NAME: Tron, an automated cleaner/scanner/disinfection tool

AUTHOR: vocatus on reddit.com/r/TronScript ( vocatus.gate @ gmail ) // PGP key

ID: 0x07d1490f82a211a2
BACKGROUND: Why the name? Tron "Fights for the User"

I got tired of running these utilities manually and decided to just script
everything, so Tron basically automates a variety of tasks to clean up/disinfect a
Windows machine.

CONTENTS:
1. Usage Summary
2. Command-Line Use
3. Script Interruption
4. Notes on Safe Mode
5. Sending a Post-Run Email Report
6. Changing Defaults
7. Pack Integrity
8. License
9. Contact Info
10. Full description of ALL actions taken

USE:
0. FIRST THINGS FIRST: If there are pending Windows updates, reboot the machine and
allow it to install updates if at all possible. This isn't *required* but STRONGLY
recommended prior to running Tron
1. Boot into Safe Mode with Network Support (Safe Mode isn't required but IS
recommended)
2. Copy tron.bat and the \resources folder to the Desktop of the target machine and
run tron.bat as an ADMINISTRATOR (Tron does not work if you don't run it as an
Administrator)
3. Wait anywhere from 3-10 hours (yes, it really does take that long)
4. Side note: You'll need to manually click "scan" in the Malwarebytes window that
appears part of the way through Stage 3: Disinfect
5. Reboot

By default the master log file is at C:\Logs\tron\tron.log. If you want to change

this, read the section on changing defaults below.

Tron will briefly check for a newer version when it starts up and notify you if one
is found.

Depending how badly the system is infected, it could take anywhere from 3 to 10
hours to run. I've personally observed times between 4-8 hours, and one user
reported a run time of 30 hours. Basically set it and forget it.

COMMAND-LINE USE:
Command-line use is fully supported. All flags are optional and can be used
simultaneously.*

tron.bat [-a -c -d -dev -e -er -m -o -p -r -sa -sdb -sd -sdc -sdu -se
-sfr -sk -sl -sm -sp -spr -srr -ss -str -sw -v -x] | [-h]

-a Automatic execution mode (no prompts; implies -e; reboots to Safe Mode)
-c Config dump (show config. Can be used with other flags to see what
WOULD happen, but script will never execute if this flag is used)
-d Dry run (run through script without executing any jobs)
 -dev Override OS detection (allow running on unsupported Windows versions)
-e Accept EULA (suppress disclaimer warning screen)
-er Email a report when finished. Requires you to configure SwithMailSettings.xml
-m Preserve OEM Metro apps (don't remove them)
-np Skip the pause at the end of script
-o Power off after running (overrides -r)
-p Preserve power settings (don't reset to Windows default)
-r Reboot (auto-reboot 15 seconds after completion)
-sa Skip ALL antivirus scans (KVRT, MBAM, SAV)
-sdb Skip de-bloat (OEM bloatware removal; implies -m)
-sd Skip defrag (force Tron to ALWAYS skip Stage 5 defrag)
-sdc Skip DISM Cleanup (SxS component store deflation)
-sdu Skip debloat update. Prevent Tron from auto-updating the S2 debloat lists
-se Skip Event Log clearing
-sfr Skip filesystem permissions reset (saves time if you're in a hurry)
-sk Skip Kaspersky Virus Rescue Tool (KVRT) scan
-sm Skip Malwarebytes Anti-Malware (MBAM) installation
-sp Skip patches (do not patch Java Runtime, Adobe Flash or Reader)
-spr Skip page file settings reset (don't set to "Let Windows manage the page
file")
-srr Skip registry permissions reset (saves time if you're in a hurry)
-ss Skip Sophos Anti-Virus (SAV) scan
-str Skip Telemetry Removal (don't remove Windows user tracking, Win7 and up only)
-sw Skip Windows Updates (do not attempt to run Windows Update)
-v Verbose. Show as much output as possible. NOTE: Significantly slower!
-x Self-destruct. Tron deletes itself after running and leaves logs intact

Misc flags (must be used alone):

-h Display this help text

* There is no -UPM flag

SCRIPT INTERRUPTION:
If the script is interrupted e.g. from a crash or a forced reboot (often
encountered during stage_2_de-bloat), it will attempt to resume from the last stage
successfully started. Tron accomplishes this by creating a RunOnce registry key for
the current user at the beginning of Stage 0 (e.g. when jobs start executing), and
deleting it at the end of the script if everything finished without interruption.

