@ECHO OFF
SETLOCAL EnableDelayedExpansion
rem: Description: Force removal tool for Security Agent

set INSTALL_RUNTIME_ROOT=%~dp0

rem: query installed folder from registry key
call :GETREGFOLDER "HKLM\Software\TrendMicro\Wofie\CurrentVersion" "Application Path"
set PRODUCT_ROOT=%_REGFOLDER%
if NOT EXIST "%PRODUCT_ROOT%" (
	call :GETREGFOLDER "HKLM\Software\TrendMicro\PC-cillinNTCorp\CurrentVersion" "Application Path"
	set PRODUCT_ROOT=!_REGFOLDER!
)
if NOT EXIST "%PRODUCT_ROOT%" (
	call :GETREGFOLDER "HKLM\Software\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion" "Application Path"
	set PRODUCT_ROOT=!_REGFOLDER!
)
if NOT EXIST "%PRODUCT_ROOT%" set PRODUCT_ROOT=%ProgramFiles%\Trend Micro\Security Agent\

echo Security Agent installed at: %PRODUCT_ROOT%

call :GETREGFOLDER "HKLM\Software\TrendMicro\AMSP" InstallDir
set INSTALL_ROOT=%_REGFOLDER%
if NOT EXIST "%INSTALL_ROOT%AMSP" (
	call :GETFOLDER "!PRODUCT_ROOT!..\"
	set INSTALL_ROOT=!_RESULT!
)
if NOT EXIST "%INSTALL_ROOT%AMSP" set INSTALL_ROOT=%ProgramFiles%\Trend Micro\

echo AMSP installed at: %INSTALL_ROOT%AMSP


echo Security Agent Remover Start [%DATE%][%TIME%]

set AGENT_DISABLE_SVC=1
call "%INSTALL_RUNTIME_ROOT%AgentStop.bat"

echo Remove AMSP, Communicator, and AEGIS drivers
call :DELSERVICE amsp tmactmon tmevtmgr tmcomm 
call :DELSERVICE tmcomm tmlisten ntrtscan tmbmserver tmprefilter vsapint tmfilter 
call :DELSERVICE tmproxy tmpfw 

echo Stop and Remove Firewall drivers
call :GETWINMAJORVER
if %WINMAJORVER% LEQ 5 (
	call :FINDNSCUTIL ncfg.exe
	if exist "!_RESULT!" (
	    call :GETFOLDER "!_RESULT!"
	    echo "!_RESULT!ncfg.exe" -ur tm_cfw %TMCFW_REG% InfNameForCfw
	         "!_RESULT!ncfg.exe" -ur tm_cfw %TMCFW_REG% InfNameForCfw
	)
) else (
	call :FINDNSCUTIL tmlwfins.exe
	if exist "!_RESULT!" (
	    call :GETFOLDER "!_RESULT!"
	    echo "!_RESULT!tmlwfins.exe" -u tmlwf %TMCFW_REG% InfNameForLwf
	         "!_RESULT!tmlwfins.exe" -u tmlwf %TMCFW_REG% InfNameForLwf
	)
	
	call :FINDNSCUTIL tmwfpins.exe
	if exist "!_RESULT!" (
	    call :GETFOLDER "!_RESULT!"
	    echo "!_RESULT!tmwfpins.exe" -u "!_RESULT!tmwfp.inf" %TMCFW_REG% InfNameForWfp
	         "!_RESULT!tmwfpins.exe" -u "!_RESULT!tmwfp.inf" %TMCFW_REG% InfNameForWfp
	)
)

echo Stop and Remove Proxy drivers
set TMTDI_REG=Software\TrendMicro\AMSP
call :FINDFILEBYNAME "%INSTALL_ROOT%AMSP\module\20004" tdiins.exe
if not exist "!_RESULT!" (
	call :FINDFILEBYNAME "%PRODUCT_ROOT%pfw_features" tdiins.exe
)
if not exist "!_RESULT!" (
	set TMTDI_REG=SOFTWARE\TrendMicro\NSC\TmProxy
	call :FINDFILEBYNAME "%PRODUCT_ROOT%" tdiins.exe
)
if exist "!_RESULT!" (
    call :GETFOLDER "!_RESULT!"
    echo "!_RESULT!tdiins.exe" -u "!_RESULT!tmtdi.inf" %TMTDI_REG% InfNameForTdi
         "!_RESULT!tdiins.exe" -u "!_RESULT!tmtdi.inf" %TMTDI_REG% InfNameForTdi
)

echo Force Remove Proxy drivers
if /I "%PROCESSOR_ARCHITECTURE%" EQU "AMD64" (
    set RSTRTMGR=%INSTALL_RUNTIME_ROOT%x64\RestartManager.exe
) else (
    set RSTRTMGR=%INSTALL_RUNTIME_ROOT%x86\RestartManager.exe
)
echo Restart Manager "%RSTRTMGR%"
if exist "%RSTRTMGR%" (
    echo "%RSTRTMGR%" "%INSTALL_RUNTIME_ROOT%RemoveNSC.ini"
         "%RSTRTMGR%" "%INSTALL_RUNTIME_ROOT%RemoveNSC.ini"
)

