Update PUP detection

5 files changed, 55 insertions, 25 deletions

diff --git a/MAS/All-In-One-Version-KL/MAS_AIO.cmd b/MAS/All-In-One-Version-KL/MAS_AIO.cmd
index aefa363..cd6bcf6 100644
--- a/MAS/All-In-One-Version-KL/MAS_AIO.cmd
+++ b/MAS/All-In-One-Version-KL/MAS_AIO.cmd
@@ -1310,11 +1310,10 @@ exit /b
 

 set w=

 set results=

-if exist "%ProgramFiles%\KM%w%Spico" set pupfound1= KM%w%Spico 

-if exist "%SysPath%\Tasks\R@1n-KMS"  set pupfound2= R@inKMS 

-reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s | find /i "AutoPico" %nul% && set pupfound1= KM%w%Spico 

-reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s | find /i "R@1n" %nul% && set pupfound2= R@inKMS 

-set pupfound=%pupfound1%%pupfound2%

+if exist "%ProgramFiles%\KM%w%Spico" set pupfound= KM%w%Spico 

+if not defined pupfound (

+reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s | find /i "AutoPico" %nul% && set pupfound= KM%w%Spico 

+)

 

 set hcount=0

 for %%# in (avira.com kaspersky.com virustotal.com mcafee.com) do (

@@ -1336,6 +1335,13 @@ set fixes=%fixes% %mas%remove_mal%w%ware
 call :dk_color2 %Blue% "Help - " %_Yellow% " %mas%remove_mal%w%ware"

 echo:

 )

+

+::  Remove the scheduled task of R@1n-KMS (old version) that runs the activation command every minute, as it leads to high CPU usage.

+

+if exist %SysPath%\Tasks\R@1n-KMS (

+for /f %%A in ('dir /b /a:-d %SysPath%\Tasks\R@1n-KMS %nul6%') do (schtasks /delete /tn \R@1n-KMS\%%A /f %nul%)

+)

+

 exit /b

 

 ::========================================================================================================================================

diff --git a/MAS/Separate-Files-Version/Activators/HWID_Activation.cmd b/MAS/Separate-Files-Version/Activators/HWID_Activation.cmd
index fa0a6f4..2563ac7 100644
--- a/MAS/Separate-Files-Version/Activators/HWID_Activation.cmd
+++ b/MAS/Separate-Files-Version/Activators/HWID_Activation.cmd
@@ -1073,11 +1073,10 @@ exit /b
 

 set w=

 set results=

-if exist "%ProgramFiles%\KM%w%Spico" set pupfound1= KM%w%Spico 

-if exist "%SysPath%\Tasks\R@1n-KMS"  set pupfound2= R@inKMS 

-reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s | find /i "AutoPico" %nul% && set pupfound1= KM%w%Spico 

-reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s | find /i "R@1n" %nul% && set pupfound2= R@inKMS 

-set pupfound=%pupfound1%%pupfound2%

+if exist "%ProgramFiles%\KM%w%Spico" set pupfound= KM%w%Spico 

+if not defined pupfound (

+reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s | find /i "AutoPico" %nul% && set pupfound= KM%w%Spico 

+)

 

 set hcount=0

 for %%# in (avira.com kaspersky.com virustotal.com mcafee.com) do (

@@ -1099,6 +1098,13 @@ set fixes=%fixes% %mas%remove_mal%w%ware
 call :dk_color2 %Blue% "Help - " %_Yellow% " %mas%remove_mal%w%ware"

 echo:

 )

+

+::  Remove the scheduled task of R@1n-KMS (old version) that runs the activation command every minute, as it leads to high CPU usage.

+

+if exist %SysPath%\Tasks\R@1n-KMS (

+for /f %%A in ('dir /b /a:-d %SysPath%\Tasks\R@1n-KMS %nul6%') do (schtasks /delete /tn \R@1n-KMS\%%A /f %nul%)

+)

+

 exit /b

 

 ::========================================================================================================================================

diff --git a/MAS/Separate-Files-Version/Activators/KMS38_Activation.cmd b/MAS/Separate-Files-Version/Activators/KMS38_Activation.cmd
index ad5b239..e7ecf7a 100644
--- a/MAS/Separate-Files-Version/Activators/KMS38_Activation.cmd
+++ b/MAS/Separate-Files-Version/Activators/KMS38_Activation.cmd
@@ -1238,11 +1238,10 @@ exit /b
 

 set w=

 set results=

-if exist "%ProgramFiles%\KM%w%Spico" set pupfound1= KM%w%Spico 

-if exist "%SysPath%\Tasks\R@1n-KMS"  set pupfound2= R@inKMS 

-reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s | find /i "AutoPico" %nul% && set pupfound1= KM%w%Spico 

-reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s | find /i "R@1n" %nul% && set pupfound2= R@inKMS 

-set pupfound=%pupfound1%%pupfound2%

+if exist "%ProgramFiles%\KM%w%Spico" set pupfound= KM%w%Spico 

+if not defined pupfound (

+reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s | find /i "AutoPico" %nul% && set pupfound= KM%w%Spico 

+)

 

 set hcount=0

 for %%# in (avira.com kaspersky.com virustotal.com mcafee.com) do (

@@ -1264,6 +1263,13 @@ set fixes=%fixes% %mas%remove_mal%w%ware
 call :dk_color2 %Blue% "Help - " %_Yellow% " %mas%remove_mal%w%ware"

 echo:

 )

+

+::  Remove the scheduled task of R@1n-KMS (old version) that runs the activation command every minute, as it leads to high CPU usage.