More details about this function can be found in the list of all actions Tron
performs at the bottom of this document.

SAFE MODE:
When Tron launches it will briefly check if the computer is in Safe Mode with
Networking, and if not it will prompt you to automatically reboot into it.

Tron doesn't NEED to be run in Safe Mode, but it is STRONGLY recommended.

EMAIL REPORT:
To have Tron send an email report at completion, edit this file:

\tron\resources\stage_7_wrap-up\email_report\SwithMailSettings.xml

Specify your SMTP server, username, and password. After specifying your settings
you can use the -er flag to have Tron send the email report. The summary logs
(tron_removed_files.txt and tron_removed_programs.txt) will be attached as well.
Keep in mind the username and password for the email account will be stored in
PLAIN TEXT so don't leave it lying around on a system you don't trust.

CHANGE DEFAULTS (advanced):

If you don't want to use the command-line and don't like Tron's defaults, you can
change the following default variables. Keep in mind command-line flags will always
override their respective default option when used.

- To change the master directory where all of Tron's output goes, edit this line:
set LOGPATH=%SystemDrive%\Logs\tron

- To change the name of Tron's master log file, edit this line:
set LOGFILE=tron.log

- To change where Tron stores quarantined files, change this path (note: this is
currently unused by Tron, setting it has no effect):
set QUARANTINE=%LOGPATH%\quarantine

- To change the location of the backups Tron makes (Registry, Event Logs, power
scheme, etc), edit this line:
set BACKUPS=%LOGPATH%\backups

- To change where Tron saves raw unprocessed logs from the various sub-tools,
edit this line:
set RAW_LOGS=%LOGPATH%\raw_logs

- To change where Tron saves summary logs, edit this line:

set SUMMARY_LOGS=%LOGPATH%\summary_logs

- To always run automatically (no welcome screen, implies acceptance of EULA),

change this to yes:
set AUTORUN=no

- To do a dry run (don't actually execute jobs), change this to yes:

set DRY_RUN=no

- To permanently accept the End User License Agreement (suppress display of

disclaimer warning screen), change this to yes:
set EULA_ACCEPTED=no

- To have Tron send an email report when finished, change this to yes:
set EMAIL_REPORT=no

- To preserve default Metro apps (don't remove them), change this to yes:
set PRESERVE_METRO_APPS=no

- To prevent Tron from pausing at the end of the script (waiting for a keypress),
change this to yes:
set NO_PAUSE=yes

- To shut down the computer when Tron is finished, change this to yes:
set AUTO_SHUTDOWN=no

- To preserve the power scheme (instead of resetting to Windows defaults), change

this to yes:
set PRESERVE_POWER_SCHEME=no
 - To configure post-run reboot, change this value (in seconds). 0 disables auto-
reboot:
set AUTO_REBOOT_DELAY=0

- To skip anti-virus scan engines (MBAM, KVRT, Sophos), change this to yes:
set SKIP_ANTIVIRUS_SCANS=no

- To skip OEM debloat, change this to yes:

set SKIP_DEBLOAT=no

- To always skip defrag, regardless whether C:\ is an SSD or not, change this to
yes:
set SKIP_DEFRAG=no

- To skip DISM component (SxS store) cleanup, change this to yes:

set SKIP_DISM_CLEANUP=no

- To prevent Tron from connecting to Github and automatically updating the Stage
2 debloat lists, set this to yes:
set SKIP_DEBLOAT_UPDATE=no

- To skip Event Log clearing, change this to yes:

set SKIP_EVENT_LOG_CLEAR=no

- To prevent Tron from granting the SYSTEM and Administrator accounts full
permissions to everything under the %WinDir% directory structure, change this to
yes:
set SKIP_FILEPERMS_RESET=no

- To skip scanning with Kaspersky Virus Rescue Tool (KVRT), change this to yes:
set SKIP_KASPERSKY_SCAN=no

- To skip installation of Malwarebytes Anti-Malware (MBAM), change this to yes:

set SKIP_MBAM_INSTALL=no

- To skip patches (don't patch 7-Zip, Java, Adobe Flash and Reader) change this
to yes:
set SKIP_PATCHES=no

