BEQLEUNXP1NB103 - Windows - Files

%USERPROFILE%\StartFunctions.sh

(cygwin bash script)

Download [{{#filelink: StartFunctions.sh}} this file]. {{#fileanchor: fstab}}

# Function handy for the start script
#
# include with
#
# . "$USERPROFILE/StartFunctions.sh"

function kill_win_process_pid()
{
	WINPID=$1
	/bin/kill -f $WINPID														# Don't use bash's kill built-in !
}

function kill_win_process_name()
{
	WINPROC=$1
	WINPID=$(ps -sW | grep "$WINPROC" | sed -re "s/^ +([0-9]*) .*$/\1/")
	/bin/kill -f $WINPID														# Don't use bash's kill built-in !
}

function kill_win_service ()
{
	WIN_SVC=$1
	cmd /c "tasklist /svc >%TEMP%\\$$"
	WINPID=$(grep "$WIN_SVC" "$TEMP/$$" | sed -re "s/^.* ([0-9]*) .*$/\1/")
	rm "$TEMP/$$"
	/bin/kill -f $WINPID														# Don't use bash's kill built-in !
}

function hijack ()
{
	EXENAME="$1"
	[ $DEBUG ] && echo "Hijacking executable \"${EXENAME}\"..." >/dev/stderr
	regtool set -q    "\\HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\${EXENAME}\\Debugger" '"C:\BIN\WIJACK.EXE"'
	regtool remove -q "\\HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\${EXENAME}\\AutorunsDisabled"
}

function disable_hijack ()
{
	EXENAME="$1"
	[ $DEBUG ] && echo "Disabling hijack for executable \"${EXENAME}\"..." >/dev/stderr
	regtool add -q "\\HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\${EXENAME}\\AutorunsDisabled"
	regtool set -q "\\HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\${EXENAME}\\AutorunsDisabled\\Debugger" '"C:\BIN\WIJACK.EXE"'
	regtool unset -q "\\HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\${EXENAME}\\Debugger"
}

#Usage: if ( is_service_enabled "wuauserv" ) ; then echo service is enabled; fi
function is_service_enabled ()
{
	SERVICE="$1"
	regtool list -l "\\HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\${SERVICE}" | grep -q "AutorunsDisabled"
	return $(( ! $? ))
}

#Usage: if ( is_service_disabled "wuauserv" ) ; then echo service is disabled; fi
function is_service_disabled ()
{
	SERVICE="$1"
	regtool list -l "\\HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\${SERVICE}" | grep -q "AutorunsDisabled"
}

#Usage: if ( is_service_started "Automatic Updates" ) ; then echo service is started; fi
function is_service_started ()
{
	SERVICE="$1"
	net start | grep -q "${SERVICE}"
}

#Usage: if ( is_service_stopped "Automatic Updates" ) ; then echo service is stopped; fi
function is_service_stopped ()
{
	SERVICE="$1"
	net start | grep -q "${SERVICE}"
	return $(( ! $? ))
}

#Usage: enable_service "wuauserv"
function enable_service ()
{
	# Will restore a service that was disabled through Autoruns (Service is set to Automatic again)
	SERVICE="$1"
	[ $DEBUG ] && echo "Restoring service \"${SERVICE}\"..." >/dev/stderr
	regtool unset -q "\\HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\${SERVICE}\\AutorunsDisabled"
	regtool set -q   "\\HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\${SERVICE}\\Start" 2
}

#Usage: disable_service "wuauserv"
function disable_service ()
{
	# Will disable a service as if it was disabled through Autoruns (Service will be listed in Autoruns disabled entries)
	SERVICE="$1"
	[ $DEBUG ] && echo "Disabling service \"${SERVICE}\"..." >/dev/stderr
	regtool set -q   "\\HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\${SERVICE}\\AutorunsDisabled" 1
	regtool set -q   "\\HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\${SERVICE}\\Start" 4
}

