe
echo %systemroot%\system32\ttlms.exe
echo %systemroot%\system32\Ttt.exe
echo %systemroot%\system32\tvctray.exe
echo %systemroot%\system32\tvumbal.dll
echo %systemroot%\system32\txkernel.exe
echo %systemroot%\system32\uagen.sys
echo %systemroot%\system32\ubpr01.exe
echo %systemroot%\system32\ucmd.exe
echo %systemroot%\system32\udate32.exe
echo %systemroot%\system32\udzou.exe
echo %systemroot%\system32\uient.exe
echo %systemroot%\system32\un1x.exe
echo %systemroot%\system32\unifff.dll
echo %systemroot%\system32\unqgod.exe
echo %systemroot%\system32\unsvchosts.exe
echo %systemroot%\system32\unsvchosts.lzma
echo %systemroot%\system32\uoyzsydz.exe
echo %systemroot%\system32\update.exe
echo %systemroot%\system32\update0.exe
echo %systemroot%\system32\update1.exe
echo %systemroot%\system32\update2.exe
echo %systemroot%\system32\update3.exe
echo %systemroot%\system32\update4.exe
echo %systemroot%\system32\update5.exe
echo %systemroot%\system32\update6.exe
echo %systemroot%\system32\update7.exe
echo %systemroot%\system32\update8.exe
echo %systemroot%\system32\update9.exe
echo %systemroot%\system32\update.pif
echo %systemroot%\system32\update32.exe
echo %systemroot%\system32\update32.exe.tmp
echo %systemroot%\system32\updatees.exe
echo %systemroot%\system32\updatemgr.exe
echo %systemroot%\system32\updater.exe
echo %systemroot%\system32\updaterar.exe
echo %systemroot%\system32\updaterarwin.exe
echo %systemroot%\system32\updates.exe
echo %systemroot%\system32\updclient.exe
echo %systemroot%\system32\updrvs.exe
echo %systemroot%\system32\upds.exe
echo %systemroot%\system32\upds.log
echo %systemroot%\system32\updt.exe
echo %systemroot%\system32\UPMSN.exe
echo %systemroot%\system32\upnp.exe
echo %systemroot%\system32\upnphelp.exe
echo %systemroot%\system32\upsctl.dll
echo %systemroot%\system32\uptask.exe
echo %systemroot%\system32\urdvxc.exe
echo %systemroot%\system32\url1
echo %systemroot%\system32\url2
echo %systemroot%\system32\url3
echo %systemroot%\system32\urlbase.bin
echo %systemroot%\system32\usb2ctrl.exe
echo %systemroot%\system32\USBhardware327.exe
echo %systemroot%\system32\usbpda.dll
echo %systemroot%\system32\USBS.exe
echo %systemroot%\system32\usbserver.exe
echo %systemroot%\system32\user10.exe
echo %systemroot%\system32\user32.dat
echo %systemroot%\system32\user32.exe
echo %systemroot%\system32\users.ini
echo %systemroot%\system32\users32.dat
echo %systemroot%\system32\users64.da_
echo %systemroot%\system32\users64.dat
echo %systemroot%\system32\univrs32.dat
echo %systemroot%\system32\userspi.dll
echo %systemroot%\system32\usndebug.exe
echo %systemroot%\system32\usnhost.exe
echo %systemroot%\system32\usnmsgr.exe
echo %systemroot%\system32\usnmsgs.exe
echo %systemroot%\system32\usnmsn.exe
echo %systemroot%\system32\usnserv.exe
echo %systemroot%\system32\usnshare.exe
echo %systemroot%\system32\usnsharen.exe
echo %systemroot%\system32\usnsrv.exe
echo %systemroot%\system32\usnsrvc.exe
echo %systemroot%\system32\usnsvcs.exe
echo %systemroot%\system32\usr64.dll
echo %systemroot%\system32\usrlink.dll
echo %systemroot%\system32\usrmsg.exe
echo %systemroot%\system32\usrserv.exe
echo %systemroot%\system32\usrshare.exe
echo %systemroot%\system32\usvr\usvr32.dat
echo %systemroot%\system32\usvr\usvr32.exe
echo %systemroot%\system32\utorrent.exe
echo %systemroot%\system32\uvcx.exe
echo %systemroot%\system32\uvnx.exe
echo %systemroot%\system32\v1rg1n
echo %systemroot%\system32\v6.exe
echo %systemroot%\system32\v6msn.exe
echo %systemroot%\system32\v7.exe
echo %systemroot%\system32\vapsvc.exe
echo %systemroot%\system32\ValueSoft.exe
echo %systemroot%\system32\vav.cpl
echo %systemroot%\system32\vb.exe
echo %systemroot%\system32\vbcsvc.exe
echo %systemroot%\system32\vbdsvc.exe
echo %systemroot%\system32\VBIEWER.OCX
echo %systemroot%\system32\vbmsvc.exe
echo %systemroot%\system32\vbsys2.dll
echo %systemroot%\system32\vc.exe
echo %systemroot%\system32\vcatchpi.dll
echo %systemroot%\system32\vcmon.exe
echo %systemroot%\system32\vcodec.exe
echo %systemroot%\system32\vcshost.exe
echo %systemroot%\system32\verifier32list.cpl
echo %systemroot%\system32\veritas.exe
echo %systemroot%\system32\verticals.exe
echo %systemroot%\system32\vga32.exe
echo %systemroot%\system32\vhosts.exe
echo %systemroot%\system32\via.exe
echo %systemroot%\system32\viddriver.exe
echo %systemroot%\system32\Video.exe
echo %systemroot%\system32\video.rar
echo %systemroot%\system32\video.zip
echo %systemroot%\system32\video_32sD.exe
echo %systemroot%\system32\viewmon.exe
echo %systemroot%\system32\vig.exe
echo %systemroot%\system32\vistaupgrade.exe
echo %systemroot%\system32\viwsvc.exe
echo %systemroot%\system32\vmddnst.exe
echo %systemroot%\system32\vmdriver.exe
echo %systemroot%\system32\vmmon32.exe
echo %systemroot%\system32\vmst32.exe
echo %systemroot%\system32\vnc.exe
echo %systemroot%\system32\vpms.exe
echo %systemroot%\system32\vpnsvc.exe
echo %systemroot%\system32\vr32.exe
echo %systemroot%\system32\vservice32.exe
echo %systemroot%\system32\vsp32.exe
echo %systemroot%\system32\vspell.exe
echo %systemroot%\system32\vssms32.exe
echo %systemroot%\system32\vtr.dll
echo %systemroot%\system32\vv815.exe
echo %systemroot%\system32\vwservice.exe
echo %systemroot%\system32\vwsrv.exe
echo %systemroot%\system32\vx.tll
echo %systemroot%\system32\vxaudio.exe
echo %systemroot%\system32\vxddsk.exe
echo %systemroot%\system32\w1m.dll
echo %systemroot%\system32\w32_mjd.dll
echo %systemroot%\system32\w332er2tm.dll
echo %systemroot%\system32\w32drv0.exe
echo %systemroot%\system32\w32drv1.exe
echo %systemroot%\system32\w32drv2.exe
echo %systemroot%\system32\w32drv3.exe
echo %systemroot%\system32\w32drv4.exe
echo %systemroot%\system32\w32mvs.exe
echo %systemroot%\system32\w32usb2.exe
echo %systemroot%\system32\w33s.exe
echo %systemroot%\system32\wadinst.sys
echo %systemroot%\system32\WAed.pif
echo %systemroot%\system32\waes.exe
echo %systemroot%\system32\wafps.exe
echo %systemroot%\system32\wagfxds.exe
echo %systemroot%\system32\wandrv.exe
echo %systemroot%\system32\wangard.exe
echo %systemroot%\system32\wanman.exe
echo %systemroot%\system32\warn.htm
echo %systemroot%\system32\Wasted_Years.exe
echo %systemroot%\system32\wauclt.exe
echo %systemroot%\system32\waucult.exe
echo %systemroot%\system32\waumgr.exe
echo %systemroot%\system32\WAV.cpl
echo %systemroot%\system32\waverevenue.exe
echo %systemroot%\system32\wbcmgr.exe
echo %systemroot%\system32\wbcsvc.exe
echo %systemroot%\system32\wbem\msinfo.exe
echo %systemroot%\system32\wbem\scrcons32.exe
echo %systemroot%\system32\wbem\scricon.exe
echo %systemroot%\system32\wbem\unsec.exe
echo %systemroot%\system32\wbem\unsecapp32.exe
echo %systemroot%\system32\wbem\wbemstest.exe
echo %systemroot%\system32\wbem\winscrvs.exe
echo %systemroot%\system32\wcamfrog.exe
echo %systemroot%\system32\wcescom32.exe
echo %systemroot%\system32\wclis.exe
echo %systemroot%\system32\wcnsvc.exe
echo %systemroot%\system32\wcsntfy.exe
echo %systemroot%\system32\wdcs.exe
echo %systemroot%\system32\wdfmgr32.exe
echo %systemroot%\system32\wdlrss.exe
echo %systemroot%\system32\wdtsvc.exe
echo %systemroot%\system32\we1r32tm.dll
echo %systemroot%\system32\we33tde1.dll
echo %systemroot%\system32\we4454rer.dll
echo %systemroot%\system32\web.dat
echo %systemroot%\system32\web.gif
echo %systemroot%\system32\webcp.exe
echo %systemroot%\system32\webcp32.exe
echo %systemroot%\system32\webmsn.exe
echo %systemroot%\system32\websploit.exe
echo %systemroot%\system32\wecsvc.exe
echo %systemroot%\system32\wees.exe
echo %systemroot%\system32\wekls4.exe
echo %systemroot%\system32\wem.dll
echo %systemroot%\system32\weq24m.dll
echo %systemroot%\system32\wer2tm.dll
echo %systemroot%\system32\WER8274.DLL
echo %systemroot%\system32\wetde1.dll
echo %systemroot%\system32\wfsup.exe
echo %systemroot%\system32\wfsvc.exe
echo %systemroot%\system32\wftpd32.exe
echo %systemroot%\system32\wfvs.exe
echo %systemroot%\system32\wfxmgr.exe
echo %systemroot%\system32\wgareg.exe
echo %systemroot%\system32\wgavm.exe
echo %systemroot%\system32\wgavn.exe
echo %systemroot%\system32\wgeax.exe
echo %systemroot%\system32\wgl23.exe
echo %systemroot%\system32\whcstd32.dll
echo %systemroot%\system32\whitevx.lst
echo %systemroot%\system32\whob.sys
echo %systemroot%\system32\whof.sys
echo %systemroot%\system32\whoh.sys
echo %systemroot%\system32\why-.exe
echo %systemroot%\system32\widows.exe
echo %systemroot%\system32\wifiboot.exe
echo %systemroot%\system32\wifibooter.exe
echo %systemroot%\system32\wificon.exe
echo %systemroot%\system32\wificonfig.exe
echo %systemroot%\system32\wificonfigs.exe
echo %systemroot%\system32\wificonnect.exe
echo %systemroot%\system32\wifidebug.exe
echo %systemroot%\system32\wifiload.exe
echo %systemroot%\system32\wifiloader.exe
echo %systemroot%\system32\wifisetup.exe
echo %systemroot%\system32\win\klog.dat
echo %systemroot%\system32\win\svchost.exe
echo "%systemroot%\system32\Win XP.exe"
echo %systemroot%\system32\win.ini.t00
echo %systemroot%\system32\win.exe
echo %systemroot%\system32\win_update.exe
echo %systemroot%\system32\win23.exe
echo %systemroot%\system32\win31243.exe
echo %systemroot%\system32\win32\klog.dat
echo %systemroot%\system32\win32\update.exe
echo %systemroot%\system32\win32GI\klog.dat
echo %systemroot%\system32\win32GI\svchost.exe
echo %systemroot%\system32\win32.bat
echo %systemroot%\system32\win32.dll
echo %systemroot%\system32\win32.exe
echo %systemroot%\system32\win32bootcfg.exe
echo %systemroot%\system32\win32conf.exe
echo %systemroot%\system32\win32dll.exe
echo %systemroot%\system32\win32help.exe
echo %systemroot%\system32\win32sp.exe
echo %systemroot%\system32\win32sys.exe
echo %systemroot%\system32\win32ttb.exe
echo %systemroot%\system32\Win32Update.exe
echo %systemroot%\system32\win32wins.exe
echo %systemroot%\system32\win442.dll
echo %systemroot%\system32\WinAbring.exe
echo %systemroot%\system32\winaamp.exe
echo %systemroot%\system32\winadll.exe
echo %systemroot%\system32\winamap.exe
echo %systemroot%\system32\winamp.exe
echo %systemroot%\system32\winamp32.exe
echo %systemroot%\system32\Winamp6.exe
echo %systemroot%\system32\winampa.exe
echo %systemroot%\system32\winampaa.exe
echo %systemroot%\system32\winapi32.exe
echo %systemroot%\system32\winappp.exe
echo %systemroot%\system32\winauth23.exe
echo %systemroot%\system32\winav32.exe
echo %systemroot%\system32\winavguard.exe
echo %systemroot%\system32\winavxx.exe
echo %systemroot%\system32\winbios1.dll
echo %systemroot%\system32\winbo32.exe
echo %systemroot%\system32\winboot.exe
echo %systemroot%\system32\winbooter.exe
echo %systemroot%\system32\winbot.exe
echo %systemroot%\system32\WinCES.exe
echo %systemroot%\system32\winchk.exe
echo %systemroot%\system32\winclean.exe
echo %systemroot%\system32\wincls.dll
echo %systemroot%\system32\wincmd.exe
echo %systemroot%\system32\wincom32.ini
echo %systemroot%\system32\winconf.exe
echo %systemroot%\system32\winconfig.exe
echo %systemroot%\system32\WinCore32.exe
echo %systemroot%\system32\wincntrl.exe
echo %systemroot%\system32\wincomm.exe
echo %systemroot%\system32\winctl.exe
echo %systemroot%\system32\WinCtrl32.dll
echo %systemroot%\system32\WinCtrl32.dl_
echo %systemroot%\system32\wind32.exe
echo %systemroot%\system32\windat.exe
echo %systemroot%\system32\windat32.exe
echo %systemroot%\system32\WinData.cab
echo %systemroot%\system32\windata.exe
echo %systemroot%\system32\WinDDE.exe
echo %systemroot%\system32\windefend.exe
echo %systemroot%\system32\windev-peers.ini
echo %systemroot%\system32\windex\klog.dat
echo %systemroot%\system32\windex\wini.exe
echo %systemroot%\system32\windfe.exe
echo %systemroot%\system32\windfrag.exe
echo %systemroot%\system32\windir.dll
echo %systemroot%\system32\windir32.exe
echo %systemroot%\system32\windl32.exe
echo %systemroot%\system32\WinDLCT.exe
echo %systemroot%\system32\windll.exe
echo %systemroot%\system32\windll.ini
echo %systemroot%\system32\windll32.exe
echo %systemroot%\system32\WinDLT.exe
echo %systemroot%\system32\windmupdr.exe
echo %systemroot%\system32\windns32.dll
echo %systemroot%\system32\windocs.exe
echo %systemroot%\system32\wind0w.exe
echo %systemroot%\system32\windos.dll
echo %systemroot%\system32\Window2.exe
echo "%systemroot%\system32\windows .exe"
echo %systemroot%\system32\windows.exe
echo %systemroot%\system32\Windows12.exe
echo %systemroot%\system32\Windows2.exe
echo %systemroot%\system32\windows32.exe
echo %systemroot%\system32\Windows-.exe
echo %systemroot%\system32\Windows-Anti.exe
echo %systemroot%\system32\Windows_kernel32.exe
echo %systemroot%\system32\windows_log.txt
echo %systemroot%\system32\Windows-mod.exe
echo %systemroot%\system32\Windows-spyware.exe
echo %systemroot%\system32\windows.pif
echo %systemroot%\system32\WindowsActivation.exe
echo %systemroot%\system32\windowsapp.exe
echo %systemroot%\system32\windowsboot.exe
echo %systemroot%\system32\windowsconf.exe
echo %systemroot%\system32\windowsdefender.exe
echo "%systemroot%\system32\Windows Genuine Check.exe"
echo %systemroot%\system32\windowslivemsn.exe
echo %systemroot%\system32\WindowsLockdown.exe
echo %systemroot%\system32\windowsmem.exe
echo %systemroot%\system32\windowsmsnlive.exe
echo %systemroot%\system32\windowsnfo.exe
echo %systemroot%\system32\windowsp.exe
echo %systemroot%\system32\windowstime.exe
echo %systemroot%\system32\Windowsupd.exe
echo %systemroot%\system32\WindowsUpdate.exe
echo %systemroot%\system32\windows_update.exe
echo "%systemroot%\system32\Windows Update.exe"
echo %systemroot%\system32\WindowsUpdater.exe
echo %systemroot%\system32\windowsupdats.exe
echo "%systemroot%\system32\Windows Utilities Manager"
echo %systemroot%\system32\windowsvista.exe
echo %systemroot%\system32\WindowsXPContorl.exe
echo %systemroot%\system32\windowz.exe
echo %systemroot%\system32\windr32.exe
echo %systemroot%\system32\windr64.exe
echo %systemroot%\system32\windr128.exe
echo %systemroot%\system32\windrg.exe
echo %systemroot%\system32\windrive.exe
echo %systemroot%\system32\windriver.exe
echo %systemroot%\system32\windrv.exe
echo %systemroot%\system32\WinDrv32.exe
echo %systemroot%\system32\winds32.exe
echo %systemroot%\system32\windsp.exe
echo %systemroot%\system32\windsys2.exe
echo %systemroot%\system32\windsw.dll
echo %systemroot%\system32\windumper32.exe
echo %systemroot%\system32\Windws.exe
echo %systemroot%\system32\winenv.exe
echo %systemroot%\system32\WinEUM.exe
echo %systemroot%\system32\WinEWUM.exe
echo %systemroot%\system32\winexplorer.exe
echo %systemroot%\system32\winfix.exe
echo %systemroot%\system32\winfrun32.bin
echo %systemroot%\system32\WinFx.exe
echo %systemroot%\system32\wing32.exe
echo %systemroot%\system32\wingamma.exe
echo %systemroot%\system32\wingate32.exe
echo %systemroot%\system32\WinGuard.exe
echo %systemroot%\system32\wingrd32.exe
echo %systemroot%\system32\winhelp.exe
echo %systemroot%\system32\winhlp32.pif
echo %systemroot%\system32\Winhndl.ini
echo %systemroot%\system32\winhost.exe
echo %systemroot%\system32\winhosts.exe
echo %systemroot%\system32\WinHSD.exe
echo %systemroot%\system32\winhttps.exe
echo %systemroot%\system32\WinIM.xe
echo %systemroot%\system32\wininet.exe
echo %systemroot%\system32\winini.exe
echo %systemroot%\system32\wininit.exe
echo %systemroot%\system32\wininitc.dll
echo %systemroot%\system32\winins.exe
echo %systemroot%\system32\wininv.dll
echo %systemroot%\system32\wininxt.exe
echo %systemroot%\system32\winIogon.exe
echo %systemroot%\system32\winIogon2.exe
echo %systemroot%\system32\WinIp32.exe
echo %systemroot%\system32\winis.exe
echo %systemroot%\system32\winistr.exe
echo %systemroot%\system32\winit.exe
echo %systemroot%\system32\winivstr.exe
echo %systemroot%\system32\winjews16.exe
echo %systemroot%\system32\Wink2sk3.exe
echo %systemroot%\system32\Wink2sk7.exe
echo %systemroot%\system32\Wink3sk9.exe
echo %systemroot%\system32\winkey.dll
echo %systemroot%\system32\WinKey.exe
echo %systemroot%\system32\winkeyboard.exe
echo %systemroot%\system32\winkeybrd.exe
echo %systemroot%\system32\winkeybrd32.exe
echo %systemroot%\system32\winl0g0.exe
echo %systemroot%\system32\winl0g0z.exe
echo %systemroot%\system32\winlagons.exe
echo %systemroot%\system32\winlast.exe
echo %systemroot%\system32\winlast.tmp
echo %systemroot%\system32\winlde.exe
echo %systemroot%\system32\winldr.exe
echo %systemroot%\system32\winlegal.exe
echo %systemroot%\system32\winligom.exe
echo %systemroot%\system32\winline.exe
echo %systemroot%\system32\winline32.exe
echo %systemroot%\system32\winlive.exe
echo %systemroot%\system32\winlivemgr.exe
echo %systemroot%\system32\winlivemsn.exe
echo %systemroot%\system32\winlivemsnmessenger.exe
echo %systemroot%\system32\winload.dll
echo %systemroot%\system32\winlog.exe
echo %systemroot%\system32\winlogans.tmp
echo %systemroot%\system32\winlogg.exe
echo %systemroot%\system32\winlogi.exe
echo %systemroot%\system32\winlogin.exe
echo %systemroot%\system32\winlogin.pif
echo %systemroot%\system32\winlogin32.exe
echo %systemroot%\system32\winlogins.exe
echo %systemroot%\system32\WINLOGO.EXE
echo %systemroot%\system32\winlogom.exe
echo %systemroot%\system32\winlogon.dll
echo %systemroot%\system32\winlog0n.exe
echo %systemroot%\system32\winlogon.scr
echo %systemroot%\system32\winlogon32.exe
echo %systemroot%\system32\winlogonpc.exe
echo %systemroot%\system32\Winlogons.exe
echo %systemroot%\system32\winlogonsys.exe
echo %systemroot%\system32\winlogos.exe
echo %systemroot%\system32\winlogout.exe
echo %systemroot%\system32\winlogz2.exe
echo %systemroot%\system32\winlolx.exe
echo %systemroot%\system32\winlugan.exe
echo %systemroot%\system32\winmanwan.exe
echo %systemroot%\system32\winmed.exe
echo %systemroot%\system32\winmes.exe
echo %systemroot%\system32\winmessengerlive.exe
echo %systemroot%\system32\winmgr.exe
echo %systemroot%\system32\winmgr32.exe
echo %systemroot%\system32\WinMI.xe
echo %systemroot%\system32\WinMIO.exe
echo %systemroot%\system32\WinMIS.exe
echo %systemroot%\system32\winmon.exe
echo %systemroot%\system32\winmouse.exe
echo %systemroot%\system32\winmouse64.exe
echo %systemroot%\system32\winmngr.exe
echo %systemroot%\system32\winmnpld.lhp
echo %systemroot%\system32\winmsdn.exe
echo %systemroot%\system32\winmsfw.exe
echo %systemroot%\system32\winmsfws.exe
echo %systemroot%\system32\winmsg.exe
echo %systemroot%\system32\winmsg32.exe
echo %systemroot%\system32\winmsn.exe
echo %systemroot%\system32\winmx.exe
echo %systemroot%\system32\winmx32.EXE
echo %systemroot%\system32\winn.exe
echo %systemroot%\System32\winnet.dll
echo %systemroot%\System32\winnett.exe
echo %systemroot%\System32\winnetwork.exe
echo %systemroot%\System32\winnetwork32.exe
echo %systemroot%\System32\winnetwork64.exe
echo %systemroot%\system32\winnlde.exe
echo %systemroot%\system32\winnnit.exe
echo %systemroot%\system32\winnoob.exe
echo %systemroot%\system32\WinNPS.exe
echo %systemroot%\system32\winnt.sys
echo %systemroot%\system32\winnt32lb.sys
echo %systemroot%\system32\winnt4.exe
echo %systemroot%\system32\WinNTLM.exe
echo %systemroot%\system32\winntmsn.exe
echo %systemroot%\system32\WinOcx.exe
echo %systemroot%\system32\winocxdll.exe
echo %systemroot%\system32\winoem.exe
echo %systemroot%\system32\WinP2P.exe
echo %systemroot%\system32\winpatch.exe
echo %systemroot%\system32\winPE.exe
echo %systemroot%\system32\winpnp32.exe
echo %systemroot%\system32\winpol.exe
echo %systemroot%\system32\WinPrint.exe
echo %systemroot%\system32\winprot32.exe
echo %systemroot%\system32\winprotect.exe
echo %systemroot%\system32\WinPTTP.exe
echo %systemroot%\system32\WinrarCO.com
echo %systemroot%\system32\WinRDH.exe
echo %systemroot%\system32\winreg.exe
echo %systemroot%\system32\winregdll.exe
echo %systemroot%\system32\Winregs326a.exe
echo %systemroot%\system32\winrestore.exe
echo %systemroot%\system32\winrnr.exe
echo %systemroot%\system32\winrsvp.exe
echo %systemroot%\system32\Winrun.exe
echo %systemroot%\system32\winrvc.exe
echo %systemroot%\system32\winrvp.exe
echo %systemroot%\system32\winrvs.exe
echo %systemroot%\system32\winrxd64.exe
echo %systemroot%\system32\wins\wmsncs.exe
echo %systemroot%\system32\wins32a.exe
echo %systemroot%\system32\winsas32.exe
echo %systemroot%\system32\winscntrl.exe
echo %systemroot%\system32\winscrne.exe
echo %systemroot%\system32\winscv.exe
echo %systemroot%\system32\WinSec.001
echo %systemroot%\system32\WinSec.006
echo %systemroot%\system32\WinSec.007
echo %systemroot%\system32\Winsec.exe
echo %systemroot%\system32\WinSecDir.exe
echo %systemroot%\system32\WinSecUp.exe
echo %systemroot%\system32\WinSecUps.exe
echo %systemroot%\system32\WinSecure.exe
echo %systemroot%\system32\winsecurityxp\mswinup.exe
echo %systemroot%\system32\winser.exe
echo %systemroot%\system32\winserv.exe
echo %systemroot%\system32\Winserv23.exe
echo %systemroot%\system32\winserv32.exe
echo %systemroot%\system32\winservces.exe
echo %systemroot%\system32\winservcs32.dll
echo %systemroot%\system32\winservcs32.dl_
echo %systemroot%\system32\WinServices.exe
echo %systemroot%\system32\winservicess.exe
echo %systemroot%\system32\winservicessss.exe
echo %systemroot%\system32\winservnt32.exe
echo %systemroot%\system32\winsfs32.exe
echo %systemroot%\system32\winshell.exe
echo %systemroot%\system32\winskd.exe
echo %systemroot%\system32\winskvc32.exe
echo %systemroot%\system32\winslog.exe
echo %systemroot%\system32\winslogin.exe
echo %systemroot%\system32\winsmv.exe
echo %systemroot%\system32\winsn.exe
echo %systemroot%\system32\winsnt.exe
echo %systemroot%\system32\wins0ck.dll
echo %systemroot%\system32\winsock.exe
echo %systemroot%\system32\winsock3.exe
echo %systemroot%\system32\WinSock32
echo %systemroot%\system32\WinSock32.exe
echo %systemroot%\system32\WinSocks.exe
echo %systemroot%\system32\winsockx32.exe
echo %systemroot%\system32\winsoft.nls
echo %systemroot%\system32\winsos.exe
echo %systemroot%\system32\winsplr.exe
echo %systemroot%\system32\winspool.exe.tmp
echo %systemroot%\system32\WinSpooler.exe
echo %systemroot%\system32\WinS0ki.exe
echo %systemroot%\system32\winssh.exe
echo %systemroot%\system32\winssv.exe
echo %systemroot%\system32\winssx.exe
echo %systemroot%\system32\winsrc.dll
echo %systemroot%\system32\winsrc.dll.tmp
echo %systemroot%\system32\winstat.dll
echo %systemroot%\system32\winstats.dll
echo %systemroot%\system32\winstruct32.exe
echo %systemroot%\system32\winsub.xml
echo %systemroot%\system32\WinSUp.exe
echo %systemroot%\system32\winsupply.exe
echo %systemroot%\system32\winsvc.exe
echo %systemroot%\system32\winsvcli.exe
echo %systemroot%\system32\winsvcmon.exe
echo %systemroot%\system32\winsvcup.exe
echo %systemroot%\system32\winsvcx.exe
echo %systemroot%\system32\winsvr.exe
echo %systemroot%\system32\winsyncupx.exe
echo %systemroot%\system32\Winsyncupxxx.exe
echo %systemroot%\system32\winsys_32.exe
echo %systemroot%\system32\winsys32.exe
echo %systemroot%\system32\winsyser.exe
echo %systemroot%\system32\winsysmgr.exe
echo %systemroot%\system32\winsysmngr.exe
echo %systemroot%\system32\winsystem.exe
echo %systemroot%\system32\winsystems.exe
echo %systemroot%\system32\winsystems16.exe
echo %systemroot%\system32\wintask32.exe
echo %systemroot%\system32\wintasks32.exe
echo %systemroot%\system32\wintcp32.exe
echo %systemroot%\system32\winter.exe
echo %systemroot%\system32\wintimer.bmp
echo %systemroot%\system32\wintmp.exe
echo %systemroot%\system32\wintrust32.exe
echo %systemroot%\system32\wints.exe
echo %systemroot%\system32\winudpt32.exe
echo %systemroot%\system32\winup.exe
echo %systemroot%\system32\winup32.exe
echo %systemroot%\system32\winupcd.exe
echo %systemroot%\system32\winupd.exe
echo %systemroot%\system32\winupdate.exe
echo %systemroot%\system32\winupdate_.exe
echo %systemroot%\system32\WINUPDATE2.EXE
echo %systemroot%\system32\winupdate32.exe
echo %systemroot%\system32\WinUpdater.exe
echo %systemroot%\system32\winupdaterar.exe
echo %systemroot%\system32\winupdates.exe
echo %systemroot%\system32\WinUpdating.exe
echo %systemroot%\system32\winupdatr.exe
echo %systemroot%\system32\winupdbc.exe
echo %systemroot%\system32\winupds32.exe
echo %systemroot%\system32\winupdte.exe
echo %systemroot%\system32\winupn.exe
echo %systemroot%\system32\WinUPPD.exe
echo %systemroot%\system32\winupser.exe
echo %systemroot%\system32\winupsvc.exe
echo %systemroot%\system32\winuptdate.exe
echo %systemroot%\system32\winusers.exe
echo %systemroot%\system32\WinUUpdate.exe
echo %systemroot%\system32\winviews32.dll
echo %systemroot%\system32\winvirtual.exe
echo %systemroot%\system32\winvirtual32.exe
echo %systemroot%\system32\winvsvc.exe
echo %systemroot%\system32\WINWGPX.EXE
echo %systemroot%\system32\WinxDiagUpdate
echo %systemroot%\system32\winxp.exe
echo %systemroot%\system32\winxp_sp3.exe
echo %systemroot%\system32\WinXpUpdate32.exe
echo %systemroot%\system32\winystems.exe
echo %systemroot%\system32\Winz_Keyz.txt
echo %systemroot%\system32\winzip.exe
echo %systemroot%\system32\winzip81.exe
echo %systemroot%\system32\wirpc.dll
echo %systemroot%\system32\wivsvc.exe
echo %systemroot%\system32\wjcstd32.dll
echo %systemroot%\system32\wkops.exe
echo %systemroot%\system32\wkserver.exe
echo %systemroot%\system32\wkssr.exe
echo %systemroot%\system32\wkssvr.exe
echo %systemroot%\system32\wksvc.exe
echo %systemroot%\system32\wlivemsg.exe
echo %systemroot%\system32\wlivemsgs.exe
echo %systemroot%\system32\wlliveapp.exe
echo %systemroot%\system32\wllivemsgr.exe
echo %systemroot%\system32\wllivemsngr.exe
echo %systemroot%\system32\wllmsngr.exe
echo %systemroot%\system32\wlloginmsgs.exe
echo %systemroot%\system32\wlmsn.exe
echo %systemroot%\system32\wlmsngr.exe
echo %systemroot%\system32\WlNDWOS\klog.dat
echo %systemroot%\system32\WlNDWOS\Systam.exe
echo %systemroot%\system32\wlogon32.dll
echo %systemroot%\system32\wlolxx.exe
echo %systemroot%\system32\wm05.dll
echo %systemroot%\system32\wmanage.exe
echo %systemroot%\system32\wndms.exe
echo %systemroot%\system32\wmdsvc.exe
echo %systemroot%\system32\wmedia
echo %systemroot%\system32\wmedia.exe
echo %systemroot%\system32\wmedia32.exe
echo %systemroot%\system32\wmhost.exe
echo %systemroot%\system32\wmhs32.dll
echo %systemroot%\system32\wml.exe
echo %systemroot%\system32\wmpIayer.exe
echo %systemroot%\system32\wmpirvse.exe
echo %systemroot%\system32\wmscc.exe
echo %systemroot%\system32\wmscheduler.exe
echo %systemroot%\system32\wmsdkns.exe
echo %systemroot%\system32\wmserv.exe
echo %systemroot%\system32\wmserver.exe
echo %systemroot%\system32\wmssvc.exe
echo %systemroot%\system32\wmsvc.exe
echo %systemroot%\system32\wmsv.exe
echo %systemroot%\system32\wmvsvc.exe
echo %systemroot%\system32\wmwplayers.exe
echo %systemroot%\system32\wnbsvc.exe
echo %systemroot%\system32\wnd32.exe
echo %systemroot%\system32\wndupdate.exe
echo %systemroot%\system32\wnlsos.exe
echo %systemroot%\system32\wnpcgs.exe
echo %systemroot%\system32\wnpmcs.exe
echo %systemroot%\system32\wns.exe
echo %systemroot%\system32\wnslogan.exe
echo %systemroot%\system32\wnss.exe
echo %systemroot%\system32\WNTdll.exe
echo %systemroot%\system32\Wntsf.exe
echo %systemroot%\system32\wnuserv.exe
echo %systemroot%\system32\woodtype.dll
echo %systemroot%\system32\wor.exe
echo %systemroot%\system32\workertc.dll
echo %systemroot%\system32\worldso.dll
echo %systemroot%\system32\wpa.exe
echo %systemroot%\system32\wplayer.exe
echo %systemroot%\system32\wpnsc.exe
echo %systemroot%\system32\wposvc.exe
echo %systemroot%\system32\wprinspooler.exe
echo %systemroot%\system32\wrdpad05.exe
echo %systemroot%\system32\wrapper.exe
echo %systemroot%\system32\wrasvc.exe
echo %systemroot%\system32\wre.cdm
echo %systemroot%\system32\wrt.acx
echo %systemroot%\system32\ws2_32.exe
echo %systemroot%\system32\ws2_64.exe
echo %systemroot%\system32\ws386.ini
echo %systemroot%\system32\wsap32.exe
echo %systemroot%\system32\wsass.exe
echo %systemroot%\system32\wsass32.exe
echo %systemroot%\system32\wscmp.dll
echo %systemroot%\system32\wscmp.dll.tmp
echo %systemroot%\system32\wscnfty.exe
echo %systemroot%\system32\wscntfx.exe
echo %systemroot%\system32\wsctnfy.exe
echo %systemroot%\system32\wscvs.exe
echo %systemroot%\system32\wscxt.exe
echo %systemroot%\system32\wservice.dll
echo %systemroot%\system32\WServing.exe
echo %systemroot%\system32\wsim32.exe
echo %systemroot%\system32\wsivs.exe
echo %systemroot%\system32\wsmmlog.exe
echo %systemroot%\system32\wsock32d.dll
echo %systemroot%\system32\wsots32.dll
echo %systemroot%\system32\wspvs.exe
echo %systemroot%\system32\wsrsvc.exe
echo %systemroot%\system32\wsscntfy.exe
echo %systemroot%\system32\wssl.exe
echo %systemroot%\system32\wsvc.exe
echo %systemroot%\system32\wsys.dll
echo %systemroot%\system32\wuaclt.exe
echo %systemroot%\system32\wuamguard.exe
echo %systemroot%\system32\wuamgrd.exe
echo %systemroot%\system32\wuamgrd32.exe
echo %systemroot%\system32\wuamk032.exe
echo %systemroot%\system32\wuampd.exe
echo %systemroot%\system32\wuapi.exe
echo %systemroot%\system32\wuasirvy.dll
echo %systemroot%\system32\wuauclt4.exe
echo %systemroot%\system32\wuauclt6.exe
echo %systemroot%\system32\wuauclt9.exe
echo %systemroot%\system32\wuauclt10.exe
echo %systemroot%\system32\wuauclt11.exe
echo %systemroot%\system32\wuauclt12.exe
echo %systemroot%\system32\wuauclt13.exe
echo %systemroot%\system32\wuauclt14.exe
echo %systemroot%\system32\wuauclt15.exe
echo %systemroot%\system32\wuauclt16.exe
echo %systemroot%\system32\wuauclt28.exe
echo %systemroot%\system32\wuaudit.exe
echo %systemroot%\system32\wuaumqr.exe
echo %systemroot%\system32\wuaumqr1.exe
echo %systemroot%\system32\wuaumqr12.exe
echo %systemroot%\system32\wuaumqr3.exe
echo %systemroot%\system32\wudb.dll
echo %systemroot%\system32\wudupdate.exe
echo %systemroot%\system32\wumss.exe
echo %systemroot%\system32\wunosjava.exe
echo %systemroot%\system32\wuosdial.exe
echo %systemroot%\system32\wupdate.exe
echo %systemroot%\system32\wupdategux32.exe
echo %systemroot%\system32\wupdates.exe
echo %systemroot%\system32\wupdmgr32x.exe
echo %systemroot%\system32\wupdmgr98.exe
echo %systemroot%\system32\wupdmng.exe
echo %systemroot%\system32\wupeng.exe
echo %systemroot%\system32\wuvenr.exe
echo %systemroot%\system32\wvcsvc.exe
echo %systemroot%\system32\wwwe1r32tm.dll
echo %systemroot%\system32\wzmcv.exe
echo %systemroot%\system32\xag.exe
echo %systemroot%\system32\xbccd.log
echo %systemroot%\system32\xcvbbnnm.dll
echo %systemroot%\system32\xd.txt
echo %systemroot%\system32\xee32.dll
echo %systemroot%\system32\Xeyu.exe
echo %systemroot%\system32\xex1.dll
echo %systemroot%\system32\xfire32.exe
echo %systemroot%\system32\xg165.exe
echo %systemroot%\system32\XGun
echo %systemroot%\system32\xhost.exe
echo %systemroot%\system32\xlibgfl254.dll
echo %systemroot%\system32\xloader.exe
echo %systemroot%\system32\xmdmx.exe
echo %systemroot%\system32\xp
echo %systemroot%\system32\xp.exe
echo %systemroot%\system32\xp386.exe
echo %systemroot%\system32\xpcphost.exe
echo %systemroot%\system32\xpiupdate.exe
echo %systemroot%\system32\xpjavams.exe
echo %systemroot%\system32\xpfilesys.exe
echo %systemroot%\system32\xpspz.exe
echo %systemroot%\system32\xptxt.exe
echo %systemroot%\system32\xpupdate.exe
echo %systemroot%\system32\xpuupdate.exe
echo %systemroot%\system32\Xred1.exe
echo %systemroot%\system32\Zred2.exe
echo %systemroot%\system32\xmd.dat
echo %systemroot%\system32\xsfer.dll
echo %systemroot%\system32\Xsfr.exe
echo %systemroot%\system32\xwinupdaterarx.exe
echo %systemroot%\system32\xydll.dll
echo %systemroot%\system32\yahoo.htm
echo %systemroot%\system32\yatool.dll
echo %systemroot%\system32\ymsmsgs.exe
echo %systemroot%\system32\ymssgr.exe
echo %systemroot%\system32\ymssmsgs.exe
echo %systemroot%\system32\ypag3r.exe
echo %systemroot%\system32\YPager.exe
echo %systemroot%\system32\ypages.exe
echo %systemroot%\system32\ysch_srp_gsp2_20070621.js
echo %systemroot%\system32\yschx_20070405.css
echo %systemroot%\system32\zaq.exe
echo %systemroot%\system32\zanbor.exe
echo %systemroot%\system32\zAskop.dll
echo %systemroot%\system32\zfton.exe
echo %systemroot%\system32\zlbw.dll
echo %systemroot%\system32\zlclint.exe
echo %systemroot%\system32\zmon.exe
echo %systemroot%\system32\znnsvc.exe
echo %systemroot%\system32\zoneu32.exe
echo %systemroot%\system32\zxdnt3d.cfg
echo %systemroot%\system32\zz.exe
echo %systemroot%\system32smp
echo %systemroot%\SystemFile.exe
echo %systemroot%\systemn.in
echo %systemroot%\Systems.exe
echo %systemroot%\systemz32.exe
echo %systemroot%\systhost.dll
echo %systemroot%\sysutili.exe
echo %systemroot%\sysutrnez.exe
echo %systemroot%\sysvn.exe
echo %systemroot%\sysvol32.dll
echo %systemroot%\sysvrs32.exe
echo %systemroot%\sysvtypkbjx.exe
echo %systemroot%\sysvx_.exe
echo %systemroot%\sysys.exe
echo %systemroot%\syszweuas.exe
echo %systemroot%\szr_dll.dll
echo %systemroot%\szr_32.exe
echo %systemroot%\taksmgr.exe
echo %systemroot%\taksmrg.exe
echo %systemroot%\task.exe
echo %systemroot%\taskbarmngr.exe
echo %systemroot%\Taskend.exe
echo %systemroot%\taskib.exe
echo %systemroot%\taskmg.exe
echo %systemroot%\taskmgr.exe
echo %systemroot%\taskmgr1.dll
echo %systemroot%\taskmng.exe
echo %systemroot%\taskmon.exe
echo %systemroot%\taskms.exe
echo %systemroot%\taskshed.exe
echo %systemroot%\tasksch.exe
echo %systemroot%\tBHO.dll
echo %systemroot%\tcb.pmw
echo %systemroot%\tcpip.exe
echo %systemroot%\TCPIPSTACK.EXE
echo %systemroot%\tdomgafw.dll
echo %systemroot%\telefonos.txt
echo %systemroot%\temp.exe
echo %systemroot%\temp1.exe
echo %systemroot%\tempeje.exe
echo %systemroot%\tempexe.exe
echo %systemroot%\tempfile.jpg
echo %systemroot%\TEMP#01.EXE
echo %systemroot%\Temp\01final.exe
echo %systemroot%\Temp\$_2341233.TMP
echo %systemroot%\Temp\$_2341234.TMP
echo %systemroot%\Temp\$_2341235.TMP
echo %systemroot%\Temp\$_3472452.EXE
echo %systemroot%\Temp\$b17a2e8.tmp
echo %systemroot%\Temp\1.dll
echo %systemroot%\Temp\babkinepaxnut.exe
echo %systemroot%\Temp\bca4e2da.$$$
echo %systemroot%\Temp\BtocSHDh.exe
echo %systemroot%\Temp\cmdinst.exe
echo %systemroot%\Temp\codec.exe
echo %systemroot%\Temp\csrssc.exe
echo %systemroot%\Temp\dipset.exe
echo %systemroot%\Temp\dllsvr32.exe
echo %systemroot%\Temp\DSAR.exe
echo %systemroot%\Temp\DxcUpdater3.exe
echo %systemroot%\Temp\ed47fa.$
echo %systemroot%\Temp\fa56d7ec.$$$
echo %systemroot%\Temp\file1.exe
echo %systemroot%\Temp\file2.exe
echo %systemroot%\Temp\ie888.exe
echo %systemroot%\Temp\ieobj.dll
echo %systemroot%\Temp\iframestat.exe
echo %systemroot%\Temp\kaw
echo %systemroot%\Temp\kawkgs
echo %systemroot%\Temp\kjj.exe 
echo %systemroot%\Temp\lsass.exe
echo %systemroot%\Temp\iexplore.exe
echo %systemroot%\Temp\iexplorer.exe
echo %systemroot%\Temp\loader.exe
echo %systemroot%\Temp\ma1x1dd1.game
echo %systemroot%\Temp\maindll.dll
echo %systemroot%\Temp\mc32.bat
echo %systemroot%\Temp\msnmsg.exe
echo %systemroot%\Temp\msnmsgr.exe
echo %systemroot%\Temp\ms32.sys
echo %systemroot%\Temp\mso13.exe
echo %systemroot%\Temp\0wl.tmp
echo %systemroot%\Temp\removalfile.bat
echo %systemroot%\Temp\restore.sys
echo %systemroot%\Temp\SALM.EXE
echo %systemroot%\Temp\secure.bat
echo %systemroot%\Temp\server.exe
echo %systemroot%\Temp\service32.exe
echo %systemroot%\Temp\sh.exe
echo %systemroot%\Temp\spoolsvv.exe
echo %systemroot%\Temp\SRJ.exe
echo %systemroot%\Temp\startdrv.exe
echo %systemroot%\Temp\svcgirl.exe
echo %systemroot%\Temp\svchast.exe
echo %systemroot%\Temp\svchost.exe
echo %systemroot%\Temp\svchots.exe
echo %systemroot%\Temp\svdhost.exe
echo %systemroot%\Temp\Sys.htm
echo %systemroot%\Temp\system.tmp
echo %systemroot%\Temp\system32\msconfg.dll
echo %systemroot%\Temp\system32\Systemx.dll
echo %systemroot%\Temp\taksmgr.exe
echo %systemroot%\Temp\temp.exe
echo %systemroot%\Temp\temp.dat
echo %systemroot%\Temp\tem1p.exe
echo %systemroot%\Temp\win.exe
echo %systemroot%\Temp\win32.exe
echo %systemroot%\Temp\winlogan.exe
echo %systemroot%\Temp\winlogen.exe
echo %systemroot%\Temp\winlogon.exe
echo %systemroot%\Temp\winlogun.exe
echo %systemroot%\Temp\winsto.exe
echo %systemroot%\Temp\winsyst32.exe
echo %systemroot%\Temp\wnset.exe
echo %systemroot%\Temp\wuauclt.exe
echo %systemroot%\Temp\zupacha.exe
echo %systemroot%\temps.exe
echo %systemroot%\termsvrs.exe
echo %systemroot%\test.tmp
echo %systemroot%\test.exe
echo %systemroot%\testing.exe
echo %systemroot%\textos.txt
echo %systemroot%\tfnslopk.dll
echo %systemroot%\tggcktxt.txt
echo %systemroot%\tggcktxt1.txt
echo %systemroot%\themeui.exe
echo %systemroot%\themeupd.exe
echo %systemroot%\three333333.exe
echo %systemroot%\time.exe
echo %systemroot%\TinyBHO.dll
echo %systemroot%\tk.exe
echo %systemroot%\tk58.exe
echo %systemroot%\tktest.exe
echo %systemroot%\tl.exe
echo %systemroot%\tlhelp.dll
echo %systemroot%\tlhelper.dll
echo %systemroot%\tmanagesvc.exe
echo %systemroot%\tmp.dat
echo %systemroot%\tmp.exe
echo %systemroot%\tmp.tmp.tmp1
echo %systemroot%\tmps.exe
echo %systemroot%\toolbar.exe
echo %systemroot%\toprates.dll
echo %systemroot%\totacon.config
echo %systemroot%\totacon.exe
echo %systemroot%\tovafrnm.exe
echo %systemroot%\tpabfelq.dll
echo %systemroot%\tqwolser.exe
echo %systemroot%\trayicon.exe
echo %systemroot%\trayicons.exe
echo %systemroot%\tremapi.exe
echo %systemroot%\trojan.exe
echo %systemroot%\troya.log
echo %systemroot%\troyan.exe
echo %systemroot%\tsxngabr.dll
echo %systemroot%\TTC-4444.exe
echo %systemroot%\ttvbonfvm.dll
echo %systemroot%\ttvbonfwt.dll
echo %systemroot%\ttvbonkog.dll
echo %systemroot%\ttvbonldf.dll
echo %systemroot%\ttvbonmlk.dll
echo %systemroot%\ttvbonmwo.dll
echo %systemroot%\ttvbonpwx.dll
echo %systemroot%\ttvbonqld.dll
echo %systemroot%\ttvbonsgr.dll
echo %systemroot%\ttvbonsmf.dll
echo %systemroot%\ttvbontvm.dll
echo %systemroot%\ttvbonvgl.dll
echo %systemroot%\tune.exe
echo %systemroot%\tvmware-tray..exe
echo %systemroot%\twain_16.dll
echo %systemroot%\twain_32.exe
echo %systemroot%\Tweka\server.exe
echo %systemroot%\two222222.exe
echo %systemroot%\Uninst2.htm
echo %systemroot%\Unist1.htm
echo %systemroot%\uninstal.bat
echo %systemroot%\uninstall_nmon.vbs
echo %systemroot%\update\klog.dat
echo %systemroot%\update\updmgr.exe
echo %systemroot%\update\updmangr.exe
echo %systemroot%\Update\win32update.exe
echo %systemroot%\update\wuauclt.exe
echo %systemroot%\update.exe
echo %systemroot%\updater.com
echo %systemroot%\updater.exe
echo %systemroot%\updater32.exe
echo %systemroot%\updatetc.exe
echo %systemroot%\ups.exe
echo %systemroot%\Urgent.zip
echo %systemroot%\user32.exe
echo %systemroot%\users32.exe
echo %systemroot%\userconfig9x.dll
echo %systemroot%\userinit.exe
echo %systemroot%\usnsv.exe
echo %systemroot%\usnsvc.exe
echo %systemroot%\utorrent.exe
echo %systemroot%\uvchost1.dll
echo %systemroot%\vadokmxt.dll
echo %systemroot%\vbksrofa.dll
echo %systemroot%\vbstub.exe
echo %systemroot%\vbgtorfd.dll
echo %systemroot%\VerifierPolicy.exe
echo %systemroot%\Via.exe
echo %systemroot%\video.exe
echo %systemroot%\vipextmdx.dll
echo %systemroot%\vipextmnq.dll
echo %systemroot%\vipextmst.dll
echo %systemroot%\vipextndl.dll
echo %systemroot%\vipextnog.dll
echo %systemroot%\vipextoxn.dll
echo %systemroot%\vipextpnk.dll
echo %systemroot%\vipextpxm.dll
echo %systemroot%\vipextqgp.dll
echo %systemroot%\vipextgpk.dll
echo %systemroot%\vipextqtr.dll
echo %systemroot%\vipextrlw.dll
echo %systemroot%\Vista32.exe
echo %systemroot%\vlc.exe
echo %systemroot%\vltdfabw.dll
echo %systemroot%\vmmlog32.dll
echo %systemroot%\vmware-tray.exe
echo %systemroot%\vnbptxlf.dll
echo %systemroot%\voiceip.dll
echo %systemroot%\voipwet.dll
echo %systemroot%\vpcrtf.exe
echo %systemroot%\vpnconfig.dll
echo %systemroot%\vpnsupport.dll
echo %systemroot%\vpsnetwork.dll
echo %systemroot%\vpssup.dll
echo %systemroot%\vregfwlx.dll
echo %systemroot%\vrmdtneg.dll
echo %systemroot%\vsmart.dll
echo %systemroot%\vsmon.sys
echo %systemroot%\vwsrfton.dll
echo %systemroot%\vtqnxfko.dll
echo %systemroot%\VTTray.exe
echo %systemroot%\VTTrayp.exe
echo %systemroot%\vwnskbot.dll
echo %systemroot%\vxddsk.exe
echo %systemroot%\w32edus.exe
echo %systemroot%\w32service.exe
echo %systemroot%\w32services.exe
echo %systemroot%\waol.exe
echo %systemroot%\waudio.exe
echo %systemroot%\wault.exe
echo %systemroot%\wbeCheck.exe
echo %systemroot%\wbeInst$.exe
echo %systemroot%\wbqxfpgl.dll
echo %systemroot%\wbRecv.exe
echo %systemroot%\wbxdpgfevkl.dll
echo %systemroot%\wcsrss.exe
echo %systemroot%\wdfmgr.exe
echo %systemroot%\wdfmgrr.exe
echo %systemroot%\wdmon.exe
echo %systemroot%\web\aolspy.exe
echo %systemroot%\Web\aolspysw.exe
echo %systemroot%\Web\def.htm
echo %systemroot%\Web\klog.dat
echo %systemroot%\Web\svchost.exe
echo %systemroot%\Web\Sys.exe
echo %systemroot%\webmsn.exe
echo %systemroot%\websvc32.exe
echo %systemroot%\weccom.exe
echo %systemroot%\wdpoefan.dll
echo %systemroot%\werbetdqw.dll
echo %systemroot%\werbetgxd.dll
echo %systemroot%\werbetknp.dll
echo %systemroot%\werbetlrw.dll
echo %systemroot%\werbetlvm.dll
echo %systemroot%\werbetnor.dll
echo %systemroot%\werbetorq.dll
echo %systemroot%\werbetpql.dll
echo %systemroot%\werbetprt.dll
echo %systemroot%\werbetpwg.dll
echo %systemroot%\werbetxdp.dll
echo %systemroot%\WeRecl.exe
echo %systemroot%\weRecv.exe
echo %systemroot%\wetkadmr.dll
echo %systemroot%\wfdmgr.exe
echo %systemroot%\wfdmgrsp.exe
echo %systemroot%\wfexqnrp.dll
echo %systemroot%\wiadss.exe
echo %systemroot%\wiaservb.log
echo %systemroot%\wiaservv.log
echo %systemroot%\win.exe
echo %systemroot%\Win31SecurityUpdates.dll
echo %systemroot%\win32.exe
echo %systemroot%\Win32SecurityUpdates.exe
echo %systemroot%\Win33SecurityUpdates.exe
echo %systemroot%\win32boot.exe
echo %systemroot%\win32chk.exe
echo %systemroot%\win32dll.exe
echo %systemroot%\win32e.exe
echo %systemroot%\win32host.exe
echo %systemroot%\Win32install.exe
echo %systemroot%\win32logon.exe
echo %systemroot%\win32microsoft.sys
echo %systemroot%\win32ole.dll
echo %systemroot%\win32ssr.exe
echo %systemroot%\win32udt.exe
echo %systemroot%\win325b.exe
echo %systemroot%\win64.exe
echo %systemroot%\win64tyt.exe
echo %systemroot%\winagent.exe
echo %systemroot%\winajbm.dll
echo %systemroot%\Winamp.exe
echo %systemroot%\winampa.exe
echo %systemroot%\winampb.exe
echo %systemroot%\winavscan.exe
echo %systemroot%\WinConfSrv.exe
echo %systemroot%\WinCore32.exe
echo %systemroot%\wincfy.exe
echo %systemroot%\wincrypt32.exe
echo %systemroot%\windat.exe
echo %systemroot%\windefender.exe
echo %systemroot%\windll.exe
echo %systemroot%\windll32.exe
echo %systemroot%\windmupdr.exe
echo %systemroot%\windns.exe
echo %systemroot%\window.exe
echo %systemroot%\windows.bat
echo %systemroot%\windows.dll
echo %systemroot%\windows.exe
echo %systemroot%\windowshostservice.exe
echo %systemroot%\windowslife\Windows.exe
echo %systemroot%\windows32.exe
echo %systemroot%\WindowsSecurityUpdate.exe
echo %systemroot%\windowsys.com
echo %systemroot%\WindowsUpdateManager.exe
echo %systemroot%\windowsupdate.exe
echo %systemroot%\WindowsUpdates.exe
echo %systemroot%\windrg.exe
echo %systemroot%\windrivers.exe
echo %systemroot%\WinDrives.EXE
echo %systemroot%\windrvrs32.exe
echo %systemroot%\windsk.dll
echo %systemroot%\WinDV.exe
echo %systemroot%\windvrhost.exe
echo %systemroot%\winfp.exe
echo %systemroot%\wingrd32.exe
echo %systemroot%\winhlp.exe
echo %systemroot%\winhp32.exe
echo %systemroot%\winins.exe
echo %systemroot%\winipsvc.exe
echo %systemroot%\winlive32.exe
echo %systemroot%\WinLoaderXP.exe
echo %systemroot%\winlog.exe
echo %systemroot%\winlog32.exe
echo %systemroot%\winlog0n.exe
echo %systemroot%\winlogon.dll
echo %systemroot%\winiogon.exe
echo %systemroot%\winlogon32.dll
echo %systemroot%\winlogon32.exe
echo %systemroot%\winlogon1.dll
echo %systemroot%\winlogin.exe
echo %systemroot%\winlogoin.exe
echo %systemroot%\winlogon.exe
echo %systemroot%\winm32.exe
echo %systemroot%\WinMedia.exe
echo %systemroot%\winmgc.exe
echo %systemroot%\WinMgmt.exe
echo %systemroot%\winmgnt.exe
echo %systemroot%\winmgr.exe
echo %systemroot%\winmnon32.exe
echo %systemroot%\winmon.exe
echo %systemroot%\winmsgr.exe
echo %systemroot%\winmsgslive.exe
echo %systemroot%\winmsn.exe
echo %systemroot%\WinNT.exe
echo %systemroot%\winnt32.exe
echo %systemroot%\winpifviewer.exe
echo %systemroot%\winpo32.exe
echo %systemroot%\winrar.exe
echo %systemroot%\WinReghelp.exe
echo %systemroot%\winrofl32.exe
echo %systemroot%\winrofl32.exe_
echo %systemroot%\winrpc.exe
echo %systemroot%\winrun32.exe
echo %systemroot%\winrvc.exe
echo %systemroot%\winsb.dll
echo %systemroot%\winsck.exe
echo %systemroot%\Winsec32.exe
echo %systemroot%\winself.exe
echo %systemroot%\winservicehost.exe
echo %systemroot%\winserv.exe
echo %systemroot%\winservs.exe
echo %systemroot%\winshow.exe
echo %systemroot%\wins0ck.dll
echo %systemroot%\winsock\csrss.exe
echo %systemroot%\winSock32.exe
echo %systemroot%\winsock32
echo %systemroot%\winsock64.dll
echo %systemroot%\winsocks32.exe
echo %systemroot%\winspool32.exe
echo %systemroot%\winsrv.exe
echo %systemroot%\winsrvc.exe
echo %systemroot%\winss
echo %systemroot%\winsurf.dll
echo %systemroot%\winsvc.exe
echo %systemroot%\winsvcmgr.exe
echo %systemroot%\WinSxS\explorer.exe
echo %systemroot%\winsys.exe
echo %systemroot%\winsysdll.exe
echo %systemroot%\winsyshp.exe
echo %systemroot%\winsysnet.exe
echo %systemroot%\winsysplg.exe
echo %systemroot%\winsysdir.exe
echo %systemroot%\winsyssrv.exe
echo %systemroot%\winsystem.exe
echo %systemroot%\wintasks32.exe
echo %systemroot%\winthcr.exe
echo %systemroot%\wintimage.exe
echo %systemroot%\wints.ini
echo %systemroot%\winudmr.exe
echo %systemroot%\winudp.exe
echo %systemroot%\winudpmg.exe
echo %systemroot%\winudpmgr
echo %systemroot%\winudpmgr.exe
echo %systemroot%\winudpmgrs.exe
echo %systemroot%\winudpmsgr.exe
echo %systemroot%\winudspm.exe
echo %systemroot%\winup.exe
echo %systemroot%\winup32.exe
echo %systemroot%\winupd.exe
echo %systemroot%\winupdate.exe
echo %systemroot%\winupdatr.exe
echo %systemroot%\winupdt.exe
echo %systemroot%\winupmgr.exe
echo %systemroot%\winuscn32.exe
echo %systemroot%\winusers.exe
echo %systemroot%\winvip.exe
echo %systemroot%\winx.log
echo %systemroot%\winxp.exe
echo %systemroot%\wksmgrtsgs.exe
echo %systemroot%\wkssvc.exe
echo %systemroot%\wkssvr.exe
echo %systemroot%\wkssvr1.exe
echo %systemroot%\wkssvrs.exe
echo %systemroot%\wksvcsc.exe
echo %systemroot%\wksvr.exe
echo %systemroot%\wlmsngr.exe
echo %systemroot%\wlnlogon.exe
echo %systemroot%\wmedia.exe
echo %systemroot%\wmev.exe
echo %systemroot%\wmiapsv.exe
echo %systemroot%\wmiprvse.exe
echo %systemroot%\wmiprsv.exe
echo %systemroot%\wml.exe
echo %systemroot%\wmpconf.dll
echo %systemroot%\wmpdev.dll
echo %systemroot%\wmpdxm.dll
echo %systemroot%\wmpenv.dll
echo %systemroot%\wmphost.dll
echo %systemroot%\wmplayer.dll
echo %systemroot%\wmplayer.exe
echo %systemroot%\wmsound.dll
echo %systemroot%\wmsnlivexp.exe
echo %systemroot%\wmupdate.exe
echo %systemroot%\WNDXP.exe
echo %systemroot%\wnslvxtf.dll
echo %systemroot%\wnsp.dll
echo %systemroot%\woprdagt.exe
echo %systemroot%\wordpad.exe
echo %systemroot%\wow.dll
echo %systemroot%\wowsupport.dll
echo %systemroot%\wpablan.exe
echo %systemroot%\wpablin.exe
echo %systemroot%\wpcjmd.log
echo %systemroot%\WPlayer.exe
echo %systemroot%\wpservice.exe
echo %systemroot%\wpvmqosg.dll
echo %systemroot%\wr.txt
echo %systemroot%\ws386.ini
echo %systemroot%\wscty32.exe
echo %systemroot%\wsecur3.exe
echo %systemroot%\wspl.exe
echo %systemroot%\wsremover.exe
echo %systemroot%\wtopmod.exe
echo %systemroot%\wuasirvy.dll
echo %systemroot%\wuactll.exe
echo %systemroot%\wuaucll.exe
echo %systemroot%\wuauclt.exe
echo %systemroot%\wupdmgr.exe
echo %systemroot%\wupdmgr32.exe
echo %systemroot%\wupdmgr32x.exe
echo %systemroot%\wvbegpqs.dll
echo %systemroot%\wvfsrqab.dll
echo %systemroot%\wxdbpfvo.dll
echo %systemroot%\wxvgsdbq.exe
echo %systemroot%\xadbrk.dll
echo %systemroot%\xadbrk.exe
echo %systemroot%\xadbrk_.exe
echo %systemroot%\xar6000v7.exe
echo %systemroot%\xbaqktfv.exe
echo %systemroot%\xbqmfsed.exe
echo %systemroot%\xcbhwuq.exe
echo %systemroot%\xcvwer.dll
echo %systemroot%\xewuaqj.exe
echo %systemroot%\xfjzrby.dll
echo %systemroot%\xgpsarbm.dll
echo %systemroot%\xhbxcnv.exe
echo %systemroot%\xkefqtgs.dll
echo %systemroot%\xlash.exe
echo %systemroot%\xlavba3.exe
echo %systemroot%\xlavra3.exe
echo %systemroot%\xmlmimefilter.dll
echo %systemroot%\xmpstean.exe
echo %systemroot%\xokvrpwg.dll
echo %systemroot%\xp11.exe
echo %systemroot%\xplsass.exe
echo %systemroot%\xplugin.dll
echo %systemroot%\xpos.exe
echo %systemroot%\xpupdate.exe
echo %systemroot%\xrdwbfgn.dll
echo %systemroot%\xvideo.dll
echo %systemroot%\xvorfwbd.dll
echo %systemroot%\xxxvideo.exe
echo %systemroot%\xxxvideo.hta
echo %systemroot%\z31.exe
echo %systemroot%\Zap.exe
echo %systemroot%\zefckuxgdh.exe
echo %systemroot%\zegtpefban.exe
echo %systemroot%\zeqbhjcrau.exe
echo %systemroot%\zetasvrfgce.exe
echo %systemroot%\zetjmnefwqh.exe
echo %systemroot%\zetuhxdafgn.exe
echo %systemroot%\zetzfhjbnud.exe
echo %systemroot%\zewpemnckv.exe
echo %systemroot%\ziplog.txt
echo %systemroot%\Zser.exe
echo %systemroot%\zysalwhkkw.exe
echo %systemroot%\zysaoxcjiy.exe
echo %systemroot%\zysapghucv.exe
echo %systemroot%\zysaxyczld.exe
	)