- To prevent Tron from resetting the page file to Windows defaults, change this
to yes:
set SKIP_PAGEFILE_RESET=no

- To prevent Tron from granting the SYSTEM and Administrator accounts full
permissions to the HKLM, HKCU, and HKCR hives, change this to yes:
set SKIP_REGPERMS_RESET=no

- To skip scanning with Sophos Anti-Virus (SAV), change this to yes:

set SKIP_SOPHOS_SCAN=no

- To skip removal of the Windows "telemetry" (user tracking) updates, change this
to yes:
set SKIP_TELEMETRY_REMOVAL=no

- To skip Windows Updates (don't attempt to run Windows Update) change this to
yes:
set SKIP_WINDOWS_UPDATES=no

- To display as much output as possible (verbose), change this to yes:

 set VERBOSE=no

- To have Tron delete itself after running (self-destruct), change this to yes:
set SELF_DESTRUCT=no

INTEGRITY:
In every release 'checksums.txt' is signed with my PGP key (0x07d1490f82a211a2,
included). You can use it to verify package integrity.

LICENSE:
Tron and any included subscripts and .reg files I've written are free to
use/redistribute/whatever under the MIT license. It'd be nice if you sent an email
and let me know if you do something cool with it, but it's not required. All 3rd-
party tools Tron calls (MBAM, TDSSK, etc) are bound by their respective licenses.
It is YOUR responsibility to determine if you can use them in your specific
situation.

OTHER:
I try to keep everything updated. If you notice some of the packages are out of
date, PM me on reddit or send me an email (listed above), I typically respond in a
day or less.

Hope this is helpful to other PC techs,

- Vocatus

If you feel overly charitable, bitcoin donations are accepted at this address:
16dxc4hgzuXYSKGbLuEVxXQCM8dW59ZSCe

#########################
# FULL TRON DESCRIPTION #
#########################
The best way to see what Tron does is simply crack open Tron.bat or one of the
stage-specific subscripts with a text editor (preferably one with syntax
highlighting) or on GitHub and just read the code. Every section has comments
explaining exactly what it does, and you don't need to be able to read code to
understand it. Barring that however, here's a general description of every action
Tron performs.

tron.bat Master script that launches everything else. It

performs many actions on its own, but for any task not performed directly, we call
an external utility or script. Each stage (e.g. Stage 1: Tempclean) has its own
master script that Tron calls in sequence. Sub-stage scripts can be found in each
stages subdirectory under the \resources folder. e.g.
\tron\resources\stage_1_tempclean\stage_1_tempclean.bat

Tron-internal prep jobs:

(These are all executed even if Tron is canceled before running)
. Detect TEMP execution Detect if we're running from the TEMP directory
and prevent Tron from executing if so. TEMP is one of the first places to get wiped
when Tron starts so we cannot run from there
. Make log directories Create the master log directory and sub-
directories if they don't exist. By default this is %SystemDrive%\Logs\tron.log
. Detect Windows & IE versions Determines quite a few things in the script, such
as which versions of various commands get executed
. Unsupported OS blocker Throw an alert message if running on an
unsupported OS, then exit. Use the -dev flag to override this behavior and allow
running on unsupported Windows versions
. Disk configuration check Check if the system drive is an SSD, Virtual Disk,
or threw an unspecified error (couldn't be read by smartctl.exe) and set the
SKIP_DEFRAG variable to yes_ssd, yes_vm, or yes_error respectively. If any of these
conditions are triggered, Tron skips **Stage 5 defrag** automatically
. Detect free space Detect and save available hard drive space to
compare against later. Simply used to show how much space was reclaimed; does not
affect any script functions
. Detect resume Detect whether or not we're resuming after an
interrupted run (e.g. from a reboot)
. Enable F8 Safe Mode selection Re-enable the ability to use the F8 key on bootup
(Windows 8/8.1 only; enabled by default on Server 2012/2012 R2)
. Check for network connection Check for an active network connection, and skip
the update checks if one isn't found
. Check for update Compare the local copy of Tron to the version on
the official repo (does this by reading latest version number from sha256sums.txt).
If the local copy is out of date, Tron will ask to automatically download the
latest copy (**always** recommended). If permitted, it will download a copy to the
desktop, verify the SHA256 hash, then self-destruct (delete) the current outdated
copy
. Update debloat lists Connect to Github and download the latest version
of the Stage 2 debloat lists at initial launch. Use the -sdu (SKIP_DEBLOAT_UPDATE)
switch to prevent this behavior. I recommend letting Tron update the lists unless
you have a good, specific reason not to
. Detect Administrator rights Detect whether or not we're running as
Administrator and alert the user if we're not
. Detect Safe Mode Detect whether or not we're in Safe Mode and
notifies the user if we're not
. SMART check Run a quick SMART disk health check and notify if
any drives don't report "OK" for their status