call :REMOVE_SHELL_EXT

echo Remove files
call :DELFOLDER "%INSTALL_ROOT%AMSP\"
call :DELFOLDER "%INSTALL_ROOT%UniClient\"
call :DELFOLDER "%PRODUCT_ROOT%..\BM"
call :DELFOLDER "%PRODUCT_ROOT%"

echo Remove Start Menu shortcuts
set _RESULT=%ALLUSERSPROFILE%\Start Menu\Programs\Trend Micro Worry-Free Business Security Agent
for /f "delims=" %%f in ('dir /b /s ^"!ALLUSERSPROFILE!^" ^| find /I ^"Security Agent^" ^| find /I /V ^".lnk^"') do (
	set _RESULT=%%f
)
if not exist "%_RESULT%" set _RESULT=%ALLUSERSPROFILE%\Start Menu\Programs\Trend Micro Worry-Free Business Security Agent
call :DELFOLDER "%_RESULT%"

echo Remove registry
call :DELREGISTRY "HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\AMSP"
call :DELREGISTRY "HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\AMSP_INST"
call :DELREGISTRY "HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\AMSPStatus"
call :DELREGISTRY "HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\AMSPTest"
call :DELREGISTRY "HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\UniClient"
call :DELREGISTRY "HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\AEGIS"
call :DELREGISTRY "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\AEGIS"
call :DELREGISTRY "HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\NSC"
call :DELREGISTRY "HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\Wofie"
call :DELREGISTRY "HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\Vizor"
call :DELREGISTRY "HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\LoadHTTP"
call :DELREGISTRY "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\LoadHTTP"
call :DELREGISTRY "HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp"
call :DELREGISTRY "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp"
call :DELREGISTRY "HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\OfcWatchDog"
call :DELREGISTRY "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\OfcWatchDog"
call :DELREGISTRY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Wofie"
call :DELREGISTRY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OfficeScanNT"
call :DELREGISTRY "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\OfficeScanNT"

echo Remove Windows Installer record
"%INSTALL_RUNTIME_ROOT%msizap.exe" TW! {0A07E717-BB5D-4B99-840B-6C5DED52B277}
rem call :DELREGISTRY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0A07E717-BB5D-4B99-840B-6C5DED52B277}"
rem call :DELREGISTRY "HKEY_CLASSES_ROOT\Installer\Features\717E70A0D5BB99B448B0C6D5DE252B77"
rem call :DELREGISTRY "HKEY_CLASSES_ROOT\Installer\Products\717E70A0D5BB99B448B0C6D5DE252B77"
rem call :DELREGISTRY "HKEY_CLASSES_ROOT\Installer\UpgradeCodes\8A88AE84D667B304CB368C99791A74A6"

echo Remove auto-startup programs
call :DELREGVALUE "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "Trend Micro Client Framework"
call :DELREGVALUE "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "OfficeScanNT Monitor"
call :DELREGVALUE "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "OE"
call :DELREGVALUE "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run" "OfficeScanNT Monitor"
call :DELREGVALUE "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run" "OE"

echo Remove driver files
call :DELFILE %WINDIR%\system32\drivers\tmactmon.sys
call :DELFILE %WINDIR%\system32\drivers\tmevtmgr.sys
call :DELFILE %WINDIR%\system32\drivers\tmcomm.sys

goto :EOF


:REMOVE_SHELL_EXT
echo Stop and Un-register Shell Extensions
if exist "%INSTALL_ROOT%UniClient\UiFrmwrk\tmdshell.dll" (
    echo regsvr32 /u /s "%INSTALL_ROOT%UniClient\UiFrmwrk\tmdshell.dll"
         regsvr32 /u /s "%INSTALL_ROOT%UniClient\UiFrmwrk\tmdshell.dll"
    taskkill /F /IM explorer.exe
    start explorer
)

echo Remove shell extension
call :DELREGISTRY "HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{48F45200-91E6-11CE-8A4F-0080C81A28D4}"
call :DELREGISTRY "HKEY_CLASSES_ROOT\CLSID\{48F45200-91E6-11CE-8A4F-0080C81A28D4}"
call :DELREGISTRY "HKEY_CLASSES_ROOT\DocShortcut\shellex\ContextMenuHandlers\{48F45200-91E6-11CE-8A4F-0080C81A28D4}"
call :DELREGISTRY "HKEY_CLASSES_ROOT\Folder\shellex\ContextMenuHandlers\{48F45200-91E6-11CE-8A4F-0080C81A28D4}"
call :DELREGISTRY "HKEY_CLASSES_ROOT\InternetShortcut\shellex\ContextMenuHandlers\{48F45200-91E6-11CE-8A4F-0080C81A28D4}"
call :DELREGISTRY "HKEY_CLASSES_ROOT\lnkfile\shellex\ContextMenuHandlers\{48F45200-91E6-11CE-8A4F-0080C81A28D4}"
call :DELREGISTRY "HKEY_CLASSES_ROOT\piffile\shellex\ContextMenuHandlers\{48F45200-91E6-11CE-8A4F-0080C81A28D4}"
GOTO :EOF