dir /b/a-d "%programfiles%\tmp*.exe">testtmp1.txt 2>NUL
dir /b/a-d "%programfiles%\KB?????.exe">>testtmp1.txt 2>NUL
for /f "tokens=1 delims=." %%G in (testtmp1.txt) do IF EXIST "%programfiles%\%%G.exe" echo %programfiles%\%%G.exe>>Find.txt

cls

echo.
echo Starting Repairs
echo.
echo Checking Running Processes and Services
echo.
echo.
echo Please Be Patient As This May Take Up To 20 Minutes
echo.
echo Restoring Default Security Values
echo Restoring Default Hosts File
echo.
echo Note - Protective Host Files such as MVPS/HP hosts or Spybots
echo        Immunizer feature should be reapplied after using SDFix
echo.
echo Checking Files
echo.
echo Please Wait
echo.
echo 75%% Checked


>>Find.txt (
dir /b/s/a-d "%Temp%\privacy_danger\*" 2>nul
dir /b/s/a-d "%AppData%\0000005738\*" 2>nul
dir /b/s/a-d "%AppData%\Antivir64\*" 2>nul
dir /b/s/a-d "%AppData%\Antivirus2008\*" 2>nul
dir /b/s/a-d "%AppData%\Antivirus2008y\*" 2>nul
dir /b/s/a-d "%AppData%\AXPFixer\*" 2>nul
dir /b/s/a-d "%AppData%\Facegame\*" 2>nul
dir /b/s/a-d "%AppData%\gadcom\*" 2>nul
dir /b/s/a-d "%AppData%\Gool\*" 2>nul
dir /b/s/a-d "%AppData%\IBPlugin\*" 2>nul
dir /b/s/a-d "%AppData%\Microsoft\dtsc\*" 2>nul
dir /b/s/a-d "%AppData%\MPatrolPRO\*" 2>nul
dir /b/s/a-d "%AppData%\PC-Antispy\*" 2>nul
dir /b/s/a-d "%AppData%\PC Clean Pro\*" 2>nul
dir /b/s/a-d "%AppData%\Power-Antivirus-2009\*" 2>nul
dir /b/s/a-d "%AppData%\Rapid Antivirus\*" 2>nul
dir /b/s/a-d "%AppData%\SalesMon\*" 2>nul
dir /b/s/a-d "%AppData%\SecurePCCleaner\*" 2>nul
dir /b/s/a-d "%AppData%\SpeedRunner\*" 2>nul
dir /b/s/a-d "%AppData%\SystemDefender\*" 2>nul
dir /b/s/a-d "%AppData%\SpyGuarder\*" 2>nul
dir /b/s/a-d "%AppData%\TrustedAntivirus\*" 2>nul
dir /b/s/a-d "%AppData%\Ultimate Cleaner\*" 2>nul
dir /b/s/a-d "%AppData%\Ultimate Defender\*" 2>nul
dir /b/s/a-d "%AppData%\ultra\*" 2>nul
dir /b/s/a-d "%AppData%\WinButler\*" 2>nul
dir /b/s/a-d "%AppData%\WinIFixer.com\*" 2>nul
dir /b/s/a-d "%AppData%\WinSecureAv\*" 2>nul
dir /b/s/a-d "%AppData%\WinTouch\*" 2>nul
dir /b/s/a-d "%AppData%\WinXDefender\*" 2>nul
dir /b/s/a-d "%AppData%\WinXProtector\*" 2>nul
dir /b/s/a-d "%AppData%\WinX Security Center\*" 2>nul
dir /b/s/a-d "%commapp%\ipd\*" 2>nul
dir /b/s/a-d "%commapp%\NetExt\*" 2>nul
dir /b/s/a-d "%commapp%\PersonalAntiSpy\*" 2>nul
dir /b/s/a-d "%commapp%\SalesMon\*" 2>nul
dir /b/s/a-d "%commapp%\Solt Lake Software\*" 2>nul
IF EXIST "%programfiles%\SecureExpertCleaner\" dir /b/s/a-d "%commapp%\SEC\*" 2>nul
dir /b/s/a-d "%commapp%\SecurePCCleaner\*" 2>nul
dir /b/s/a-d "%commapp%\Secure Solutions\*" 2>nul
dir /b/s/a-d "%commapp%\SoftLand Ltd\*" 2>nul
dir /b/s/a-d "%commapp%\Software Licensors\*" 2>nul
dir /b/s/a-d "%commapp%\System Doctor Free\*" 2>nul
dir /b/s/a-d "%commapp%\Tarma Installer\{FE5B4D78-069A-4F1E-B2C9-0BE2D0A53E6E}\*" 2>nul
dir /b/s/a-d "%allusersprofile%\SSCVIIHOST.exe" 2>nul
dir /b/s/a-d "%allusersprofile%\abc32.dll" 2>nul
dir /b/s/a-d "%allusersprofile%\abc32.dll~" 2>nul
dir /b/s/a-d "%allusersprofile%\Antivirus Scan.url" 2>nul
dir /b/s/a-d "%allusersprofile%\Online Spyware Test.url" 2>nul
dir /b/s/a-d "%allusersprofile%\arm32.dll" 2>nul
dir /b/s/a-d "%allusersprofile%\arm32.dll~" 2>nul
dir /b/s/a-d "%allusersprofile%\bot.dll" 2>nul
dir /b/s/a-d "%allusersprofile%\bot.dll~" 2>nul
dir /b/s/a-d "%allusersprofile%\ivn4.dll~" 2>nul
dir /b/s/a-d "%allusersprofile%\ivn4.dll~" 2>nul
dir /b/s/a-d "%allusersprofile%\linker.dll" 2>nul
dir /b/s/a-d "%allusersprofile%\linker.dll~" 2>nul
dir /b/s/a-d "%allusersprofile%\Online Security Guide.url" 2>nul
dir /b/s/a-d "%allusersprofile%\Security Troubleshooting.url" 2>nul
dir /b/s/a-d "%allusersprofile%\partnership.dll" 2>nul
dir /b/s/a-d "%allusersprofile%\partnership.dll~" 2>nul
dir /b/s/a-d "%allusersprofile%\TrustedAntivirus.lnk" 2>nul
dir /b/s/a-d "%allusersprofile%\winsys2f.dll~" 2>nul
dir /b/s/a-d "%allusersprofile%\winsys2f.dll~" 2>nul
dir /b/s/a-d "%allusersprofile%\WinReanimator.lnk" 2>nul
dir /b/s/a-d "%allusersprofile%\WinSecureAv.lnk" 2>nul
dir /b/s/a-d "%commPrograms%\AdvancedCleaner Free\*" 2>nul
dir /b/s/a-d "%commPrograms%\Advanced XP Fixer\*" 2>nul
dir /b/s/a-d "%commPrograms%\AntiMalwareGuard\*" 2>nul
dir /b/s/a-d "%commPrograms%\AntispyStorm\*" 2>nul
dir /b/s/a-d "%commPrograms%\AntiSpywareMaster\*" 2>nul
dir /b/s/a-d "%commPrograms%\Antivir64\*" 2>nul
dir /b/s/a-d "%commPrograms%\AntivirusFiable\*" 2>nul
dir /b/s/a-d "%commPrograms%\Antivirus XP 2008\*" 2>nul
dir /b/s/a-d "%commPrograms%\AV2010\*" 2>nul
dir /b/s/a-d "%commPrograms%\Malware Patrol PRO\*" 2>nul
dir /b/s/a-d "%commPrograms%\Malware Protector 2008\*" 2>nul
dir /b/s/a-d "%commPrograms%\PC-Antispy\*" 2>nul
dir /b/s/a-d "%commPrograms%\PC Clean Pro\*" 2>nul
dir /b/s/a-d "%commPrograms%\PCPrivacyCleaner\*" 2>nul
dir /b/s/a-d "%commPrograms%\PCTotalDefender\*" 2>nul
dir /b/s/a-d "%commPrograms%\Power-Antivirus-2009\*" 2>nul
dir /b/s/a-d "%commPrograms%\Rapid Antivirus\*" 2>nul
dir /b/s/a-d "%commPrograms%\SecureExpertCleaner\*" 2>nul
dir /b/s/a-d "%commPrograms%\SecureFileShredder\*" 2>nul
dir /b/s/a-d "%commPrograms%\SecurePCCleaner\*" 2>nul
dir /b/s/a-d "%commPrograms%\SpyMaxx\*" 2>nul
dir /b/s/a-d "%commPrograms%\SpywareIsolator\*" 2>nul
dir /b/s/a-d "%commPrograms%\SystemDefender\*" 2>nul
dir /b/s/a-d "%commPrograms%\System Doctor Unregistered Version\*" 2>nul
dir /b/s/a-d "%commPrograms%\TrustedAntivirus\*" 2>nul
dir /b/s/a-d "%commPrograms%\UltimateCleaner 2007\*" 2>nul
dir /b/s/a-d "%commPrograms%\Ultimate Defender\*" 2>nul
dir /b/s/a-d "%commPrograms%\vipantispyware\*" 2>nul
dir /b/s/a-d "%commPrograms%\VirusEffaceur\*" 2>nul
dir /b/s/a-d "%commPrograms%\VirusGarde\*" 2>nul
dir /b/s/a-d "%commPrograms%\VirusRemover2008\*" 2>nul
dir /b/s/a-d "%commPrograms%\WinIFixer\*" 2>nul
dir /b/s/a-d "%commPrograms%\WinReanimator\*" 2>nul
dir /b/s/a-d "%commPrograms%\WinSecureAv\*" 2>nul
dir /b/s/a-d "%commPrograms%\XPSecurityCenter\*" 2>nul
dir /b/s/a-d "%userprofile%\~tmp1174.exe" 2>nul
dir /b/s/a-d "%userprofile%\*.tmp.exe" 2>nul
dir /b/s/a-d "%userprofile%\AdvancedCleaner Free.lnk" 2>nul
dir /b/s/a-d "%userprofile%\AdwareRemover2007.lnk" 2>nul
dir /b/s/a-d "%userprofile%\AntiSpywareMaster.lnk" 2>nul
dir /b/s/a-d "%userprofile%\Antivirus Scan.url" 2>nul
dir /b/s/a-d "%userprofile%\BDSM galleries.URL" 2>nul
dir /b/s/a-d "%userprofile%\Cheap Pharmacy Online.url" 2>nul
dir /b/s/a-d "%userprofile%\Click To dnif.exe and Fix Errors.lnk" 2>nul
dir /b/s/a-d "%userprofile%\CP illegal content.URL" 2>nul
dir /b/s/a-d "%userprofile%\Desktop\virii\*" 2>nul
dir /b/s/a-d "%userprofile%\dnif.exe Spyware Remover.lnk" 2>nul
dir /b/s/a-d "%userprofile%\Free MP3 Search.url" 2>nul
dir /b/s/a-d "%userprofile%\Free Online Dating.lnk" 2>nul
dir /b/s/a-d "%userprofile%\Free Porn.url" 2>nul
dir /b/s/a-d "%userprofile%\Go to Casino.lnk" 2>nul
dir /b/s/a-d "%userprofile%\Install ErrorSafe .lnk" 2>nul
dir /b/s/a-d "%userprofile%\Live Safety Center.lnk" 2>nul
dir /b/s/a-d "%userprofile%\MalwareCrush 3.7.lnk" 2>nul
dir /b/s/a-d "%userprofile%\Malware Defender.url" 2>nul
dir /b/s/a-d "%userprofile%\Malware Protection.url" 2>nul
dir /b/s/a-d "%userprofile%\My Documents\SpyDevastator\*" 2>nul
dir /b/s/a-d "%userprofile%\My Documents.url" 2>nul
dir /b/s/a-d "%userprofile%\My Music.url" 2>nul
dir /b/s/a-d "%userprofile%\My Pictures.url" 2>nul
dir /b/s/a-d "%userprofile%\My Video.url" 2>nul
dir /b/s/a-d "%userprofile%\Protect Your Privacy.url" 2>nul
dir /b/s/a-d "%userprofile%\Online Security Center.URL" 2>nul
dir /b/s/a-d "%userprofile%\Online Security Guide.lnk" 2>nul
dir /b/s/a-d "%userprofile%\Online Spyware Test.url" 2>nul
dir /b/s/a-d "%userprofile%\phandler.php.url" 2>nul
dir /b/s/a-d "%userprofile%\Quality BDSM galleries.url" 2>nul
dir /b/s/a-d "%userprofile%\SecurePCCleaner unregistered.lnk" 2>nul
dir /b/s/a-d "%userprofile%\SMS TRAP.url" 2>nul
dir /b/s/a-d "%userprofile%\System Error Fixer.url" 2>nul
dir /b/s/a-d "%userprofile%\spywareisolator.lnk" 2>nul
dir /b/s/a-d "%userprofile%\SystemDoctor.url" 2>nul
dir /b/s/a-d "%userprofile%\Tempmbroit.exe" 2>nul
dir /b/s/a-d "%userprofile%\TrustedAntivirus.lnk" 2>nul
dir /b/s/a-d "%userprofile%\Ultimate Cleaner 2007.lnk" 2>nul
dir /b/s/a-d "%userprofile%\Uncensored porn.URL" 2>nul
dir /b/s/a-d "%userprofile%\VIP Casino.url" 2>nul
dir /b/s/a-d "%userprofile%\Vista Antivirus 2008.lnk" 2>nul
dir /b/s/a-d "%userprofile%\WinAntiSpyware 20*" 2>nul
dir /b/s/a-d "%userprofile%\WinAntiVirus Pro 20*" 2>nul
dir /b/s/a-d "%userprofile%\www.google.com" 2>nul
dir /b/s/a-d "%StaMen%\Antivirus2008\*" 2>nul
dir /b/s/a-d "%StaMen%\Antivirus 2009\*" 2>nul
dir /b/s/a-d "%StaMen%\XP Antivirus 2008\*" 2>nul
dir /b/s/a-d "%Programs%\AdwareRemover2007\*" 2>nul
dir /b/s/a-d "%Programs%\AntiMalware2009\*" 2>nul
dir /b/s/a-d "%Programs%\AntiSpyCheck 2.1\*" 2>nul
dir /b/s/a-d "%Programs%\AntispyKnight\*" 2>nul
dir /b/s/a-d "%Programs%\AntiSpywareXP2009\*" 2>nul
dir /b/s/a-d "%Programs%\Antivirus 2008\*" 2>nul
dir /b/s/a-d "%Programs%\Antivirus 2008 PRO\*" 2>nul
dir /b/s/a-d "%Programs%\AntivirusPro2009\*" 2>nul
dir /b/s/a-d "%Programs%\AntiVirus Lab 2009 2.1\*" 2>nul
dir /b/s/a-d "%Programs%\Brave-Sentry\*" 2>nul
dir /b/s/a-d "%Programs%\ezPorn\*" 2>nul
dir /b/s/a-d "%Programs%\Internet Speed Monitor\*" 2>nul
dir /b/s/a-d "%Programs%\KeyToPorn\*" 2>nul
dir /b/s/a-d "%Programs%\MalwareCrush\*" 2>nul
dir /b/s/a-d "%Programs%\Personal Defender 2009\*" 2>nul
dir /b/s/a-d "%Programs%\PlayMP3z\*" 2>nul
dir /b/s/a-d "%Programs%\Pornovid\*" 2>nul
dir /b/s/a-d "%Programs%\SecureCleaner\*" 2>nul
dir /b/s/a-d "%Programs%\sexvid\*" 2>nul
dir /b/s/a-d "%Programs%\SpyDevastator\*" 2>nul
dir /b/s/a-d "%Programs%\SpyShredder\*" 2>nul
dir /b/s/a-d "%Programs%\SpywareSweeper\*" 2>nul
dir /b/s/a-d "%Programs%\TheSpyBot\*" 2>nul
dir /b/s/a-d "%Programs%\TonsOfPorn\*" 2>nul
dir /b/s/a-d "%Programs%\VirusHeat 4.3\*" 2>nul
dir /b/s/a-d "%Programs%\VirusHeat 4.4\*" 2>nul
dir /b/s/a-d "%Programs%\VirusIsolator\*" 2>nul
dir /b/s/a-d "%Programs%\VirusResponse Lab 2009 2.1\*" 2>nul
dir /b/s/a-d "%Programs%\WinAntispyware2008\*" 2>nul
dir /b/s/a-d "%Programs%\WinXDefender\*" 2>nul
dir /b/s/a-d "%Programs%\XP_AntiSpyware\*" 2>nul
dir /b/s/a-d "%systemdrive%\.protected" 2>nul
dir /b/s/a-d "%systemdrive%\.security" 2>nul
dir /b/s/a-d "%systemdrive%\directx.sys" 2>nul
dir /b/s/a-d "%systemdrive%\directxclks.sys" 2>nul
dir /b/s/a-d "%systemdrive%\Documents and Settings\LocalService\Application Data\ultra\*" 2>nul
dir /b/s/a-d "%systemdrive%\Documents and Settings\LocalService\Application Data\NetMon\*" 2>nul
dir /b/s/a-d "%systemdrive%\directxpush.sys" 2>nul
dir /b/s/a-d "%systemdrive%\Error Cleaner.url" 2>nul
dir /b/s/a-d "%systemdrive%\ftp34.dll" 2>nul
dir /b/s/a-d "%systemdrive%\ie_update3r.exe" 2>nul
dir /b/s/a-d "%systemdrive%\ie_updates3r.exe" 2>nul
dir /b/s/a-d "%systemdrive%\ma1*x*.game" 2>nul
dir /b/s/a-d "%systemdrive%\msftp.dll" 2>nul
dir /b/s/a-d "%systemdrive%\msdirect.sys" 2>nul
dir /b/s/a-d "%systemdrive%\msdirectx.sys" 2>nul
dir /b/s/a-d "%systemdrive%\msdirectxclks.sys" 2>nul
dir /b/s/a-d "%systemdrive%\PrivacyProtector.url" 2>nul
dir /b/s/a-d "%systemdrive%\Privacy Protector.url" 2>nul
dir /b/s/a-d "%systemdrive%\rdriv.sys" 2>nul
dir /b/s/a-d "%systemdrive%\resycled\*" 2>nul
dir /b/s/a-d "%systemdrive%\Sohbet-Script\*" 2>nul
dir /b/s/a-d "%systemdrive%\stdrun*.exe" 2>nul
dir /b/s/a-d "%systemdrive%\Spyware&Malware Protection.url" 2>nul
dir /b/s/a-d "%systemdrive%\Temp\1cb\*" 2>nul
dir /b/s/a-d "%systemdrive%\Temp\xp34\*" 2>nul
dir /b/s/a-d "%systemdrive%\V*xd*.g*e" 2>nul
dir /b/s/a-d "%systemdrive%\VirusEffaceur\*" 2>nul
dir /b/s/a-d "%systemdrive%\VirusGarde\*" 2>nul
dir /b/s/a-d "%systemdrive%\Vx*d*.g*e" 2>nul
dir /b/s/a-d "%systemdrive%\WinSecureAv\*" 2>nul
dir /b/s/a-d "%systemroot%\system32\*.exe.exe" 2>nul
dir /b/s/a-d "%systemroot%\system32\*.exe.dll" 2>nul
dir /b/s/a-d "%systemroot%\system32\tmp*.tmp.dll" 2>nul
dir /b/s/a-d "%systemroot%\*.png.exe" 2>nul
dir /b/s/a-d "%systemroot%\*.tmp.exe" 2>nul
dir /b/s/a-d "%systemroot%\*_netapi.exe" 2>nul
dir /b/s/a-d "%systemroot%\*.df1lb" 2>nul
dir /b/s/a-d "%systemroot%\*.dflb" 2>nul
dir /b/s/a-d "%systemroot%\*.dllb" 2>nul
dir /b/s/a-d "%systemroot%\abc????def*.exe" 2>nul
dir /b/s/a-d "%systemroot%\bdir\ffmiu\*" 2>nul
dir /b/s/a-d "%systemroot%\Bifrost\*" 2>nul
dir /b/s/a-d "%systemroot%\edfimg_*" 2>nul
dir /b/s/a-d "%systemroot%\eraseme_*.exe" 2>nul
dir /b/s/a-d "%systemroot%\FLEOK\*" 2>nul
dir /b/s/a-d "%systemroot%\Fonts\system32\*" 2>nul
dir /b/s/a-d "%systemroot%\haxdrv.sys" 2>nul
dir /b/s/a-d "%systemroot%\hide_evr2.sys" 2>nul
dir /b/s/a-d "%systemroot%\Hpdriver.sys" 2>nul
dir /b/s/a-d "%systemroot%\hxdefdrv.sys" 2>nul
dir /b/s/a-d "%systemroot%\*_ie-hook.dll" 2>nul
dir /b/s/a-d "%systemroot%\mlsdf8h*" 2>nul
dir /b/s/a-d "%systemroot%\mslagent\*" 2>nul
dir /b/s/a-d "%systemroot%\new_drv.sys" 2>nul
dir /b/s/a-d "%systemroot%\nic\sox\*" 2>nul
dir /b/s/a-d "%systemroot%\nlkfev7*" 2>nul
dir /b/s/a-d "%systemroot%\PerfInfo\*" 2>nul
dir /b/s/a-d "%systemroot%\privacy_danger\*" 2>nul
dir /b/s/a-d "%systemroot%\rdrive\*" 2>nul
dir /b/s/a-d "%systemroot%\remon.sys" 2>nul
dir /b/s/a-d "%systemroot%\rofl.sys" 2>nul
dir /b/s/a-d "%systemroot%\sdrive\*" 2>nul
dir /b/s/a-d "%systemroot%\ServicePackFiles\www.google.com\*" 2>nul
dir /b/s/a-d "%systemroot%\sysguard\*" 2>nul
dir /b/s/a-d "%systemroot%\system32\service\*" 2>nul
dir /b/s/a-d "%systemroot%\system32\services\*" 2>nul
dir /b/s/a-d "%systemroot%\SMONITOR.SYS" 2>nul
dir /b/s/a-d "%systemroot%\system32\acespy\*" 2>nul
dir /b/s/a-d "%systemroot%\system32\Bifrost\*" 2>nul
dir /b/s/a-d "%systemroot%\system32\config\systemprofile\TA_Start.lnk" 2>nul
dir /b/s/a-d "%systemroot%\system32\config\systemprofile\Start Menu\Programs\Brave-Sentry\*" 2>nul
dir /b/s/a-d "%systemroot%\system32\csrss.ini" 2>nul
IF EXIST "%systemroot%\system32\v1rg1n" dir /b/s/a-d "%systemroot%\system32\download\*" 2>nul
IF EXIST "%systemroot%\system32\blablabla.exe" dir /b/s/a-d "%systemroot%\system32\download\*" 2>nul
dir /b/s/a-d "%systemroot%\system32\dllcache\win32\*" 2>nul
dir /b/s/a-d "%systemroot%\system32\EV02\*" 2>nul
dir /b/s/a-d "%systemroot%\system32\k\*.exe" 2>nul
dir /b/s/a-d "%systemroot%\system32\kazaabackupfiles\*" 2>nul
dir /b/s/a-d "%systemroot%\system32\KaZaaBinaries\*" 2>nul
dir /b/s/a-d "%systemroot%\system32\KBRunOnce*.t*" 2>nul
IF EXIST "%systemroot%\system32\blablabla.exe" dir /b/s/a-d "%systemroot%\system32\logs\*" 2>nul
IF EXIST "%systemroot%\system32\v1rg1n" dir /b/s/a-d "%systemroot%\system32\logs\*" 2>nul
dir /b/s/a-d "%systemroot%\system32\orb32wvx\*" 2>nul
IF EXIST "%systemroot%\system32\blablabla.exe" dir /b/s/a-d "%systemroot%\system32\sounds\*" 2>nul
IF EXIST "%systemroot%\system32\v1rg1n" dir /b/s/a-d "%systemroot%\system32\sounds\*" 2>nul
dir /b/s/a-d "%systemroot%\system32\vir5\*" 2>nul
dir /b/s/a-d "%systemroot%\system32\vod1\*" 2>nul
dir /b/s/a-d "%systemroot%\system32\windows32\*" 2>nul
dir /b/s/a-d "%systemroot%\system32\winlogon.ini" 2>nul
dir /b/s/a-d "%systemroot%\Temp\*.tmp.lst" 2>nul
dir /b/s/a-d "%systemroot%\Temp\*.tmp.exe" 2>nul
dir /b/s/a-d "%systemroot%\Temp\ms-??.exe" 2>nul
dir /b/s/a-d "%systemroot%\Temp\spoolsv\*" 2>nul
dir /b/s/a-d "%systemroot%\Temp\v*x*.g*e" 2>nul
dir /b/s/a-d "%systemroot%\timedrv26.sys" 2>nul
dir /b/s/a-d "%systemroot%\win32sydkey\*" 2>nul
dir /b/s/a-d "%systemroot%\winmon.sys" 2>nul
dir /b/s/a-d "%temp%\*.tmp.taras" 2>nul
dir /b/s/a-d "%temp%\*.tmp.dll" 2>nul
dir /b/s/a-d "%temp%\*.png.exe" 2>nul
dir /b/s/a-d "%temp%\*.df1lb" 2>nul
dir /b/s/a-d "%temp%\*.dflb" 2>nul
dir /b/s/a-d "%temp%\*.dllb" 2>nul
dir /b/s/a-d "%temp%\ac8zt2\*" 2>nul
dir /b/s/a-d "%programfiles%\180searchassistant\*" 2>nul
dir /b/s/a-d "%programfiles%\180search assistant\*" 2>nul
dir /b/s/a-d "%programfiles%\180solutions\*" 2>nul
dir /b/s/a-d "%programfiles%\3721\*" 2>nul
dir /b/s/a-d "%programfiles%\Accessories\Common\*" 2>nul
dir /b/s/a-d "%programfiles%\Accoona\*" 2>nul
dir /b/s/a-d "%programfiles%\AdvancedCleaner Free\*" 2>nul
dir /b/s/a-d "%programfiles%\AdwareRemover2007\*" 2>nul
dir /b/s/a-d "%programfiles%\akl\*" 2>nul
dir /b/s/a-d "%programfiles%\altcmd\*" 2>nul
dir /b/s/a-d "%programfiles%\amsys\*" 2>nul
dir /b/s/a-d "%programfiles%\AntiMalwareGuard\*" 2>nul
dir /b/s/a-d "%programfiles%\AntiSpyCheck 2.1\*" 2>nul
dir /b/s/a-d "%programfiles%\AntispyKnight\*" 2>nul
dir /b/s/a-d "%programfiles%\AntispyStorm\*" 2>nul
dir /b/s/a-d "%programfiles%\AntiSpywareMaster\*" 2>nul
dir /b/s/a-d "%programfiles%\AntiSpywareExpert\*" 2>nul
dir /b/s/a-d "%programfiles%\AntiSpywareXP2009\*" 2>nul
dir /b/s/a-d "%programfiles%\Antivir64\*" 2>nul
dir /b/s/a-d "%programfiles%\Antivirus2008\*" 2>nul
dir /b/s/a-d "%programfiles%\Antivirus2008y\*" 2>nul
dir /b/s/a-d "%programfiles%\Antivirus 2008\*" 2>nul
dir /b/s/a-d "%programfiles%\Antivirus 2008 PRO\*" 2>nul
dir /b/s/a-d "%programfiles%\Antivirus 2009\*" 2>nul
dir /b/s/a-d "%programfiles%\AntiVirusLab2009\*" 2>nul
dir /b/s/a-d "%programfiles%\AntivirusFiable\*" 2>nul
dir /b/s/a-d "%programfiles%\AntivirusPro2009\*" 2>nul
IF EXIST "%programfiles%\Applications\iebr.dll" dir /b/s/a-d "%programfiles%\Applications\*" 2>nul
dir /b/s/a-d "%programfiles%\ASC 2.1\*" 2>nul
dir /b/s/a-d "%programfiles%\aspch\*" 2>nul
dir /b/s/a-d "%programfiles%\ASpyC\*" 2>nul
dir /b/s/a-d "%programfiles%\AV2010\*" 2>nul
dir /b/s/a-d "%programfiles%\AV9\*" 2>nul
dir /b/s/a-d "%programfiles%\AXPFixer\*" 2>nul
dir /b/s/a-d "%programfiles%\BChanger\*" 2>nul
dir /b/s/a-d "%programfiles%\Bifrost\*" 2>nul
dir /b/s/a-d "%programfiles%\BraveSentry\*" 2>nul
dir /b/s/a-d "%programfiles%\cjb\*" 2>nul
dir /b/s/a-d "%programfiles%\config32\*" 2>nul
dir /b/s/a-d "%programfiles%\CPV\*" 2>nul
dir /b/s/a-d "%programfiles%\dbar\*" 2>nul
dir /b/s/a-d "%programfiles%\dfsdfsd\*" 2>nul
dir /b/s/a-d "%programfiles%\Dot1XCfg\*" 2>nul
dir /b/s/a-d "%programfiles%\drmupgds\*" 2>nul
dir /b/s/a-d "%programfiles%\E404 Helper\*" 2>nul
dir /b/s/a-d "%programfiles%\E404DHelper\*" 2>nul
dir /b/s/a-d "%programfiles%\Eroca\*" 2>nul
dir /b/s/a-d "%programfiles%\ExpertHelper\*" 2>nul
dir /b/s/a-d "%programfiles%\ezPorn\*" 2>nul
dir /b/s/a-d "%programfiles%\e-zshopper\*" 2>nul
dir /b/s/a-d "%programfiles%\FBrowsingAdvisor\*" 2>nul
dir /b/s/a-d "%programfiles%\Files-Secure\*" 2>nul
dir /b/s/a-d "%programfiles%\GetModule\*" 2>nul
dir /b/s/a-d "%programfiles%\GetPack\*" 2>nul
dir /b/s/a-d "%programfiles%\GIGAPorn\*" 2>nul
dir /b/s/a-d "%programfiles%\Helper\*" 2>nul
dir /b/s/a-d "%programfiles%\iCheck\*" 2>nul
dir /b/s/a-d "%programfiles%\IEAntiVirus\*" 2>nul
dir /b/s/a-d "%programfiles%\IE Extensions\*" 2>nul
dir /b/s/a-d "%programfiles%\Inet Delivery\*" 2>nul
dir /b/s/a-d "%programfiles%\InetGet2\*" 2>nul
dir /b/s/a-d "%programfiles%\Insider\*" 2>nul
dir /b/s/a-d "%programfiles%\Internet Explorer Assistant\*" 2>nul
dir /b/s/a-d "%programfiles%\Internet Speed Monitor\*" 2>nul
dir /b/s/a-d "%programfiles%\Ipwindows\*" 2>nul
dir /b/s/a-d "%programfiles%\iSecurity\*" 2>nul
dir /b/s/a-d "%programfiles%\ISM\*" 2>nul
dir /b/s/a-d "%programfiles%\ISM2\*" 2>nul
dir /b/s/a-d "%programfiles%\JavaCore\*" 2>nul
dir /b/s/a-d "%programfiles%\kernel\*" 2>nul
dir /b/s/a-d "%programfiles%\KeyToPorn\*" 2>nul
dir /b/s/a-d "%programfiles%\LPVideoPlugin\*" 2>nul
dir /b/s/a-d "%programfiles%\MalwareBell\*" 2>nul
dir /b/s/a-d "%programfiles%\MalwareCrush\*" 2>nul
dir /b/s/a-d "%programfiles%\MapEDC\*" 2>nul
dir /b/s/a-d "%programfiles%\MediaEldoradoCodec\*" 2>nul
dir /b/s/a-d "%programfiles%\MediaJukeCodec\*" 2>nul
dir /b/s/a-d "%programfiles%\MediaVideoCodec\*" 2>nul
dir /b/s/a-d "%programfiles%\MicroAntivirus\*" 2>nul
dir /b/s/a-d "%programfiles%\MicroAV\*" 2>nul
dir /b/s/a-d "%programfiles%\Microsoft Common\*" 2>nul
dir /b/s/a-d "%programfiles%\Microsoft Security Adviser\*" 2>nul
dir /b/s/a-d "%programfiles%\mIRC\IRC Bot\*" 2>nul
dir /b/s/a-d "%programfiles%\mjc\*" 2>nul
dir /b/s/a-d "%programfiles%\Mjcore\*" 2>nul
dir /b/s/a-d "%programfiles%\Mozilla Firefox\extensions\sotfone-tracker@sotfone.ru\*" 2>nul
dir /b/s/a-d "%programfiles%\MPatrolPRO\*" 2>nul
dir /b/s/a-d "%programfiles%\MS Antivirus\*" 2>nul
dir /b/s/a-d "%programfiles%\NetProject\*" 2>nul
dir /b/s/a-d "%programfiles%\NoDNS\*" 2>nul
dir /b/s/a-d "%programfiles%\nvcoi\*" 2>nul
dir /b/s/a-d "%programfiles%\p2pnetworks\*" 2>nul
dir /b/s/a-d "%programfiles%\PC-Antispy\*" 2>nul
dir /b/s/a-d "%programfiles%\PC Clean Pro\*" 2>nul
dir /b/s/a-d "%programfiles%\PCTotalDefender\*" 2>nul
dir /b/s/a-d "%programfiles%\PlayMP3z\*" 2>nul
IF EXIST "%programfiles%\programsis\m5z.exe" dir /b/s/a-d "%programfiles%\programsis\*" 2>nul
dir /b/s/a-d "%programfiles%\PCHealthCenter\*" 2>nul
dir /b/s/a-d "%programfiles%\PCPrivacyCleaner\*" 2>nul
dir /b/s/a-d "%programfiles%\PersonalAntiSpy Free\*" 2>nul
dir /b/s/a-d "%programfiles%\Personal Defender 2009\*" 2>nul
dir /b/s/a-d "%programfiles%\PestTrap\*" 2>nul
dir /b/s/a-d "%programfiles%\poolsv\*" 2>nul
dir /b/s/a-d "%programfiles%\Pornovid\*" 2>nul
dir /b/s/a-d "%programfiles%\Power-Antivirus-2009\*" 2>nul
dir /b/s/a-d "%programfiles%\QdrDrive\*" 2>nul
dir /b/s/a-d "%programfiles%\QdrPack\*" 2>nul
dir /b/s/a-d "%programfiles%\QdrModule\*" 2>nul
dir /b/s/a-d "%programfiles%\Rapid Antivirus\*" 2>nul
dir /b/s/a-d "%programfiles%\RichVideoCodec\*" 2>nul
dir /b/s/a-d "%programfiles%\Router\*" 2>nul
dir /b/s/a-d "%programfiles%\s300\*" 2>nul
dir /b/s/a-d "%programfiles%\Sakora\*" 2>nul
dir /b/s/a-d "%programfiles%\SecureCleaner\*" 2>nul
dir /b/s/a-d "%programfiles%\SecureExpertCleaner\*" 2>nul
dir /b/s/a-d "%programfiles%\SecureFileShredder\*" 2>nul
dir /b/s/a-d "%programfiles%\SecurePCCleaner\*" 2>nul
dir /b/s/a-d "%programfiles%\seekmo\*" 2>nul
dir /b/s/a-d "%programfiles%\ShopperLink\*" 2>nul
dir /b/s/a-d "%programfiles%\Skra\*" 2>nul
dir /b/s/a-d "%programfiles%\Sotfone\*" 2>nul
dir /b/s/a-d "%programfiles%\Spcron\*" 2>nul
dir /b/s/a-d "%programfiles%\sprof\*" 2>nul
dir /b/s/a-d "%programfiles%\Spruce\*" 2>nul
dir /b/s/a-d "%programfiles%\SpyDevastator\*" 2>nul
dir /b/s/a-d "%programfiles%\SpyMaxx\*" 2>nul
dir /b/s/a-d "%programfiles%\SpyGuarder\*" 2>nul
dir /b/s/a-d "%programfiles%\SpyShredder\*" 2>nul
dir /b/s/a-d "%programfiles%\SpywareIsolator\*" 2>nul
dir /b/s/a-d "%programfiles%\SpywareSweeper\*" 2>nul
dir /b/s/a-d "%programfiles%\SunPorn\*" 2>nul
dir /b/s/a-d "%programfiles%\Svconr\*" 2>nul
dir /b/s/a-d "%programfiles%\svhost\*" 2>nul
dir /b/s/a-d "%programfiles%\Sysmnt\*" 2>nul
dir /b/s/a-d "%programfiles%\SystemDefender\*" 2>nul
dir /b/s/a-d "%programfiles%\System Doctor Free\*" 2>nul
dir /b/s/a-d "%programfiles%\Temporary\*" 2>nul
dir /b/s/a-d "%programfiles%\TheSpyBot\*" 2>nul
dir /b/s/a-d "%programfiles%\TonsOfPorn\*" 2>nul
dir /b/s/a-d "%programfiles%\TotalSecure2009\*" 2>nul
dir /b/s/a-d "%programfiles%\TrustedAntivirus\*" 2>nul
dir /b/s/a-d "%programfiles%\TS-2009\*" 2>nul
dir /b/s/a-d "%programfiles%\Twain\*" 2>nul
dir /b/s/a-d "%programfiles%\Ultimate Cleaner\*" 2>nul
dir /b/s/a-d "%programfiles%\Ultimate Defender\*" 2>nul
dir /b/s/a-d "%programfiles%\VAV\*" 2>nul
dir /b/s/a-d "%programfiles%\Video Add-on\*" 2>nul
dir /b/s/a-d "%programfiles%\VideoAccessCodec\*" 2>nul
dir /b/s/a-d "%programfiles%\vipantispyware\*" 2>nul
dir /b/s/a-d "%programfiles%\VirRL2009\*" 2>nul
dir /b/s/a-d "%programfiles%\VirusEffaceur\*" 2>nul
dir /b/s/a-d "%programfiles%\VirusGarde\*" 2>nul
dir /b/s/a-d "%programfiles%\VirusHeat 4.3\*" 2>nul
dir /b/s/a-d "%programfiles%\VirusHeat 4.4\*" 2>nul
dir /b/s/a-d "%programfiles%\VirusIsolator\*" 2>nul
dir /b/s/a-d "%programfiles%\VirusRemover2008\*" 2>nul
dir /b/s/a-d "%programfiles%\VirusResponseLab2009\*" 2>nul
dir /b/s/a-d "%programfiles%\VnrBlock\*" 2>nul
dir /b/s/a-d "%programfiles%\VnrPack\*" 2>nul
dir /b/s/a-d "%programfiles%\VResLab\*" 2>nul
dir /b/s/a-d "%programfiles%\Web Buying\*" 2>nul
dir /b/s/a-d "%programfiles%\Web Technologies\*" 2>nul
IF EXIST "%programfiles%\Webtools\webtools.dll" dir /b/s/a-d "%programfiles%\Webtools\*" 2>nul
dir /b/s/a-d "%programfiles%\win32a\*" 2>nul
dir /b/s/a-d "%programfiles%\WinAble\*" 2>nul
dir /b/s/a-d "%programfiles%\WinAntispyware2008\*" 2>nul
dir /b/s/a-d "%programfiles%\WinIFixer\*" 2>nul
dir /b/s/a-d "%programfiles%\WinPop\*" 2>nul
dir /b/s/a-d "%programfiles%\WinReanimator\*" 2>nul
dir /b/s/a-d "%programfiles%\WinSecureAv\*" 2>nul
dir /b/s/a-d "%programfiles%\winvi\*" 2>nul
dir /b/s/a-d "%programfiles%\WinXDefender\*" 2>nul
dir /b/s/a-d "%programfiles%\WinXProtector\*" 2>nul
dir /b/s/a-d "%programfiles%\WinX Security Center\*" 2>nul
dir /b/s/a-d "%programfiles%\Words\*" 2>nul
dir /b/s/a-d "%programfiles%\xInsIDE\*" 2>nul
dir /b/s/a-d "%programfiles%\XP_Antispyware\*" 2>nul
dir /b/s/a-d "%programfiles%\XP Antivirus\*" 2>nul
dir /b/s/a-d "%programfiles%\XPSecurityCenter\*" 2>nul
dir /b/s/a-d "%programfiles%\rtemego.html" 2>nul
dir /b/s/a-d "%programfiles%\zango\*" 2>nul
dir /b/s/a-d "%commonprogramfiles%\AntivirusFiable\*" 2>nul
dir /b/s/a-d "%commonprogramfiles%\PCTotalDefender\*" 2>nul
dir /b/s/a-d "%commonprogramfiles%\PersonalAntiSpy\*" 2>nul
dir /b/s/a-d "%commonprogramfiles%\Yazzle*" 2>nul
dir /b/s/a-d "%commonprogramfiles%\SecurePCCleaner\*" 2>nul
dir /b/s/a-d "%commonprogramfiles%\SpyGuarder\*" 2>nul
dir /b/s/a-d "%commonprogramfiles%\System Doctor\*" 2>nul
dir /b/s/a-d "%commonprogramfiles%\TrustedAntivirus\*" 2>nul
dir /b/s/a-d "%commonprogramfiles%\VirusEffaceur\*" 2>nul
dir /b/s/a-d "%commonprogramfiles%\VirusGarde\*" 2>nul
dir /b/s/a-d "%commonprogramfiles%\WinSecureAv\*" 2>nul
dir /b/s/a-d "%commonprogramfiles%\WinXProtector\*" 2>nul
dir /b/s/a-d "%commonprogramfiles%\WinX Security Center\*" 2>nul
	)

cls
echo.
echo Starting Repairs
echo.
echo Checking Running Processes and Services
echo.
echo.
echo Please Be Patient As This May Take Up To 20 Minutes
echo.
echo Restoring Default Security Values
echo Restoring Default Hosts File
echo.
echo Note - Protective Host Files such as MVPS/HP hosts or Spybots
echo        Immunizer feature should be reapplied after using SDFix
echo.
echo Checking Files
echo.
echo Please Wait
echo.
echo 100%% Checked

For %%c in (
"%allstart%\msn_*_upd*.exe"
"%allstart%\MS_update_061*_KB*.exe"
"%allstart%\MS_update_070*_KB*.exe"
"%ALLUSERSPROFILE%\MenuDm~1\Programmes\Dmarra~1\msn_*_upd*.exe"
"%start%\MS_update_061*_KB*.exe"
"%start%\MS_update_070*_KB*.exe"
"%userprofile%\MenuDm~1\Programmes\Dmarra~1\msn_*_upd*.exe"
"%userprofile%\MediaTubeCodec*.exe"
"%start%\msn_*_upd*.exe"
"%start%\MSWin--*.exe"
"%programfiles%\MSN Gaming Zone\mero?????.dll"
"%programfiles%\Online Services\lawuhe*.dll"
"%programfiles%\Online Services\sadeho*.dll"
"%programfiles%\Outlook Express\bugamu*.dll"
"%programfiles%\rcx?.tmp"
"%commdocs%\*.scr"
"%commonprogramfiles%\*._sy"
"%commonprogramfiles%\*.scr"
"%commonprogramfiles%\Microsoft Shared\Web Folders\ibm00*"
"%commonprogramfiles%\Microsoft Shared\Web Folders\clea*"
"%userprofile%\xrt_????.exe"
"%userprofile%\xx_????.exe"
"%appdata%\antivirusinstallfree*.exe"
"%appdata%\Google\mupd*_*_*.exe"
%temp%\?.exe
%temp%\.tt*.tmp
%temp%\.tt*.tmp.exe
%temp%\.tt*.tmp.vbs
%temp%\*.exe.bat
%temp%\A?-tmpa-install.exe
%temp%\A??-tmpaoi.exe
%temp%\*exgmrgml*.exe
%temp%\Binaries?.cab?
%temp%\Clean_*.dll
%temp%\dimarik_?.exe
%temp%\DVC-Foto*.zip
%temp%\DVR-Imagen*.zip
%temp%\facebook*.com.zip
%temp%\foto_*.zip
%temp%\gettpa*.exe
%temp%\HDVideodll_*.*.*.exe
%temp%\image*.zip
%temp%\ingen???.exe
%temp%\inst1_2??.exe
%temp%\inst2_2??.exe
%temp%\ismtpa*.exe
%temp%\kb2??????.exe
%temp%\Keygen*.exe
%temp%\loadadv???.exe
%temp%\maxpay*.game
%temp%\MTE*DoxNg.exe
%temp%\NewestPicture*.zip
%temp%\photo*.zip
%temp%\Setup_ver*.*.*.exe
%temp%\sft_ver*.*.*.exe
%temp%\StarCodec_ver*.exe
%temp%\tds??.tmp
%temp%\teste?_p.exe
%temp%\tmp??.tmp
%temp%\video*.cfg.exe
%temp%\VideoAccessCodec*.exe
%temp%\wrdwn?
%temp%\xxx1???.exe
%temp%\xxx2???.exe
%temp%\xxx3???.exe
%temp%\xxx4???.exe
%temp%\xxx5???.exe
%temp%\xxx6???.exe
%temp%\xxx7???.exe
%temp%\xxx8???.exe
%temp%\xxx9???.exe
%temp%\xxx0???.exe
%temp%\zfe?.exe
%systemdrive%\?.bat
%systemdrive%\?.exe
%systemdrive%\*.exe1
%systemdrive%\_?.exe
%systemdrive%\000000*.exe
%systemdrive%\1?.tmp
%systemdrive%\2?.tmp
%systemdrive%\3?.tmp
%systemdrive%\b?_log.txt
%systemdrive%\download15??.exe
%systemdrive%\eraseme_*.exe
%systemdrive%\HDOV*.exe
%systemdrive%\myspace*.exe
%systemdrive%\sex*.exe
%systemdrive%\Temp\tmp?.tmp
%systemdrive%\TIGEN00?.exe
%systemdrive%\WINDOWSMY_Photos_*.zip
%systemdrive%\WINDOWSPhoto_*.zip
%systemroot%\?.bat
%systemroot%\?.exe
%systemroot%\*_jpg.zip
%systemroot%\*._sy
%systemroot%\*.com-error.html
%systemroot%\*Keygen.exe
%systemroot%\17PHolmes*.exe
%systemroot%\3??.reg
"%systemroot%\album*.zip"
%systemroot%\b10?.exe
%systemroot%\b11?.exe
%systemroot%\b12?.exe
%systemroot%\b13?.exe
%systemroot%\b14?.exe
%systemroot%\b15?.exe
%systemroot%\b16?.exe
%systemroot%\aetlsrkn???.dll
"%systemroot%\beachpic*.zip"
%systemroot%\blopenv???.dll
%systemroot%\bndsr???.dll
%systemroot%\boqnrwdm???.dll
%systemroot%\Chirstmas*.zip
%systemroot%\Christmas*.zip
%systemroot%\DCS*.zip
%systemroot%\ddwlxtq???.dll
%systemroot%\dfmlxbpk???.dll
%systemroot%\dgtxrdf???.dll
%systemroot%\dkxrstq???.dll 
%systemroot%\dmdqdrx???.dll
%systemroot%\dmdvpn???.dll
%systemroot%\dnqdlpm???.dll
%systemroot%\dntpkwo???.dll
%systemroot%\domnftw???.dll
%systemroot%\dopfwrl???.dll
%systemroot%\downloadme*.zip
%systemroot%\dpvtpor???.dll
%systemroot%\drnpfdx???.dll
"%systemroot%\DSC0*.zip"
%systemroot%\dwrmnts???.dll
%systemroot%\dwvdwnq???.dll
%systemroot%\dxpvqlm???.dll
%systemroot%\emdat.tm?
%systemroot%\file*.zip
%systemroot%\fvowketq???.dll
%systemroot%\gfetqaxs???.dll
%systemroot%\gndarmbl???.dll
%systemroot%\grfxbano???.dll
%systemroot%\Hotmail-Album-*.zip
%systemroot%\HPIM*.zip
"%systemroot%\img*.zip"
"%systemroot%\image*.zip"
%systemroot%\JPGimage*.zip
%systemroot%\kdftlboe???.dll
%systemroot%\kgxmotap???.dll
%systemroot%\kgqfwelt???.dll
%systemroot%\ksendlbt???.dll
%systemroot%\kvsdpfea???.dll
%systemroot%\kx1????.dll
%systemroot%\kx2????.dll
%systemroot%\kx3????.dll
%systemroot%\kx4????.dll
%systemroot%\kx5????.dll
%systemroot%\kx6????.dll
%systemroot%\kx7????.dll
%systemroot%\kx8????.dll
%systemroot%\kx9????.dll
%systemroot%\kx0????.dll
%systemroot%\lgmxvpat???.dll
%systemroot%\loadadv???.exe
%systemroot%\look*.zip
"%systemroot%\love*.zip"
%systemroot%\mesdxbrq???.dll
%systemroot%\mljul?.exe
%systemroot%\mrofinu*.exe
%systemroot%\mrofinu*.exe.tmp
%systemroot%\myalbum*.zip
%systemroot%\MyGallery*.zip
%systemroot%\My-Pic*.zip
%systemroot%\mypic*.zip
%systemroot%\myphotos*.zip
%systemroot%\news*.zip
%systemroot%\nfavxwdb???.dll
%systemroot%\nkefbltd???.dll
%systemroot%\nldfmtap???.dll
%systemroot%\nogxfvbl???.dll
%systemroot%\nslbvxpg???.dll
%systemroot%\PART0?00.DAT
"%systemroot%\photo*.zip"
"%systemroot%\pic*.zip"
%systemroot%\promo?.html
%systemroot%\promogif?.gif
%systemroot%\qnmargol???.dll
%systemroot%\qvlbodmn???.dll
%systemroot%\temlxopq???.dll
%systemroot%\retadpu*.exe
%systemroot%\rodqgpvl???.dll
%systemroot%\rsdgbtkq???.dll
"%systemroot%\secretimag*.zip"
%systemroot%\ServicePackFiles\mmshst???.exe
%systemroot%\ServicePackFiles\mm????.exe
%systemroot%\SexyMama.JPG.exe
%systemroot%\stfMeane???.exe
%systemroot%\soso?.exe
%systemroot%\svpekgon???.dll
%systemroot%\system32KBRunOnce*.t*
%systemroot%\system32\{*-*-*-*-*}.dll-uninst.exe
%systemroot%\system32\_mzu_stonedrv?.exe
%systemroot%\system32\_tmp????
%systemroot%\system32\___?.dll
%systemroot%\system32\___?.exe
%systemroot%\system32\___?
%systemroot%\system32\?.bat
%systemroot%\system32\?.exe
%systemroot%\system32\?.tmp
%systemroot%\system32\?x32.exe
%systemroot%\system32\*._sy
%systemroot%\system32\000???.exe
%systemroot%\system32\?.ico
%systemroot%\system32\1??.reg
%systemroot%\system32\2??.reg
%systemroot%\system32\3??.reg
%systemroot%\system32\4??.reg
%systemroot%\system32\5??.reg
%systemroot%\system32\6??.reg
%systemroot%\system32\7??.reg
%systemroot%\system32\8??.reg
%systemroot%\system32\9??.reg
%systemroot%\system32\0??.reg
%systemroot%\system32\70???.exe
%systemroot%\system32\71???.exe
%systemroot%\system32\72???.exe
%systemroot%\system32\73???.exe
%systemroot%\system32\74???.exe
%systemroot%\system32\75???.exe
%systemroot%\system32\76???.exe
%systemroot%\system32\77???.exe
%systemroot%\system32\78???.exe
%systemroot%\system32\79???.exe
%systemroot%\system32\80???.exe
%systemroot%\system32\81???.exe
%systemroot%\system32\82???.exe
%systemroot%\system32\83???.exe
%systemroot%\system32\84???.exe
%systemroot%\system32\85???.exe
%systemroot%\system32\86???.exe
%systemroot%\system32\87???.exe
%systemroot%\system32\88???.exe
%systemroot%\system32\89???.exe
%systemroot%\system32\2??.tmp
%systemroot%\system32\1??.tmp
%systemroot%\system32\*_exception.nls
%systemroot%\system32\*Keygen.exe
%systemroot%\system32\*Keygen].exe
%systemroot%\system32\AV2009Install_*.exe
%systemroot%\system32\boyl0??.exe
%systemroot%\system32\boyl1??.exe
%systemroot%\system32\boyl2??.exe
%systemroot%\system32\boyl3??.exe
%systemroot%\system32\boyl4??.exe
%systemroot%\system32\boyl5??.exe
%systemroot%\system32\boyl6??.exe
%systemroot%\system32\boyl7??.exe
%systemroot%\system32\boyl8??.exe
%systemroot%\system32\boyl9??.exe
%systemroot%\system32\bskl0??.exe
%systemroot%\system32\bskl1??.exe
%systemroot%\system32\bskl2??.exe
%systemroot%\system32\bskl3??.exe
%systemroot%\system32\bskl4??.exe
%systemroot%\system32\bskl5??.exe
%systemroot%\system32\bskl6??.exe
%systemroot%\system32\bskl7??.exe
%systemroot%\system32\bskl8??.exe
%systemroot%\system32\bskl9??.exe
%systemroot%\system32\ClickToFindandFixErrors_*.ico
%systemroot%\system32\comcs32?.dll
%systemroot%\system32\De*eteme.bat
%systemroot%\system32\dflgh8jk*.exe
%systemroot%\system32\dflgh8jk*.exe~
%systemroot%\system32\dlh9jk*.exe
%systemroot%\system32\dlh9jk*.exe~
%systemroot%\system32\dllgh8jk*.exe
%systemroot%\system32\dllgh8jk*.exe~
%systemroot%\system32\dllh8jk*.exe
%systemroot%\system32\dllh8jk*.exe~
%systemroot%\system32\drivers\core.cache^(*^).dsk
%systemroot%\system32\game?.exe
%systemroot%\system32\goht0??.exe
%systemroot%\system32\goht1??.exe
%systemroot%\system32\goht2??.exe
%systemroot%\system32\goht3??.exe
%systemroot%\system32\goht4??.exe
%systemroot%\system32\goht5??.exe
%systemroot%\system32\goht6??.exe
%systemroot%\system32\goht7??.exe
%systemroot%\system32\goht8??.exe
%systemroot%\system32\goht9??.exe
%systemroot%\system32\gtms0??.exe
%systemroot%\system32\gtms1??.exe
%systemroot%\system32\gtms2??.exe
%systemroot%\system32\gtms3??.exe
%systemroot%\system32\gtms4??.exe
%systemroot%\system32\gtms5??.exe
%systemroot%\system32\gtms6??.exe
%systemroot%\system32\gtms7??.exe
%systemroot%\system32\gtms8??.exe
%systemroot%\system32\gtms9??.exe
%systemroot%\system32\HDTVDecoder_ver*.exe
%systemroot%\system32\herjt???.exe
%systemroot%\system32\IEBHO??.dll
%systemroot%\system32\img*.JPG.exe
%systemroot%\system32\img*.rar
%systemroot%\system32\img*.zip
%systemroot%\system32\image.b??
%systemroot%\system32\jhgsdf*.exe
%systemroot%\system32\jpwnw64?.exe
%systemroot%\system32\kjpn0??.exe
%systemroot%\system32\kjpn1??.exe
%systemroot%\system32\kjpn2??.exe
%systemroot%\system32\kjpn3??.exe
%systemroot%\system32\kjpn4??.exe
%systemroot%\system32\kjpn5??.exe
%systemroot%\system32\kjpn6??.exe
%systemroot%\system32\kjpn7??.exe
%systemroot%\system32\kjpn8??.exe
%systemroot%\system32\kjpn9??.exe
%systemroot%\system32\loadadv???.exe
%systemroot%\system32\m1ax1d1*.exe
%systemroot%\system32\m4x[?]
%systemroot%\system32\max1d1*.exe
%systemroot%\system32\maxpaynow*.exe
%systemroot%\system32\mini?tone.ini
%systemroot%\system32\msdnc0.exe
%systemroot%\system32\msdnc1.exe
%systemroot%\system32\msdnc2.exe
%systemroot%\system32\msdnc3.exe
%systemroot%\system32\msdnc4.exe
%systemroot%\system32\msdnc5.exe
%systemroot%\system32\msdnc6.exe
%systemroot%\system32\msdnc7.exe
%systemroot%\system32\msdnc8.exe
%systemroot%\system32\msdnc9.exe
%systemroot%\system32\msgk0??.exe
%systemroot%\system32\msgk1??.exe
%systemroot%\system32\msgk2??.exe
%systemroot%\system32\msgk3??.exe
%systemroot%\system32\msgk4??.exe
%systemroot%\system32\msgk5??.exe
%systemroot%\system32\msgk6??.exe
%systemroot%\system32\msgk7??.exe
%systemroot%\system32\msgk8??.exe
%systemroot%\system32\msgk9??.exe
%systemroot%\system32\mssrv32^(*^).exe
%systemroot%\system32\msuu0??.exe
%systemroot%\system32\msuu1??.exe
%systemroot%\system32\msuu2??.exe
%systemroot%\system32\msuu3??.exe
%systemroot%\system32\msuu4??.exe
%systemroot%\system32\msuu5??.exe
%systemroot%\system32\msuu6??.exe
%systemroot%\system32\msuu7??.exe
%systemroot%\system32\msuu8??.exe
%systemroot%\system32\msuu9??.exe
%systemroot%\system32\n*wm*xxsv*.exe
%systemroot%\system32\oirh0??.exe
%systemroot%\system32\oirh1??.exe
%systemroot%\system32\oirh2??.exe
%systemroot%\system32\oirh3??.exe
%systemroot%\system32\oirh4??.exe
%systemroot%\system32\oirh5??.exe
%systemroot%\system32\oirh6??.exe
%systemroot%\system32\oirh7??.exe
%systemroot%\system32\oirh8??.exe
%systemroot%\system32\oirh9??.exe
%systemroot%\system32\photo_0*.scr
%systemroot%\system32\photo_0*.zip
%systemroot%\system32\pnsm0??.exe
%systemroot%\system32\pnsm1??.exe
%systemroot%\system32\pnsm2??.exe
%systemroot%\system32\pnsm3??.exe
%systemroot%\system32\pnsm4??.exe
%systemroot%\system32\pnsm5??.exe
%systemroot%\system32\pnsm6??.exe
%systemroot%\system32\pnsm7??.exe
%systemroot%\system32\pnsm8??.exe
%systemroot%\system32\pnsm9??.exe
%systemroot%\system32\qvxga*m*.exe
%systemroot%\system32\qvx*game*.exe
%systemroot%\system32\rori0??.exe
%systemroot%\system32\rori1??.exe
%systemroot%\system32\rori2??.exe
%systemroot%\system32\rori3??.exe
%systemroot%\system32\rori4??.exe
%systemroot%\system32\rori5??.exe
%systemroot%\system32\rori6??.exe
%systemroot%\system32\rori7??.exe
%systemroot%\system32\rori8??.exe
%systemroot%\system32\rori9??.exe
%systemroot%\system32\RunOnce*.t__
%systemroot%\system32\RunOnce*.tm_
%systemroot%\system32\RunOnce*.tmp
%systemroot%\system32\sahagent????.exe
%systemroot%\system32\setup_?????.exe
%systemroot%\system32\Setup_v.?.???.exe
%systemroot%\system32\setup_incred_*.exe
%systemroot%\system32\sex?.ico
%systemroot%\system32\sex?.ico.tmp
%systemroot%\system32\shot_*.*_*.html
%systemroot%\system32\sqvx*game*.exe
%systemroot%\system32\sqvxga*me*.exe
%systemroot%\system32\srvswc?.dll
%systemroot%\system32\syspic?.exe
%systemroot%\system32\tbpi0??.exe
%systemroot%\system32\tbpi1??.exe
%systemroot%\system32\tbpi2??.exe
%systemroot%\system32\tbpi3??.exe
%systemroot%\system32\tbpi4??.exe
%systemroot%\system32\tbpi5??.exe
%systemroot%\system32\tbpi6??.exe
%systemroot%\system32\tbpi7??.exe
%systemroot%\system32\tbpi8??.exe
%systemroot%\system32\tbpi9??.exe
%systemroot%\system32\TFTP????
%systemroot%\system32\TISKY00?.exe
%systemroot%\system32\tmmx0??.exe
%systemroot%\system32\tmmx1??.exe
%systemroot%\system32\tmmx2??.exe
%systemroot%\system32\tmmx3??.exe
%systemroot%\system32\tmmx4??.exe
%systemroot%\system32\tmmx5??.exe
%systemroot%\system32\tmmx6??.exe
%systemroot%\system32\tmmx7??.exe
%systemroot%\system32\tmmx8??.exe
%systemroot%\system32\tmmx9??.exe
%systemroot%\system32\vedxg*m*.exe
%systemroot%\system32\vexg*m*.exe
%systemroot%\system32\vxgame*.exe
%systemroot%\system32\vxga*m*.exe
%systemroot%\system32\w32sys?.exe
%systemroot%\system32\w32sys1?.exe
%systemroot%\system32\wdih0??.exe
%systemroot%\system32\wdih1??.exe
%systemroot%\system32\wdih2??.exe
%systemroot%\system32\wdih3??.exe
%systemroot%\system32\wdih4??.exe
%systemroot%\system32\wdih5??.exe
%systemroot%\system32\wdih6??.exe
%systemroot%\system32\wdih7??.exe
%systemroot%\system32\wdih8??.exe
%systemroot%\system32\wdih9??.exe
%systemroot%\system32\WinCtrl32^(*^).dll
%systemroot%\system32\wini1????.exe
%systemroot%\system32\winpfz3?.sys
%systemroot%\system32\winupd_KB*.exe
%systemroot%\system32\wmsoft1????.exe
%systemroot%\system32\wmsoft2????.exe
%systemroot%\system32\wmsoft3????.exe
%systemroot%\system32\wmsoft4????.exe
%systemroot%\system32\wmsoft5????.exe
%systemroot%\system32\wmsoft6????.exe
%systemroot%\system32\wmsoft7????.exe
%systemroot%\system32\wmsoft8????.exe
%systemroot%\system32\wmsoft9????.exe
%systemroot%\system32\wpv???.cpx
%systemroot%\system32\wpv????.cpx
%systemroot%\system32\wpx??.cpx
%systemroot%\system32\wpx???.cpx
%systemroot%\system32\wsnpoem\*.uf
%systemroot%\system32\z1?.exe
%systemroot%\Temp\79_003.exe
%systemroot%\Temp\HDVideodll_*.*.*.exe
%systemroot%\Temp\loadadv???.exe
%systemroot%\Temp\??.sys
%systemroot%\Temp\MediaCodec_*.exe
%systemroot%\Temp\pwrmgr.exe
%systemroot%\Temp\pwrmgr.exe.bat
%systemroot%\Temp\s1402.php.bat
%systemroot%\Temp\smchk.exe
%systemroot%\Temp\smchk.exe.bat
%systemroot%\Temp\tds??.tmp
%systemroot%\Temp\temp_*.bat
%systemroot%\Temp\upwind*.exe
%systemroot%\Temp\windfr.exe.bat
%systemroot%\TIELT00?.exe
%systemroot%\TISKY00?.exe
%systemroot%\tmp??.tmp
%systemroot%\tsitra*.exe.tmp
%systemroot%\tsitra*.exe
%systemroot%\twmxbsqr???.dll
%systemroot%\vanwxemg???.dll
%systemroot%\vc.*.?.exe
%systemroot%\vmgspntb???.dll
%systemroot%\vortsgbq???.dll
%systemroot%\youtube*.zip
%systemroot%\wbxdpgfe???.dll
%systemroot%\wnlmdakq???.dll
%systemroot%\zip*.tmp
	 ) do if exist %%c echo %%~c>>Find.txt

for /f "tokens=*" %%G in (FileList1.txt) do if exist %%G echo %%~G>>Find.txt

for /f "tokens=*" %%a in (Find.txt) do if exist "%%a" ( 	attrib.exe -a -h -r -s "%%a" >nul
						copy "%%a" backups >nul
						del /a/f/q "%%a" && echo %%a - Deleted )

for /f "tokens=1 delims=." %%G in (Find.txt) do if exist "%%G" apps\moveex.exe "%%G" "%cd%\backups\movedfile.vir">nul
for /f "tokens=1 delims=." %%c in (Find.txt) do if exist "%%c" apps\Cghtme.exe -e "%%c">nul