#Usage: start_service "wuauserv"   OR start_service "Automatic Updates"
function start_service ()
{
	SERVICE="$1"
	[ $DEBUG ] && echo -n "Starting service \"${SERVICE}\"..." >/dev/stderr
	net start "${SERVICE}" >/dev/null 2>&1
	RES=$?
	[ $DEBUG ] && ( [ $RES -eq 0 ] && echo "Success" || echo "Failed" )
}

function stop_service ()
{
	SERVICE="$1"
	[ $DEBUG ] && echo -n "Stopping service \"${SERVICE}\"..." >/dev/stderr
	net stop "${SERVICE}" >/dev/null 2>&1
	RES=$?
	[ $DEBUG ] && ( [ $RES -eq 0 ] && echo "Success" || echo "Failed" )
}

function enable_hkcu_run ()
{
	REGVALUE=$1
	REGDATA=$(regtool get -q "\\HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\AutorunsDisabled\\${REGVALUE}") || return $?
	[ $DEBUG ] && echo -n "Restoring HKCU run ${REGVALUE}=${REGDATA}" >/dev/stderr
	regtool set -q "\\HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\${REGVALUE}" "${REGDATA}"
	regtool unset -q "\\HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\AutorunsDisabled\\${REGVALUE}"
}

function disable_hkcu_run ()
{
	REGVALUE=$1
	REGDATA=$(regtool get -q "\\HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\${REGVALUE}") || return $?
	[ $DEBUG ] && echo -n "Disabling HKCU run ${REGVALUE}=${REGDATA}" >/dev/stderr
	regtool add -q "\\HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\AutorunsDisabled"
	regtool set -q "\\HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\AutorunsDisabled\\${REGVALUE}" "${REGDATA}"
	regtool unset -q "\\HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\${REGVALUE}"
}

function enable_hklm_run ()
{
	REGVALUE=$1
	REGDATA=$(regtool get -q "\\HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\AutorunsDisabled\\${REGVALUE}") || return $?
	[ $DEBUG ] && echo -n "Restoring HKLM run ${REGVALUE}=${REGDATA}" >/dev/stderr
	regtool set -q "\\HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\${REGVALUE}" "${REGDATA}"
	regtool unset -q "\\HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\AutorunsDisabled\\${REGVALUE}"
}

function disable_hklm_run ()
{
	REGVALUE=$1
	REGDATA=$(regtool get -q "\\HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\${REGVALUE}") || return $?
	[ $DEBUG ] && echo -n "Disabling HKLM run ${REGVALUE}=${REGDATA}" >/dev/stderr
	regtool add -q "\\HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\AutorunsDisabled"
	regtool set -q "\\HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\AutorunsDisabled\\${REGVALUE}" "${REGDATA}"
	regtool unset -q "\\HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\${REGVALUE}"
}

function parse_parameters ()
{
	# Evaluate command-line parameters
	until [[ ! "$*" ]]; do
		if [[ ${1:0:2} = '--' ]]; then
			local PAIR=${1:2}
			local PARAMETER=$(echo ${PAIR%=*} | tr [:lower:]- [:upper:]_)
			eval P_$PARAMETER="${PAIR##*=}"
		else
			if [[ $1 = '-d' ]]; then DEBUG=$((DEBUG+1)); fi
		fi
		shift
	done
}

%USERPROFILE%\Start.sh

(cygwin bash script)

Download [{{#filelink: Start.sh}} this file]. {{#fileanchor: fstab}}

#! /bin/bash

# ===== ENABLE / DISABLE McAfee Framework Services =====================================================================

"$USERPROFILE/McAfee.sh" -d

# ===== ENABLE / DISABLE Windows Automatic Update ======================================================================

"$USERPROFILE/WinUpdate.sh" -d

# ===== ENABLE / DISABLE ManageSoft Services ===========================================================================

"$USERPROFILE/ManageSoft.sh" -d

# ===== ENABLE / DISABLE Bluetooth Services ===========================================================================

# "$USERPROFILE/BlueTooth.sh" -d

# ===== ENABLE / DISABLE Miscellaneous Non-Essential Services ==========================================================

"$USERPROFILE/Miscellaneous.sh" -d

# ===== Update Outlook Registry Settings ===============================================================================

"$USERPROFILE/Outlook.sh"