:GETREGFOLDER
set _REGFOLDER=
for /F "tokens=1,2 delims=:" %%a in ('REG QUERY %1 /v %2 ^|FINDSTR /I %2 2^>NUL') do (
    set DISK=%%a
    set FOLDER=%%b
    call :GETFOLDER "!DISK:~-1!:!FOLDER!\"
    set _REGFOLDER=!_RESULT!
)
GOTO :EOF


:FINDFILEBYNAME
set _FINDTHIS=%~f1
set _RESULT=
for /f "delims=" %%f in ('dir ^"!_FINDTHIS!^" /s /b ^| findstr /I %2') do (
    set _RESULT=%%f
)
GOTO :EOF

:GETFOLDER
set _RESULT=%~dp1
if "%_RESULT:~-1%" NEQ "\" set _RESULT=%_RESULT%\
GOTO :EOF

:DELSERVICE
set SERVICE_TO_DEL=%*
for %%p in (%SERVICE_TO_DEL%) do (
    echo sc delete %%p
    sc delete %%p
)
GOTO :EOF


:DISABLESERVICE
set SERVICE_TO_DISABLE=%*
for %%p in (%SERVICE_TO_DISABLE%) do (
    echo sc config %%p start= disabled
    sc config %%p start= disabled
)
GOTO :EOF

:STOPSERVICE
set SERVICE_TO_STOP=%*
for %%p in (%SERVICE_TO_STOP%) do (
    echo net stop /y %%p
    net stop /y %%p
)
GOTO :EOF

:DELFILE
    echo del /F /Q %*
         del /F /Q %*
GOTO :EOF

:DELFOLDER
set FOLDER_TO_DEL=%*
for %%p in (%FOLDER_TO_DEL%) do (
    echo RMDIR /S /Q %%p
    RMDIR /S /Q %%p
    if exist %%p (
        call :MOVEFOLDERTOTMP %%p
    )
)
GOTO :EOF

:DELREGVALUE
set REGISTRY_KEY=%1
set REGISTRY_VALUE=%2
echo REG DELETE %REGISTRY_KEY% /v %REGISTRY_VALUE% /f
REG DELETE %REGISTRY_KEY% /v %REGISTRY_VALUE% /f
GOTO :EOF

:DELREGISTRY
set REGISTRY_TO_DEL=%~1
echo Deleting registry key %REGISTRY_TO_DEL%
echo Windows Registry Editor Version 5.00>temp4del.reg
echo [-%REGISTRY_TO_DEL%]>>temp4del.reg
start /wait regedit /s temp4del.reg
del /f /q temp4del.reg
GOTO :EOF

:KILLPROCESS
set IMAGENAME_TO_KILL=%*
for %%p in (%IMAGENAME_TO_KILL%) do (
    echo killing process: %%p
   
    for /F "tokens=2" %%t in ('TASKLIST /NH /FI "IMAGENAME eq %%p"' ) do (
        echo TASKKILL /F /PID %%t
        TASKKILL /F /PID %%t
    )
)
GOTO :EOF

:MOVEFOLDERTOTMP
set FOLDER_TO_TMP=%~dp1
IF %FOLDER_TO_TMP:~-1%==\ set FOLDER_TO_TMP=%FOLDER_TO_TMP:~0,-1%
call :GETTEMPNAME
echo move "%FOLDER_TO_TMP%" "!_TMP_RESULT!"
move "%FOLDER_TO_TMP%" "!_TMP_RESULT!"
GOTO :EOF

:GETTEMPNAME
set _TMP_RESULT=%TMP%\RmvTool-%RANDOM%-%TIME:~6,5%
if exist "%_TMP_RESULT%" GOTO :GETTEMPNAME
GOTO :EOF

:SHOWHELP
echo AMSP UniClient Framework Removal Tool
echo.
echo Usage
echo RmvTool.bat INSTALL_RUNTIME_ROOT [DEFAULT_INSTALL_ROOT]
echo.
GOTO :EOF

:FINDNSCUTIL
set TMCFW_REG=Software\TrendMicro\AMSP
call :FINDFILEBYNAME "%INSTALL_ROOT%AMSP\module\20003" %1
if not exist "!_RESULT!" (
	call :FINDFILEBYNAME "%PRODUCT_ROOT%pfw_features" %1
)
if not exist "!_RESULT!" (
	set TMCFW_REG=Software\TrendMicro\NSC\PFW
	call :FINDFILEBYNAME "%PRODUCT_ROOT%" %1
)
GOTO :EOF

:GETWINMAJORVER
set WINMAJORVER=4
for /F "tokens=1 delims=." %%v in ('wmic os get version ^| findstr \.') do set WINMAJORVER=%%v
GOTO :EOF

:EOF

rem ENDLOCAL