IF EXIST RemLat0.txt for /f "tokens=1 delims=." %%G in (RemLat0.txt) do (
apps\moveex.exe "%%G.tmp" "%cd%\backups\movedfile.tmp.vir" >nul
apps\Cghtme.exe -e "%%G.tmp" >nul
echo %%G.tmp>>Find.txt
	)

IF EXIST RemLat1.txt for /f "tokens=1 delims=." %%G in (RemLat1.txt) do (
apps\moveex.exe "%%G.sys" "%cd%\backups\movedfile.sys.vir" >nul
apps\Cghtme.exe -e "%%G.sys" >nul
echo %%G.sys>>Find.txt
	)

IF EXIST RemLat2.txt for /f "tokens=1 delims=." %%G in (RemLat2.txt) do (
apps\moveex.exe "%%G.dll" "%cd%\backups\movedfile.dll.vir" >nul
apps\Cghtme.exe -e "%%G.dll" >nul
echo %%G.dll>>Find.txt
	)

IF EXIST RemLat3.txt for /f "tokens=1 delims=." %%G in (RemLat3.txt) do (
apps\moveex.exe "%%G.dat" "%cd%\backups\movedfile.dat.vir" >nul
apps\Cghtme.exe -e "%%G.dat" >nul
echo %%G.dat>>Find.txt
	)

IF EXIST RemLat4.txt for /f "tokens=1 delims=." %%G in (RemLat4.txt) do (
apps\moveex.exe "%%G.log" "%cd%\backups\movedfile.log.vir" >nul
apps\Cghtme.exe -e "%%G.log" >nul
echo %%G.log>>Find.txt
	)

cls
IF EXIST delzip*.txt del /q delzip*.txt >nul

apps\locate "%systemroot%\Fonts\*.zip" /D- /n|dnif.exe /I ".zip">>delzip0.txt 2>NUL
IF EXIST delzip0.txt rtsdnif.exe /m /f:delzip0.txt "Crack.exe">>Findzip.txt 2>NUL
IF EXIST delzip0.txt rtsdnif.exe /m /f:delzip0.txt "Setup.exe">>Findzip.txt 2>NUL

IF EXIST Findzip.txt dnif.exe /I "."<Findzip.txt>NUL && (
echo Please Wait>CON
dir /a-d "%systemroot%\Fonts\*.zip" >>delzip1.txt 2>NUL
dir /a-d "%systemroot%\Fonts\'\*.zip" >>delzip2.txt 2>NUL
dir /a-d "%systemroot%\Fonts\-\*.zip" >>delzip2a.txt 2>NUL
IF EXIST delzip1.txt dnif.exe /I "File(s)"<delzip1.txt>delzip3.txt
IF EXIST delzip2.txt dnif.exe /I "File(s)"<delzip2.txt>delzip4.txt
IF EXIST delzip2a.txt dnif.exe /I "File(s)"<delzip2a.txt>delzip4a.txt
IF EXIST delzip3.txt dnif.exe /I ","<delzip3.txt>nul && for /f "tokens=*" %%a in (delzip3.txt) do echo %systemroot%\Fonts\*.zip - %%a - Deleted>>delzip5.txt
IF EXIST delzip4.txt dnif.exe /I ","<delzip4.txt>nul && for /f "tokens=*" %%d in (delzip4.txt) do echo %systemroot%\Fonts\'\*.zip - %%d - Deleted>>delzip5.txt
IF EXIST delzip4a.txt dnif.exe /I ","<delzip4a.txt>nul && for /f "tokens=*" %%d in (delzip4a.txt) do echo %systemroot%\Fonts\-\*.zip - %%d - Deleted>>delzip5.txt
IF EXIST delzip1.txt dnif.exe /I "fichier(s)"<delzip1.txt>delzip6.txt
IF EXIST delzip2.txt dnif.exe /I "fichier(s)"<delzip2.txt>delzip7.txt
IF EXIST delzip2a.txt dnif.exe /I "fichier(s)"<delzip2a.txt>delzip7a.txt
IF EXIST delzip6.txt dnif.exe /I ","<delzip6.txt>nul && for /f "tokens=*" %%a in (delzip6.txt) do echo %systemroot%\Fonts\*.zip - %%a - Deleted>>delzip5.txt
IF EXIST delzip7.txt dnif.exe /I ","<delzip7.txt>nul && for /f "tokens=*" %%d in (delzip7.txt) do echo %systemroot%\Fonts\'\*.zip - %%d - Deleted>>delzip5.txt
IF EXIST delzip7a.txt dnif.exe /I ","<delzip7a.txt>nul && for /f "tokens=*" %%d in (delzip7a.txt) do echo %systemroot%\Fonts\-\*.zip - %%d - Deleted>>delzip5.txt
IF EXIST delzip1.txt dnif.exe /I "Datei(en)"<delzip1.txt>delzip8.txt
IF EXIST delzip2.txt dnif.exe /I "Datei(en)"<delzip2.txt>delzip9.txt
IF EXIST delzip2a.txt dnif.exe /I "Datei(en)"<delzip2a.txt>delzip9a.txt
IF EXIST delzip8.txt dnif.exe /I ","<delzip8.txt>nul && for /f "tokens=*" %%a in (delzip8.txt) do echo %systemroot%\Fonts\*.zip - %%a - Deleted>>delzip5.txt
IF EXIST delzip9.txt dnif.exe /I ","<delzip9.txt>nul && for /f "tokens=*" %%d in (delzip9.txt) do echo %systemroot%\Fonts\'\*.zip - %%d - Deleted>>delzip5.txt
IF EXIST delzip9a.txt dnif.exe /I ","<delzip9a.txt>nul && for /f "tokens=*" %%d in (delzip9a.txt) do echo %systemroot%\Fonts\-\*.zip - %%d - Deleted>>delzip5.txt
IF EXIST delzip1.txt dnif.exe /I "archivos"<delzip1.txt>delzip10.txt
IF EXIST delzip2.txt dnif.exe /I "archivos"<delzip2.txt>delzip11.txt
IF EXIST delzip2a.txt dnif.exe /I "archivos"<delzip2a.txt>delzip11a.txt
IF EXIST delzip10.txt dnif.exe /I ","<delzip10.txt>nul && for /f "tokens=*" %%a in (delzip10.txt) do echo %systemroot%\Fonts\*.zip - %%a - Deleted>>delzip5.txt
IF EXIST delzip11.txt dnif.exe /I ","<delzip11.txt>nul && for /f "tokens=*" %%d in (delzip11.txt) do echo %systemroot%\Fonts\'\*.zip - %%d - Deleted>>delzip5.txt
IF EXIST delzip11a.txt dnif.exe /I ","<delzip11a.txt>nul && for /f "tokens=*" %%d in (delzip11a.txt) do echo %systemroot%\Fonts\-\*.zip - %%d - Deleted>>delzip5.txt
IF EXIST delzip1.txt dnif.exe /I "bestand(en)"<delzip1.txt>delzip12.txt
IF EXIST delzip2.txt dnif.exe /I "bestand(en)"<delzip2.txt>delzip13.txt
IF EXIST delzip2a.txt dnif.exe /I "bestand(en)"<delzip2a.txt>delzip13a.txt
IF EXIST delzip12.txt dnif.exe /I ","<delzip12.txt>nul && for /f "tokens=*" %%a in (delzip12.txt) do echo %systemroot%\Fonts\*.zip - %%a - Deleted>>delzip5.txt
IF EXIST delzip13.txt dnif.exe /I ","<delzip13.txt>nul && for /f "tokens=*" %%d in (delzip13.txt) do echo %systemroot%\Fonts\'\*.zip - %%d - Deleted>>delzip5.txt
IF EXIST delzip13a.txt dnif.exe /I ","<delzip13a.txt>nul && for /f "tokens=*" %%d in (delzip13a.txt) do echo %systemroot%\Fonts\-\*.zip - %%d - Deleted>>delzip5.txt
	)

cls

IF EXIST Findzip.txt dnif.exe /I "."<Findzip.txt>NUL && for /f "tokens=*" %%a in (Findzip.txt) do if exist "%%a" (
					del /q "%%a" )

IF EXIST "%systemroot%\Fonts\'\*.zip" rd /s /q "%systemroot%\Fonts\'">nul && echo Folder %systemroot%\Fonts\' - Removed >>Foldel1.txt
IF EXIST "%systemroot%\Fonts\-\*.zip" rd /s /q "%systemroot%\Fonts\-">nul && echo Folder %systemroot%\Fonts\- - Removed >>Foldel1.txt

apps\locate "%Userprofile%\!\*.avi" /D- /n|dnif.exe /I ".avi">>delavi0.txt 2>NUL

IF EXIST delavi0.txt dnif.exe /I "."<delavi0.txt>NUL && (
echo Please Wait>CON
dir /a-d "%Userprofile%\!\*.avi">>delavi1.txt 2>NUL
IF EXIST delavi1.txt dnif.exe /I "File(s)"<delavi1.txt>delavi2.txt
IF EXIST delavi2.txt dnif.exe /I ","<delavi2.txt>nul && for /f "tokens=*" %%a in (delavi2.txt) do echo %Userprofile%\!\*.avi - %%a - Deleted>>delavi5.txt
IF EXIST delavi1.txt dnif.exe /I "fichier(s)"<delavi1.txt>delavi6.txt
IF EXIST delavi6.txt dnif.exe /I ","<delavi6.txt>nul && for /f "tokens=*" %%a in (delavi6.txt) do echo %Userprofile%\!\*.avi - %%a - Deleted>>delavi5.txt
IF EXIST delavi1.txt dnif.exe /I "Datei(en)"<delavi1.txt>delavi8.txt
IF EXIST delavi8.txt dnif.exe /I ","<delavi8.txt>nul && for /f "tokens=*" %%a in (delavi8.txt) do echo %Userprofile%\!\*.avi - %%a - Deleted>>delavi5.txt
IF EXIST delavi1.txt dnif.exe /I "archivos"<delavi1.txt>delavi10.txt
IF EXIST delavi10.txt dnif.exe /I ","<delavi10.txt>nul && for /f "tokens=*" %%a in (delavi10.txt) do echo %Userprofile%\!\*.avi - %%a - Deleted>>delavi5.txt
IF EXIST delavi1.txt dnif.exe /I "bestand(en)"<delavi1.txt>delavi12.txt
IF EXIST delavi12.txt dnif.exe /I ","<delavi12.txt>nul && for /f "tokens=*" %%a in (delavi12.txt) do echo %Userprofile%\!\*.avi - %%a - Deleted>>delavi5.txt
	)

IF EXIST "%Userprofile%\!\*.avi" rd /s /q "%Userprofile%\!">nul && echo Folder %Userprofile%\! - Removed >>Foldel1.txt

attrib.exe -s -r -h "%systemroot%\TEMP\*" >NUL
attrib.exe -s -r -h "%TEMP%\*" >NUL
del /q /s "%systemroot%\TEMP\*" >nul 2>&1
del /q /s "%TEMP%\*" >nul 2>&1

IF EXIST Find.txt COPY /Y Find.txt %systemroot%\ERUNT\SDFIX\Find.txt >nul
IF EXIST report.txt COPY /Y report.txt %systemroot%\ERUNT\SDFIX\report.txt >nul
IF EXIST RemLat.txt COPY /Y RemLat.txt %systemroot%\ERUNT\SDFIX\RemLat.txt >nul

cls
echo.
echo.
echo.
echo. 
echo            The PC will now restart, SDFix will run again after reboot 
echo.
echo.
echo.
echo.
echo.
echo.
echo.
echo.
echo.
echo.
echo.
echo.
echo.
echo.
echo.
echo    Note: If sdfix does not restart, open the Runthis.bat file and type F then
echo          press Enter for it to finish the final stage and produce the report
echo.

for /f "tokens=*" %%a in (apps\rem.txt) do if exist "%%a" (
					del /q "%%a" 2>nul)

pause

start apps\RestartIt!.exe /f:reboot

goto end

exit





:Second

CLS
color 1F

cd %~dps0

If not exist RunThis.bat For /f "tokens=*" %%b in (dest.txt) do if exist "%%b\RunThis.bat" cd "%%b\" 2>nul
echo.
echo.
echo Finishing Malware Check
echo.
echo Please Be Patient As This Part May Take Several Minutes...
echo.
apps\ISADMIN.EXE>>AdminCheck2.txt
dnif.exe /i "not"<AdminCheck2.txt>nul && (
apps\WINMSG.EXE -t "Error" -m "SDFix Requires Administrator Account Privileges!, Please exit SDFix and restart the PC using the Administrator Account!"
	PAUSE
	)

editreg.exe /s apps\assosfix.reg 2>NUL

apps\locate "%systemdrive%\*.rar" /D /n /O:"&W"|dnif.exe /I ".rar"|dnif.exe /I /V "RECYCLER"|dnif.exe /I /V "Temp">TESTspreadbot1.TXT

IF EXIST TESTspreadbot1.TXT dnif.exe /I ".rar"<TESTspreadbot1.TXT>NUL && (
IF EXIST "%windir%\temp\SDFix_Filecheck\" RD /Q/S "%windir%\temp\SDFix_Filecheck" 2>nul
IF NOT EXIST "%windir%\temp\SDFix_Filecheck\" MD "%windir%\temp\SDFix_Filecheck" 2>nul
IF EXIST TESTspreadbot1.TXT For /f "tokens=*" %%C in (TESTspreadbot1.TXT) do COPY /Y "%%~C" "%windir%\temp\SDFix_Filecheck\" >NUL
IF EXIST "%windir%\temp\SDFix_Filecheck\*.rar" dir /b "%windir%\temp\SDFix_Filecheck\*.rar">TESTspreadbot2.TXT
	)

IF EXIST TESTspreadbot2.TXT dnif.exe /I ".rar"<TESTspreadbot2.TXT>NUL && For /f "tokens=*" %%C in (TESTspreadbot2.TXT) do (
IF EXIST "%windir%\temp\SDFix_Filecheck\%%C" apps\unrar e -p- -Y "%windir%\temp\SDFix_Filecheck\%%C" "%windir%\temp\SDFix_Filecheck\" 2>nul|dnif.exe /I "Extracting  "|dnif.exe /I ".exe">TESTspreadbot3.TXT 2>nul
for /f "TOKENS=5 DELIMS=\." %%f in (TESTspreadbot3.TXT) do apps\MD5File.exe "%windir%\temp\SDFix_Filecheck\%%f.exe"|dnif.exe /I "A98417E0FD0374551DD15C22951AB14C">NUL && (
dnif.exe /I "%%C"<TESTspreadbot1.TXT>TESTspreadbot4.TXT
for /f "TOKENS=*" %%N in (TESTspreadbot4.TXT) do echo %%~N\%%f.exe>>TESTspreadbot5.TXT 2>nul
	)
for /f "TOKENS=5 DELIMS=\." %%f in (TESTspreadbot3.TXT) do apps\MD5File.exe "%windir%\temp\SDFix_Filecheck\%%f.exe"|dnif.exe /I "B5AC836A350964F43FBCFD86F5381634">NUL && (
dnif.exe /I "%%C"<TESTspreadbot1.TXT>TESTspreadbot4.TXT
for /f "TOKENS=*" %%N in (TESTspreadbot4.TXT) do echo %%~N\%%f.exe>>TESTspreadbot5.TXT 2>nul
	)
IF EXIST TESTspreadbot5.TXT dnif.exe /I "."<TESTspreadbot5.TXT>NUL && TYPE TESTspreadbot5.TXT>>TESTspreadbot6.TXT 2>nul
IF EXIST TESTspreadbot5.TXT del /q TESTspreadbot5.TXT >nul
	)

IF EXIST TESTspreadbot6.TXT dnif.exe /I "."<TESTspreadbot6.TXT>NUL && (
>>SpreadBotres.txt (
ECHO.
ECHO The following Winrar archives contain Backdoor IRC Worms!
ECHO.
TYPE TESTspreadbot6.TXT
ECHO.
ECHO Note - SDFix does not repair these files!
ECHO.
	))

IF EXIST Remlat6*.txt DEL /Q Remlat6*.txt>NUL
apps\Csweg acl "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tdssserv" /reset >nul
apps\Csweg acl "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tdssserv" /reset >nul
apps\Csweg acl "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\tdssserv" /reset >nul
apps\Csweg acl "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\tdssserv" /reset >nul
apps\Csweg acl "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TDSSserv.sys)" /reset >nul
apps\Csweg acl "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TDSSserv.sys)" /reset >nul
apps\Csweg acl "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\TDSSserv.sys)" /reset >nul
apps\Csweg acl "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\TDSSserv.sys)" /reset >nul
apps\Csweg acl "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TDSSserv.sys" /reset >nul
apps\Csweg acl "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TDSSserv.sys" /reset >nul
apps\Csweg acl "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\TDSSserv.sys" /reset >nul
apps\Csweg acl "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\TDSSserv.sys" /reset >nul
apps\Csweg.exe query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tdssserv"|dnif.exe /I "Imagepath"|dnif.exe /I "tdss">TESTtdsss1.TXT
IF EXIST TESTtdsss1.TXT For /f "tokens=5 delims=\." %%G in (TESTtdsss1.TXT) do (
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%G.sys dummy.sys>NUL
IF EXIST %systemroot%\system32\drivers\%%G.sys echo %systemroot%\system32\drivers\%%G.sys>>Remlat6a.txt
>RepairTDSSS.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\%%G.sys]
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\%%G.sys]
echo.
	)
editreg.exe /s RepairTDSSS.reg 2>NUL
copy RepairTDSSS.reg .\backups >nul
	)

apps\Csweg.exe query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TDSSserv.sys)"|dnif.exe /I "Imagepath"|dnif.exe /I "tdss">TESTtdsss1a.TXT
IF EXIST TESTtdsss1a.TXT For /f "tokens=5 delims=\." %%G in (TESTtdsss1a.TXT) do (
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%G.sys dummy.sys>NUL
IF EXIST %systemroot%\system32\drivers\%%G.sys echo %systemroot%\system32\drivers\%%G.sys>>Remlat6a.txt
>RepairTDSSSa.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\%%G.sys]
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\%%G.sys]
echo.
	)
editreg.exe /s RepairTDSSSa.reg 2>NUL
copy RepairTDSSSa.reg .\backups >nul
	)

apps\Csweg.exe query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TDSSserv.sys"|dnif.exe /I "Imagepath"|dnif.exe /I "tdss">TESTtdsss1b.TXT
IF EXIST TESTtdsss1b.TXT For /f "tokens=5 delims=\." %%G in (TESTtdsss1b.TXT) do (
apps\Cghtme.exe -l nul -o %systemroot%\system32\drivers\%%G.sys dummy.sys>NUL
IF EXIST %systemroot%\system32\drivers\%%G.sys echo %systemroot%\system32\drivers\%%G.sys>>Remlat6a.txt
>RepairTDSSSb.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\%%G.sys]
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\%%G.sys]
echo.
	)
editreg.exe /s RepairTDSSSb.reg 2>NUL
copy RepairTDSSSb.reg .\backups >nul
	)

apps\Csweg.exe query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tdssserv\modules"|dnif.exe /I ".dll"|dnif.exe /I "tdss">TESTtdsss2.TXT
IF EXIST TESTtdsss2.TXT For /f "tokens=4 delims=\." %%c in (TESTtdsss2.TXT) do if exist %systemroot%\system32\%%c.dll echo %systemroot%\system32\%%c.dll>>Remlat6b.txt
apps\Csweg.exe query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TDSSserv.sys)\modules"|dnif.exe /I ".dll"|dnif.exe /I "tdss">TESTtdsss2a.TXT
IF EXIST TESTtdsss2a.TXT For /f "tokens=4 delims=\." %%c in (TESTtdsss2a.TXT) do if exist %systemroot%\system32\%%c.dll echo %systemroot%\system32\%%c.dll>>Remlat6b.txt
apps\Csweg.exe query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules"|dnif.exe /I ".dll"|dnif.exe /I "tdss">TESTtdsss2f.TXT
IF EXIST TESTtdsss2f.TXT For /f "tokens=4 delims=\." %%c in (TESTtdsss2f.TXT) do if exist %systemroot%\system32\%%c.dll echo %systemroot%\system32\%%c.dll>>Remlat6b.txt

apps\Csweg.exe query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tdssserv\modules"|dnif.exe /I ".dat"|dnif.exe /I "tdss">TESTtdsss2b.TXT
IF EXIST TESTtdsss2b.TXT For /f "tokens=4 delims=\." %%c in (TESTtdsss2b.TXT) do if exist %systemroot%\system32\%%c.dat echo %systemroot%\system32\%%c.dat>>Remlat6c.txt
apps\Csweg.exe query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TDSSserv.sys)\modules"|dnif.exe /I ".dat"|dnif.exe /I "tdss">TESTtdsss2e.TXT
IF EXIST TESTtdsss2e.TXT For /f "tokens=4 delims=\." %%c in (TESTtdsss2e.TXT) do if exist %systemroot%\system32\%%c.dat echo %systemroot%\system32\%%c.dat>>Remlat6c.txt
apps\Csweg.exe query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules"|dnif.exe /I ".dat"|dnif.exe /I "tdss">TESTtdsss2g.TXT
IF EXIST TESTtdsss2g.TXT For /f "tokens=4 delims=\." %%c in (TESTtdsss2g.TXT) do if exist %systemroot%\system32\%%c.dat echo %systemroot%\system32\%%c.dat>>Remlat6c.txt

apps\Csweg.exe query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tdssserv\modules"|dnif.exe /I ".log"|dnif.exe /I "tdss">TESTtdsss2c.TXT
IF EXIST TESTtdsss2c.TXT For /f "tokens=4 delims=\." %%c in (TESTtdsss2c.TXT) do if exist %systemroot%\system32\%%c.log echo %systemroot%\system32\%%c.log>>Remlat6d.txt
apps\Csweg.exe query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TDSSserv.sys)\modules"|dnif.exe /I ".log"|dnif.exe /I "tdss">TESTtdsss2d.TXT
IF EXIST TESTtdsss2d.TXT For /f "tokens=4 delims=\." %%c in (TESTtdsss2d.TXT) do if exist %systemroot%\system32\%%c.log echo %systemroot%\system32\%%c.log>>Remlat6d.txt
apps\Csweg.exe query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules"|dnif.exe /I ".log"|dnif.exe /I "tdss">TESTtdsss2h.TXT
IF EXIST TESTtdsss2h.TXT For /f "tokens=4 delims=\." %%c in (TESTtdsss2h.TXT) do if exist %systemroot%\system32\%%c.log echo %systemroot%\system32\%%c.log>>Remlat6d.txt

IF EXIST "%systemroot%\system32\drivers\TDSS*.sys" apps\locate "%systemroot%\system32\drivers\TDSS*.sys" /D- /n /nr>TESTClbtds1.txt
IF EXIST "%systemroot%\system32\TDSS*.dll" apps\locate "%systemroot%\system32\TDSS*.dll" /D- /n /nr>>TESTClbtds2.txt
IF EXIST "%systemroot%\system32\TDSS*.dat" apps\locate "%systemroot%\system32\TDSS*.dat" /D- /n /nr>>TESTClbtds2a.txt
IF EXIST "%systemroot%\system32\TDSS*.log" apps\locate "%systemroot%\system32\TDSS*.log" /D- /n /nr>>TESTClbtds2b.txt
IF EXIST "%temp%\TDSS????.tmp" apps\locate "%temp%\TDSS????.tmp" /D- /n /nr>>Remlat6g.txt 2>nul
IF EXIST "%systemroot%\Temp\TDSS????.tmp" apps\locate "%systemroot%\Temp\TDSS????.tmp" /D- /n /nr>>Remlat6g.txt 2>nul
rtsdnif.exe /m /f:TESTClbtds2.txt "idskdrtux.dll">>Remlat6b.txt 2>nul
rtsdnif.exe /m /f:TESTClbtds2.txt "tdllog.dll">>Remlat6b.txt 2>nul
rtsdnif.exe /m /f:TESTClbtds2.txt "tdlmain.dll">>Remlat6b.txt 2>nul
rtsdnif.exe /m /f:TESTClbtds2.txt "iwxengk.dll">>Remlat6b.txt 2>nul
rtsdnif.exe /m /f:TESTClbtds2.txt "fiqsefo.dll">>Remlat6b.txt 2>nul
rtsdnif.exe /m /f:TESTClbtds2.txt "aawslvy.dll">>Remlat6b.txt 2>nul
rtsdnif.exe /m /f:TESTClbtds2.txt "onvtwktly.dll">>Remlat6b.txt 2>nul
rtsdnif.exe /m /f:TESTClbtds2.txt "qfhnufyi.dll">>Remlat6b.txt 2>nul
rtsdnif.exe /m /f:TESTClbtds2.txt "tumgx.dll">>Remlat6b.txt 2>nul
rtsdnif.exe /m /f:TESTClbtds2.txt "usn26622">>Remlat6b.txt 2>nul
rtsdnif.exe /m /f:TESTClbtds2.txt "xtcdk.dll">>Remlat6b.txt 2>nul
rtsdnif.exe /m /f:TESTClbtds2.txt "yubsmqiwo.dll">>Remlat6b.txt 2>nul
rtsdnif.exe /m /f:TESTClbtds2.txt "FindVolumeMountPointClose">>Remlat6b.txt 2>nul
rtsdnif.exe /m /f:TESTClbtds2.txt "UpdateICMRegKeyW">>Remlat6b.txt 2>nul
rtsdnif.exe /m /f:TESTClbtds1.txt "KeAcquireSpinLock">TESTClbtds3A.txt 2>nul
rtsdnif.exe /m /f:TESTClbtds1.txt "KeAcquireSpinLock">>Remlat6a.txt 2>nul
rtsdnif.exe /m /f:TESTClbtds1.txt "KeUpdateRunTime">TESTClbtds3A.txt 2>nul
rtsdnif.exe /m /f:TESTClbtds1.txt "KeUpdateRunTime">>Remlat6a.txt 2>nul
rtsdnif.exe /m /f:TESTClbtds2a.txt "bvu">>Remlat6c.txt 2>nul
rtsdnif.exe /m /f:TESTClbtds2b.txt "csrss.exe=">>Remlat6d.txt 2>nul
rtsdnif.exe /m /f:TESTClbtds2b.txt "http">>Remlat6d.txt 2>nul

IF EXIST TESTClbtds3A.txt dnif.exe /I "."<TESTClbtds3A.txt>NUL && For /f "tokens=5 delims=\." %%c in (TESTClbtds3A.txt) do (
>RepairTDSS.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\%%c.sys]
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\%%c.sys]
echo.
	)
editreg.exe /s RepairTDSS.reg 2>NUL
copy RepairTDSS.reg .\backups\FixTDS_SafeBoot.reg >nul
	)

IF EXIST "%windir%\temp\SDFix_Filecheck\" RD /Q/S "%windir%\temp\SDFix_Filecheck" 2>nul

IF EXIST RemLat6a.txt dnif /i "."<RemLat6a.txt>NUL && For /f "tokens=1 delims=." %%c in (RemLat6a.txt) do if exist %%c.sys apps\Cghtme.exe -e "%%c.sys">nul
IF EXIST RemLat6b.txt dnif /i "."<RemLat6b.txt>NUL && For /f "tokens=1 delims=." %%c in (RemLat6b.txt) do if exist %%c.dll apps\Cghtme.exe -e "%%c.dll">nul
IF EXIST RemLat6c.txt dnif /i "."<RemLat6c.txt>NUL && For /f "tokens=1 delims=." %%c in (RemLat6c.txt) do if exist %%c.dat apps\Cghtme.exe -e "%%c.dat">nul
IF EXIST RemLat6d.txt dnif /i "."<RemLat6d.txt>NUL && For /f "tokens=1 delims=." %%c in (RemLat6d.txt) do if exist %%c.log apps\Cghtme.exe -e "%%c.log">nul
IF EXIST Remlat6g.txt dnif /i "."<Remlat6g.txt>NUL && For /f "tokens=1 delims=." %%c in (Remlat6g.txt) do if exist %%c.tmp apps\Cghtme.exe -e "%%c.tmp">nul

CLS
echo.
echo Finishing Malware Check
echo.
echo Please Be Patient As This Part May Take Several Minutes...
echo.

apps\Csweg query "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders" /V SecurityProviders|dnif.exe /I "SecurityProviders"|dnif.exe /I ".dll">TESTSecProar.txt

dnif.exe /I "wowfx.dll"<TESTSecProar.txt>>NUL && (
echo.Windows Registry Editor Version 5.00>FixSecurityProvider.reg
echo.>>FixSecurityProvider.reg
echo.[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]>>FixSecurityProvider.reg 
apps\Csweg query "hklm\system\currentcontrolset\control\securityproviders" /v securityproviders |(
    apps\SED -r "/.*\t/!d; s/^ +(.*)\t.*\t(.*)$/\x22\1\x22=\x22\2\x22/; s/, wowfx.dll//" )>>FixSecurityProvider.reg
editreg.exe /s FixSecurityProvider.reg 2>NUL
copy FixSecurityProvider.reg .\backups >nul
	)

dnif.exe /I "xlibgfl254.dll"<TESTSecProar.txt>>NUL && (
echo.Windows Registry Editor Version 5.00>FixSecurityProvider2.reg
echo.>>FixSecurityProvider2.reg
echo.[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]>>FixSecurityProvider2.reg 
apps\Csweg query "hklm\system\currentcontrolset\control\securityproviders" /v securityproviders |(
    apps\SED -r "/.*\t/!d; s/^ +(.*)\t.*\t(.*)$/\x22\1\x22=\x22\2\x22/; s/, xlibgfl254.dll//" )>>FixSecurityProvider2.reg
editreg.exe /s FixSecurityProvider2.reg 2>NUL
copy FixSecurityProvider2.reg .\backups >nul
	)

dnif.exe /I "msansspc.dll"<TESTSecProar.txt>>NUL && (
echo.Windows Registry Editor Version 5.00>FixSecurityProvider3.reg
echo.>>FixSecurityProvider3.reg
echo.[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]>>FixSecurityProvider3.reg 
apps\Csweg query "hklm\system\currentcontrolset\control\securityproviders" /v securityproviders |(
    apps\SED -r "/.*\t/!d; s/^ +(.*)\t.*\t(.*)$/\x22\1\x22=\x22\2\x22/; s/, msansspc.dll//" )>>FixSecurityProvider3.reg
editreg.exe /s FixSecurityProvider3.reg 2>NUL
copy FixSecurityProvider3.reg .\backups >nul
	)

For %%b in (
actcontroller.exe
idaw64.exe
iftuyszv.exe
ldr.exe
lsass.exe
mrcmgr.exe
mgmrwmrv.exe
ntos.exe
ntss.exe
ntsvc32.dll
oembios.exe
pdbcopy.exe
rxjddnvj.exe
sbwltbxa.exe
services.exe
spool.exe
spools.exe
svchost.exe
svchost32.exe
twext.exe
uoyzsydz.exe
winlogon.exe
winsystem.exe
wsivs.exe
wmsdkns.exe
wsnpoem.exe
wsnpoema.exe
xwusuhzh.exe
	) do apps\Csweg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /V Userinit|dnif.exe /I "%%b">NUL && editreg.exe /s userinfix.reg 2>NUL

for /f "tokens=2* delims=%%" %%g in (
	'apps\Csweg query "hkcu\software\microsoft\windows\currentversion\explorer\user shell folders" /v start^|
	dnif.exe /i "startup"^|dnif.exe /v /i "system32"'
) do call set start=%%%%g%%%%h

for /f "tokens=2* delims=%%" %%g in (
	'apps\Csweg query "hklm\software\microsoft\windows\currentversion\explorer\user shell folders" /v "Common Startup"^|
	dnif.exe /i "common startup"^|dnif.exe /v /i "system32"'
) do call set allstart=%%%%g%%%%h

for /f "tokens=2* delims=%%" %%g in (
	'apps\Csweg query "hkcu\software\microsoft\windows\currentversion\explorer\user shell folders" /v Desktop^|
	dnif.exe /i "desktop"^|dnif.exe /v /i "system32"'
) do call set desktop=%%%%g%%%%h

for /f "tokens=2* delims=%%" %%g in (
	'apps\Csweg query "hkcu\software\microsoft\windows\currentversion\explorer\user shell folders" /v Programs^|
	dnif.exe /i "Programs"^|dnif.exe /v /i "system32"'
) do call set Programs=%%%%g%%%%h

for /f "tokens=2* delims=%%" %%g in (
	'apps\Csweg query "hkcu\software\microsoft\windows\currentversion\explorer\user shell folders" /v "Start Menu"^|
	dnif.exe /i "Start Menu"^|dnif.exe /v /i "system32"'
) do call set StaMen=%%%%g%%%%h

for /f "tokens=2* delims=%%" %%g in (
	'apps\Csweg query "hklm\software\microsoft\windows\currentversion\explorer\user shell folders" /v "Common AppData"^|
	dnif.exe /i "Common AppData"^|dnif.exe /v /i "system32"'
) do call set commapp=%%%%g%%%%h

for /f "tokens=2* delims=%%" %%g in (
	'apps\Csweg query "hklm\software\microsoft\windows\currentversion\explorer\user shell folders" /v "Common Desktop"^|
	dnif.exe /i "Common Desktop"^|dnif.exe /v /i "system32"'
) do call set commdsk=%%%%g%%%%h

for /f "tokens=2* delims=%%" %%g in (
	'apps\Csweg query "hklm\software\microsoft\windows\currentversion\explorer\user shell folders" /v "Common Start Menu"^|
	dnif.exe /i "Common Start Menu"^|dnif.exe /v /i "system32"'
) do call set commStaMen=%%%%g%%%%h

for /f "tokens=2* delims=%%" %%g in (
	'apps\Csweg query "hklm\software\microsoft\windows\currentversion\explorer\user shell folders" /v "Common Programs"^|
	dnif.exe /i "Common Programs"^|dnif.exe /v /i "system32"'
) do call set commPrograms=%%%%g%%%%h

IF EXIST bpTEST6.TXT dnif.exe /I "."<bpTEST6.TXT>NUL && (
>>bpres.txt (
ver|dnif.exe "Windows XP">nul && COPY /Y apps\Replace\xp\beep.sys "%systemroot%\system32\dllcache\beep.sys">nul
ver|dnif.exe "Windows XP">nul && COPY /Y apps\Replace\xp\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y apps\Replace\w2k\beep.sys "%systemroot%\system32\dllcache\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y apps\Replace\w2k\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
IF EXIST bpTEST1.TXT rtsdnif.exe /m /f:bpTEST1.TXT "rootkit">NUL && echo Unable To Replace Infected File!||echo Original beep.sys Restored
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg
echo.
echo.
	))

IF EXIST beepFAres.txt dnif.exe /I "."<beepFAres.txt>NUL && (
>>beepFAres.txt (
ver|dnif.exe "Windows XP">nul && COPY /Y apps\Replace\xp\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y apps\Replace\w2k\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
IF EXIST beepFA3.TXT rtsdnif.exe /m /f:beepFA3.TXT "HalHandleNMI">NUL && echo Unable To Replace Infected File!||echo Original beep.sys Restored
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg
echo.
echo.
	))

IF EXIST beepxcodecres.txt dnif.exe /I "."<beepxcodecres.txt>NUL && (
>>beepxcodecres.txt (
ver|dnif.exe "Windows XP">nul && COPY /Y apps\Replace\xp\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y apps\Replace\w2k\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
IF EXIST beepxcodec3.TXT rtsdnif.exe /m /f:beepxcodec3.TXT "IoFreeIrp">NUL && echo Unable To Replace Infected File!||echo Original beep.sys Restored
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg
echo.
echo.
	))

IF EXIST bprustockTEST2.TXT dnif.exe /I "."<bprustockTEST2.TXT>NUL && (
attrib -r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
IF NOT EXIST "%systemroot%\system32\dllcache\beep.sys" (
ver|dnif.exe "Windows XP">nul && COPY /Y apps\Replace\xp\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y apps\Replace\w2k\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
	)
apps\locate "%systemroot%\system32\drivers\beep.sys" /D- /s:63920! /n /nr|dnif.exe /I ".sys">>bprustockTEST4.TXT
>>bprustockres.txt (
dnif.exe /I "beep.sys"<bprustockTEST4.TXT>NUL && echo Unable To Replace Infected File!||echo Original beep.sys Restored
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg
echo.
echo.
	))