# ===== Mount TrueCrypt disks ==========================================================================================
# echo ===========================================================================
# echo MOUNT TRUECRYPT DISKS
# echo ===========================================================================
# echo.

# "C:\Program Files\TrueCrypt\truecrypt.exe" /v F:\Profiles\beq06659\PGP\NXP.tc /k F:\Profiles\beq06659\PGP\tckeyfile /a D /q
# net share D$=D:\

# ===== Launching SSH Agent ============================================================================================
echo ===========================================================================
echo LAUNCHING SSH AGENT
echo ===========================================================================
bash -lc "echo Launching SSH Agent..."			# Create a login shell to force launching SSH Agent

# ===== Launching SSHPROXY =============================================================================================
echo ===========================================================================
echo LAUNCHING SSHPROXY
echo ===========================================================================
bash -lc "sshproxy start"						# Login shell because sshproxy is in ~/bin + need sshagent context

# ===== Detect changes on noekeon.org ==================================================================================
echo ===========================================================================
echo DETECT CHANGES ON NOEKEON.ORG
echo ===========================================================================

bash -lc "ssh noekeonsshtunnel '~/private/changemonitor/monitor-all.sh'"	#Login shell, we need sshagent context

%USERPROFILE%\BlueTooth.sh

(cygwin bash script)

Download [{{#filelink: BlueTooth.sh}} this file]. {{#fileanchor: fstab}}

#! /bin/bash

# ===== Enable / Disable BlueSoleil Bluetooth services==================================================================

# Services:
# - BlueSoleil Hid Service
# - Start BT in service
# - stisvc
# - WudfSvc
# Tasks:
# - HKCU_RUN "PC Suite Tray" (REG_SZ) "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray

. "$USERPROFILE/StartFunctions.sh"

echo ===========================================================================
echo ENABLE / DISABLE BLUESOLEIL BLUETOOTH SERVICES
echo ===========================================================================

function GetStatus ()
{
	( net start | grep -q "BlueSoleil Hid Service" ) && RUNNING=1 || RUNNING=0
}

function ShowStatus ()
{
	echo -n "BlueTooth services are "
	[[ $RUNNING -eq 1 ]] && echo "*RUNNING*" || echo "*NOT RUNNING*"
}

function Stop ()
{
	kill_win_process_name "PCSuite.exe"
	kill_win_process_name "PcSync2.exe"
	stop_service "Start BT in service"
	stop_service "BlueSoleil Hid Service"
	stop_service "ServiceLayer"
	stop_service "stisvc"
	kill_win_service "WudfSvc"													#Killing service "WudfSvc" - Can't be stopped with net stop but killed instead
	kill_win_process_name "BlueSoleil.exe"

	disable_service "BlueSoleil Hid Service"
	disable_service "Start BT in service"
	disable_service "stisvc"
	disable_service "WudfSvc"

	disable_hkcu_run 'PC Suite Tray' 											# REG_SZ  '"C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray'
}

function Start ()
{
	enable_service "BlueSoleil Hid Service"
	enable_service "Start BT in service"
	enable_service "stisvc"
	enable_service "WudfSvc"

	enable_hkcu_run 'PC Suite Tray' 											# REG_SZ  '"C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray'

	start_service "WudfPf"			# driver
	start_service "WudfRd"          # driver
	start_service "WudfSvc"
	start_service "stisvc"
	start_service "ServiceLayer"
	start_service "BlueSoleil Hid Service"
	start_service "Start BT in service"