STAGE 0: Prep
. Create RunOnce entry Create the following registry key to support
resuming if there is an interruption:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v "tron_resume" /t
REG_SZ /d "%~dp0tron.bat %-resume"
. Create System Restore point Create a pre-run system restore point. Vista and
up only, client OS's only (not supported on Server OS's, and on Windows 10 does not
work if the system is in any form of Safe Mode. This is a known bug, and I spent
hours trying to find a workaround but was not able to find a solution, so if you
absolutely require a system restore point, recommend running in normal mode
. Rkill rkill is an anti-malware prep tool; it looks for
and kills a number of known malware that interfere with removal tools. Rkill will
exclude any process listed in
\resources\stage_0_prep\rkill\rkill_process_whitelist.txt from being closed
. Create pre-run profile Dump list of installed programs and list of all
files on the system so we can compare later and see exactly what was removed
. GUID dump Dump list of all installed program GUIDs. These
dumps are useful in helping the project bolster the blacklist of known-bad GUIDs
. caffeine.exe Tron uses Caffeine to keep the system awake during
the scan. At the end of the script it re-enables the screensaver and resets power
settings to Windows defaults. Use the -p switch to prevent resetting the power
scheme to Windows defaults
. ProcessKiller Utility provided by /u/cuddlychops06 which kills
various userland processes. You can customize this list in the accompanying
whitelist.txt file in the same directory as the ProcessKiller .exe. We use this to
further kill anything that might interfere with Tron. Specifically, it kills
everything in userland with the exception of the following processes:
ClassicShellService.exe, explorer.exe, dwm.exe, cmd.exe, mbam.exe, teamviewer.exe,
TeamViewer_Service.exe, Taskmgr.exe, Teamviewer_Desktop.exe, MsMpEng.exe,
tv_w32.exe, VTTimer.exe, Tron.bat, rkill.exe, rkill64.exe, rkill.com, rkill64.com,
conhost.exe, dashost.exe
. Safe Mode Set system to reboot into Safe Mode with
Networking if a reboot occurs. Removes this and resets to normal bootup at the end
of the script. Accomplished via this command: bcdedit /set {default} safeboot
network
. Set system time via NTP Sync the system clock to time.nist.gov,
3.pool.ntp.org and time.windows.com
. check and repair WMI Check the WMI interface and attempt repair if
broken. Tron uses WMI for a lot of stuff including ISO date format conversion, OEM
bloatware removal, and various other things, so having it functioning is critical
. McAfee Stinger anti-malware/rootkit/virus standalone scanner from
McAfee. Does not support plain-text logs so we save its HTML log to %LOGPATH
%\tron_raw_logs (by default). Tron executes Stinger as follows: stinger32.exe --GO
--SILENT --PROGRAM --REPORTPATH="%LOGPATH%" --RPTALL --DELETE
. TDSS Killer anti-rootkit utility from Kaspersky Labs. Tron
executes TDSSKiller as follows: tdsskiller.exe -l %TEMP%\tdsskiller.log -silent
-tdlfs -dcexact -accepteula -accepteulaksn
. erunt used to backup the registry before beginning a
Tron run
. VSS purge purges oldest set of Volume Shadow Service files
(basically snapshot-in-time copies of files). Malware can often hide out here.
. Reduce system restore space Restrict System Restore to only use 7% of
available hard drive space