IF EXIST bprustockTEST2a.TXT dnif.exe /I "."<bprustockTEST2a.TXT>NUL && (
attrib -r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
IF NOT EXIST "%systemroot%\system32\dllcache\beep.sys" (
ver|dnif.exe "Windows XP">nul && COPY /Y apps\Replace\xp\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y apps\Replace\w2k\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
	)
apps\locate "%systemroot%\system32\drivers\beep.sys" /D- /s:68018! /n /nr|dnif.exe /I ".sys">>bprustockTEST4a.TXT
>>bprustockres.txt (
dnif.exe /I "beep.sys"<bprustockTEST4a.TXT>NUL && echo Unable To Replace Infected File!||echo Original beep.sys Restored
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg
echo.
echo.
	))

IF EXIST bprustockTEST2b.TXT dnif.exe /I "."<bprustockTEST2b.TXT>NUL && (
attrib -r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
IF NOT EXIST "%systemroot%\system32\dllcache\beep.sys" (
ver|dnif.exe "Windows XP">nul && COPY /Y apps\Replace\xp\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y apps\Replace\w2k\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
	)
apps\locate "%systemroot%\system32\drivers\beep.sys" /D- /s:65970! /n /nr|dnif.exe /I ".sys">>bprustockTEST4b.TXT
>>bprustockres.txt (
dnif.exe /I "beep.sys"<bprustockTEST4b.TXT>NUL && echo Unable To Replace Infected File!||echo Original beep.sys Restored
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg
echo.
echo.
	))

IF EXIST bprustockTEST2c.TXT dnif.exe /I "."<bprustockTEST2c.TXT>NUL && (
attrib -r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
IF NOT EXIST "%systemroot%\system32\dllcache\beep.sys" (
ver|dnif.exe "Windows XP">nul && COPY /Y apps\Replace\xp\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y apps\Replace\w2k\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
	)
apps\locate "%systemroot%\system32\drivers\beep.sys" /D- /s:58988! /n /nr|dnif.exe /I ".sys">>bprustockTEST4c.TXT
>>bprustockres.txt (
dnif.exe /I "beep.sys"<bprustockTEST4c.TXT>NUL && echo Unable To Replace Infected File!||echo Original beep.sys Restored
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg
echo.
echo.
	))

IF EXIST bprustockTEST2d.TXT dnif.exe /I "."<bprustockTEST2d.TXT>NUL && (
attrib -r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
IF NOT EXIST "%systemroot%\system32\dllcache\beep.sys" (
ver|dnif.exe "Windows XP">nul && COPY /Y apps\Replace\xp\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y apps\Replace\w2k\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
	)
apps\locate "%systemroot%\system32\drivers\beep.sys" /D- /s:65132! /n /nr|dnif.exe /I ".sys">>bprustockTEST4d.TXT
>>bprustockres.txt (
dnif.exe /I "beep.sys"<bprustockTEST4d.TXT>NUL && echo Unable To Replace Infected File!||echo Original beep.sys Restored
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg
echo.
echo.
	))

IF EXIST bprustockTEST2e.TXT dnif.exe /I "."<bprustockTEST2e.TXT>NUL && (
attrib -r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
IF NOT EXIST "%systemroot%\system32\dllcache\beep.sys" (
ver|dnif.exe "Windows XP">nul && COPY /Y apps\Replace\xp\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y apps\Replace\w2k\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
	)
apps\locate "%systemroot%\system32\drivers\beep.sys" /D- /s:61116! /n /nr|dnif.exe /I ".sys">>bprustockTEST4e.TXT
>>bprustockres.txt (
dnif.exe /I "beep.sys"<bprustockTEST4e.TXT>NUL && echo Unable To Replace Infected File!||echo Original beep.sys Restored
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg
echo.
echo.
	))

IF EXIST bprustockTEST2f.TXT dnif.exe /I "."<bprustockTEST2f.TXT>NUL && (
attrib -r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
IF NOT EXIST "%systemroot%\system32\dllcache\beep.sys" (
ver|dnif.exe "Windows XP">nul && COPY /Y apps\Replace\xp\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y apps\Replace\w2k\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
	)
apps\locate "%systemroot%\system32\drivers\beep.sys" /D- /s:69820! /n /nr|dnif.exe /I ".sys">>bprustockTEST4f.TXT
>>bprustockres.txt (
dnif.exe /I "beep.sys"<bprustockTEST4f.TXT>NUL && echo Unable To Replace Infected File!||echo Original beep.sys Restored
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg
echo.
echo.
	))

IF EXIST bprustockTEST2g.TXT dnif.exe /I "."<bprustockTEST2g.TXT>NUL && (
attrib -r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
IF NOT EXIST "%systemroot%\system32\dllcache\beep.sys" (
ver|dnif.exe "Windows XP">nul && COPY /Y apps\Replace\xp\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y apps\Replace\w2k\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
	)
apps\locate "%systemroot%\system32\drivers\beep.sys" /D- /s:85050! /n /nr|dnif.exe /I ".sys">>bprustockTEST4g.TXT
>>bprustockres.txt (
dnif.exe /I "beep.sys"<bprustockTEST4g.TXT>NUL && echo Unable To Replace Infected File!||echo Original beep.sys Restored
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg
echo.
echo.
	))

IF EXIST bprustockTEST2h.TXT dnif.exe /I "."<bprustockTEST2h.TXT>NUL && (
attrib -r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
IF NOT EXIST "%systemroot%\system32\dllcache\beep.sys" (
ver|dnif.exe "Windows XP">nul && COPY /Y apps\Replace\xp\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y apps\Replace\w2k\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
	)
apps\locate "%systemroot%\system32\drivers\beep.sys" /D- /s:105408! /n /nr|dnif.exe /I ".sys">>bprustockTEST4h.TXT
>>bprustockres.txt (
dnif.exe /I "beep.sys"<bprustockTEST4h.TXT>NUL && echo Unable To Replace Infected File!||echo Original beep.sys Restored
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg
echo.
echo.
	))

IF EXIST bprustockTEST2i.TXT dnif.exe /I "."<bprustockTEST2i.TXT>NUL && (
attrib -r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
IF NOT EXIST "%systemroot%\system32\dllcache\beep.sys" (
ver|dnif.exe "Windows XP">nul && COPY /Y apps\Replace\xp\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y apps\Replace\w2k\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
	)
apps\locate "%systemroot%\system32\drivers\beep.sys" /D- /s:111216! /n /nr|dnif.exe /I ".sys">>bprustockTEST4i.TXT
>>bprustockres.txt (
dnif.exe /I "beep.sys"<bprustockTEST4i.TXT>NUL && echo Unable To Replace Infected File!||echo Original beep.sys Restored
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg
echo.
echo.
	))

IF EXIST bprustockTEST2j.TXT dnif.exe /I "."<bprustockTEST2j.TXT>NUL && (
attrib -r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
IF NOT EXIST "%systemroot%\system32\dllcache\beep.sys" (
ver|dnif.exe "Windows XP">nul && COPY /Y apps\Replace\xp\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y apps\Replace\w2k\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
	)
apps\locate "%systemroot%\system32\drivers\beep.sys" /D- /s:86804! /n /nr|dnif.exe /I ".sys">>bprustockTEST4j.TXT
>>bprustockres.txt (
dnif.exe /I "beep.sys"<bprustockTEST4j.TXT>NUL && echo Unable To Replace Infected File!||echo Original beep.sys Restored
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg
echo.
echo.
	))

IF EXIST bprustockTEST2k.TXT dnif.exe /I "."<bprustockTEST2k.TXT>NUL && (
attrib -r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
IF NOT EXIST "%systemroot%\system32\dllcache\beep.sys" (
ver|dnif.exe "Windows XP">nul && COPY /Y apps\Replace\xp\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y apps\Replace\w2k\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
	)
apps\locate "%systemroot%\system32\drivers\beep.sys" /D- /s:100774! /n /nr|dnif.exe /I ".sys">>bprustockTEST4k.TXT
>>bprustockres.txt (
dnif.exe /I "beep.sys"<bprustockTEST4k.TXT>NUL && echo Unable To Replace Infected File!||echo Original beep.sys Restored
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg
echo.
echo.
	))

IF EXIST bprustockTEST2l.TXT dnif.exe /I "."<bprustockTEST2l.TXT>NUL && (
attrib -r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
IF NOT EXIST "%systemroot%\system32\dllcache\beep.sys" (
ver|dnif.exe "Windows XP">nul && COPY /Y apps\Replace\xp\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y apps\Replace\w2k\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
	)
apps\locate "%systemroot%\system32\drivers\beep.sys" /D- /s:84210! /n /nr|dnif.exe /I ".sys">>bprustockTEST4l.TXT
>>bprustockres.txt (
dnif.exe /I "beep.sys"<bprustockTEST4l.TXT>NUL && echo Unable To Replace Infected File!||echo Original beep.sys Restored
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg
echo.
echo.
	))

IF EXIST bprustockTEST2m.TXT dnif.exe /I "."<bprustockTEST2m.TXT>NUL && (
attrib -r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
IF NOT EXIST "%systemroot%\system32\dllcache\beep.sys" (
ver|dnif.exe "Windows XP">nul && COPY /Y apps\Replace\xp\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y apps\Replace\w2k\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
	)
apps\locate "%systemroot%\system32\drivers\beep.sys" /D- /s:104944! /n /nr|dnif.exe /I ".sys">>bprustockTEST4m.TXT
>>bprustockres.txt (
dnif.exe /I "beep.sys"<bprustockTEST4m.TXT>NUL && echo Unable To Replace Infected File!||echo Original beep.sys Restored
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg
echo.
echo.
	))

IF EXIST bprustockTEST2n.TXT dnif.exe /I "."<bprustockTEST2n.TXT>NUL && (
attrib -r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
IF NOT EXIST "%systemroot%\system32\dllcache\beep.sys" (
ver|dnif.exe "Windows XP">nul && COPY /Y apps\Replace\xp\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y apps\Replace\w2k\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
	)
apps\locate "%systemroot%\system32\drivers\beep.sys" /D- /s:109762! /n /nr|dnif.exe /I ".sys">>bprustockTEST4n.TXT
>>bprustockres.txt (
dnif.exe /I "beep.sys"<bprustockTEST4n.TXT>NUL && echo Unable To Replace Infected File!||echo Original beep.sys Restored
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg
echo.
echo.
	))

IF EXIST bprustockTEST2o.TXT dnif.exe /I "."<bprustockTEST2o.TXT>NUL && (
attrib -r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
IF NOT EXIST "%systemroot%\system32\dllcache\beep.sys" (
ver|dnif.exe "Windows XP">nul && COPY /Y apps\Replace\xp\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y apps\Replace\w2k\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
	)
apps\locate "%systemroot%\system32\drivers\beep.sys" /D- /s:127488! /n /nr|dnif.exe /I ".sys">>bprustockTEST4o.TXT
>>bprustockres.txt (
dnif.exe /I "beep.sys"<bprustockTEST4o.TXT>NUL && echo Unable To Replace Infected File!||echo Original beep.sys Restored
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg
echo.
echo.
	))

IF EXIST bprustockTEST2p.TXT dnif.exe /I "."<bprustockTEST2p.TXT>NUL && (
attrib -r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
IF NOT EXIST "%systemroot%\system32\dllcache\beep.sys" (
ver|dnif.exe "Windows XP">nul && COPY /Y apps\Replace\xp\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y apps\Replace\w2k\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
	)
apps\locate "%systemroot%\system32\drivers\beep.sys" /D- /s:244448! /n /nr|dnif.exe /I ".sys">>bprustockTEST4p.TXT
>>bprustockres.txt (
dnif.exe /I "beep.sys"<bprustockTEST4p.TXT>NUL && echo Unable To Replace Infected File!||echo Original beep.sys Restored
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg
echo.
echo.
	))

IF EXIST bprustockTEST2q.TXT dnif.exe /I "."<bprustockTEST2q.TXT>NUL && (
attrib -r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
IF NOT EXIST "%systemroot%\system32\dllcache\beep.sys" (
ver|dnif.exe "Windows XP">nul && COPY /Y apps\Replace\xp\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y apps\Replace\w2k\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
	)
apps\locate "%systemroot%\system32\drivers\beep.sys" /D- /s:64056! /n /nr|dnif.exe /I ".sys">>bprustockTEST4q.TXT
>>bprustockres.txt (
dnif.exe /I "beep.sys"<bprustockTEST4q.TXT>NUL && echo Unable To Replace Infected File!||echo Original beep.sys Restored
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg
echo.
echo.
	))

IF EXIST bprustockTEST2r.TXT dnif.exe /I "."<bprustockTEST2r.TXT>NUL && (
attrib -r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
IF NOT EXIST "%systemroot%\system32\dllcache\beep.sys" (
ver|dnif.exe "Windows XP">nul && COPY /Y apps\Replace\xp\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y apps\Replace\w2k\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
	)
apps\locate "%systemroot%\system32\drivers\beep.sys" /D- /s:103772! /n /nr|dnif.exe /I ".sys">>bprustockTEST4r.TXT
>>bprustockres.txt (
dnif.exe /I "beep.sys"<bprustockTEST4r.TXT>NUL && echo Unable To Replace Infected File!||echo Original beep.sys Restored
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg
echo.
echo.
	))

IF EXIST bprustockTEST2s.TXT dnif.exe /I "."<bprustockTEST2s.TXT>NUL && (
attrib -r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
IF NOT EXIST "%systemroot%\system32\dllcache\beep.sys" (
ver|dnif.exe "Windows XP">nul && COPY /Y apps\Replace\xp\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y apps\Replace\w2k\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
	)
apps\locate "%systemroot%\system32\drivers\beep.sys" /D- /s:71006! /n /nr|dnif.exe /I ".sys">>bprustockTEST4s.TXT
>>bprustockres.txt (
dnif.exe /I "beep.sys"<bprustockTEST4s.TXT>NUL && echo Unable To Replace Infected File!||echo Original beep.sys Restored
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg
echo.
echo.
	))

IF EXIST bprustockTEST2t.TXT dnif.exe /I "."<bprustockTEST2t.TXT>NUL && (
attrib -r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
IF NOT EXIST "%systemroot%\system32\dllcache\beep.sys" (
ver|dnif.exe "Windows XP">nul && COPY /Y apps\Replace\xp\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y apps\Replace\w2k\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
	)
apps\locate "%systemroot%\system32\drivers\beep.sys" /D- /s:72374! /n /nr|dnif.exe /I ".sys">>bprustockTEST4t.TXT
>>bprustockres.txt (
dnif.exe /I "beep.sys"<bprustockTEST4t.TXT>NUL && echo Unable To Replace Infected File!||echo Original beep.sys Restored
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg
echo.
echo.
	))

IF EXIST bprustockTEST2u.TXT dnif.exe /I "."<bprustockTEST2u.TXT>NUL && (
attrib -r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
IF NOT EXIST "%systemroot%\system32\dllcache\beep.sys" (
ver|dnif.exe "Windows XP">nul && COPY /Y apps\Replace\xp\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y apps\Replace\w2k\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
	)
apps\locate "%systemroot%\system32\drivers\beep.sys" /D- /s:86750! /n /nr|dnif.exe /I ".sys">>bprustockTEST4u.TXT
>>bprustockres.txt (
dnif.exe /I "beep.sys"<bprustockTEST4u.TXT>NUL && echo Unable To Replace Infected File!||echo Original beep.sys Restored
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg
echo.
echo.
	))

IF EXIST bprustockTEST2v.TXT dnif.exe /I "."<bprustockTEST2v.TXT>NUL && (
attrib -r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
IF NOT EXIST "%systemroot%\system32\dllcache\beep.sys" (
ver|dnif.exe "Windows XP">nul && COPY /Y apps\Replace\xp\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y apps\Replace\w2k\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
	)
apps\locate "%systemroot%\system32\drivers\beep.sys" /D- /s:94720! /n /nr|dnif.exe /I ".sys">>bprustockTEST4v.TXT
>>bprustockres.txt (
dnif.exe /I "beep.sys"<bprustockTEST4v.TXT>NUL && echo Unable To Replace Infected File!||echo Original beep.sys Restored
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg
echo.
echo.
	))

IF EXIST bprustockTEST2w.TXT dnif.exe /I "."<bprustockTEST2w.TXT>NUL && (
attrib -r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
IF NOT EXIST "%systemroot%\system32\dllcache\beep.sys" (
ver|dnif.exe "Windows XP">nul && COPY /Y apps\Replace\xp\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y apps\Replace\w2k\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
	)
apps\locate "%systemroot%\system32\drivers\beep.sys" /D- /s:100004! /n /nr|dnif.exe /I ".sys">>bprustockTEST4w.TXT
>>bprustockres.txt (
dnif.exe /I "beep.sys"<bprustockTEST4w.TXT>NUL && echo Unable To Replace Infected File!||echo Original beep.sys Restored
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg
echo.
echo.
	))

IF EXIST bprustockTEST2x.TXT dnif.exe /I "."<bprustockTEST2x.TXT>NUL && (
attrib -r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
IF NOT EXIST "%systemroot%\system32\dllcache\beep.sys" (
ver|dnif.exe "Windows XP">nul && COPY /Y apps\Replace\xp\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y apps\Replace\w2k\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
	)
apps\locate "%systemroot%\system32\drivers\beep.sys" /D- /s:100062! /n /nr|dnif.exe /I ".sys">>bprustockTEST4x.TXT
>>bprustockres.txt (
dnif.exe /I "beep.sys"<bprustockTEST4x.TXT>NUL && echo Unable To Replace Infected File!||echo Original beep.sys Restored
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg
echo.
echo.
	))

IF EXIST bprustockTEST2y.TXT dnif.exe /I "."<bprustockTEST2y.TXT>NUL && (
attrib -r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
IF NOT EXIST "%systemroot%\system32\dllcache\beep.sys" (
ver|dnif.exe "Windows XP">nul && COPY /Y apps\Replace\xp\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y apps\Replace\w2k\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
	)
apps\locate "%systemroot%\system32\drivers\beep.sys" /D- /s:101342! /n /nr|dnif.exe /I ".sys">>bprustockTEST4y.TXT
>>bprustockres.txt (
dnif.exe /I "beep.sys"<bprustockTEST4y.TXT>NUL && echo Unable To Replace Infected File!||echo Original beep.sys Restored
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg
echo.
echo.
	))

IF EXIST bprustockTEST2z.TXT dnif.exe /I "."<bprustockTEST2z.TXT>NUL && (
attrib -r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
IF NOT EXIST "%systemroot%\system32\dllcache\beep.sys" (
ver|dnif.exe "Windows XP">nul && COPY /Y apps\Replace\xp\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y apps\Replace\w2k\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
	)
apps\locate "%systemroot%\system32\drivers\beep.sys" /D- /s:104178! /n /nr|dnif.exe /I ".sys">>bprustockTEST4z.TXT
>>bprustockres.txt (
dnif.exe /I "beep.sys"<bprustockTEST4z.TXT>NUL && echo Unable To Replace Infected File!||echo Original beep.sys Restored
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg
echo.
echo.
	))

IF EXIST bprustockTEST2z1a.TXT dnif.exe /I "."<bprustockTEST2z1a.TXT>NUL && (
attrib -r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
IF NOT EXIST "%systemroot%\system32\dllcache\beep.sys" (
ver|dnif.exe "Windows XP">nul && COPY /Y apps\Replace\xp\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y apps\Replace\w2k\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
	)
apps\locate "%systemroot%\system32\drivers\beep.sys" /D- /s:75698! /n /nr|dnif.exe /I ".sys">>bprustockTEST4z1a.TXT
>>bprustockres.txt (
dnif.exe /I "beep.sys"<bprustockTEST4z1a.TXT>NUL && echo Unable To Replace Infected File!||echo Original beep.sys Restored
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg
echo.
echo.
	))

IF EXIST bprustockTEST2z1b.TXT dnif.exe /I "."<bprustockTEST2z1b.TXT>NUL && (
attrib -r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
IF NOT EXIST "%systemroot%\system32\dllcache\beep.sys" (
ver|dnif.exe "Windows XP">nul && COPY /Y apps\Replace\xp\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y apps\Replace\w2k\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
	)
apps\locate "%systemroot%\system32\drivers\beep.sys" /D- /s:90582! /n /nr|dnif.exe /I ".sys">>bprustockTEST4z1b.TXT
>>bprustockres.txt (
dnif.exe /I "beep.sys"<bprustockTEST4z1b.TXT>NUL && echo Unable To Replace Infected File!||echo Original beep.sys Restored
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg
echo.
echo.
	))

IF EXIST bprustockTEST2z1c.TXT dnif.exe /I "."<bprustockTEST2z1c.TXT>NUL && (
attrib -r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
IF NOT EXIST "%systemroot%\system32\dllcache\beep.sys" (
ver|dnif.exe "Windows XP">nul && COPY /Y apps\Replace\xp\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y apps\Replace\w2k\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
	)
apps\locate "%systemroot%\system32\drivers\beep.sys" /D- /s:25600! /n /nr|dnif.exe /I ".sys">>bprustockTEST4z1c.TXT
>>bprustockres.txt (
dnif.exe /I "beep.sys"<bprustockTEST4z1c.TXT>NUL && echo Unable To Replace Infected File!||echo Original beep.sys Restored
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg
echo.
echo.
	))

IF EXIST bprustockTEST2z1d.TXT dnif.exe /I "."<bprustockTEST2z1d.TXT>NUL && (
attrib -r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
IF NOT EXIST "%systemroot%\system32\dllcache\beep.sys" (
ver|dnif.exe "Windows XP">nul && COPY /Y apps\Replace\xp\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y apps\Replace\w2k\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
	)
apps\locate "%systemroot%\system32\drivers\beep.sys" /D- /s:100774! /n /nr|dnif.exe /I ".sys">>bprustockTEST4z1d.TXT
>>bprustockres.txt (
dnif.exe /I "beep.sys"<bprustockTEST4z1d.TXT>NUL && echo Unable To Replace Infected File!||echo Original beep.sys Restored
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg
echo.
echo.
	))

IF EXIST bprustockTEST2z1e.TXT dnif.exe /I "."<bprustockTEST2z1e.TXT>NUL && (
attrib -r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
IF NOT EXIST "%systemroot%\system32\dllcache\beep.sys" (
ver|dnif.exe "Windows XP">nul && COPY /Y apps\Replace\xp\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y apps\Replace\w2k\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
	)
apps\locate "%systemroot%\system32\drivers\beep.sys" /D- /s:109150! /n /nr|dnif.exe /I ".sys">>bprustockTEST4z1e.TXT
>>bprustockres.txt (
dnif.exe /I "beep.sys"<bprustockTEST4z1e.TXT>NUL && echo Unable To Replace Infected File!||echo Original beep.sys Restored
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg
echo.
echo.
	))

IF EXIST bprustockTEST2z1f.TXT dnif.exe /I "."<bprustockTEST2z1f.TXT>NUL && (
attrib -r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
IF NOT EXIST "%systemroot%\system32\dllcache\beep.sys" (
ver|dnif.exe "Windows XP">nul && COPY /Y apps\Replace\xp\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y apps\Replace\w2k\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
	)
apps\locate "%systemroot%\system32\drivers\beep.sys" /D- /s:65214! /n /nr|dnif.exe /I ".sys">>bprustockTEST4z1f.TXT
>>bprustockres.txt (
dnif.exe /I "beep.sys"<bprustockTEST4z1f.TXT>NUL && echo Unable To Replace Infected File!||echo Original beep.sys Restored
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg
echo.
echo.
	))

IF EXIST bprustockTEST2z1g.TXT dnif.exe /I "."<bprustockTEST2z1g.TXT>NUL && (
attrib -r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
IF NOT EXIST "%systemroot%\system32\dllcache\beep.sys" (
ver|dnif.exe "Windows XP">nul && COPY /Y apps\Replace\xp\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y apps\Replace\w2k\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
	)
apps\locate "%systemroot%\system32\drivers\beep.sys" /D- /s:76988! /n /nr|dnif.exe /I ".sys">>bprustockTEST4z1g.TXT
>>bprustockres.txt (
dnif.exe /I "beep.sys"<bprustockTEST4z1g.TXT>NUL && echo Unable To Replace Infected File!||echo Original beep.sys Restored
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg
echo.
echo.
	))

IF EXIST bprustockTEST2z1h.TXT dnif.exe /I "."<bprustockTEST2z1h.TXT>NUL && (
attrib -r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
IF NOT EXIST "%systemroot%\system32\dllcache\beep.sys" (
ver|dnif.exe "Windows XP">nul && COPY /Y apps\Replace\xp\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y apps\Replace\w2k\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
	)
apps\locate "%systemroot%\system32\drivers\beep.sys" /D- /s:85924! /n /nr|dnif.exe /I ".sys">>bprustockTEST4z1h.TXT
>>bprustockres.txt (
dnif.exe /I "beep.sys"<bprustockTEST4z1h.TXT>NUL && echo Unable To Replace Infected File!||echo Original beep.sys Restored
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg
echo.
echo.
	))

IF EXIST bprustockTEST2z1i.TXT dnif.exe /I "."<bprustockTEST2z1i.TXT>NUL && (
attrib -r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
IF NOT EXIST "%systemroot%\system32\dllcache\beep.sys" (
ver|dnif.exe "Windows XP">nul && COPY /Y apps\Replace\xp\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y apps\Replace\w2k\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
	)
apps\locate "%systemroot%\system32\drivers\beep.sys" /D- /s:96726! /n /nr|dnif.exe /I ".sys">>bprustockTEST4z1i.TXT
>>bprustockres.txt (
dnif.exe /I "beep.sys"<bprustockTEST4z1i.TXT>NUL && echo Unable To Replace Infected File!||echo Original beep.sys Restored
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg
echo.
echo.
	))

IF EXIST bprustockTEST2z1j.TXT dnif.exe /I "."<bprustockTEST2z1j.TXT>NUL && (
attrib -r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
IF NOT EXIST "%systemroot%\system32\dllcache\beep.sys" (
ver|dnif.exe "Windows XP">nul && COPY /Y apps\Replace\xp\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y apps\Replace\w2k\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
	)
apps\locate "%systemroot%\system32\drivers\beep.sys" /D- /s:105858! /n /nr|dnif.exe /I ".sys">>bprustockTEST4z1j.TXT
>>bprustockres.txt (
dnif.exe /I "beep.sys"<bprustockTEST4z1j.TXT>NUL && echo Unable To Replace Infected File!||echo Original beep.sys Restored
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg
echo.
echo.
	))

IF EXIST bprustockTEST2z1k.TXT dnif.exe /I "."<bprustockTEST2z1k.TXT>NUL && (
attrib -r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
IF NOT EXIST "%systemroot%\system32\dllcache\beep.sys" (
ver|dnif.exe "Windows XP">nul && COPY /Y apps\Replace\xp\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y apps\Replace\w2k\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
	)
apps\locate "%systemroot%\system32\drivers\beep.sys" /D- /s:100702! /n /nr|dnif.exe /I ".sys">>bprustockTEST4z1k.TXT
>>bprustockres.txt (
dnif.exe /I "beep.sys"<bprustockTEST4z1k.TXT>NUL && echo Unable To Replace Infected File!||echo Original beep.sys Restored
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg
echo.
echo.
	))

IF EXIST bprustockTEST2z1l.TXT dnif.exe /I "."<bprustockTEST2z1l.TXT>NUL && (
attrib -r %systemroot%\system32\drivers\beep.sys>nul
ver|dnif.exe "Windows XP">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y "%systemroot%\system32\dllcache\beep.sys" "%systemroot%\system32\drivers\beep.sys">nul
IF NOT EXIST "%systemroot%\system32\dllcache\beep.sys" (
ver|dnif.exe "Windows XP">nul && COPY /Y apps\Replace\xp\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
ver|dnif.exe "Windows 2000">nul && COPY /Y apps\Replace\w2k\beep.sys "%systemroot%\system32\drivers\beep.sys">nul
	)
apps\locate "%systemroot%\system32\drivers\beep.sys" /D- /s:103394! /n /nr|dnif.exe /I ".sys">>bprustockTEST4z1l.TXT
>>bprustockres.txt (
dnif.exe /I "beep.sys"<bprustockTEST4z1l.TXT>NUL && echo Unable To Replace Infected File!||echo Original beep.sys Restored
echo.
For /F "TOKENS=*" %%g IN ('dir /s/a-d/b %windir%\beep.sys'
) Do @echo "%%~g" %%~zg %%~tg
echo.
echo.
	))

IF EXIST BaseCheck6.txt dnif.exe /I "base"<BaseCheck6.txt|dnif.exe /I "32.dll">BaseCheck6a.txt
IF EXIST BaseCheck6a.txt dnif.exe /I "base"<BaseCheck6a.txt|dnif.exe /I "32.dll">NUL && For /f "tokens=4 delims=\." %%c in (BaseCheck6a.txt) do apps\Csweg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems" /V Windows|dnif.exe /I "Windows"|dnif.exe /I "ServerDll=%%c">Nul && echo %%c>BaseCheck7.txt
IF EXIST BaseCheck7.txt dnif.exe "base"<BaseCheck7.txt|dnif.exe /I "32.dll">Nul && (
>BaseRes.txt (
echo Session Manager\SubSystems:
echo Unable to Remove Trojan startup value!
echo [b]Windows ServerDll registry value needs to be restored to basesrv before the trojan file is removed![/b]
echo 
echo Key export:
echo.
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems]
apps\Csweg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems" /V Windows|dnif.exe /I "Windows">BaseCheck66.txt
For /f "tokens=3 delims=	" %%b in (BaseCheck66.txt) do echo "Windows"=%%b
echo. 
	))

IF EXIST BaseCheck6.txt dnif.exe /I "base"<BaseCheck6.txt|dnif.exe /I "32.dll">BaseCheck6b.txt
IF EXIST BaseCheck6b.txt dnif.exe /I "base"<BaseCheck6b.txt|dnif.exe /I "32.dll">NUL && (
apps\Csweg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems" /V Windows|dnif.exe /I "Windows"|dnif.exe /I "ServerDll=basesrv">Nul && (
>BaseRes.txt (
echo.
echo Session Manager\SubSystems:
echo Windows ServerDll value restored to basesrv
echo Key export:
echo.
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems]
apps\Csweg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems" /V Windows|dnif.exe /I "Windows">BaseCheck66.txt
For /f "tokens=3 delims=	" %%b in (BaseCheck66.txt) do echo "Windows"=%%b
echo.
For /f "tokens=4 delims=\." %%i in (BaseCheck6b.txt) do if exist %systemroot%\system32\%%i.dll (
echo %systemroot%\system32\%%i.dll>>Find.txt
echo Removing %systemroot%\system32\%%i.dll
echo. )
echo.
	)))

IF EXIST miditest1.txt dnif.exe /I "."<miditest1.txt>NUL && (
TYPE miditest1.txt>>Find.txt
IF EXIST Repairmidi.reg editreg.exe /s Repairmidi.reg 2>NUL
	)

IF EXIST miditestnew5.txt dnif.exe /I "."<miditestnew5.txt>NUL && (
TYPE miditestnew5.txt >>Find.txt
IF EXIST Repairmidi.reg editreg.exe /s Repairmidi.reg 2>NUL
	)

IF EXIST miditestnewmap5.txt dnif.exe /I "."<miditestnewmap5.txt>NUL && (
TYPE miditestnewmap5.txt >>Find.txt
IF EXIST Repairmidimap1.reg editreg.exe /s Repairmidimap1.reg 2>NUL
	)

IF EXIST miditestnew5a.txt dnif.exe /I "."<miditestnew5a.txt>NUL && (
TYPE miditestnew5a.txt >>Find.txt
IF EXIST Repairmidi2.reg editreg.exe /s Repairmidi2.reg 2>NUL
	)

IF EXIST miditestnew70.txt dnif.exe /I "."<miditestnew70.txt>NUL && (
TYPE miditestnew70.txt >>Find.txt
IF EXIST Repairmidi.reg editreg.exe /s Repairmidi.reg 2>NUL
	)

IF EXIST miditestnew70a.txt dnif.exe /I "."<miditestnew70a.txt>NUL && (
TYPE miditestnew70a.txt >>Find.txt
IF EXIST Repairmidi3.reg editreg.exe /s Repairmidi3.reg 2>NUL
	)

IF EXIST miditestaux5.txt dnif.exe /I "."<miditestaux5.txt>NUL && (
TYPE miditestaux5.txt >>Find.txt
IF EXIST Repairaux1.reg editreg.exe /s Repairaux1.reg 2>NUL
	)

IF EXIST Foundsvc.txt For /f "tokens=*" %%G in (Foundsvc.txt) do apps\SWSC.exe delete "%%G">nul && echo Service %%G - Deleted after Reboot>>srvrem.txt
IF EXIST apps\srv2.txt For /f "tokens=*" %%G in (apps\srv2.txt) do apps\SWSC.exe delete "%%G">nul && echo Service %%G - Deleted after Reboot>>srvrem.txt

IF EXIST Foundsvc.txt For /f "tokens=*" %%G in (apps\legacy.txt) do apps\Csweg acl "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_%%G" /ge:f /p /q >NUL 
IF EXIST Foundsvc.txt For /f "tokens=*" %%b in (Foundsvc.txt) do apps\Csweg acl "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_%%b" /ge:f /p /q >NUL 

>> FileList2.txt (
echo.%temp%\services.exe
echo.%temp%\winlogon.exe
echo.%AppData%\ntos.exe
echo %appdata%\Adobe\crc.dat
echo %appdata%\Adobe\Manager.exe
echo.%systemdrive%\fwdrv.sys
echo.%systemdrive%\lich.exe
echo.%systemdrive%\lich.sys
echo.%systemdrive%\qqd.sys
echo.%systemdrive%\suhdlog.sys
echo.%systemroot%\Cursors\mkwsqp.cur
echo.%systemroot%\Cursors\rqksgpu.cur
echo.%systemroot%\Cursors\rwtatpl.lid
echo.%systemroot%\Cursors\werasqlp.cur
echo.%systemroot%\fkjdfje.sys
echo.%systemroot%\help\aiqpbter.chm
echo.%systemroot%\help\guntest.chm
echo.%systemroot%\help\hqaply.chm
echo.%systemroot%\help\lagednick.chm
echo.%systemroot%\help\merqpo.chm
echo.%systemroot%\help\oqtxde.chm
echo.%systemroot%\help\pzqlp.chm
echo.%systemroot%\help\zeqwur.chm
echo.%systemroot%\ieqazhew.dll
echo.%systemroot%\inf\accctsggw.cat
echo.%systemroot%\inf\agehhtd.cat
echo.%systemroot%\inf\cjwriiigqazft.cat
echo.%systemroot%\inf\qwetab.inf
echo.%systemroot%\inf\rYehhbqzx.adm
echo.%systemroot%\inf\uxgrafj.adm
echo.%systemroot%\inf\wseqnx.inf
echo.%systemroot%\inf\yqzsypbgh.cat
echo.%systemroot%\inf\yutsubk.cat
echo.%systemroot%\inf\zyxelmodem.ADM
echo.%systemroot%\mqzprwe.log
echo.%systemroot%\njqzpir.sys
echo.%systemroot%\nqaplwj.sys
echo.%systemroot%\nkit.dll
echo.%systemroot%\qalwpmdgt.sys
echo.%systemroot%\qaszpurn.sys
echo.%systemroot%\repair\kasutio
echo.%systemroot%\serazavr.log
echo.%systemroot%\spooldr.exe
echo.%systemroot%\system\efidriver.drv
echo.%systemroot%\system\hipsrv.mm
echo.%systemroot%\system\pcximg.pif
echo.%systemroot%\system\tap64drv
echo.%systemroot%\system\tunnet.ocx
echo.%systemroot%\system\userinfo32.ggt
echo.%systemroot%\system32\3klagia.dll
echo.%systemroot%\system32\4fdw.dll
echo.%systemroot%\system32\asplug.dll
echo.%systemroot%\system32\asplg.sys
echo.%systemroot%\system32\bqzpas.sys
echo.%systemroot%\system32\btstack.ibs
echo.%systemroot%\system32\bzsqlpa.sys
echo.%systemroot%\system32\clbdll.dll
echo.%systemroot%\system32\cmon32.lib
echo.%systemroot%\system32\dbmgmnt.dll
echo.%systemroot%\system32\DefLib.sys
echo.%systemroot%\system32\dmclient.exe
echo.%systemroot%\system32\dprot.sys
echo.%systemroot%\system32\drivers\asc355.sys
echo.%systemroot%\system32\drivers\asc355O.sys
echo.%systemroot%\system32\drivers\asc3550a.sys
echo.%systemroot%\system32\drivers\asc3550o.sys
echo.%systemroot%\system32\drivers\asc3550p.sys
echo.%systemroot%\system32\drivers\asc3550u.sys
echo.%systemroot%\system32\drivers\asc3550v.sys
echo.%systemroot%\system32\drivers\astq.tga
echo.%systemroot%\system32\drivers\core.sys
echo.%systemroot%\system32\drivers\clbdriver.sys
echo.%systemroot%\system32\drivers\ctl_w32.sys
echo.%systemroot%\system32\drivers\dhlp.sys
echo.%systemroot%\system32\drivers\fak32.sys
echo.%systemroot%\system32\drivers\glaide32.sys
echo.%systemroot%\system32\drivers\grande48.sys
echo.%systemroot%\system32\drivers\FMTR.sys
echo.%systemroot%\system32\drivers\ini910p.sys
echo.%systemroot%\system32\drivers\kcp.sys
echo.%systemroot%\system32\drivers\khtml.sys
echo.%systemroot%\system32\drivers\msgegh.sys
echo.%systemroot%\system32\drivers\mickey32.sys
echo.%systemroot%\system32\drivers\msliksurserv.sys
echo.%systemroot%\system32\drivers\ntio922.sys
echo.%systemroot%\system32\drivers\ndisaluo.sys
echo.%systemroot%\system32\drivers\NdisWon.sys
echo.%systemroot%\system32\drivers\nkv2.sys
echo.%systemroot%\system32\drivers\ntndis.sys
echo.%systemroot%\system32\drivers\ntosnh.sys 
echo.%systemroot%\system32\drivers\ntoss.sys
echo.%systemroot%\system32\drivers\ohbusb.sys
echo.%systemroot%\system32\drivers\ohbusb.syt
echo.%systemroot%\system32\drivers\ohciusb.sys
echo.%systemroot%\system32\drivers\ohciusb.syt
echo.%systemroot%\system32\drivers\ohctusb.sys
echo.%systemroot%\system32\drivers\ohctusb.syt
echo.%systemroot%\system32\drivers\ohcuusb.sys
echo.%systemroot%\system32\drivers\ohcuusb.syt
echo.%systemroot%\system32\drivers\ohcusb.sys
echo.%systemroot%\system32\drivers\ohcusb.syt
echo.%systemroot%\system32\drivers\ohdusb.sys
echo.%systemroot%\system32\drivers\ohdusb.syt
echo.%systemroot%\system32\drivers\pcantispy.sys
echo.%systemroot%\system32\drivers\protect.sys
echo.%systemroot%\system32\drivers\qandr.sys
echo.%systemroot%\system32\drivers\qwer78.sys
echo.%systemroot%\system32\drivers\restore.sys
echo.%systemroot%\system32\drivers\retx2.sys
echo.%systemroot%\system32\drivers\riode32.sys
echo.%systemroot%\system32\drivers\rpcdrv.sys
echo.%systemroot%\system32\drivers\rpcmon.sys
echo.%systemroot%\system32\drivers\rpcsrv.sys
echo.%systemroot%\system32\drivers\runtime.sys
echo.%systemroot%\system32\drivers\runtime2.sys
echo.%systemroot%\system32\drivers\runtime2.sy_
echo.%systemroot%\system32\drivers\services.exe
echo.%systemroot%\system32\drivers\smtpdrv.sys
echo.%systemroot%\system32\drivers\SndSystem.sys
echo.%systemroot%\system32\drivers\spool.exe
echo.%systemroot%\system32\drivers\spools.exe
echo.%systemroot%\system32\drivers\srtwe.sys
echo.%systemroot%\system32\drivers\symavc32.sys
echo.%systemroot%\system32\drivers\tcpsr.sys
echo.%systemroot%\system32\drivers\TDSShpue.sys
echo.%systemroot%\system32\drivers\TDSSevri.sys
echo.%systemroot%\system32\drivers\TDSSjcxe.sys
echo.%systemroot%\system32\drivers\TDSSjjsm.sys
echo.%systemroot%\system32\drivers\tdssserv.sys
echo.%systemroot%\system32\drivers\uwasfsd.sys
echo.%systemroot%\system32\drivers\vissv.sys
echo.%systemroot%\system32\drivers\wsnpoem.sys
echo.%systemroot%\system32\drivers\xpdt.sys
echo.%systemroot%\system32\dllcache\figaro.sys
echo.%systemroot%\system32\dllcache\fuurod.sys
echo.%systemroot%\system32\dwave.sys
echo.%systemroot%\system32\dxdss.sys
echo.%systemroot%\system32\ellowtab.txt
echo.%systemroot%\system32\frmwrk.exe
echo.%systemroot%\system32\frmwrk.sys
echo.%systemroot%\system32\fvelwow.sys
echo.%systemroot%\system32\gsbgqpwwfw.sys
echo.%systemroot%\system32\hcnwg4u.sys
echo.%systemroot%\system32\hdport.sys
echo.%systemroot%\system32\hqiopa.sys
echo.%systemroot%\system32\iasmngr.dll
echo.%systemroot%\system32\itcoe.sys
echo.%systemroot%\system32\itcom.sys
echo.%systemroot%\system32\iasmngr.exe
echo.%systemroot%\system32\iuzqpaf.sys
echo.%systemroot%\system32\jecsst.sys
echo.%systemroot%\system32\jkghje.dll
echo.%systemroot%\system32\jnhjkfrn
echo.%systemroot%\system32\jwzpqng.sys
echo.%systemroot%\system32\kernelw.sys
echo.%systemroot%\system32\krnllds.sys
echo.%systemroot%\system32\ksnhtr.sys
echo.%systemroot%\system32\ksys.sys
echo.%systemroot%\system32\kzq5re.sys
echo.%systemroot%\system32\lanmandrv.sys
echo.%systemroot%\system32\ldr.exe
echo.%systemroot%\system32\lspool.ini
echo.%systemroot%\system32\lspool.exe
echo.%systemroot%\system32\lspooldrv.sys
echo.%systemroot%\system32\lzx32.sys
echo.%systemroot%\system32\main.sys
echo.%systemroot%\system32\mapi32.drv
echo.%systemroot%\system32\mapi32.exe
echo.%systemroot%\system32\mapi32.sys
echo.%systemroot%\system32\mcrwave.dll
echo.%systemroot%\system32\mp32s.sys
echo.%systemroot%\system32\mrcmgr.exe
echo.%systemroot%\system32\msdefender.sys
echo.%systemroot%\system32\msdnc.cmd
echo.%systemroot%\system32\msdndr.dat
echo.%systemroot%\system32\msdndr.pif
echo.%systemroot%\system32\msdndr.sys
echo.%systemroot%\system32\msdvdr.cmd
echo.%systemroot%\system32\msdvdr.dat
echo.%systemroot%\system32\msdvdr.pif
echo.%systemroot%\system32\msdvdr.sys
echo.%systemroot%\system32\msfsr.sys
echo.%systemroot%\system32\msguard.sys
echo.%systemroot%\system32\mssync20.sys
echo.%systemroot%\system32\mstmp.cmd
echo.%systemroot%\system32\MZU_DRV.sys
echo.%systemroot%\system32\narqwe.sys
echo.%systemroot%\system32\nax12.sys
echo.%systemroot%\system32\ndetect.exe
echo.%systemroot%\system32\nested.sys
echo.%systemroot%\system32\nexkaqf.sys
echo.%systemroot%\system32\noskrnl.sys
echo.%systemroot%\system32\nso12k.sys
echo.%systemroot%\system32\ntio256.sys
echo.%systemroot%\system32\ntload.sys
echo.%systemroot%\system32\ntos.exe
echo.%systemroot%\system32\ntsvc32.dll
echo.%systemroot%\system32\nzqtegh.sys
echo.%systemroot%\system32\oembios.exe
echo.%systemroot%\system32\pdbcopy.exe
echo.%systemroot%\system32\pe386.sys
echo.%systemroot%\system32\pjsapdg.sys
echo.%systemroot%\system32\powerio.sys
echo.%systemroot%\system32\powermgmt.sys
echo.%systemroot%\system32\pqasghjd.sys
echo.%systemroot%\system32\qtprot.sys
echo.%systemroot%\system32\ras\hhlmken.scp
echo.%systemroot%\system32\ras\slipmenu1.scp
echo.%systemroot%\system32\ras\yeyqase.mis
echo.%systemroot%\system32\reg.sys
echo.%systemroot%\system32\rotr.sys
echo.%systemroot%\system32\runtime.sys
echo.%systemroot%\system32\service.sys
echo.%systemroot%\system32\spooldr.sys
echo.%systemroot%\system32\spoolsvv.sys
echo.%systemroot%\system32\sysproc64\sysproc32.sys
echo.%systemroot%\system32\sysproc64\sysproc32.sys.cla
echo.%systemroot%\system32\sysproc64\sysproc86.sys
echo.%systemroot%\system32\sysproc64\log.txt
echo.%systemroot%\system32\sysrest.sys
echo.%systemroot%\system32\systeminit.exe
echo.%systemroot%\system32\syswindrv.bin
echo.%systemroot%\system32\sywtdxaz.sys
echo.%systemroot%\system32\drivers\sysldr
echo.%systemroot%\system32\szr_dr.sys
echo.%systemroot%\system32\taskmon.sys
echo.%systemroot%\system32\tdidrv32.sys
echo.%systemroot%\system32\tdssadw.dll
echo.%systemroot%\system32\TDSSbeer.dll
echo.%systemroot%\system32\TDSSerrors.log
echo.%systemroot%\system32\TDSShpue.dll
echo.%systemroot%\system32\TDSSevri.dll
echo.%systemroot%\system32\tdssinit.dll
echo.%systemroot%\system32\TDSSjcxe.dll
echo.%systemroot%\system32\TDSSjjsm.dll
echo.%systemroot%\system32\tdssl.dll
echo.%systemroot%\system32\tdsslog.dll
echo.%systemroot%\system32\tdssmain.dll
echo.%systemroot%\system32\TDSSmnsl.dll
echo.%systemroot%\system32\tdsspopup.dll
echo.%systemroot%\system32\tdsspopup1.url
echo.%systemroot%\system32\tdsspopup2.url
echo.%systemroot%\system32\tdsspopup3.url
echo.%systemroot%\system32\tdssserf.dll
echo.%systemroot%\system32\tdssserf1.dll
echo.%systemroot%\system32\tdssservers.dat
echo.%systemroot%\system32\twain_32\local.ds
echo.%systemroot%\system32\twain_32\user.ds
echo.%systemroot%\system32\twain_32\user.ds.cla
echo.%systemroot%\system32\twext.exe
echo.%systemroot%\system32\upscr.sys
echo.%systemroot%\system32\vbagz.sys
echo.%systemroot%\system32\win32_rkt.sys
echo.%systemroot%\system32\wincom32.sys
echo.%systemroot%\system32\wininit.sys
echo.%systemroot%\system32\WinNt32.dll
echo.%systemroot%\system32\WinNt32.dl_
echo.%systemroot%\system32\WinNt64.dll
echo.%systemroot%\system32\WinNt64.dl_
echo.%systemroot%\system32\WLCtrl32.dll
echo.%systemroot%\system32\WLCtrl32.dl_
echo.%systemroot%\system32\wowfx.dll
echo.%systemroot%\system32\wsnpoem.exe
echo.%systemroot%\system32\wsnpoema.exe
echo.%systemroot%\system32\wsnpoema\audio.dll
echo.%systemroot%\system32\wsnpoema\audio.dll.cla
echo.%systemroot%\system32\wsnpoema\video.dll
echo.%systemroot%\system32\wsnpoema\log.txt
echo.%systemroot%\system32\wsock32.sys
echo.%systemroot%\system32\wzghui.sys
echo.%systemroot%\system32\xwusuhzh.exe
echo.%systemroot%\system32\yzbgqap.sys
echo.%systemroot%\system32\ztx86.sys
echo.%systemroot%\system32\zwqcplsp.sys
echo.%systemroot%\Temp\kernel.sys
echo.%systemroot%\trahtibedoh.sys
echo.%systemroot%\twain_32\e67gdfg.ds
echo.%systemroot%\twain_32\jwlbqzpi.dll
echo.%systemroot%\twain_32\tzraqlo.dll
echo.%systemroot%\twain_32\ytzpoqw.dll
echo.%systemroot%\uazpiq.sys
echo.%systemroot%\uerj45kj.sys
echo.%systemroot%\widuxngq.sys
echo.%systemroot%\ydhqzop.sys
echo.%systemroot%\yeTyezzd.sys
echo.%systemroot%\zalpqbj.sys
echo.%systemroot%\zdegpig.ini
echo.%systemroot%\zeqbqwp.sys
echo.%systemroot%\zsqalpdt.sys
	)