+

+if exist %SysPath%\Tasks\R@1n-KMS (

+for /f %%A in ('dir /b /a:-d %SysPath%\Tasks\R@1n-KMS %nul6%') do (schtasks /delete /tn \R@1n-KMS\%%A /f %nul%)

+)

+

 exit /b

 

 ::========================================================================================================================================

diff --git a/MAS/Separate-Files-Version/Activators/Ohook_Activation_AIO.cmd b/MAS/Separate-Files-Version/Activators/Ohook_Activation_AIO.cmd
index 17cd223..0f29f7b 100644
--- a/MAS/Separate-Files-Version/Activators/Ohook_Activation_AIO.cmd
+++ b/MAS/Separate-Files-Version/Activators/Ohook_Activation_AIO.cmd
@@ -1553,11 +1553,10 @@ exit /b
 

 set w=

 set results=

-if exist "%ProgramFiles%\KM%w%Spico" set pupfound1= KM%w%Spico 

-if exist "%SysPath%\Tasks\R@1n-KMS"  set pupfound2= R@inKMS 

-reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s | find /i "AutoPico" %nul% && set pupfound1= KM%w%Spico 

-reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s | find /i "R@1n" %nul% && set pupfound2= R@inKMS 

-set pupfound=%pupfound1%%pupfound2%

+if exist "%ProgramFiles%\KM%w%Spico" set pupfound= KM%w%Spico 

+if not defined pupfound (

+reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s | find /i "AutoPico" %nul% && set pupfound= KM%w%Spico 

+)

 

 set hcount=0

 for %%# in (avira.com kaspersky.com virustotal.com mcafee.com) do (

@@ -1579,6 +1578,13 @@ set fixes=%fixes% %mas%remove_mal%w%ware
 call :dk_color2 %Blue% "Help - " %_Yellow% " %mas%remove_mal%w%ware"

 echo:

 )

+

+::  Remove the scheduled task of R@1n-KMS (old version) that runs the activation command every minute, as it leads to high CPU usage.

+

+if exist %SysPath%\Tasks\R@1n-KMS (

+for /f %%A in ('dir /b /a:-d %SysPath%\Tasks\R@1n-KMS %nul6%') do (schtasks /delete /tn \R@1n-KMS\%%A /f %nul%)

+)

+

 exit /b

 

 ::========================================================================================================================================

diff --git a/MAS/Separate-Files-Version/Activators/Online_KMS_Activation.cmd b/MAS/Separate-Files-Version/Activators/Online_KMS_Activation.cmd
index 9bbc706..85e82fc 100644
--- a/MAS/Separate-Files-Version/Activators/Online_KMS_Activation.cmd
+++ b/MAS/Separate-Files-Version/Activators/Online_KMS_Activation.cmd
@@ -2654,11 +2654,10 @@ exit /b
 

 set w=

 set results=

-if exist "%ProgramFiles%\KM%w%Spico" set pupfound1= KM%w%Spico 

-if exist "%SysPath%\Tasks\R@1n-KMS"  set pupfound2= R@inKMS 

-reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s | find /i "AutoPico" %nul% && set pupfound1= KM%w%Spico 

-reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s | find /i "R@1n" %nul% && set pupfound2= R@inKMS 

-set pupfound=%pupfound1%%pupfound2%

+if exist "%ProgramFiles%\KM%w%Spico" set pupfound= KM%w%Spico 

+if not defined pupfound (

+reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s | find /i "AutoPico" %nul% && set pupfound= KM%w%Spico 

+)

 

 set hcount=0

 for %%# in (avira.com kaspersky.com virustotal.com mcafee.com) do (

@@ -2680,6 +2679,13 @@ set fixes=%fixes% %mas%remove_mal%w%ware
 call :dk_color2 %Blue% "Help - " %_Yellow% " %mas%remove_mal%w%ware"

 echo:

 )

+

+::  Remove the scheduled task of R@1n-KMS (old version) that runs the activation command every minute, as it leads to high CPU usage.

+

+if exist %SysPath%\Tasks\R@1n-KMS (

+for /f %%A in ('dir /b /a:-d %SysPath%\Tasks\R@1n-KMS %nul6%') do (schtasks /delete /tn \R@1n-KMS\%%A /f %nul%)

+)

+

 exit /b

 

 ::========================================================================================================================================