STAGE 1: Tempclean
. Internet Explorer cleanup Runs built-in Windows tool to clean and reset
Internet Explorer ( rundll32.exe inetcpl.cpl,ClearMyTracksByProcess 4351 ). Runs on
IE 7 and up
. TempFileCleanup.bat Script I wrote to clean some areas that other
tools seem to miss. Note: it specifically targets, among other things, any .txt
or .bat files at the root of C:\
. CCLeaner CCLeaner utility by Piriform. Used to clean temp
files before running AV scanners
. BleachBit BleachBit utility. Used to clean temp files before
running AV scanners
. Cleanup duplicate downloads Searches for and delete duplicate files found in
the Downloads folders of each user profile (ChromeInstaller(1).exe,
ChromeInstaller(2)exe, etc). Does not touch any other folders. Uses Sentex's [Find
Dupe](http://www.sentex.net/~mwandel/finddupe/) utility
. USB Device cleanup Uninstalls unused or not present USB devices from
the system (non-existent thumb drives, etc). Uses drivecleanup.exe from Uwe Sieber
( www.uwe-sieber.de )
. Clear Windows event logs Backs up Windows event logs to the LOGPATH
directory, then clears all log files
. Clear Windows Update cache Purges uninstaller files for already-installed
Windows Updates. Typically frees up quite a bit of space

STAGE 2: De-bloat
. OEM de-bloat (by name) Use WMI to attempt to uninstall any program listed
in this file: \resources\stage_3_de-bloat\programs_to_target_by_name.txt
. OEM de-bloat (by GUID) Use WMI to attempt to remove specific list of
GUIDs in this file: \resources\stage_3_de-bloat\programs_to_target_by_GUID.bat
. Toolbar & BHOs (by GUID) Use WMI to attempt to remove specific list of
GUIDs in this file: \resources\stage_3_de-bloat\toolbars_BHOs_to_target_by_GUID.bat
. Metro de-bloat Remove many built-in Metro apps that aren't
commonly used (does NOT remove things like Calculator, Paint) then purges them from
the cache (can always fetch later from Windows Update). On Windows 8/8.1, removes
all stock "Modern" apps. On Windows 10 and up, only removes a few specific Modern
apps. Use the -sdb switch (skip ALL de-bloat) or -m switch (skip only Metro de-
bloat) to skip this action
. Remove OneDrive integration Remove forced OneDrive integration (Windows 10
only). Tron first checks if any files exist in the default OneDrive folder
(%USERPROFILE%\OneDrive\) and skips removal if any are found. As a an additional
safety precaution, Tron leaves the OneDrive folder intact regardless whether
OneDrive is removed or not.

STAGE 3: Disinfect
. Malwarebytes Anti-Malware Anti-malware scanner. Because there is no command-
line support for MBAM, we simply install it and continue with the rest of the
script. This way a tech can click "scan" whenever they're around, but the script
doesn't stall while waiting for user input. Use the -sa or -sm flags skip this
component
. Kaspersky Virus Removal Tool Command-line anti-virus scanner. Use the -sa or
-sk flags skip this component
. Sophos Virus Removal Tool Command-line anti-virus scanner. Use the -v flag
gives more verbose output. Use the -sa or -ss flags skip this component

STAGE 4: Repair
. DISM image check & repair Microsoft utility for checking the Windows Image
Store (basically like System File Checker on crack). Windows 8 and up only
. Registry permissions reset Grant SYSTEM and Administrator users full
permissions on HKLM, HKCU, and HKCR hives. This is an add-only permissions
operation (does not remove any permissions). Use the -srr flag skips this operation
. Filesystem permissions reset Grant SYSTEM and Administrator users full
permissions on everything in the %WinDir% directory tree. Use the -sfr flag skips
this operation
. System File Checker Microsoft utility for checking the filesystem for
errors and attempting to repair if found. Tron runs this on Windows Vista and up
only (XP and below require a reboot)
. chkdsk Checks disk for errors and schedules a chkdsk with
repair at next reboot
. Disable Windows "telemetry" Disable Windows "telemetry" (user tracking),
Windows 7 and up only. If the system is running Windows 7/8/8.1, Tron removes the
"bad" updates Microsoft rolled out to Windows 7/8/8.1 systems after the Windows 10
release which backport the surveillance/spyware functions that are by default
present in Windows 10 back to the older Windows versions. See the code to see
exactly which KB's are removed. Tron also stops and deletes the Diagtrack
("Diagnostics Tracking Service") service. If the system is running Windows 10, Tron
does a more in-depth disabling of the Windows telemetry features, including
automatically applying all the immunizations from Spybot's Anti-Beacon tool. Go
over the code in \tron\resources\stage_4_repair\disable_windows_telemetry\ to see
exactly what is removed and disabled. Use the -str switch to skip this action.
NOTE: This section takes a LONG time to run, DO NOT CANCEL IT
. Disable Windows 10 upgrade Disables the Windows 10 upgrade nagger on Windows
7/8/8.1 by flipping the appropriate registry switches. Users can still manually
upgrade the machine if they desire, but it will no longer nag via the system tray,
auto-download, or auto-install Windows 10 without their permission
. Network repair Tron performs minor network repair. Specifically
it runs these commands: ipconfig /flushdns, netsh interface ip delete arpcache,
netsh winsock reset catalog
. File extension repair Tron repairs most default file extensions with a
batch file that loops through a series of registry files stored in
\tron\resources\stage_4_repair\repair_file_extensions\. Thanks to /u/cuddlychops06