>> Find.txt (
dir /b/s/a-d %systemroot%\lzx32.sys 2>nul
dir /b/s/a-d %systemroot%\msdirect.sys 2>nul
dir /b/s/a-d %systemroot%\msdirectx.sys 2>nul
dir /b/s/a-d %systemroot%\msdirectxclks.sys 2>nul
dir /b/s/a-d %systemroot%\rdriv.sys 2>nul
dir /b/s/a-d %systemroot%\xpdt.sys 2>nul
dir /b/s/a-d %systemroot%\xpdx.sys 2>nul
dir /b/s/a-d "%systemroot%\system32\ro0\*" 2>nul

for /f "tokens=*" %%G in (FileList2.txt) do if exist %%G echo %%~G )

IF EXIST RemLat.txt for /f "tokens=*" %%d in (RemLat.txt) do if exist "%%~d" echo %%d>>Find.txt

dir /b/s/a-d "%systemdrive%\userinit.exe">TESTstartupusr.TXT 2>nul
IF EXIST TESTstartupusr dnif.exe /I "\Startup\userinit.exe"<TESTstartupusr.txt>>Find.txt

apps\Csweg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" CheckRuns.txt

IF EXIST Tofseetest2.txt dnif.exe /I "."<Tofseetest2.txt>NUL && editreg.exe /s userinfix.reg 2>NUL
dnif.exe /I "sulimo.dat"<Find.txt>nul && editreg.exe /s apps\Reset_AppInit_DLLs.reg 2>NUL
dnif.exe /I "karina.dat" <Find.txt>NUL && editreg.exe /s apps\Reset_AppInit_DLLs.reg 2>NUL
dnif.exe /I "karna.dat" <Find.txt>NUL && editreg.exe /s apps\Reset_AppInit_DLLs.reg 2>NUL
dnif.exe /I "ldcore.dll" <Find.txt>NUL && editreg.exe /s apps\Reset_AppInit_DLLs.reg 2>NUL
dnif.exe /I "cru629.dat" <Find.txt>NUL && editreg.exe /s apps\Reset_AppInit_DLLs.reg 2>NUL
dnif.exe /I "kus109.dat" <Find.txt>NUL && editreg.exe /s apps\Reset_AppInit_DLLs.reg 2>NUL
dnif.exe /I "murka.dat" <Find.txt>NUL && editreg.exe /s apps\Reset_AppInit_DLLs.reg 2>NUL
dnif.exe /I "wowfx.dll" <Find.txt>NUL && editreg.exe /s apps\Reset_AppInit_DLLs.reg 2>NUL
dnif.exe /I "ntos.exe"<Find.txt>nul && editreg.exe /s userinfix.reg 2>NUL
dnif.exe /I "oembios.exe"<Find.txt>nul && editreg.exe /s userinfix.reg 2>NUL
dnif.exe /I "twext.exe"<Find.txt>nul && editreg.exe /s userinfix.reg 2>NUL
dnif.exe /I "drivers\spool.exe"<Find.txt>nul && editreg.exe /s userinfix.reg 2>NUL
dnif.exe /I "wsnpoem.exe"<Find.txt>nul && editreg.exe /s userinfix.reg 2>NUL
dnif.exe /I "wsnpoema"<Find.txt>nul && editreg.exe /s userinfix.reg 2>NUL
dnif.exe /I "Temp\services.exe"<Find.txt>nul && editreg.exe /s userinfix.reg 2>NUL
dnif.exe /I "Temp\winlogon.exe"<Find.txt>nul && editreg.exe /s userinfix.reg 2>NUL
IF EXIST FixSecurityProvider.reg editreg.exe /s FixSecurityProvider.reg 2>NUL
IF EXIST RepairBOTFM.reg editreg.exe /s RepairBOTFM.reg 2>NUL
IF EXIST RepairBHO1.reg editreg.exe /s RepairBHO1.reg 2>NUL
IF EXIST Repairmidi.reg editreg.exe /s Repairmidi.reg 2>NUL
IF EXIST RepairPakes.reg editreg.exe /s RepairPakes.reg 2>NUL
IF EXIST RepairRK.reg editreg.exe /s RepairRK.reg 2>NUL
IF EXIST RepairRK01.reg editreg.exe /s RepairRK01.reg 2>NUL
IF EXIST RepairRK1.reg editreg.exe /s RepairRK1.reg 2>NUL
IF EXIST RepairRK3.reg editreg.exe /s RepairRK3.reg 2>NUL
IF EXIST RepairRK4.reg editreg.exe /s RepairRK4.reg 2>NUL
IF EXIST RepairRKprotect1.reg editreg.exe /s RepairRKprotect1.reg 2>NUL
IF EXIST Repairdllpatcherssodl.reg editreg.exe /s Repairdllpatcherssodl.reg 2>NUL
IF EXIST RepairTDSSS.reg editreg.exe /s RepairTDSSS.reg 2>NUL
IF EXIST RepairTDSS.reg editreg.exe /s RepairTDSS.reg 2>NUL
IF EXIST DNSChangerfix.reg editreg.exe /s DNSChangerfix.reg 2>NUL
apps\Csweg QUERY "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main" /v "Search Bar"|dnif.exe /i "internetsearchservice">NUL && editreg.exe /s apps\HPFix9.reg 2>NUL
apps\Csweg QUERY "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main" /v "Search Bar"|dnif.exe /i "windiwsfsearch.com">NUL && editreg.exe /s apps\HPFix9.reg 2>NUL

editreg.exe /s apps\FIXCU.reg 2>NUL
editreg.exe /s apps\FIXLM.reg 2>NUL
editreg.exe /s apps\FixBH.reg 2>NUL
editreg.exe /s apps\fix.reg 2>NUL

for /f "tokens=*" %%a in (Find.txt) do if exist "%%a" ( 	attrib.exe -a -h -r -s "%%a"
					copy "%%a" backups >nul 2>&1
					del /q "%%a" && echo %%a - Deleted 2>nul )

if exist "%systemroot%\system32\wowfx.dll\" rd /s/q "%systemroot%\system32\wowfx.dll" >nul

for /f "tokens=*" %%c in (Find.txt) do if exist "%%c" apps\Cghtme.exe -e "%%c" >nul

IF NOT EXIST apps\tds.txt (
IF EXIST RemLat6a.txt dnif /i ".sys"<RemLat6a.txt>NUL && for /f "tokens=1 delims=." %%a in (RemLat6a.txt) DO IF EXIST %%a.sys (
apps\Csweg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\install1" /v "SDFix" /d "%~s0 /second"
DEL /Q RemLat*.txt>NUL
echo tds>apps\tds.txt
cls
echo.
echo.
echo.
echo.
echo.
echo. 
echo                     Tdssserv Rootkit Detected - Reboot Needed!
echo.
echo.
echo                         Press Any Key To Restart The PC
echo.
echo.
echo.
echo.
echo.
echo.
echo.
echo.
echo.
echo.
pause
start apps\RestartIt!.exe /f:reboot
goto end
	))

>>Report.txt (
IF EXIST srvrem.txt TYPE srvrem.txt
IF EXIST bpres.txt dnif.exe /I "."<bpres.txt>NUL && TYPE bpres.txt
IF EXIST beepFAres.txt dnif.exe /I "."<beepFAres.txt>NUL && TYPE beepFAres.txt
IF EXIST beepxcodecres.txt dnif.exe /I "."<beepxcodecres.txt>NUL && TYPE beepxcodecres.txt
IF EXIST bprustockres.txt dnif.exe /I "."<bprustockres.txt>NUL && TYPE bprustockres.txt
IF EXIST baseres.txt TYPE baseres.txt
echo.
echo [b]Checking Files [/b]: 
	)

>clean.reg (
echo Windows Registry Editor Version 5.00
echo.
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
echo "SDFix"=- 
echo.
	)
For /f "tokens=*" %%G in (apps\srv2.txt) do (
	echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\%%G]>>clean.reg )
For /f "tokens=*" %%G in (apps\srv2.txt) do (
	echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\%%G]>>clean.reg )
For /f "tokens=*" %%G in (apps\svc.txt) do (
	echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\%%G]>>clean.reg )
For /f "tokens=*" %%G in (apps\srv2.txt) do (
	echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\%%G]>>clean.reg )
For /f "tokens=*" %%G in (apps\legacy.txt) do (
	echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_%%G]>>clean.reg )
IF EXIST Foundsvc.txt For /f "tokens=*" %%G in (Foundsvc.txt) do (
	echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_%%G]>>clean.reg )

dnif.exe /I /V "\]"<clean.reg>>cleanD.reg
editreg.exe /s cleanD.reg 2>NUL

IF EXIST Find.txt dnif.exe /I ":\" <Find.txt>NUL && COPY /Y Find.txt backups\FileList.txt >NUL

apps\zip "backups.zip" backups\*.*>nul 2>&1
del /q backups\*.*
move backups.zip backups>nul 2>&1
apps\zip ".\backups\backupreg.zip" backupreg\*.* >nul 2>&1
rd /s /q backupreg

cls

ECHO %USERPROFILE%>Checkusersdir1a.txt
FOR /F "TOKENS=1,2* DELIMS=\" %%A in (Checkusersdir1a.txt) DO CALL SET USRDIR=%%A\%%B>NUL
FOR /F "TOKENS=1,2* DELIMS=\" %%C in (Checkusersdir1a.txt) DO DIR /B/A:D "%%C\%%D\" >Checkusersdir2a.txt
FOR /F "TOKENS=*" %%G in (Checkusersdir2a.txt) DO (
IF EXIST "%USRDIR%\%%G\Application Data\sysproc64\" rd /s/q "%USRDIR%\%%G\Application Data\sysproc64">nul && echo Folder %USRDIR%\%%G\Application Data\sysproc64 - Removed>>Foldel1.txt
IF EXIST "%USRDIR%\%%G\Application Data\twain_32\" rd /s/q "%USRDIR%\%%G\Application Data\twain_32">nul && echo Folder %USRDIR%\%%G\Application Data\twain_32 - Removed>>Foldel1.txt
IF EXIST "%USRDIR%\%%G\Application Data\wsnpoem\" rd /s/q "%USRDIR%\%%G\Application Data\wsnpoem">nul && echo Folder %USRDIR%\%%G\Application Data\wsnpoem - Removed>>Foldel1.txt
	)

>> Report.txt (
echo.
dnif.exe /I ":\" <Find.txt>NUL && echo Trojan Files Found:||IF NOT EXIST delzip5.txt echo No Trojan Files Found
echo.
IF EXIST BITSTEST.TXT dnif.exe /I "Deleted"<BITSTEST.TXT>NUL && TYPE BITSTEST.TXT
IF EXIST Find.txt for /f "tokens=*" %%a in (Find.txt) do if not exist "%%a" echo %%a - Deleted
IF EXIST delzip5.txt TYPE delzip5.txt
IF EXIST delavi5.txt TYPE delavi5.txt
echo.
IF EXIST Find.txt dnif.exe /I ".$$$" <Find.txt>NUL && echo [color=red]Note - Files associated with the MBR Rootkit have been found on this system, to check the PC use the [url=http://www2.gmer.net/mbr/mbr.exe]MBR Rootkit Detector[/url] by Gmer[/color]>Testsinmbr.txt
IF EXIST sinowaltest1.txt dnif.exe /I "foundsin" <sinowaltest1.txt>NUL && echo [color=red]Note - Files associated with the MBR Rootkit have been found on this system, to check the PC use the [url=http://www2.gmer.net/mbr/]MBR Rootkit Detector[/url] by Gmer[/color]>Testsinmbr.txt
IF EXIST Testsinmbr.txt TYPE Testsinmbr.txt
IF EXIST Data.txt dnif.exe /I "====="<Data.txt>nul && echo x.dat and z.dat data copied to \SDFix\Data.txt
echo.
IF EXIST Find.txt for /f "tokens=*" %%a in (Find.txt) do if exist "%%a" echo Could Not Remove %%a
echo.
if exist Foldel1.txt TYPE Foldel1.txt
if exist Foldel2.txt dnif.exe "{"<Foldel2.txt>NUL && TYPE Foldel2.txt
if exist "%Temp%\privacy_danger\" rd /s/q "%Temp%\privacy_danger" >nul && echo Folder %Temp%\privacy_danger - Removed
if exist "%appdata%\0000005738\" rd /s/q "%appdata%\0000005738" >nul && echo Folder %appdata%\0000005738 - Removed
if exist "%appdata%\Antivir64\" rd /s/q "%appdata%\Antivir64" >nul && echo Folder %appdata%\Antivir64 - Removed
if exist "%appdata%\Antivirus2008\" rd /s/q "%appdata%\Antivirus2008" >nul && echo Folder %appdata%\Antivirus2008 - Removed
if exist "%appdata%\Antivirus2008y\" rd /s/q "%appdata%\Antivirus2008y" >nul && echo Folder %appdata%\Antivirus2008y - Removed
if exist "%appdata%\AXPFixer\" rd /s/q "%appdata%\AXPFixer" >nul && echo Folder %appdata%\AXPFixer - Removed
if exist "%appdata%\Facegame\" rd /s/q "%appdata%\Facegame" >nul && echo Folder %appdata%\Facegame - Removed
if exist "%appdata%\gadcom\" rd /s/q "%appdata%\gadcom" >nul && echo Folder %appdata%\gadcom - Removed
if exist "%appdata%\Gool\" rd /s/q "%appdata%\Gool" >nul && echo Folder %appdata%\Gool - Removed
if exist "%appdata%\IBPlugin\" rd /s/q "%appdata%\IBPlugin" >nul && echo Folder %appdata%\IBPlugin - Removed
if exist "%appdata%\Microsoft\dtsc\" rd /q/s "%appdata%\Microsoft\dtsc" >nul && echo Folder %appdata%\Microsoft\dtsc - Removed
if exist "%appdata%\MPatrolPRO\" rd /q/s "%appdata%\MPatrolPRO" >nul && echo Folder %appdata%\MPatrolPRO - Removed
if exist "%appdata%\NetMon\" rd /q "%appdata%\NetMon" >nul && echo Folder %appdata%\NetMon - Removed
if exist "%appdata%\PC-Antispy\" rd /q/s "%appdata%\PC-Antispy" >nul && echo Folder %appdata%\PC-Antispy - Removed
if exist "%appdata%\PC Clean Pro\" rd /q/s "%appdata%\PC Clean Pro" >nul && echo Folder %appdata%\PC Clean Pro - Removed
if exist "%appdata%\Power-Antivirus-2009\" rd /q "%appdata%\Power-Antivirus-2009" >nul && echo Folder %appdata%\Power-Antivirus-2009 - Removed
IF EXIST Find.txt dnif.exe /I "\sp2\qaccess.dll" <Find.txt>NUL && if exist "%appdata%\sp2" rd /s/q "%appdata%\sp2" >nul && echo Folder %appdata%\sp2 - Removed
if exist "%appdata%\Rapid Antivirus\" rd /s/q "%appdata%\Rapid Antivirus" >nul && echo Folder %appdata%\Rapid Antivirus - Removed
if exist "%appdata%\SalesMon\" rd /s/q "%appdata%\SalesMon" >nul && echo Folder %appdata%\SalesMon - Removed
if exist "%appdata%\SecurePCCleaner\" rd /s/q "%appdata%\SecurePCCleaner" >nul && echo Folder %appdata%\SecurePCCleaner - Removed
if exist "%appdata%\SpeedRunner\" rd /s/q "%appdata%\SpeedRunner" >nul && echo Folder %appdata%\SpeedRunner - Removed
if exist "%appdata%\SpyGuarder\" rd /s/q "%appdata%\SpyGuarder" >nul && echo Folder %appdata%\SpyGuarder - Removed
if exist "%appdata%\SystemDefender\" rd /s/q "%appdata%\SystemDefender" >nul && echo Folder %appdata%\SystemDefender - Removed
if exist "%appdata%\TrustedAntivirus\" rd /s/q "%appdata%\TrustedAntivirus" >nul && echo Folder %appdata%\TrustedAntivirus - Removed
if exist "%appdata%\Ultimate Cleaner\" rd /s /q "%appdata%\Ultimate Cleaner" >nul && echo Folder %appdata%\Ultimate Cleaner - Removed
if exist "%appdata%\Ultimate Defender\" rd /s /q "%appdata%\Ultimate Defender" >nul && echo Folder %appdata%\Ultimate Defender - Removed
if exist "%appdata%\ultra\" rd /q "%appdata%\ultra" >nul && echo Folder %appdata%\ultra - Removed
if exist "%appdata%\WinButler\" rd /q/s "%appdata%\WinButler" >nul && echo Folder %appdata%\WinButler - Removed
if exist "%appdata%\WinIFixer.com\" rd /q/s "%appdata%\WinIFixer.com" >nul && echo Folder %appdata%\WinIFixer.com - Removed
if exist "%appdata%\WinTouch\" rd /q "%appdata%\WinTouch" >nul && echo Folder %appdata%\WinTouch - Removed
if exist "%appdata%\WinSecureAv\" rd /q/s "%appdata%\WinSecureAv" >nul && echo Folder %appdata%\WinSecureAv - Removed
if exist "%appdata%\WinXDefender\" rd /q/s "%appdata%\WinXDefender" >nul && echo Folder %appdata%\WinXDefender - Removed
if exist "%appdata%\WinXProtector\" rd /q/s "%appdata%\WinXProtector" >nul && echo Folder %appdata%\WinXProtector - Removed
if exist "%appdata%\WinX Security Center\" rd /q/s "%appdata%\WinX Security Center" >nul && echo Folder %appdata%\WinX Security Center - Removed
if exist "%appdata%\wsnpoem\" rd /q/s "%appdata%\wsnpoem" >nul && echo Folder %appdata%\wsnpoem - Removed
if exist "%StaMen%\Antivirus2008\" rd /s/q "%StaMen%\Antivirus2008" >nul && echo Folder %StaMen%\Antivirus2008 - Removed
if exist "%StaMen%\Antivirus 2009\" rd /s/q "%StaMen%\Antivirus 2009" >nul && echo Folder %StaMen%\Antivirus 2009 - Removed
if exist "%StaMen%\XP Antivirus 2008\" rd /s/q "%StaMen%\XP Antivirus 2008" >nul && echo Folder %StaMen%\XP Antivirus 2008 - Removed
if exist "%Programs%\AdwareRemover2007\" rd /q "%Programs%\AdwareRemover2007" >nul && echo Folder %Programs%\AdwareRemover2007 - Removed
if exist "%Programs%\AntiMalware2009\" rd /q "%Programs%\AntiMalware2009" >nul && echo Folder %Programs%\AntiMalware2009 - Removed
if exist "%Programs%\AntiSpyCheck 2.1\" rd /q "%Programs%\AntiSpyCheck 2.1" >nul && echo Folder %Programs%\AntiSpyCheck 2.1 - Removed
if exist "%Programs%\AntispyKnight\" rd /q/s "%Programs%\AntispyKnight" >nul && echo Folder %Programs%\AntispyKnight - Removed
if exist "%Programs%\AntiSpywareXP2009\" rd /q "%Programs%\AntiSpywareXP2009" >nul && echo Folder %Programs%\AntiSpywareXP2009 - Removed
if exist "%Programs%\Antivirus 2008\" rd /q "%Programs%\Antivirus 2008" >nul && echo Folder %Programs%\Antivirus 2008 - Removed
if exist "%Programs%\Antivirus 2008 PRO\" rd /q "%Programs%\Antivirus 2008 PRO" >nul && echo Folder %Programs%\Antivirus 2008 PRO - Removed
if exist "%Programs%\AntiVirus Lab 2009 2.1\" rd /q /s "%Programs%\AntiVirus Lab 2009 2.1" >nul && echo Folder %Programs%\AntiVirus Lab 2009 2.1 - Removed
if exist "%Programs%\ASC 2.1\" rd /q "%Programs%\ASC 2.1" >nul && echo Folder %Programs%\ASC 2.1 - Removed
if exist "%Programs%\ASpyC\" rd /q "%Programs%\ASpyC" >nul && echo Folder %Programs%\ASpyC - Removed
if exist "%Programs%\Brave-Sentry\" rd /q "%Programs%\Brave-Sentry" >nul && echo Folder %Programs%\Brave-Sentry - Removed
if exist "%Programs%\Internet Speed Monitor\" rd /q "%Programs%\Internet Speed Monitor" >nul && echo Folder %Programs%\Internet Speed Monitor - Removed
if exist "%Programs%\MalwareCrush\" rd /s /q "%Programs%\MalwareCrush" >nul && echo Folder %Programs%\MalwareCrush - Removed
if exist "%Programs%\Personal Defender 2009\" rd /s /q "%Programs%\Personal Defender 2009" >nul && echo Folder %Programs%\Personal Defender 2009 - Removed
if exist "%Programs%\PlayMP3z\" rd /s /q "%Programs%\PlayMP3z" >nul && echo Folder %Programs%\PlayMP3z - Removed
if exist "%Programs%\Pornovid\" rd /s /q "%Programs%\Pornovid" >nul && echo Folder %Programs%\Pornovid - Removed
if exist "%Programs%\SecureCleaner\" rd /q "%Programs%\SecureCleaner" >nul && echo Folder %Programs%\SecureCleaner - Removed
if exist "%Programs%\sexvid\" rd /q "%Programs%\sexvid" >nul && echo Folder %Programs%\sexvid - Removed
if exist "%Programs%\SpyDevastator\" rd /q "%Programs%\SpyDevastator" >nul && echo Folder %Programs%\SpyDevastator - Removed
if exist "%Programs%\SpyShredder\" rd /q "%Programs%\SpyShredder" >nul && echo Folder %Programs%\SpyShredder - Removed
if exist "%Programs%\SpywareSweeper\" rd /q "%Programs%\SpywareSweeper" >nul && echo Folder %Programs%\SpywareSweeper - Removed
if exist "%Programs%\TheSpyBot\" rd /q "%Programs%\TheSpyBot" >nul && echo Folder %Programs%\TheSpyBot - Removed
if exist "%Programs%\TonsOfPorn\" rd /q "%Programs%\TonsOfPorn" >nul && echo Folder %Programs%\TonsOfPorn - Removed
if exist "%Programs%\VirusHeat 4.3\" rd /q "%Programs%\VirusHeat 4.3" >nul && echo Folder %Programs%\VirusHeat 4.3 - Removed
if exist "%Programs%\VirusHeat 4.4\" rd /q "%Programs%\VirusHeat 4.4" >nul && echo Folder %Programs%\VirusHeat 4.4 - Removed
if exist "%Programs%\VirusIsolator\" rd /q "%Programs%\VirusIsolator" >nul && echo Folder %Programs%\VirusIsolator - Removed
if exist "%Programs%\WinAntispyware2008\" rd /q /s "%Programs%\WinAntispyware2008" >nul && echo Folder %Programs%\WinAntispyware2008 - Removed
if exist "%Programs%\WinXDefender\" rd /q /s "%Programs%\WinXDefender" >nul && echo Folder %Programs%\WinXDefender - Removed
if exist "%Programs%\XP_AntiSpyware\" rd /q /s "%Programs%\XP_AntiSpyware" >nul && echo Folder %Programs%\XP_AntiSpyware - Removed
if exist "%userprofile%\Google\" rd /q "%userprofile%\Google" >nul && echo Folder %userprofile%\Google - Removed
if exist "%userprofile%\My Documents\SpyDevastator\" rd /q/s "%userprofile%\My Documents\SpyDevastator" >nul && echo Folder %userprofile%\My Documents\SpyDevastator - Removed
if exist "%allusersprofile%\Documents\Settings\" rd /s /q "%allusersprofile%\Documents\Settings" >nul && echo Folder %allusersprofile%\Documents\Settings - Removed
if exist "%allusersprofile%\Documentos\Settings\" rd /s /q "%allusersprofile%\Documentos\Settings" >nul && echo Folder %allusersprofile%\Documentos\Settings - Removed
if exist "%allusersprofile%\Dokumenty\Settings\" rd /s /q "%allusersprofile%\Dokumenty\Settings" >nul && echo Folder %allusersprofile%\Dokumenty\Settings - Removed
if exist "%commapp%\ipd\" rd /s /q "%commapp%\ipd" >nul && echo Folder %commapp%\ipd - Removed
if exist "%commapp%\PersonalAntiSpy\" rd /s /q "%commapp%\PersonalAntiSpy" >nul && echo Folder %commapp%\PersonalAntiSpy - Removed
if exist "%commapp%\SalesMon\" rd /s /q "%commapp%\SalesMon" >nul && echo Folder %commapp%\SalesMon - Removed
if exist "%commapp%\Solt Lake Software\" rd /s /q "%commapp%\Solt Lake Software" >nul && echo Folder %commapp%\Solt Lake Software - Removed
IF EXIST Find.txt dnif.exe /I "SecureExpertCleaner" <Find.txt>NUL && if exist "%commapp%\SEC" rd /q "%commapp%\SEC" >nul && echo Folder %commapp%\SEC - Removed
if exist "%commapp%\SecurePCCleaner\" rd /s /q "%commapp%\SecurePCCleaner" >nul && echo Folder %commapp%\SecurePCCleaner - Removed
if exist "%commapp%\Secure Solutions\" rd /s /q "%commapp%\Secure Solutions" >nul && echo Folder %commapp%\Secure Solutions - Removed
if exist "%commapp%\SoftLand Ltd\" rd /s /q "%commapp%\SoftLand Ltd" >nul && echo Folder %commapp%\SoftLand Ltd - Removed
if exist "%commapp%\Software Licensors\" rd /s /q "%commapp%\Software Licensors" >nul && echo Folder %commapp%\Software Licensors - Removed
if exist "%commapp%\System Doctor Free\" rd /s /q "%commapp%\System Doctor Free" >nul && echo Folder %commapp%\System Doctor Free - Removed
IF EXIST Find.txt dnif.exe /I "\services\services.dll" <Find.txt>NUL && if exist "%commapp%\services" rd /q "%commapp%\services" >nul && echo Folder %commapp%\services - Removed
if exist "%commapp%\Tarma Installer\{FE5B4D78-069A-4F1E-B2C9-0BE2D0A53E6E}\" rd /s /q "%commapp%\Tarma Installer\{FE5B4D78-069A-4F1E-B2C9-0BE2D0A53E6E}" >nul && echo Folder %commapp%\Tarma Installer\{FE5B4D78-069A-4F1E-B2C9-0BE2D0A53E6E} - Removed
if exist "%commapp%\NetExt\" rd /s /q "%commapp%\NetExt" >nul && echo Folder %commapp%\NetExt - Removed
if exist "%commPrograms%\AdvancedCleaner Free\" rd /s /q "%commPrograms%\AdvancedCleaner Free" >nul && echo Folder %commPrograms%\AdvancedCleaner Free - Removed
if exist "%commPrograms%\Advanced XP Fixer\" rd /s /q "%commPrograms%\Advanced XP Fixer" >nul && echo Folder %commPrograms%\Advanced XP Fixer - Removed
if exist "%commPrograms%\AntiMalwareGuard\" rd /s /q "%commPrograms%\AntiMalwareGuard" >nul && echo Folder %commPrograms%\AntiMalwareGuard - Removed
if exist "%commPrograms%\AntispyStorm\" rd /s /q "%commPrograms%\AntispyStorm" >nul && echo Folder %commPrograms%\AntispyStorm - Removed
if exist "%commPrograms%\AntiSpywareMaster\" rd /s /q "%commPrograms%\AntiSpywareMaster" >nul && echo Folder %commPrograms%\SecurePCCleaner - Removed
if exist "%commPrograms%\Antivir64\" rd /s /q "%commPrograms%\Antivir64" >nul && echo Folder %commPrograms%\Antivir64 - Removed
if exist "%commPrograms%\AntivirusFiable\" rd /s /q "%commPrograms%\AntivirusFiable" >nul && echo Folder %commPrograms%\AntivirusFiable - Removed
if exist "%commPrograms%\Antivirus XP 2008\" rd /s /q "%commPrograms%\Antivirus XP 2008" >nul && echo Folder %commPrograms%\Antivirus XP 2008 - Removed
if exist "%commPrograms%\AV2010\" rd /s /q "%commPrograms%\AV2010" >nul && echo Folder %commPrograms%\AV2010 - Removed
if exist "%commPrograms%\Malware Patrol PRO\" rd /s /q "%commPrograms%\Malware Patrol PRO" >nul && echo Folder %commPrograms%\Malware Patrol PRO - Removed
if exist "%commPrograms%\Malware Protector 2008\" rd /s /q "%commPrograms%\Malware Protector 2008" >nul && echo Folder %commPrograms%\Malware Protector 2008 - Removed
if exist "%commPrograms%\PC-Antispy\" rd /s /q "%commPrograms%\PC-Antispy" >nul && echo Folder %commPrograms%\PC-Antispy - Removed
if exist "%commPrograms%\PC Clean Pro\" rd /s /q "%commPrograms%\PC Clean Pro" >nul && echo Folder %commPrograms%\PC Clean Pro - Removed
if exist "%commPrograms%\PCPrivacyCleaner\" rd /s /q "%commPrograms%\PCPrivacyCleaner" >nul && echo Folder %commPrograms%\PCPrivacyCleaner - Removed
if exist "%commPrograms%\PCTotalDefender\" rd /s /q "%commPrograms%\PCTotalDefender" >nul && echo Folder %commPrograms%\PCTotalDefender - Removed
if exist "%commPrograms%\PersonalAntiSpy\" rd /s /q "%commPrograms%\PersonalAntiSpy" >nul && echo Folder %commPrograms%\PersonalAntiSpy - Removed
if exist "%commPrograms%\Power-Antivirus-2009\" rd /s /q "%commPrograms%\Power-Antivirus-2009" >nul && echo Folder %commPrograms%\Power-Antivirus-2009 - Removed
if exist "%commPrograms%\Rapid Antivirus\" rd /s /q "%commPrograms%\Rapid Antivirus" >nul && echo Folder %commPrograms%\Rapid Antivirus - Removed
if exist "%commPrograms%\SecureExpertCleaner\" rd /s /q "%commPrograms%\SecureExpertCleaner" >nul && echo Folder %commPrograms%\SecureExpertCleaner - Removed
if exist "%commPrograms%\SecureFileShredder\" rd /s /q "%commPrograms%\SecureFileShredder" >nul && echo Folder %commPrograms%\SecureFileShredder - Removed
if exist "%commPrograms%\SecurePCCleaner\" rd /s /q "%commPrograms%\SecurePCCleaner" >nul && echo Folder %commPrograms%\AntiSpywareMaster - Removed
if exist "%commPrograms%\SpyMaxx\" rd /s /q "%commPrograms%\SpyMaxx" >nul && echo Folder %commPrograms%\SpyMaxx - Removed
if exist "%commPrograms%\SpywareIsolator\" rd /s /q "%commPrograms%\SpywareIsolator" >nul && echo Folder %commPrograms%\SpywareIsolator - Removed
if exist "%commPrograms%\SystemDefender\" rd /s /q "%commPrograms%\SystemDefender" >nul && echo Folder %commPrograms%\SystemDefender - Removed
if exist "%commPrograms%\System Doctor Unregistered Version\" rd /s /q "%commPrograms%\System Doctor Unregistered Version" >nul && echo Folder %commPrograms%\System Doctor Unregistered Version - Removed
if exist "%commPrograms%\TrustedAntivirus\" rd /s /q "%commPrograms%\TrustedAntivirus" >nul && echo Folder %commPrograms%\TrustedAntivirus - Removed
if exist "%commPrograms%\UltimateCleaner 2007\" rd /s /q "%commPrograms%\UltimateCleaner 2007" >nul && echo Folder %commPrograms%\UltimateCleaner 2007 - Removed
if exist "%commPrograms%\Ultimate Defender\" rd /s /q "%commPrograms%\Ultimate Defender" >nul && echo Folder %commPrograms%\Ultimate Defender - Removed
if exist "%commPrograms%\vipantispyware\" rd /s /q "%commPrograms%\vipantispyware" >nul && echo Folder %commPrograms%\vipantispyware - Removed
if exist "%commPrograms%\VirusEffaceur\" rd /s /q "%commPrograms%\VirusEffaceur" >nul && echo Folder %commPrograms%\VirusEffaceur - Removed
if exist "%commPrograms%\VirusGarde\" rd /s /q "%commPrograms%\VirusGarde" >nul && echo Folder %commPrograms%\VirusGarde - Removed
if exist "%commPrograms%\VirusRemover2008\" rd /s /q "%commPrograms%\VirusRemover2008" >nul && echo Folder %commPrograms%\VirusRemover2008 - Removed
if exist "%commPrograms%\WinIFixer\" rd /s /q "%commPrograms%\WinIFixer" >nul && echo Folder %commPrograms%\VWinIFixer - Removed
if exist "%commPrograms%\WinSecureAv\" rd /s /q "%commPrograms%\WinSecureAv" >nul && echo Folder %commPrograms%\WinSecureAv - Removed
if exist "%commPrograms%\WinReanimator\" rd /s /q "%commPrograms%\WinReanimator" >nul && echo Folder %commPrograms%\WinReanimator - Removed
if exist "%commPrograms%\XPSecurityCenter\" rd /s /q "%commPrograms%\XPSecurityCenter" >nul && echo Folder %commPrograms%\XPSecurityCenter - Removed
if exist "%programfiles%\180searchassistant\" rd /q/s "%programfiles%\180searchassistant" >nul && echo Folder %programfiles%\180searchassistant - Removed
if exist "%programfiles%\180search assistant\" rd /q/s "%programfiles%\180search assistant" >nul && echo Folder %programfiles%\180search assistant - Removed
if exist "%programfiles%\180solutions\" rd /q/s "%programfiles%\180solutions" >nul && echo Folder %programfiles%\180solutions - Removed
if exist "%programfiles%\3721\" rd /q/s "%programfiles%\3721" >nul && echo Folder %programfiles%\3721 - Removed
if exist "%programfiles%\Accessories\Common\" rd /q "%programfiles%\Accessories\Common" >nul && echo Folder %programfiles%\Accessories\Common - Removed
if exist "%programfiles%\Accoona\" rd /q "%programfiles%\Accoona" >nul && echo Folder %programfiles%\Accoona - Removed
if exist "%programfiles%\AdvancedCleaner Free\" rd /q/s "%programfiles%\AdvancedCleaner Free" >nul && echo Folder %programfiles%\AdvancedCleaner Free - Removed
if exist "%programfiles%\AdwareRemover2007\" rd /q "%programfiles%\AdwareRemover2007" >nul && echo Folder %programfiles%\AdwareRemover2007 - Removed
if exist "%programfiles%\akl\" rd /q "%programfiles%\akl" >nul && echo Folder %programfiles%\akl - Removed
if exist "%programfiles%\altcmd\" rd /s/q "%programfiles%\altcmd" >nul && echo Folder %programfiles%\altcmd - Removed
if exist "%programfiles%\amsys\" rd /q "%programfiles%\amsys" >nul && echo Folder %programfiles%\amsys - Removed
if exist "%programfiles%\AntiMalwareGuard\" rd /s/q "%programfiles%\AntiMalwareGuard" >nul && echo Folder %programfiles%\AntiMalwareGuard - Removed
if exist "%programfiles%\AntiSpyCheck 2.1\" rd /s/q "%programfiles%\AntiSpyCheck 2.1" >nul && echo Folder %programfiles%\AntiSpyCheck 2.1 - Removed
if exist "%programfiles%\AntispyKnight\" rd /s/q "%programfiles%\AntispyKnight" >nul && echo Folder %programfiles%\AntispyKnight - Removed
if exist "%programfiles%\AntispyStorm\" rd /s/q "%programfiles%\AntispyStorm" >nul && echo Folder %programfiles%\AntispyStorm - Removed
if exist "%programfiles%\AntiSpywareMaster\" rd /s/q "%programfiles%\AntiSpywareMaster" >nul && echo Folder %programfiles%\AntiSpywareMaster - Removed
if exist "%programfiles%\AntiSpywareExpert\" rd /s/q "%programfiles%\AntiSpywareExpert" >nul && echo Folder %programfiles%\AntiSpywareExpert - Removed
if exist "%programfiles%\AntiSpywareXP2009\" rd /s/q "%programfiles%\AntiSpywareXP2009" >nul && echo Folder %programfiles%\AntiSpywareXP2009 - Removed
if exist "%programfiles%\Antivir64\" rd /s/q "%programfiles%\Antivir64" >nul && echo Folder %programfiles%\Antivir64 - Removed
if exist "%programfiles%\Antivirus2008\" rd /s/q "%programfiles%\Antivirus2008" >nul && echo Folder %programfiles%\Antivirus2008 - Removed
if exist "%programfiles%\Antivirus2008y\" rd /s/q "%programfiles%\Antivirus2008y" >nul && echo Folder %programfiles%\Antivirus2008y - Removed
if exist "%programfiles%\Antivirus 2008\" rd /s/q "%programfiles%\Antivirus 2008" >nul && echo Folder %programfiles%\Antivirus 2008 - Removed
if exist "%programfiles%\Antivirus 2008 PRO\" rd /s/q "%programfiles%\Antivirus 2008 PRO" >nul && echo Folder %programfiles%\Antivirus 2008 PRO - Removed
if exist "%programfiles%\Antivirus 2009\" rd /s/q "%programfiles%\Antivirus 2009" >nul && echo Folder %programfiles%\Antivirus 2009 - Removed
if exist "%programfiles%\AntiVirusLab2009\" rd /s/q "%programfiles%\AntiVirusLab2009" >nul && echo Folder %programfiles%\AntiVirusLab2009 - Removed
if exist "%programfiles%\AntivirusFiable\" rd /s/q "%programfiles%\AntivirusFiable" >nul && echo Folder %programfiles%\AntivirusFiable - Removed
if exist "%programfiles%\AntivirusPro2009\" rd /s/q "%programfiles%\AntivirusPro2009" >nul && echo Folder %programfiles%\AntivirusPro2009 - Removed
IF EXIST Find.txt dnif.exe /I "\Applications\iebr.dll" <Find.txt>NUL && if exist "%programfiles%\Applications\" rd /s/q "%programfiles%\Applications" >nul && echo Folder %programfiles%\Applications - Removed
if exist "%programfiles%\ASC 2.1\" rd /s/q "%programfiles%\ASC 2.1" >nul && echo Folder %programfiles%\ASC 2.1 - Removed
if exist "%programfiles%\aspch\" rd /s/q "%programfiles%\aspch" >nul && echo Folder %programfiles%\aspch - Removed
if exist "%programfiles%\ASpyC\" rd /s/q "%programfiles%\ASpyC" >nul && echo Folder %programfiles%\ASpyC - Removed
if exist "%programfiles%\AV2010\" rd /s/q "%programfiles%\AV2010" >nul && echo Folder %programfiles%\AV2010 - Removed
if exist "%programfiles%\AV9\" rd /s/q "%programfiles%\AV9" >nul && echo Folder %programfiles%\AV9 - Removed
if exist "%programfiles%\AXPFixer\" rd /s/q "%programfiles%\AXPFixer" >nul && echo Folder %programfiles%\AXPFixer - Removed
if exist "%programfiles%\BChanger\" rd /s/q "%programfiles%\BChanger" >nul && echo Folder %programfiles%\BChanger - Removed
if exist "%programfiles%\Bifrost\" rd /q "%programfiles%\Bifrost" >nul && echo Folder %programfiles%\Bifrost - Removed
if exist "%programfiles%\BraveSentry\" rd /s /q "%programfiles%\BraveSentry" >nul && echo Folder %programfiles%\BraveSentry - Removed
if exist "%programfiles%\cjb\" rd /s /q "%programfiles%\cjb" >nul && echo Folder %programfiles%\cjb - Removed
if exist "%programfiles%\config32\" rd /s /q "%programfiles%\config32" >nul && echo Folder %programfiles%\config32 - Removed
if exist "%programfiles%\CPV\" rd /s /q "%programfiles%\CPV" >nul && echo Folder %programfiles%\CPV - Removed
if exist "%programfiles%\dbar\" rd /s /q "%programfiles%\dbar" >nul && echo Folder %programfiles%\dbar - Removed
if exist "%programfiles%\dfsdfsd\" rd /s /q "%programfiles%\dfsdfsd" >nul && echo Folder %programfiles%\dfsdfsd - Removed
if exist "%programfiles%\Dot1XCfg\" rd /s /q "%programfiles%\Dot1XCfg" >nul && echo Folder %programfiles%\Dot1XCfg - Removed
if exist "%programfiles%\drmupgds\" rd /s /q "%programfiles%\drmupgds" >nul && echo Folder %programfiles%\drmupgds - Removed
if exist "%programfiles%\E404 Helper\" rd /s /q "%programfiles%\E404 Helper" >nul && echo Folder %programfiles%\E404 Helper - Removed
if exist "%programfiles%\E404DHelper\" rd /s /q "%programfiles%\E404DHelper" >nul && echo Folder %programfiles%\E404DHelper - Removed
if exist "%programfiles%\Eroca\" rd /q "%programfiles%\Eroca" >nul && echo Folder %programfiles%\Eroca - Removed
if exist "%programfiles%\ExpertHelper\" rd /q "%programfiles%\ExpertHelper" >nul && echo Folder %programfiles%\ExpertHelper - Removed
if exist "%programfiles%\ezPorn\" rd /q "%programfiles%\ezPorn" >nul && echo Folder %programfiles%\ezPorn - Removed
if exist "%programfiles%\e-zshopper\" rd /q "%programfiles%\e-zshopper" >nul && echo Folder %programfiles%\e-zshopper - Removed
if exist "%programfiles%\FBrowsingAdvisor\" rd /q "%programfiles%\FBrowsingAdvisor" >nul && echo Folder %programfiles%\FBrowsingAdvisor - Removed
if exist "%programfiles%\Files-Secure\" rd /q "%programfiles%\Files-Secure" >nul && echo Folder %programfiles%\Files-Secure - Removed
if exist "%programfiles%\GetModule\" rd /q "%programfiles%\GetModule" >nul && echo Folder %programfiles%\GetModule - Removed
if exist "%programfiles%\GetPack\" rd /q "%programfiles%\GetPack" >nul && echo Folder %programfiles%\GetPack - Removed
if exist "%programfiles%\GIGAPorn\" rd /q "%programfiles%\GIGAPorn" >nul && echo Folder %programfiles%\GIGAPorn - Removed
if exist "%programfiles%\Helper\" rd /q "%programfiles%\Helper" >nul && echo Folder %programfiles%\Helper - Removed
if exist "%programfiles%\iCheck\" rd /q "%programfiles%\iCheck" >nul && echo Folder %programfiles%\iCheck - Removed
if exist "%programfiles%\IEAntiVirus\" rd /q "%programfiles%\IEAntiVirus" >nul && echo Folder %programfiles%\IEAntiVirus - Removed
if exist "%programfiles%\IE Extensions\" rd /q "%programfiles%\IE Extensions" >nul && echo Folder %programfiles%\IE Extensions - Removed
if exist "%programfiles%\Inet Delivery\" rd /q "%programfiles%\Inet Delivery" >nul && echo Folder %programfiles%\Inet Delivery - Removed
if exist "%programfiles%\InetGet2\" rd /q "%programfiles%\InetGet2" >nul && echo Folder %programfiles%\InetGet2 - Removed
if exist "%programfiles%\Insider\" rd /q "%programfiles%\Insider" >nul && echo Folder %programfiles%\Insider - Removed
if exist "%programfiles%\Internet Explorer Assistant\" rd /q "%programfiles%\Internet Explorer Assistant" >nul && echo Folder %programfiles%\Internet Explorer Assistant - Removed
if exist "%programfiles%\Internet Speed Monitor\" rd /q "%programfiles%\Internet Speed Monitor" >nul && echo Folder %programfiles%\Internet Speed Monitor - Removed
if exist "%programfiles%\Ipwindows\" rd /q "%programfiles%\Ipwindows" >nul && echo Folder %programfiles%\Ipwindows - Removed
if exist "%programfiles%\iSecurity\" rd /s/q "%programfiles%\iSecurity" >nul && echo Folder %programfiles%\iSecurity - Removed
if exist "%programfiles%\ISM\" rd /q "%programfiles%\ISM" >nul && echo Folder %programfiles%\ISM - Removed
if exist "%programfiles%\ISM2\" rd /q "%programfiles%\ISM2" >nul && echo Folder %programfiles%\ISM2 - Removed
if exist "%programfiles%\JavaCore\" rd /q "%programfiles%\JavaCore" >nul && echo Folder %programfiles%\JavaCore - Removed
if exist "%programfiles%\kernel\" rd /q "%programfiles%\kernel" >nul && echo Folder %programfiles%\kernel - Removed
if exist "%programfiles%\KeyToPorn\" rd /q "%programfiles%\KeyToPorn" >nul && echo Folder %programfiles%\KeyToPorn - Removed
if exist "%programfiles%\LPVideoPlugin\" rd /q /s "%programfiles%\LPVideoPlugin" >nul && echo Folder %programfiles%\LPVideoPlugin - Removed
if exist "%programfiles%\MalwareBell\" rd /q "%programfiles%\MalwareBell" >nul && echo Folder %programfiles%\MalwareBell - Removed
if exist "%programfiles%\MalwareCrush\" rd /q "%programfiles%\MalwareCrush" >nul && echo Folder %programfiles%\MalwareCrush - Removed
if exist "%programfiles%\MapEDC\" rd /q "%programfiles%\MapEDC" >nul && echo Folder %programfiles%\MapEDC - Removed
if exist "%programfiles%\MediaEldoradoCodec\" rd /q "%programfiles%\MediaEldoradoCodec" >nul && echo Folder %programfiles%\MediaEldoradoCodec - Removed
if exist "%programfiles%\MediaJukeCodec\" rd /q "%programfiles%\MediaJukeCodec" >nul && echo Folder %programfiles%\MediaJukeCodec - Removed
if exist "%programfiles%\MediaVideoCodec\" rd /q "%programfiles%\MediaVideoCodec" >nul && echo Folder %programfiles%\MediaVideoCodec - Removed
if exist "%programfiles%\MicroAntivirus\" rd /q "%programfiles%\MicroAntivirus" >nul && echo Folder %programfiles%\MicroAntivirus - Removed
if exist "%programfiles%\MicroAV\" rd /q "%programfiles%\MicroAV" >nul && echo Folder %programfiles%\MicroAV - Removed
if exist "%programfiles%\Microsoft Common\" rd /q "%programfiles%\Microsoft Common" >nul && echo Folder %programfiles%\Microsoft Common - Removed
if exist "%programfiles%\Microsoft Security Adviser\" rd /q "%programfiles%\Microsoft Security Adviser" >nul && echo Folder %programfiles%\Microsoft Security Adviser - Removed
if exist "%programfiles%\mIRC\IRC Bot\" rd /q/s "%programfiles%\mIRC\IRC Bot" >nul && echo Folder %programfiles%\mIRC\IRC Bot - Removed
if exist "%programfiles%\mjc\" rd /q "%programfiles%\mjc" >nul && echo Folder %programfiles%\mjc - Removed
if exist "%programfiles%\Mjcore\" rd /q "%programfiles%\Mjcore" >nul && echo Folder %programfiles%\Mjcore - Removed
if exist "%programfiles%\Mozilla Firefox\extensions\sotfone-tracker@sotfone.ru\" rd /q/s "%programfiles%\Mozilla Firefox\extensions\sotfone-tracker@sotfone.ru" >nul && echo Folder %programfiles%\Mozilla Firefox\extensions\sotfone-tracker@sotfone.ru - Removed
if exist "%programfiles%\MPatrolPRO\" rd /q/s "%programfiles%\MPatrolPRO" >nul && echo Folder %programfiles%\MPatrolPRO - Removed
if exist "%programfiles%\MS Antivirus\" rd /q/s "%programfiles%\MS Antivirus" >nul && echo Folder %programfiles%\MS Antivirus - Removed
if exist "%programfiles%\MsConfigs\" rd /q "%programfiles%\MsConfigs" >nul && echo Folder %programfiles%\MsConfigs - Removed
if exist "%programfiles%\Network Monitor\" rd /q "%programfiles%\Network Monitor" >nul && echo Folder %programfiles%\Network Monitor - Removed
if exist "%programfiles%\NetProject\" rd /s/q "%programfiles%\NetProject" >nul && echo Folder %programfiles%\NetProject - Removed
if exist "%programfiles%\NoDNS\" rd /q "%programfiles%\NoDNS" >nul && echo Folder %programfiles%\NoDNS - Removed
if exist "%programfiles%\nvcoi\" rd /q "%programfiles%\nvcoi" >nul && echo Folder %programfiles%\nvcoi - Removed
if exist "%programfiles%\p2pnetworks\" rd /s /q "%programfiles%\p2pnetworks" >nul && echo Folder %programfiles%\p2pnetworks - Removed
if exist "%programfiles%\PC-Antispy\" rd /s/q "%programfiles%\PC-Antispy" >nul && echo Folder %programfiles%\PC-Antispy - Removed
if exist "%programfiles%\PC Clean Pro\" rd /s /q "%programfiles%\PC Clean Pro" >nul && echo Folder %programfiles%\PC Clean Pro - Removed
if exist "%programfiles%\PCHealthCenter\" rd /s /q "%programfiles%\PCHealthCenter" >nul && echo Folder %programfiles%\PCHealthCenter - Removed
if exist "%programfiles%\PCPrivacyCleaner\" rd /s /q "%programfiles%\PCPrivacyCleaner" >nul && echo Folder %programfiles%\PCPrivacyCleaner - Removed
if exist "%programfiles%\PCTotalDefender\" rd /s /q "%programfiles%\PCTotalDefender" >nul && echo Folder %programfiles%\PCTotalDefender - Removed
if exist "%programfiles%\PersonalAntiSpy Free\" rd /s /q "%programfiles%\PersonalAntiSpy Free" >nul && echo Folder %programfiles%\PersonalAntiSpy Free - Removed
if exist "%programfiles%\Personal Defender 2009\" rd /s /q "%programfiles%\Personal Defender 2009" >nul && echo Folder %programfiles%\Personal Defender 2009 - Removed
if exist "%programfiles%\PestTrap\" rd /s /q "%programfiles%\PestTrap" >nul && echo Folder %programfiles%\PestTrap - Removed
if exist "%programfiles%\PlayMP3z\" rd /s /q "%programfiles%\PlayMP3z" >nul && echo Folder %programfiles%\PlayMP3z - Removed
if exist "%programfiles%\poolsv\" rd /s /q "%programfiles%\poolsv" >nul && echo Folder %programfiles%\poolsv - Removed
if exist "%programfiles%\Pornovid\" rd /s /q "%programfiles%\Pornovid" >nul && echo Folder %programfiles%\Pornovid - Removed
if exist "%programfiles%\Power-Antivirus-2009\" rd /s /q "%programfiles%\Power-Antivirus-2009" >nul && echo Folder %programfiles%\Power-Antivirus-2009 - Removed
IF EXIST Find.txt dnif.exe /I "programsis\m5z.exe" <Find.txt>NUL && if exist "%programfiles%\programsis\" rd /s/q "%programfiles%\programsis" >nul && echo Folder %programfiles%\programsis - Removed
if exist "%programfiles%\QdrDrive\" rd /s/q "%programfiles%\QdrDrive" >nul && echo Folder %programfiles%\QdrDrive - Removed
if exist "%programfiles%\QdrPack\" rd /s/q "%programfiles%\QdrPack" >nul && echo Folder %programfiles%\QdrPack - Removed
if exist "%programfiles%\QdrModule\" rd /s/q "%programfiles%\QdrModule" >nul && echo Folder %programfiles%\QdrModule - Removed
if exist "%programfiles%\Rapid Antivirus\" rd /s /q "%programfiles%\Rapid Antivirus" >nul && echo Folder %programfiles%\Rapid Antivirus - Removed
if exist "%programfiles%\RichVideoCodec\" rd /s /q "%programfiles%\RichVideoCodec" >nul && echo Folder %programfiles%\RichVideoCodec - Removed
if exist "%programfiles%\Router\" rd /s /q "%programfiles%\Router" >nul && echo Folder %programfiles%\Router - Removed
if exist "%programfiles%\s300\" rd /q "%programfiles%\s300" >nul && echo Folder %programfiles%\s300 - Removed
if exist "%programfiles%\Sakora\" rd /s /q "%programfiles%\Sakora" >nul && echo Folder %programfiles%\Sakora - Removed
if exist "%programfiles%\SecureCleaner\" rd /s /q "%programfiles%\SecureCleaner" >nul && echo Folder %programfiles%\SecureCleaner - Removed
if exist "%programfiles%\SecureExpertCleaner\" rd /s /q "%programfiles%\SecureExpertCleaner" >nul && echo Folder %programfiles%\SecureExpertCleaner - Removed
if exist "%programfiles%\SecureFileShredder\" rd /s /q "%programfiles%\SecureFileShredder" >nul && echo Folder %programfiles%\SecureFileShredder - Removed
if exist "%programfiles%\SecurePCCleaner\" rd /s /q "%programfiles%\SecurePCCleaner" >nul && echo Folder %programfiles%\SecurePCCleaner - Removed
if exist "%programfiles%\seekmo\" rd /s /q "%programfiles%\seekmo" >nul && echo Folder %programfiles%\seekmo - Removed
if exist "%programfiles%\sexvid\" rd /s /q "%programfiles%\sexvid" >nul && echo Folder %programfiles%\sexvid - Removed
if exist "%programfiles%\ShopperLink\" rd /s /q "%programfiles%\ShopperLink" >nul && echo Folder %programfiles%\ShopperLink - Removed
if exist "%programfiles%\Skra\" rd /s /q "%programfiles%\Skra" >nul && echo Folder %programfiles%\Skra - Removed
if exist "%programfiles%\Sotfone\" rd /q "%programfiles%\Sotfone" >nul && echo Folder %programfiles%\Sotfone - Removed
if exist "%programfiles%\Spcron\" rd /q "%programfiles%\Spcron" >nul && echo Folder %programfiles%\Spcron - Removed
if exist "%programfiles%\sprof\" rd /q "%programfiles%\sprof" >nul && echo Folder %programfiles%\sprof - Removed
if exist "%programfiles%\Spruce\" rd /q "%programfiles%\Spruce" >nul && echo Folder %programfiles%\Spruce - Removed
if exist "%programfiles%\SpyDevastator\" rd /q/s "%programfiles%\SpyDevastator" >nul && echo Folder %programfiles%\SpyDevastator - Removed
if exist "%programfiles%\SpyGuarder\" rd /q "%programfiles%\SpyGuarder" >nul && echo Folder %programfiles%\SpyGuarder - Removed
if exist "%programfiles%\SpyMaxx\" rd /s/q "%programfiles%\SpyMaxx" >nul && echo Folder %programfiles%\SpyMaxx - Removed
if exist "%programfiles%\SpyShredder\" rd /s/q "%programfiles%\SpyShredder" >nul && echo Folder %programfiles%\SpyShredder - Removed
if exist "%programfiles%\SpywareIsolator\" rd /s/q "%programfiles%\SpywareIsolator" >nul && echo Folder %programfiles%\SpywareIsolator - Removed
if exist "%programfiles%\SpywareSweeper\" rd /s/q "%programfiles%\SpywareSweeper" >nul && echo Folder %programfiles%\SpywareSweeper - Removed
if exist "%programfiles%\SunPorn\" rd /q "%programfiles%\SunPorn" >nul && echo Folder %programfiles%\SunPorn - Removed
if exist "%programfiles%\Svconr\" rd /q "%programfiles%\Svconr" >nul && echo Folder %programfiles%\Svconr - Removed
if exist "%programfiles%\svhost\" rd /q "%programfiles%\svhost" >nul && echo Folder %programfiles%\svhost - Removed
if exist "%programfiles%\Sysmnt\" rd /q "%programfiles%\Sysmnt" >nul && echo Folder %programfiles%\Sysmnt - Removed
if exist "%programfiles%\SystemDefender\" rd /q "%programfiles%\SystemDefender" >nul && echo Folder %programfiles%\SystemDefender - Removed
if exist "%programfiles%\System Doctor Free\" rd /q/s "%programfiles%\System Doctor Free" >nul && echo Folder %programfiles%\System Doctor Free - Removed
if exist "%programfiles%\Temporary\" rd /s /q "%programfiles%\Temporary" >nul && echo Folder %programfiles%\Temporary - Removed
if exist "%programfiles%\TheSpyBot\" rd /s /q "%programfiles%\TheSpyBot" >nul && echo Folder %programfiles%\TheSpyBot - Removed
if exist "%programfiles%\TinyProxy\" rd /s /q "%programfiles%\TinyProxy" >nul && echo Folder %programfiles%\TinyProxy - Removed
if exist "%programfiles%\TonsOfPorn\" rd /s /q "%programfiles%\TonsOfPorn" >nul && echo Folder %programfiles%\TonsOfPorn - Removed
if exist "%programfiles%\TotalSecure2009\" rd /s /q "%programfiles%\TotalSecure2009" >nul && echo Folder %programfiles%\TotalSecure2009 - Removed
if exist "%programfiles%\TrustedAntivirus\" rd /s /q "%programfiles%\TrustedAntivirus" >nul && echo Folder %programfiles%\TrustedAntivirus - Removed
if exist "%programfiles%\TS-2009\" rd /s /q "%programfiles%\TS-2009" >nul && echo Folder %programfiles%\TS-2009 - Removed
if exist "%programfiles%\Twain\" rd /s /q "%programfiles%\Twain" >nul && echo Folder %programfiles%\Twain - Removed
if exist "%programfiles%\Ultimate Cleaner\" rd /s /q "%programfiles%\Ultimate Cleaner" >nul && echo Folder %programfiles%\Ultimate Cleaner - Removed
if exist "%programfiles%\Ultimate Defender\" rd /s /q "%programfiles%\Ultimate Defender" >nul && echo Folder %programfiles%\Ultimate Defender - Removed
if exist "%programfiles%\VAV\" rd /s /q "%programfiles%\VAV" >nul && echo Folder %programfiles%\VAV - Removed
if exist "%programfiles%\Video Add-on\" rd /q "%programfiles%\Video Add-on" >nul && echo Folder %programfiles%\Video Add-on - Removed
if exist "%programfiles%\VideoAccessCodec\" rd /q "%programfiles%\VideoAccessCodec" >nul && echo Folder %programfiles%\VideoAccessCodec - Removed
if exist "%programfiles%\vipantispyware\" rd /s/q "%programfiles%\vipantispyware" >nul && echo Folder %programfiles%\vipantispyware - Removed
if exist "%programfiles%\VirRL2009\" rd /s/q "%programfiles%\VirRL2009" >nul && echo Folder %programfiles%\VirRL2009 - Removed
if exist "%programfiles%\VirusEffaceur\" rd /s/q "%programfiles%\VirusEffaceur" >nul && echo Folder %programfiles%\VirusEffaceur - Removed
if exist "%programfiles%\VirusGarde\" rd /s/q "%programfiles%\VirusGarde" >nul && echo Folder %programfiles%\VirusGarde - Removed
if exist "%programfiles%\VirusHeat 4.3\" rd /s/q "%programfiles%\VirusHeat 4.3" >nul && echo Folder %programfiles%\VirusHeat 4.3 - Removed
if exist "%programfiles%\VirusHeat 4.4\" rd /s/q "%programfiles%\VirusHeat 4.4" >nul && echo Folder %programfiles%\VirusHeat 4.4 - Removed
if exist "%programfiles%\VirusIsolator\" rd /s/q "%programfiles%\VirusIsolator" >nul && echo Folder %programfiles%\VirusIsolator - Removed
if exist "%programfiles%\VirusRemover2008\" rd /s/q "%programfiles%\VirusRemover2008" >nul && echo Folder %programfiles%\VirusRemover2008 - Removed
if exist "%programfiles%\VirusResponseLab2009\" rd /s/q "%programfiles%\VirusResponseLab2009" >nul && echo Folder %programfiles%\VirusResponseLab2009 - Removed
if exist "%programfiles%\VnrBlock\" rd /s/q "%programfiles%\VnrBlock" >nul && echo Folder %programfiles%\VnrBlock - Removed