STAGE 5: Patch Tron installs or updates these programs:

. 7-zip Open-source compression and extraction tool. Far
superior to just about everything (including the venerable WinRAR). Use the -sp
switch to skip this action
. Adobe Flash Player Used by YouTube and various other sites. Use the
-sp switch to skip this action
. Adobe Reader Standard PDF reader. Use the -sp switch to skip
this action
. Java Runtime Environment I hate Java, but it is still widely used so we at
least get the system on the latest version. Use the sp switch to skip this
component
. Windows updates Runs Windows update via this command: wuauclt
/detectnow /updatenow
. DISM base reset Recompile the "Windows Image Store" (SxS store
deflation). This typically results in multiple GB's of space freed up. Windows 8
and up only. Any Windows Updates installed *prior* to this point will become "baked
in" (uninstallable). Use the -sdc switch to skip this action

STAGE 6: Optimize
. Page file reset Reset the system page file settings to "let
Windows manage the page file." Accomplished via this command: %WMIC% computersystem
where name="%computername%" set AutomaticManagedPagefile=True. Use the -spr flag
skips this action
. Defraggler Command-line defrag tool from Piriform that's a
little faster than the built-in Windows defragmenter

STAGE 7: Wrap-up
. email_report Sends an email report with log file when Tron
finishes. Requires you to specify your SMTP settings in \resources\stage_6_wrap-
up\email_report\SwithMailSettings.xml
. generate summary logs Generate before and after logs detailing which
files were deleted and which programs were removed. These are placed in
LOGPATH\tron_summary_logs. Additionally, if -er flag was used or EMAIL_REPORT
variable was set, these logs will be attached to the email that is sent out
. Create restore point Create a post-run system restore point to mirror
the one we created in Stage 0: Prep. Vista and up only, client OS's only, on
Windows 10 does not work if the system is in any form of Safe Mode. See notes on
System Restore in Stage 0 documentation for more information

STAGE 8: Manual tools Tron does not run these automatically because most
of them don't support command-line use, or are only useful in special cases
. ADSSpy Scan for hidden NTFS Alternate Data Streams
. AdwCleaner Popular user-suggested adware removal tool
. aswMBR Rootkit scanner
. autoruns Examine and remove programs that run at startup
. ComboFix The "scorched-earth policy" of malware removal.
Only works on Windows XP through Windows 8 (no Windows 8.1 or above)
. PCHunter Tool to scan for rootkits and other malicious
items. Replaces gmer
. Junkware Removal Tool Temp files and random junkware remover
. Net Adapter Repair Utility to repair most aspects of Windows network
connections
. Remote Support Reboot Config Tool to quickly configure auto-login and other
parameters for running Tron via a remote connection. Thanks to /u/cuddlychops06
. Safe Mode Boot Selector.bat Batch file to quickly select bootup method to use
(Safe Mode, Network, etc). Thanks to /u/cuddlychops06
. ServicesRepair.exe ESET utility for fixing broken Windows services
. TempFileCleaner OldTimer utility for cleaning temp files
. Tron Reset Tool Tool to quickly reset Tron if it gets interrupted
or breaks while running
. UserBenchMark.exe Quick automatic system benchmark utility, compares
the system to an online database of similar systems
. VirusTotal uploader tool Uploads a file directly to VirusTotal for scanning