if exist "%programfiles%\VnrPack\" rd /s/q "%programfiles%\VnrPack" >nul && echo Folder %programfiles%\VnrPack - Removed
if exist "%programfiles%\VResLab\" rd /s/q "%programfiles%\VResLab" >nul && echo Folder %programfiles%\VResLab - Removed
if exist "%programfiles%\Web Buying\" rd /s/q "%programfiles%\Web Buying" >nul && echo Folder %programfiles%\Web Buying - Removed
if exist "%programfiles%\Web Technologies\" rd /s/q "%programfiles%\Web Technologies" >nul && echo Folder %programfiles%\Web Technologies - Removed
IF EXIST Find.txt dnif.exe /I "\Webtools\webtools.dll" <Find.txt>NUL && if exist "%programfiles%\Webtools\" rd /s/q "%programfiles%\Webtools" >nul && echo Folder %programfiles%\Webtools - Removed
if exist "%programfiles%\win32a\" rd /q "%programfiles%\win32a" >nul && echo Folder %programfiles%\win32a - Removed
if exist "%programfiles%\WinAble\" rd /q "%programfiles%\WinAble" >nul && echo Folder %programfiles%\WinAble - Removed
if exist "%programfiles%\WinAntispyware2008\" rd /s/q "%programfiles%\WinAntispyware2008" >nul && echo Folder %programfiles%\WinAntispyware2008 - Removed
if exist "%programfiles%\WinIFixer\" rd /s/q "%programfiles%\WinIFixer" >nul && echo Folder %programfiles%\WinIFixer - Removed
if exist "%programfiles%\WinPop\" rd /q "%programfiles%\WinPop" >nul && echo Folder %programfiles%\WinPop - Removed
if exist "%programfiles%\WinReanimator\" rd /s/q "%programfiles%\WinReanimator" >nul && echo Folder %programfiles%\WinReanimator - Removed
if exist "%programfiles%\WinSecureAv\" rd /s/q "%programfiles%\WinSecureAv" >nul && echo Folder %programfiles%\WinSecureAv - Removed
if exist "%programfiles%\winvi\" rd /s /q "%programfiles%\winvi" >nul && echo Folder %programfiles%\winvi - Removed
if exist "%programfiles%\WinXDefender\" rd /s /q "%programfiles%\WinXDefender" >nul && echo Folder %programfiles%\WinXDefender - Removed
if exist "%programfiles%\WinXProtector\" rd /s /q "%programfiles%\WinXProtector" >nul && echo Folder %programfiles%\WinXProtector - Removed
if exist "%programfiles%\WinX Security Center\" rd /s /q "%programfiles%\WinX Security Center" >nul && echo Folder %programfiles%\WinX Security Center - Removed
if exist "%programfiles%\Words\" rd /q "%programfiles%\Words" >nul && echo Folder %programfiles%\Words - Removed
if exist "%programfiles%\xInsIDE\" rd /q "%programfiles%\xInsIDE" >nul && echo Folder %programfiles%\xInsIDE - Removed
if exist "%programfiles%\xloadnet\" rd /q "%programfiles%\xloadnet" >nul && echo Folder %programfiles%\xloadnet - Removed
if exist "%programfiles%\XP_Antispyware\" rd /s/q "%programfiles%\XP_Antispyware" >nul && echo Folder %programfiles%\XP_Antispyware - Removed
if exist "%programfiles%\XP Antivirus\" rd /s/q "%programfiles%\XP Antivirus" >nul && echo Folder %programfiles%\XP Antivirus - Removed
if exist "%programfiles%\XPSecurityCenter\" rd /s/q "%programfiles%\XPSecurityCenter" >nul && echo Folder %programfiles%\XPSecurityCenter - Removed
if exist "%programfiles%\zango\" rd /q "%programfiles%\zango" >nul && echo Folder %programfiles%\zango - Removed
if exist "%commonprogramfiles%\AntivirusFiable\" rd /q/s "%commonprogramfiles%\AntivirusFiable" >nul && echo Folder %commonprogramfiles%\AntivirusFiable - Removed
if exist "%commonprogramfiles%\Carlson\" rasphone -r "carlton"
if exist "%commonprogramfiles%\Carlson\" rd /q "%commonprogramfiles%\Carlson" >nul && echo Folder %commonprogramfiles%\Carlson - Removed
if exist "%commonprogramfiles%\delsim\" rasphone -r "del"
if exist "%commonprogramfiles%\delsim\" rd /q "%commonprogramfiles%\delsim" >nul && echo Folder %commonprogramfiles%\delsim - Removed
if exist "%commonprogramfiles%\inst32\" attrib.exe -s -h -r "%commonprogramfiles%\inst32">nul
if exist "%commonprogramfiles%\inst32\" rd /q "%commonprogramfiles%\inst32" >nul && echo Folder %commonprogramfiles%\inst32 - Removed
if exist "%commonprogramfiles%\PCTotalDefender\" rd /q/s "%commonprogramfiles%\PCTotalDefender" >nul && echo Folder %commonprogramfiles%\PCTotalDefender - Removed
if exist "%commonprogramfiles%\PersonalAntiSpy\" rd /q/s "%commonprogramfiles%\PersonalAntiSpy" >nul && echo Folder %commonprogramfiles%\PersonalAntiSpy - Removed
if exist "%commonprogramfiles%\SecurePCCleaner\" rd /q/s "%commonprogramfiles%\SecurePCCleaner" >nul && echo Folder %commonprogramfiles%\SecurePCCleaner - Removed
if exist "%commonprogramfiles%\SpyGuarder\" rd /q/s "%commonprogramfiles%\SpyGuarder" >nul && echo Folder %commonprogramfiles%\SpyGuarder - Removed
if exist "%commonprogramfiles%\System Doctor\" rd /q/s "%commonprogramfiles%\System Doctor" >nul && echo Folder %commonprogramfiles%\System Doctor - Removed
if exist "%commonprogramfiles%\TrustedAntivirus\" rd /q/s "%commonprogramfiles%\TrustedAntivirus" >nul && echo Folder %commonprogramfiles%\TrustedAntivirus - Removed
if exist "%commonprogramfiles%\VirusEffaceur\" rd /q/s "%commonprogramfiles%\VirusEffaceur" >nul && echo Folder %commonprogramfiles%\VirusEffaceur - Removed
if exist "%commonprogramfiles%\VirusGarde\" rd /q/s "%commonprogramfiles%\VirusGarde" >nul && echo Folder %commonprogramfiles%\VirusGarde - Removed
if exist "%commonprogramfiles%\WinSecureAv\" rd /q/s "%commonprogramfiles%\WinSecureAv" >nul && echo Folder %commonprogramfiles%\WinSecureAv - Removed
if exist "%commonprogramfiles%\WinXProtector\" rd /q/s "%commonprogramfiles%\WinXProtector" >nul && echo Folder %commonprogramfiles%\WinXProtector - Removed
if exist "%commonprogramfiles%\WinX Security Center\" rd /q/s "%commonprogramfiles%\WinX Security Center" >nul && echo Folder %commonprogramfiles%\WinX Security Center - Removed
if exist "%systemdrive%\Backup_Drivers\" rd /q "%systemdrive%\Backup_Drivers" >nul && echo Folder %systemdrive%\Backup_Drivers - Removed
if exist "%systemdrive%\DriverLoad\" rd /q "%systemdrive%\DriverLoad" >nul && echo Folder %systemdrive%\DriverLoad - Removed
if exist "%systemdrive%\Documents and Settings\LocalService\Application Data\NetMon\" rd /q "%systemdrive%\Documents and Settings\LocalService\Application Data\NetMon" >nul && echo Folder %systemdrive%\Documents and Settings\LocalService\Application Data\NetMon - Removed
if exist "%systemdrive%\Documents and Settings\LocalService\Application Data\ultra\" rd /q "%systemdrive%\Documents and Settings\LocalService\Application Data\ultra" >nul && echo Folder %systemdrive%\Documents and Settings\LocalService\Application Data\ultra - Removed
if exist "%systemdrive%\iSecurity\" rd /q/s "%systemdrive%\iSecurity" >nul && echo Folder %systemdrive%\iSecurity - Removed
if exist "%systemdrive%\microsoft\" rd /q/s "%systemdrive%\microsoft" >nul && echo Folder %systemdrive%\microsoft - Removed
if exist "%systemdrive%\PCTotalDefender\" rd /q/s "%systemdrive%\PCTotalDefender" >nul && echo Folder %systemdrive%\PCTotalDefender - Removed
if exist "%systemdrive%\prkc\" rd /q "%systemdrive%\prkc" >nul && echo Folder %systemdrive%\prkc - Removed
if exist "%systemdrive%\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\" rd /q/s "%systemdrive%\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013" >nul && echo Folder %systemdrive%\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013 - Removed
if exist "%systemdrive%\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1015\" rd /q/s "%systemdrive%\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1015" >nul && echo Folder %systemdrive%\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1015 - Removed
if exist "%systemdrive%\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1033\" rd /q/s "%systemdrive%\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1033" >nul && echo Folder %systemdrive%\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1033 - Removed
if exist "%systemdrive%\RECYCLER\S-1-5-21-8749690170-1178536752-683249000-6731\" rd /q/s "%systemdrive%\RECYCLER\S-1-5-21-8749690170-1178536752-683249000-6731" >nul && echo Folder %systemdrive%\RECYCLER\S-1-5-21-8749690170-1178536752-683249000-6731 - Removed
if exist "%systemdrive%\Recyclers\" rd /q "%systemdrive%\Recyclers" >nul && echo Folder %systemdrive%\Recyclers\ - Removed
IF EXIST Find.txt dnif.exe /I "682003330-1013\msnmsngr.exe" <Find.txt>NUL && if exist "%systemdrive%\RESTORE\" rd /s/q "%systemdrive%\RESTORE" >nul && echo Folder %systemdrive%\RESTORE\ - Removed
if exist "%systemdrive%\resycled\" rd /s/q "%systemdrive%\resycled" >nul && echo Folder %systemdrive%\resycled - Removed
IF EXIST Find.txt dnif.exe /I "\Settings\arm" <Find.txt>NUL && if exist "%systemdrive%\Settings" rd /q/s "%systemdrive%\Settings" >nul && echo Folder %systemdrive%\Settings - Removed
if exist "%systemdrive%\Sohbet-Script\" rd /q /s "%systemdrive%\Sohbet-Script" >nul && echo Folder %systemdrive%\Sohbet-Script\ - Removed
if exist "%systemdrive%\tempb9\" rd /q /s "%systemdrive%\tempb9" >nul && echo Folder %systemdrive%\tempb9 - Removed
if exist "%systemdrive%\Temp\0b9\" rd /q /s "%systemdrive%\Temp\0b9" >nul && echo Folder %systemdrive%\Temp\0b9 - Removed
if exist "%systemdrive%\Temp\abW9\" rd /q /s "%systemdrive%\Temp\abW9" >nul && echo Folder %systemdrive%\Temp\abW9 - Removed
if exist "%systemdrive%\Temp\1cb\" rd /q /s "%systemdrive%\Temp\1cb" >nul && echo Folder %systemdrive%\Temp\1cb - Removed
if exist "%systemdrive%\Temp\bkR11\" rd /q /s "%systemdrive%\Temp\bkR11" >nul && echo Folder %systemdrive%\Temp\bkR11 - Removed
if exist "%systemdrive%\Temp\brr\" rd /q /s "%systemdrive%\Temp\brr" >nul && echo Folder %systemdrive%\Temp\brr - Removed
if exist "%systemdrive%\Temp\fse\" rd /q /s "%systemdrive%\Temp\fse" >nul && echo Folder %systemdrive%\Temp\fse - Removed
if exist "%systemdrive%\Temp\gbRve12\" rd /q /s "%systemdrive%\Temp\gbRve12" >nul && echo Folder %systemdrive%\Temp\gbRve12 - Removed
if exist "%systemdrive%\Temp\iee\" rd /q /s "%systemdrive%\Temp\iee" >nul && echo Folder %systemdrive%\Temp\iee - Removed
if exist "%systemdrive%\Temp\maxsv15\" rd /q /s "%systemdrive%\Temp\maxsv15" >nul && echo Folder %systemdrive%\Temp\maxsv15 - Removed
if exist "%systemdrive%\Temp\sanR24\" rd /q /s "%systemdrive%\Temp\sanR24" >nul && echo Folder %systemdrive%\Temp\sanR24 - Removed
if exist "%systemdrive%\Temp\tn3\" rd /q /s "%systemdrive%\Temp\tn3" >nul && echo Folder %systemdrive%\Temp\tn3 - Removed
if exist "%systemdrive%\Temp\tmpvc14\" rd /q /s "%systemdrive%\Temp\tmpvc14" >nul && echo Folder %systemdrive%\Temp\tmpvc14 - Removed
if exist "%systemdrive%\Temp\tpBe12\" rd /q /s "%systemdrive%\Temp\tpBe12" >nul && echo Folder %systemdrive%\Temp\tpBe12 - Removed
if exist "%systemdrive%\Temp\vtmp2\" rd /q /s "%systemdrive%\Temp\vtmp2" >nul && echo Folder %systemdrive%\Temp\vtmp2 - Removed
if exist "%systemdrive%\Temp\xp34\" rd /q /s "%systemdrive%\Temp\xp34" >nul && echo Folder %systemdrive%\Temp\xp34 - Removed
if exist "%systemdrive%\VirusEffaceur\" rd /q /s "%systemdrive%\VirusEffaceur" >nul && echo Folder %systemdrive%\VirusEffaceur - Removed
if exist "%systemdrive%\VirusGarde\" rd /q /s "%systemdrive%\VirusGarde" >nul && echo Folder %systemdrive%\VirusGarde - Removed
if exist "%systemdrive%\winla\" rd /q "%systemdrive%\winla" >nul && echo Folder %systemdrive%\winla - Removed
if exist "%systemdrive%\WinSecureAv\" rd /s/q "%systemdrive%\WinSecureAv" >nul && echo Folder %systemdrive%\WinSecureAv - Removed
if exist "%systemroot%\1222\" rd /q /s "%systemroot%\1222" >nul && echo Folder %systemroot%\1222 - Removed
if exist "%systemroot%\bdir\" rd /q /s "%systemroot%\bdir" >nul && echo Folder %systemroot%\bdir - Removed
if exist "%systemroot%\Bifrost\" rd /q "%systemroot%\Bifrost" >nul && echo Folder %systemroot%\Bifrost - Removed
if exist "%systemroot%\config\install\download\" rd /q "%systemroot%\config\install\download" >nul && echo Folder %systemroot%\config\install\download - Removed
if exist "%systemroot%\config\install\logs\" rd /q "%systemroot%\config\install\logs" >nul && echo Folder %systemroot%\config\install\logs - Removed
if exist "%systemroot%\config\install\sounds\" rd /q "%systemroot%\config\install\sounds" >nul && echo Folder %systemroot%\config\install\sounds - Removed
if exist "%systemroot%\FLEOK\" rd /s /q "%systemroot%\FLEOK" >nul && echo Folder %systemroot%\FLEOK - Removed
if exist "%systemroot%\Fonts\system32\" rd /s /q "%systemroot%\Fonts\system32" >nul && echo Folder %systemroot%\Fonts\system32 - Removed
if exist "%systemroot%\inetsponsor\" rd /s /q "%systemroot%\inetsponsor" >nul && echo Folder %systemroot%\inetsponsor - Removed
if exist "%systemroot%\isas\" rd /s /q "%systemroot%\isas" >nul && echo Folder %systemroot%\isas - Removed
if exist "%systemroot%\java\java.log\" rd /s /q "%systemroot%\java\java.log" >nul && echo Folder %systemroot%\java\java.log - Removed
if exist "%systemroot%\litmus\" rd /q "%systemroot%\litmus" >nul && echo Folder %systemroot%\litmus - Removed
if exist "%systemroot%\mslagent\" rd /q "%systemroot%\mslagent" >nul && echo Folder %systemroot%\mslagent - Removed
if exist "%systemroot%\nic\sox\" rd /q "%systemroot%\nic\sox" >nul && echo Folder %systemroot%\nic\sox - Removed
if exist "%systemroot%\OASJJ\" rd /s /q "%systemroot%\OASJJ" >nul && echo Folder %systemroot%\OASJJ - Removed
if exist "%systemroot%\privacy_danger\" rd /s /q "%systemroot%\privacy_danger" >nul && echo Folder %systemroot%\privacy_danger - Removed
if exist "%systemroot%\PerfInfo\" rd /s /q "%systemroot%\PerfInfo" >nul && echo Folder %systemroot%\PerfInfo - Removed
if exist "%systemroot%\rdrive\" rd /q "%systemroot%\rdrive" >nul && echo Folder %systemroot%\rdrive - Removed
if exist "%systemroot%\Recyclers\" rd /q "%systemroot%\Recyclers" >nul && echo Folder %systemroot%\Recyclers - Removed
if exist "%systemroot%\sdrive\" rd /q "%systemroot%\sdrive" >nul && echo Folder %systemroot%\sdrive - Removed
if exist "%systemroot%\ServicePackFiles\www.google.com\" rd /s /q "%systemroot%\ServicePackFiles\www.google.com" >nul && echo Folder %systemroot%\ServicePackFiles\www.google.com - Removed
if exist "%systemroot%\sysguard\" rd /s /q "%systemroot%\sysguard" >nul && echo Folder %systemroot%\sysguard - Removed
if exist "%systemroot%\system\download\" rd /s /q "%systemroot%\system\download" >nul && echo Folder %systemroot%\system\download - Removed
if exist "%systemroot%\system\programas\" rd /s /q "%systemroot%\system\programas" >nul && echo Folder %systemroot%\system\programas - Removed
if exist "%systemroot%\system32\1036a\" rd /q "%systemroot%\system32\1036a" >nul && echo Folder %systemroot%\system32\1036a - Removed
if exist "%systemroot%\system32\1039a\" rd /q "%systemroot%\system32\1039a" >nul && echo Folder %systemroot%\system32\1039a - Removed
if exist "%systemroot%\system32\120237\" rd /q "%systemroot%\system32\120237" >nul && echo Folder %systemroot%\system32\120237 - Removed
if exist "%systemroot%\system32\124909\" rd /q "%systemroot%\system32\124909" >nul && echo Folder %systemroot%\system32\124909 - Removed
if exist "%systemroot%\system32\146955\" rd /q "%systemroot%\system32\146955" >nul && echo Folder %systemroot%\system32\146955 - Removed
if exist "%systemroot%\system32\158117\" rd /q "%systemroot%\system32\158117" >nul && echo Folder %systemroot%\system32\158117 - Removed
if exist "%systemroot%\system32\172135\" rd /q "%systemroot%\system32\172135" >nul && echo Folder %systemroot%\system32\172135 - Removed
if exist "%systemroot%\system32\209789\" rd /q "%systemroot%\system32\209789" >nul && echo Folder %systemroot%\system32\209789 - Removed
if exist "%systemroot%\system32\214075\" rd /q "%systemroot%\system32\214075" >nul && echo Folder %systemroot%\system32\214075 - Removed
if exist "%systemroot%\system32\215651\" rd /q "%systemroot%\system32\215651" >nul && echo Folder %systemroot%\system32\215651 - Removed
if exist "%systemroot%\system32\219725\" rd /q "%systemroot%\system32\219725" >nul && echo Folder %systemroot%\system32\219725 - Removed
if exist "%systemroot%\system32\238044\" rd /q "%systemroot%\system32\238044" >nul && echo Folder %systemroot%\system32\238044 - Removed
if exist "%systemroot%\system32\247880\" rd /q "%systemroot%\system32\247880" >nul && echo Folder %systemroot%\system32\247880 - Removed
if exist "%systemroot%\system32\251851\" rd /q "%systemroot%\system32\251851" >nul && echo Folder %systemroot%\system32\251851 - Removed
if exist "%systemroot%\system32\286858\" rd /q "%systemroot%\system32\286858" >nul && echo Folder %systemroot%\system32\286858 - Removed
if exist "%systemroot%\system32\299914\" rd /q "%systemroot%\system32\299914" >nul && echo Folder %systemroot%\system32\299914 - Removed
if exist "%systemroot%\system32\304434\" rd /q "%systemroot%\system32\304434" >nul && echo Folder %systemroot%\system32\304434 - Removed
if exist "%systemroot%\system32\311496\" rd /q "%systemroot%\system32\311496" >nul && echo Folder %systemroot%\system32\311496 - Removed
if exist "%systemroot%\system32\312191\" rd /q "%systemroot%\system32\312191" >nul && echo Folder %systemroot%\system32\312191 - Removed
if exist "%systemroot%\system32\349168\" rd /q "%systemroot%\system32\349168" >nul && echo Folder %systemroot%\system32\349168 - Removed
if exist "%systemroot%\system32\371186\" rd /q "%systemroot%\system32\371186" >nul && echo Folder %systemroot%\system32\371186 - Removed
if exist "%systemroot%\system32\375013\" rd /q "%systemroot%\system32\375013" >nul && echo Folder %systemroot%\system32\375013 - Removed
if exist "%systemroot%\system32\382077\" rd /q "%systemroot%\system32\382077" >nul && echo Folder %systemroot%\system32\382077 - Removed
if exist "%systemroot%\system32\394559\" rd /q "%systemroot%\system32\394559" >nul && echo Folder %systemroot%\system32\394559 - Removed
if exist "%systemroot%\system32\403445\" rd /q "%systemroot%\system32\403445" >nul && echo Folder %systemroot%\system32\403445 - Removed
if exist "%systemroot%\system32\432591\" rd /q "%systemroot%\system32\432591" >nul && echo Folder %systemroot%\system32\432591 - Removed
if exist "%systemroot%\system32\433424\" rd /q "%systemroot%\system32\433424" >nul && echo Folder %systemroot%\system32\433424 - Removed
if exist "%systemroot%\system32\441465\" rd /q "%systemroot%\system32\441465" >nul && echo Folder %systemroot%\system32\441465 - Removed
if exist "%systemroot%\system32\443059\" rd /q "%systemroot%\system32\443059" >nul && echo Folder %systemroot%\system32\443059 - Removed
if exist "%systemroot%\system32\459849\" rd /q "%systemroot%\system32\459849" >nul && echo Folder %systemroot%\system32\459849 - Removed
if exist "%systemroot%\system32\461942\" rd /q "%systemroot%\system32\461942" >nul && echo Folder %systemroot%\system32\461942 - Removed
if exist "%systemroot%\system32\5022b\" rd /q "%systemroot%\system32\5022b" >nul && echo Folder %systemroot%\system32\5022b - Removed
if exist "%systemroot%\system32\512686\" rd /q "%systemroot%\system32\512686" >nul && echo Folder %systemroot%\system32\512686 - Removed
if exist "%systemroot%\system32\514852\" rd /q "%systemroot%\system32\514852" >nul && echo Folder %systemroot%\system32\514852 - Removed
if exist "%systemroot%\system32\518963\" rd /q "%systemroot%\system32\518963" >nul && echo Folder %systemroot%\system32\518963 - Removed
if exist "%systemroot%\system32\527631\" rd /q "%systemroot%\system32\527631" >nul && echo Folder %systemroot%\system32\527631 - Removed
if exist "%systemroot%\system32\561756\" rd /q "%systemroot%\system32\561756" >nul && echo Folder %systemroot%\system32\561756 - Removed
if exist "%systemroot%\system32\565379\" rd /q "%systemroot%\system32\565379" >nul && echo Folder %systemroot%\system32\565379 - Removed
if exist "%systemroot%\system32\566828\" rd /q "%systemroot%\system32\566828" >nul && echo Folder %systemroot%\system32\566828 - Removed
if exist "%systemroot%\system32\590075\" rd /q "%systemroot%\system32\590075" >nul && echo Folder %systemroot%\system32\590075 - Removed
if exist "%systemroot%\system32\609856\" rd /q "%systemroot%\system32\609856" >nul && echo Folder %systemroot%\system32\609856 - Removed
if exist "%systemroot%\system32\624855\" rd /q "%systemroot%\system32\624855" >nul && echo Folder %systemroot%\system32\624855 - Removed
if exist "%systemroot%\system32\639774\" rd /q "%systemroot%\system32\624855" >nul && echo Folder %systemroot%\system32\639774 - Removed
if exist "%systemroot%\system32\673351\" rd /q "%systemroot%\system32\673351" >nul && echo Folder %systemroot%\system32\673351 - Removed
if exist "%systemroot%\system32\675873\" rd /q "%systemroot%\system32\675873" >nul && echo Folder %systemroot%\system32\675873 - Removed
if exist "%systemroot%\system32\689371\" rd /q "%systemroot%\system32\689371" >nul && echo Folder %systemroot%\system32\689371 - Removed
if exist "%systemroot%\system32\690974\" rd /q "%systemroot%\system32\690974" >nul && echo Folder %systemroot%\system32\690974 - Removed
if exist "%systemroot%\system32\717305\" rd /q "%systemroot%\system32\717305" >nul && echo Folder %systemroot%\system32\717305 - Removed
if exist "%systemroot%\system32\729732\" rd /q "%systemroot%\system32\729732" >nul && echo Folder %systemroot%\system32\729732 - Removed
if exist "%systemroot%\system32\734914\" rd /q "%systemroot%\system32\734914" >nul && echo Folder %systemroot%\system32\734914 - Removed
if exist "%systemroot%\system32\736876\" rd /q "%systemroot%\system32\736876" >nul && echo Folder %systemroot%\system32\736876 - Removed
if exist "%systemroot%\system32\750623\" rd /q "%systemroot%\system32\750623" >nul && echo Folder %systemroot%\system32\750623 - Removed
if exist "%systemroot%\system32\752300\" rd /q "%systemroot%\system32\752300" >nul && echo Folder %systemroot%\system32\752300 - Removed
if exist "%systemroot%\system32\763444\" rd /q "%systemroot%\system32\763444" >nul && echo Folder %systemroot%\system32\763444 - Removed
if exist "%systemroot%\system32\774563\" rd /q "%systemroot%\system32\774563" >nul && echo Folder %systemroot%\system32\774563 - Removed
if exist "%systemroot%\system32\778670\" rd /q "%systemroot%\system32\778670" >nul && echo Folder %systemroot%\system32\778670 - Removed
if exist "%systemroot%\system32\784953\" rd /q "%systemroot%\system32\784953" >nul && echo Folder %systemroot%\system32\784953 - Removed
if exist "%systemroot%\system32\788877\" rd /q "%systemroot%\system32\788877" >nul && echo Folder %systemroot%\system32\788877 - Removed
if exist "%systemroot%\system32\792536\" rd /q "%systemroot%\system32\792536" >nul && echo Folder %systemroot%\system32\792536 - Removed
if exist "%systemroot%\system32\795367\" rd /q "%systemroot%\system32\795367" >nul && echo Folder %systemroot%\system32\795367 - Removed
if exist "%systemroot%\system32\804031\" rd /q "%systemroot%\system32\804031" >nul && echo Folder %systemroot%\system32\804031 - Removed
if exist "%systemroot%\system32\814810\" rd /q "%systemroot%\system32\814810" >nul && echo Folder %systemroot%\system32\814810 - Removed
if exist "%systemroot%\system32\818646\" rd /q "%systemroot%\system32\818646" >nul && echo Folder %systemroot%\system32\818646 - Removed
if exist "%systemroot%\system32\824223\" rd /q "%systemroot%\system32\824223" >nul && echo Folder %systemroot%\system32\824223 - Removed
if exist "%systemroot%\system32\834668\" rd /q "%systemroot%\system32\834668" >nul && echo Folder %systemroot%\system32\834668 - Removed
if exist "%systemroot%\system32\846888\" rd /q "%systemroot%\system32\846888" >nul && echo Folder %systemroot%\system32\846888 - Removed
if exist "%systemroot%\system32\848700\" rd /q "%systemroot%\system32\848700" >nul && echo Folder %systemroot%\system32\848700 - Removed
if exist "%systemroot%\system32\851174\" rd /q "%systemroot%\system32\851174" >nul && echo Folder %systemroot%\system32\851174 - Removed
if exist "%systemroot%\system32\857060\" rd /q "%systemroot%\system32\857060" >nul && echo Folder %systemroot%\system32\857060 - Removed
if exist "%systemroot%\system32\892267\" rd /q "%systemroot%\system32\892267" >nul && echo Folder %systemroot%\system32\892267 - Removed
if exist "%systemroot%\system32\905757\" rd /q "%systemroot%\system32\905757" >nul && echo Folder %systemroot%\system32\905757 - Removed
if exist "%systemroot%\system32\907465\" rd /q "%systemroot%\system32\907465" >nul && echo Folder %systemroot%\system32\907465 - Removed
if exist "%systemroot%\system32\912525\" rd /q "%systemroot%\system32\912525" >nul && echo Folder %systemroot%\system32\912525 - Removed
if exist "%systemroot%\system32\916992\" rd /q "%systemroot%\system32\916992" >nul && echo Folder %systemroot%\system32\916992 - Removed
if exist "%systemroot%\system32\931928\" rd /q "%systemroot%\system32\931928" >nul && echo Folder %systemroot%\system32\931928 - Removed
if exist "%systemroot%\system32\959563\" rd /q "%systemroot%\system32\959563" >nul && echo Folder %systemroot%\system32\959563 - Removed
if exist "%systemroot%\system32\960932\" rd /q "%systemroot%\system32\960932" >nul && echo Folder %systemroot%\system32\960932 - Removed
if exist "%systemroot%\system32\977751\" rd /q "%systemroot%\system32\977751" >nul && echo Folder %systemroot%\system32\977751 - Removed
if exist "%systemroot%\system32\995937\" rd /q "%systemroot%\system32\995937" >nul && echo Folder %systemroot%\system32\995937 - Removed
if exist "%systemroot%\system32\asxboot\" rd /s /q "%systemroot%\system32\asxboot" >nul && echo Folder %systemroot%\system32\asxboot - Removed
if exist "%systemroot%\system32\acespy\" rd /s/q "%systemroot%\system32\acespy" >nul && echo Folder %systemroot%\system32\acespy - Removed
if exist "%systemroot%\system32\Bifrost\" rd /s /q "%systemroot%\system32\Bifrost" >nul && echo Folder %systemroot%\system32\Bifrost - Removed
if exist "%systemroot%\system32\biz3\" rd /s /q "%systemroot%\system32\biz3" >nul && echo Folder %systemroot%\system32\biz3 - Removed
if exist "%systemroot%\system32\caam\" rd /q "%systemroot%\system32\caam" >nul && echo Folder %systemroot%\system32\caam - Removed
if exist "%systemroot%\system32\cdfig\" rd /q "%systemroot%\system32\cdfig" >nul && echo Folder %systemroot%\system32\cdfig - Removed
if exist "%systemroot%\system32\cdTMP\" rd /q "%systemroot%\system32\cdTMP" >nul && echo Folder %systemroot%\system32\cdTMP - Removed
if exist "%systemroot%\system32\cipantanah\" rd /s /q "%systemroot%\system32\cipantanah" >nul && echo Folder %systemroot%\system32\cipantanah - Removed
if exist "%systemroot%\system32\clrprv.oo\" rd /s /q "%systemroot%\system32\clrprv.oo" >nul && echo Folder %systemroot%\system32\clrprv.oo - Removed
if exist "%systemroot%\system32\cNF\" rd /q "%systemroot%\system32\cNF" >nul && echo Folder %systemroot%\system32\cNF - Removed
if exist "%systemroot%\system32\com52\" rd /q "%systemroot%\system32\com52" >nul && echo Folder %systemroot%\system32\com52 - Removed
if exist "%systemroot%\system32\config\systemprofile\Start Menu\Programs\Brave-Sentry\" rd /q "%systemroot%\system32\config\systemprofile\Start Menu\Programs\Brave-Sentry" >nul && echo Folder %systemroot%\system32\config\systemprofile\Start Menu\Programs\Brave-Sentry - Removed
if exist "%systemroot%\system32\din3\" rd /q "%systemroot%\system32\din3" >nul && echo Folder %systemroot%\system32\din3 - Removed
if exist "%systemroot%\system32\dllcache\win32\" rd /q /s "%systemroot%\system32\dllcache\win32" >nul && echo Folder %systemroot%\system32\dllcache\win32 - Removed
if exist "%systemroot%\system32\dot2\" rd /q "%systemroot%\system32\dot2" >nul && echo Folder %systemroot%\system32\dot2 - Removed
IF EXIST Find.txt dnif.exe /I "\system32\v1rg1n" <Find.txt>NUL && if exist "%systemroot%\system32\download\" rd /s/q "%systemroot%\system32\download" >nul && echo Folder %systemroot%\system32\download - Removed
IF EXIST Find.txt dnif.exe /I "\system32\blablabla.exe" <Find.txt>NUL && if exist "%systemroot%\system32\download\" rd /s/q "%systemroot%\system32\download" >nul && echo Folder %systemroot%\system32\download - Removed
if exist "%systemroot%\system32\drivers\etc\channels\" rd /q /s "%systemroot%\system32\drivers\etc\channels" >nul && echo Folder %systemroot%\system32\drivers\etc\channels - Removed
if exist "%systemroot%\system32\drivers\etc\download\" rd /q /s "%systemroot%\system32\drivers\etc\download" >nul && echo Folder %systemroot%\system32\drivers\etc\download - Removed
if exist "%systemroot%\system32\drivers\etc\scripts\" rd /q /s "%systemroot%\system32\drivers\etc\scripts" >nul && echo Folder %systemroot%\system32\drivers\etc\scripts - Removed
if exist "%systemroot%\system32\drivers\etc\server\" rd /q /s "%systemroot%\system32\drivers\etc\server" >nul && echo Folder %systemroot%\system32\drivers\etc\server - Removed
if exist "%systemroot%\system32\drivers\shellz\" rd /q /s "%systemroot%\system32\drivers\shellz" >nul && echo Folder %systemroot%\system32\drivers\shellz - Removed
if exist "%systemroot%\system32\drivers\syste\" rd /q /s "%systemroot%\system32\drivers\syste" >nul && echo Folder %systemroot%\system32\drivers\syste - Removed
if exist "%systemroot%\system32\drv32dta\" rd /q "%systemroot%\system32\drv32dta" >nul && echo Folder %systemroot%\system32\drv32dta - Removed
if exist "%systemroot%\system32\dtw5d\" rd /q /s "%systemroot%\system32\dtw5d" >nul && echo Folder %systemroot%\system32\dtw5d - Removed
if exist "%systemroot%\system32\dxV\" rd /q "%systemroot%\system32\dxV" >nul && echo Folder %systemroot%\system32\dxV - Removed
if exist "%systemroot%\system32\eIDb\" rd /q/s "%systemroot%\system32\eIDb" >nul && echo Folder %systemroot%\system32\eIDb - Removed
if exist "%systemroot%\system32\Engines\" rd /q/s "%systemroot%\system32\Engines" >nul && echo Folder %systemroot%\system32\Engines - Removed
if exist "%systemroot%\system32\ert\" rd /q/s "%systemroot%\system32\ert" >nul && echo Folder %systemroot%\system32\ert - Removed
if exist "%systemroot%\system32\EV02\" rd /q "%systemroot%\system32\EV02" >nul && echo Folder %systemroot%\system32\EV02 - Removed
if exist "%systemroot%\system32\ex1\" rd /q "%systemroot%\system32\ex1" >nul && echo Folder %systemroot%\system32\ex1 - Removed
if exist "%systemroot%\system32\ExTmp\" rd /q "%systemroot%\system32\ExTmp" >nul && echo Folder %systemroot%\system32\ExTmp - Removed
if exist "%systemroot%\system32\FxTmp\" rd /q "%systemroot%\system32\FxTmp" >nul && echo Folder %systemroot%\system32\FxTmp - Removed
if exist "%systemroot%\system32\goc\" rd /q "%systemroot%\system32\goc" >nul && echo Folder %systemroot%\system32\goc - Removed
if exist "%systemroot%\system32\GP2\" rd /q "%systemroot%\system32\GP2" >nul && echo Folder %systemroot%\system32\GP2 - Removed
if exist "%systemroot%\system32\gre1\" rd /q "%systemroot%\system32\gre1" >nul && echo Folder %systemroot%\system32\gre1 - Removed
if exist "%systemroot%\system32\IDE2\" rd /q "%systemroot%\system32\IDE2" >nul && echo Folder %systemroot%\system32\IDE2 - Removed
if exist "%systemroot%\system32\idme\" rd /q "%systemroot%\system32\idme" >nul && echo Folder %systemroot%\system32\idme - Removed
if exist "%systemroot%\system32\ipd1\" rd /q "%systemroot%\system32\ipd1" >nul && echo Folder %systemroot%\system32\ipd1 - Removed
if exist "%systemroot%\system32\izo\" rd /q "%systemroot%\system32\izo" >nul && echo Folder %systemroot%\system32\izo - Removed
if exist "%systemroot%\system32\iTmp\" rd /q "%systemroot%\system32\iTmp" >nul && echo Folder %systemroot%\system32\iTmp - Removed
if exist "%systemroot%\system32\k\" rd /q "%systemroot%\system32\k" >nul && echo Folder %systemroot%\system32\k - Removed
if exist "%systemroot%\system32\k1\" rd /q "%systemroot%\system32\k1" >nul && echo Folder %systemroot%\system32\k1 - Removed
if exist "%systemroot%\system32\kazaabackupfiles\" rd /s /q "%systemroot%\system32\kazaabackupfiles" >nul && echo Folder %systemroot%\system32\kazaabackupfiles - Removed
if exist "%systemroot%\system32\KaZaaBinaries\" rd /s /q "%systemroot%\system32\KaZaaBinaries" >nul && echo Folder %systemroot%\system32\KaZaaBinaries - Removed
IF EXIST Find.txt dnif.exe /I "\system32\v1rg1n" <Find.txt>NUL && if exist "%systemroot%\system32\logs\" rd /s/q "%systemroot%\system32\logs" >nul && echo Folder %systemroot%\system32\logs - Removed
IF EXIST Find.txt dnif.exe /I "\system32\blablabla.exe" <Find.txt>NUL && if exist "%systemroot%\system32\logs\" rd /s/q "%systemroot%\system32\logs" >nul && echo Folder %systemroot%\system32\logs - Removed
if exist "%systemroot%\system32\lil32\" rd /q "%systemroot%\system32\lil32" >nul && echo Folder %systemroot%\system32\lil32 - Removed
if exist "%systemroot%\system32\Messanger\" rd /q/s "%systemroot%\system32\Messanger" >nul && echo Folder %systemroot%\system32\Messanger - Removed
if exist "%systemroot%\system32\messenger\" rd /q/s "%systemroot%\system32\messenger" >nul && echo Folder %systemroot%\system32\messenger - Removed
if exist "%systemroot%\system32\microsoftserv\" rd /q "%systemroot%\system32\microsoftserv" >nul && echo Folder %systemroot%\system32\microsoftserv - Removed
if exist "%systemroot%\system32\MUI2\" rd /q "%systemroot%\system32\MUI2" >nul && echo Folder %systemroot%\system32\MUI2 - Removed
if exist "%systemroot%\system32\o02PrEz\" rd /q "%systemroot%\system32\o02PrEz" >nul && echo Folder %systemroot%\system32\o02PrEz - Removed
if exist "%systemroot%\system32\orb32wvx\" rd /q "%systemroot%\system32\orb32wvx" >nul && echo Folder %systemroot%\system32\orb32wvx - Removed
if exist "%systemroot%\system32\Programs\" rd /q "%systemroot%\system32\Programs" >nul && echo Folder %systemroot%\system32\Programs - Removed
if exist "%systemroot%\system32\PsY\" rd /s /q "%systemroot%\system32\PsY" >nul && echo Folder %systemroot%\system32\PsY - Removed
if exist "%systemroot%\system32\ro0\" rd /q "%systemroot%\system32\ro0" >nul && echo Folder %systemroot%\system32\ro0 - Removed
if exist "%systemroot%\system32\service\" rd /q /s "%systemroot%\system32\service" >nul && echo Folder %systemroot%\system32\service - Removed
if exist "%systemroot%\system32\services\" rd /q /s "%systemroot%\system32\services" >nul && echo Folder %systemroot%\system32\services - Removed
if exist "%systemroot%\system32\Shared Files\" rd /q "%systemroot%\system32\Shared Files" >nul && echo Folder %systemroot%\system32\Shared Files - Removed
if exist "%systemroot%\system32\shel9\" rd /q "%systemroot%\system32\shel9" >nul && echo Folder %systemroot%\system32\shel9 - Removed
if exist "%systemroot%\system32\shellext\download\" rd /s /q "%systemroot%\system32\shellext\download" >nul && echo Folder %systemroot%\system32\shellext\download - Removed
if exist "%systemroot%\system32\slNew\" rd /q "%systemroot%\system32\slNew" >nul && echo Folder %systemroot%\system32\slNew - Removed
if exist "%systemroot%\system32\smp\" rd /q "%systemroot%\system32\smp" >nul && echo Folder %systemroot%\system32\smp - Removed
IF EXIST Find.txt dnif.exe /I "\system32\v1rg1n" <Find.txt>NUL && if exist "%systemroot%\system32\sounds\" rd /s/q "%systemroot%\system32\sounds" >nul && echo Folder %systemroot%\system32\sounds - Removed
IF EXIST Find.txt dnif.exe /I "\system32\blablabla.exe"<Find.txt>NUL && if exist "%systemroot%\system32\sounds\" rd /s/q "%systemroot%\system32\sounds" >nul && echo Folder %systemroot%\system32\sounds - Removed
if exist "%systemroot%\system32\spoolX\" rd /q "%systemroot%\system32\spoolX" >nul && echo Folder %systemroot%\system32\spoolX - Removed
if exist "%systemroot%\system32\stk\" rd /q "%systemroot%\system32\stk" >nul && echo Folder %systemroot%\system32\stk - Removed
if exist "%systemroot%\system32\svcd\" rd /q "%systemroot%\system32\svcd" >nul && echo Folder %systemroot%\system32\svcd - Removed
if exist "%systemroot%\system32\Sys32\" rd /q "%systemroot%\system32\Sys32" >nul && echo Folder %systemroot%\system32\Sys32 - Removed
if exist "%systemroot%\system32\sysproc64\" rd /q "%systemroot%\system32\sysproc64" >nul && echo Folder %systemroot%\system32\sysproc64 - Removed
if exist "%systemroot%\system32\Systemfiles\" rd /q "%systemroot%\system32\Systemfiles" >nul && echo Folder %systemroot%\system32\Systemfiles - Removed
if exist "%systemroot%\system32\trcTMP\" rd /q "%systemroot%\system32\trcTMP" >nul && echo Folder %systemroot%\system32\trcTMP - Removed
IF EXIST Find.txt dnif.exe /I "twain_32\user.ds"<Find.txt>NUL && if exist "%systemroot%\system32\twain_32\" rd /q/s "%systemroot%\system32\twain_32" >nul && echo Folder %systemroot%\system32\twain_32 - Removed
if exist "%systemroot%\system32\umablrfk\" rd /q "%systemroot%\system32\umablrfk" >nul && echo Folder %systemroot%\system32\umablrfk - Removed
if exist "%systemroot%\system32\usnv\" rd /q "%systemroot%\system32\usnv" >nul && echo Folder %systemroot%\system32\usnv - Removed
if exist "%systemroot%\system32\usvr\" rd /q "%systemroot%\system32\usvr" >nul && echo Folder %systemroot%\system32\usvr - Removed
if exist "%systemroot%\system32\v2\" rd /q "%systemroot%\system32\v2" >nul && echo Folder %systemroot%\system32\v2 - Removed
if exist "%systemroot%\system32\v4\" rd /q "%systemroot%\system32\v4" >nul && echo Folder %systemroot%\system32\v4 - Removed
if exist "%systemroot%\system32\v8\" rd /q "%systemroot%\system32\v8" >nul && echo Folder %systemroot%\system32\v8 - Removed
if exist "%systemroot%\system32\vir5\" rd /q "%systemroot%\system32\vir5" >nul && echo Folder %systemroot%\system32\vir5 - Removed
if exist "%systemroot%\system32\vod1\" rd /q "%systemroot%\system32\vod1" >nul && echo Folder %systemroot%\system32\vod1 - Removed
if exist "%systemroot%\system32\win32GI\" rd /q "%systemroot%\system32\win32GI" >nul && echo Folder %systemroot%\system32\win32GI - Removed
if exist "%systemroot%\system32\windex\" rd /q "%systemroot%\system32\windex" >nul && echo Folder %systemroot%\system32\windex - Removed
if exist "%systemroot%\system32\windows32\" rd /q "%systemroot%\system32\windows32" >nul && echo Folder %systemroot%\system32\windows32 - Removed
if exist "%systemroot%\system32\winRem\" rd /q "%systemroot%\system32\winRem" >nul && echo Folder %systemroot%\system32\winRem - Removed
if exist "%systemroot%\system32\wsnpoem\" rd /q "%systemroot%\system32\wsnpoem" >nul && echo Folder %systemroot%\system32\wsnpoem - Removed
if exist "%systemroot%\system32\wsnpoema\" rd /q "%systemroot%\system32\wsnpoema" >nul && echo Folder %systemroot%\system32\wsnpoema - Removed
if exist "%systemroot%\system32\wTmp\" rd /q "%systemroot%\system32\wTmp" >nul && echo Folder %systemroot%\system32\wTmp - Removed
if exist "%systemroot%\system32\zura\" rd /s /q "%systemroot%\system32\zura" >nul && echo Folder %systemroot%\system32\zura - Removed
if exist "%systemroot%\Tweka\" rd /s /q "%systemroot%\Tweka" >nul && echo Folder %systemroot%\Tweka - Removed
if exist "%systemroot%\windowslife\" rd /q "%systemroot%\windowslife" >nul && echo Folder %systemroot%\windowslife - Removed
if exist "%systemroot%\win32sydkey\" rd /q "%systemroot%\win32sydkey" >nul && echo Folder %systemroot%\win32sydkey - Removed
if exist "%userprofile%\www.google.com\" rd /s /q "%userprofile%\www.google.com" >nul && echo Folder "%userprofile%\www.google.com" - Removed
echo.
echo.
IF EXIST Patched2a.txt dnif.exe /I "."<Patched2a.txt>NUL && (
echo Following files have been patched by Trojan.Agent to load users32.dat and should be replaced:
echo.
TYPE Patched2a.txt
echo.
echo. )

IF EXIST Patched2b.txt dnif.exe /I "."<Patched2b.txt>NUL && (
echo Following files have been patched by Trojan.Agent to load users64.dat and should be replaced:
echo.
TYPE Patched2b.txt
echo.
echo. )

IF EXIST Patched2c.txt dnif.exe /I "."<Patched2c.txt>NUL && (
echo Following files have been patched by Trojan.Agent to load univrs32.dat and should be replaced:
echo.
TYPE Patched2c.txt
echo.
echo. )

echo Removing Temp Files
echo.
echo [b]ADS Check [/b]:
apps\ls.exe %systemroot% >TESTADS1.txt )
if errorlevel 1 goto nextadsck
>> Report.txt (
echo.
IF EXIST TESTADS1.txt TYPE TESTADS1.txt
apps\sf.exe %systemroot%
echo.
echo Checking for remaining Streams
echo.
apps\ls.exe %systemroot%
echo. )

:nextadsck

>> Report.txt (
echo.>>TESTADS2.txt
echo %systemroot%\explorer.exe >>TESTADS2.txt
apps\ls.exe %systemroot%\explorer.exe|dnif.exe /I /V "explorer.exe"|dnif.exe /I "opts">NUL && ECHO   : ADS Found! >TESTADS2.txt
echo. )
if errorlevel 1 goto thidadsck

>> Report.txt (
IF EXIST TESTADS2.txt TYPE TESTADS2.txt
apps\sf.exe %systemroot%\explorer.exe
echo.
echo Checking for remaining Streams
echo.
echo %systemroot%\explorer.exe
apps\ls.exe %systemroot%\explorer.exe|dnif.exe /I /V "explorer.exe"|dnif.exe /I "opts">NUL && ECHO   : ADS Found!||echo No streams found.
echo. )

:thidadsck

>> Report.txt (
echo.>>TESTADS3.txt
echo %systemroot%\explorer.exe >TESTADS3.txt
apps\ls.exe %systemroot%\explorer.exe|dnif.exe /I /V "explorer.exe"|dnif.exe /I ".exe">NUL && ECHO   : ADS Found!>>TESTADS3.txt )
if errorlevel 1 goto hyredta

>> Report.txt (
IF EXIST TESTADS3.txt TYPE TESTADS3.txt
apps\sf.exe %systemroot%\explorer.exe
echo.
echo Checking for remaining Streams
echo.
echo %systemroot%\explorer.exe
apps\ls.exe %systemroot%\explorer.exe|dnif.exe /I /V "explorer.exe"|dnif.exe /I ".exe">NUL && ECHO   : ADS Found!||echo No streams found.
echo. )

:hyredta

>> Report.txt (
echo.>>TESTADS4.txt
apps\ls.exe %systemroot%\system32 >>TESTADS4.txt )
if errorlevel 1 goto secadsck

>> Report.txt (
IF EXIST TESTADS4.txt TYPE TESTADS4.txt
apps\sf.exe %systemroot%\system32
echo.
echo Checking for remaining Streams
echo.
apps\ls.exe %systemroot%\system32
echo. )

:secadsck

>> Report.txt (
echo.>>TESTADS5.txt
echo %systemroot%\system32\svchost.exe >>TESTADS5.txt
apps\ls.exe %systemroot%\system32\svchost.exe|dnif.exe /I /V "svchost.exe"|dnif.exe /I ".exe">NUL && ECHO   : ADS Found!>>TESTADS5.txt )
if errorlevel 1 goto finadsck

>> Report.txt (
IF EXIST TESTADS5.txt TYPE TESTADS5.txt
apps\sf.exe %systemroot%\system32\svchost.exe
echo.
echo Checking for remaining Streams
echo.
echo %systemroot%\system32\svchost.exe
apps\ls.exe %systemroot%\system32\svchost.exe|dnif.exe /I /V "svchost.exe"|dnif.exe /I ".exe">NUL && ECHO   : ADS Found!||echo No streams found.
echo. )

:finadsck

>> Report.txt (
echo.>>TESTADS6.txt
echo %systemroot%\system32\ntoskrnl.exe>>TESTADS6.txt
apps\ls.exe %systemroot%\system32\ntoskrnl.exe|dnif.exe /I "kernel">NUL && ECHO   :kernel ADS Found! >>TESTADS6.txt )
if errorlevel 1 goto final

>> Report.txt (
IF EXIST TESTADS6.txt TYPE TESTADS6.txt
apps\sf.exe %systemroot%\system32\ntoskrnl.exe
echo.
echo Checking for remaining Streams
echo.
echo %systemroot%\system32\ntoskrnl.exe
apps\ls.exe %systemroot%\system32\ntoskrnl.exe|dnif.exe /I "kernel">NUL && ECHO   :kernel ADS Found!||echo No streams found.
echo. )

:final

cls
echo.
echo Final Check
echo.
echo Running Catchme - Rootkit/Stealth Malware Detector by Gmer (www.gmer.net)
echo.
echo Please Wait
echo.
echo|apps\Cghtme.exe -xqpsrf "%systemroot%" "%userprofile%" >Catchme.log

>> Report.txt (
echo.
echo.
echo                                  [b]Final Check [/b]:
echo.
IF EXIST Catchme.log TYPE Catchme.log
echo.
echo [b]Remaining Services [/b]:
echo.
IF EXIST Foundsvc.txt For /f "tokens=*" %%G in (Foundsvc.txt) do apps\Csweg.exe QUERY "HKLM\SYSTEM\CurrentControlSet\Services\%%G"|dnif.exe /I "imagepath" >>Check.txt && echo %%~G
echo.
	)

IF EXIST "%desktop%\catchme.log" move /y "%desktop%\catchme.log" .\backups >nul
IF EXIST "%desktop%\catchme.zip" move /y "%desktop%\catchme.zip" .\backups >nul

CLS
echo.
echo Checking For Remaining Files and Services
echo.

ver|dnif.exe "Windows 2000">nul && goto twokbit

echo.>>Report.txt
apps\Csweg export "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List" CheckSA1.txt                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         
echo.>>Report.txt
apps\Csweg export "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List" CheckSA1.txt
apps\Csweg export "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List" CheckSA2.txt
IF EXIST CheckSA*.txt echo Authorized Application Key Export:>> Report.txt
IF EXIST CheckSA1.txt TYPE CheckSA1.txt|dnif.exe /I /V "Registry Editor">> Report.txt
IF EXIST CheckSA2.txt TYPE CheckSA2.txt|dnif.exe /I /V "Registry Editor">> Report.txt
echo.
CLS

:twokbit

CLS
echo.
echo Finishing

apps\locate "%systemdrive%\" /A:D-H+ /x:bak,com,dll,exe,pif,reg,sys,tmp,zip /UK /O:"&4 &1 &5 &B --- &W"|dnif.exe /I ":"|dnif.exe /V /I ".manifest"|dnif.exe /V /I "IO.SYS"|dnif.exe /V /I "pagefile.sys"|dnif.exe /V /I "MSDOS.SYS"|dnif.exe /V /I "NTDETECT.COM"|dnif.exe /V /I "hiberfil.sys"|dnif.exe /V /I "CONFIG.SYS"|dnif.exe /V /I "arcsetup.exe"|dnif.exe /V /I "arcldr.exe"|dnif.exe /V /I "dummy"|dnif.exe /V /I "default.tmp.LOG"|dnif.exe /V /I "software.tmp.LOG"|dnif.exe /V /I "system.tmp.LOG">>dircheck.txt

CLS
echo.
echo Finishing.

>> Report.txt (
echo.
echo [b]Remaining Files [/b]:
echo.
if exist Find.txt For /f "tokens=*" %%G in (Find.txt) do if exist "%%G" echo %%G Found
echo.
IF EXIST %CD%\backups\backups.zip echo File Backups: - %CD%\backups\backups.zip
echo.
IF EXIST patcherres.TXT TYPE patcherres.TXT
IF EXIST SpreadBotres.txt dnif /i "."<SpreadBotres.txt>nul && TYPE SpreadBotres.txt
echo [b]Files with Hidden Attributes [/b]:
echo.
if exist dircheck.txt TYPE dircheck.txt
echo.
echo [b]Finished![/b]
echo.
	)

CLS
echo.
echo Finishing..

FOR %%G in (
dummy.exe
dnif.exe
rtsdnif.exe
attrib.exe
editreg.exe
	) DO IF EXIST %%G DEL /Q %%G >NUL

IF EXIST "%cd%\apps\CSweg.exe" DEL /Q "%cd%\apps\CSweg.exe" >nul

CLS
echo.
echo Finishing...

IF EXIST HOSTS MOVE /Y HOSTS backups\HOSTS >NUL
IF EXIST Find.txt COPY /Y Find.txt %systemroot%\ERUNT\SDFIX\Find.txt >nul
IF EXIST report.txt COPY /Y report.txt %systemroot%\ERUNT\SDFIX\report.txt >nul

for /f "tokens=*" %%a in (apps\rem2.txt) do if exist %%a (
					del /q "%%a" )

apps\ClipText.exe from Report.txt

cls
echo.
echo.
echo.
echo.
echo                                  Finished!
echo.
echo.
echo.
echo         Report.txt has been copied to Clipboard and the SDFix folder 
echo.
echo.
echo.
echo.
echo.
echo. 
echo.
echo.
echo.
echo.
pause
start notepad report.txt

exit

:End

exit                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     