	# Run /cygdrive/c/PROGRA~1/Nokia/NOKIAP~1/PCSuite.exe, but without spawning an additional bash parent process
	cmd /c "start C:\\PROGRA~1\\Nokia\\NOKIAP~1\\PCSuite.exe -onlytray" &
}

parse_parameters "$@"
GetStatus
ShowStatus

if   [ $P_FORCE_ENABLE ] ; then Start
elif [ $P_FORCE_DISABLE ] ; then Stop
else
	echo
	read -p 'What do you want to do ? ((e)nable / (d)isable / (C)ANCEL) ' RESPONSE
	case $RESPONSE in
	   ""|"c"|"C") 			;;
	   "e"|"E") Start		;;
	   "d"|"D") Stop		;;
	   *) echo "Unrecognized value."
	esac
fi

exit 0

%USERPROFILE%\ManageSoft.sh

(cygwin bash script)

Download [{{#filelink: StartFunctions.sh}} this file]. {{#fileanchor: fstab}}

#! /bin/bash

# ===== ENABLE / DISABLE MANAGESOFT SERVICES ===========================================================================

# (HKLM/Run) SchedulingAgent_nDG,
# (IE - DISABLED): ManageSoft Web Application Tracker
#  --> ALWAYS DISABLED
# (service) mgsdl, mgssecsvc, ndGlobalLauncher, ndinit,
# (Hijack) mgsdl.exe, mgssecsvc.exe, ndinit.exe, ndlaunch.exe, ndschedag.exe, ndsens.exe, ndserv.exe, ndtask.exe

. "$USERPROFILE/StartFunctions.sh"

echo ===========================================================================
echo ENABLE / DISABLE MANAGESOFT SERVICES
echo ===========================================================================

function GetStatus ()
{
	( net start | grep -q "ManageSoft Security Service" ) && RUNNING=1 || RUNNING=0
}

function ShowStatus ()
{
	echo -n "ManageSoft Services are "
	[[ $RUNNING -eq 1 ]] && echo "*RUNNING*" || echo "*NOT RUNNING*"
}

function Stop ()
{
	disable_hklm_run "SchedulingAgent_nDG"
	kill_win_process_name "ndschedag.exe"

	stop_service "ManageSoft Peer-to-Peer Download Service"
	stop_service "ManageSoft Security Service"
	stop_service "ManageSoft installation agent"
	stop_service "ManageSoft managed device"

	disable_service "mgsdl"
	disable_service "mgssecsvc"
	disable_service "ndGlobalLauncher"
	disable_service "ndinit"

	hijack "mgsdl.exe"
	hijack "mgssecsvc.exe"
	hijack "ndinit.exe"
	hijack "ndlaunch.exe"
	hijack "ndschedag.exe"
	hijack "ndsens.exe"
	hijack "ndserv.exe"
	hijack "ndtask.exe"
}

function Start ()
{
	disable_hijack "mgsdl.exe"
	disable_hijack "mgssecsvc.exe"
	disable_hijack "ndinit.exe"
	disable_hijack "ndlaunch.exe"
	disable_hijack "ndschedag.exe"
	disable_hijack "ndsens.exe"
	disable_hijack "ndserv.exe"
	disable_hijack "ndtask.exe"

	enable_service "ndinit"
	enable_service "mgsdl"
	enable_service "mgssecsvc"
	enable_service "ndGlobalLauncher"

	start_service "ManageSoft managed device"
	start_service "ManageSoft installation agent"
	start_service "ManageSoft Security Service"
	start_service "ManageSoft Peer-to-Peer Download Service"

	enable_hklm_run "SchedulingAgent_nDG"
}

parse_parameters "$@"
GetStatus
ShowStatus

if   [ $P_FORCE_ENABLE ] ; then Start
elif [ $P_FORCE_DISABLE ] ; then Stop
else
	echo
	read -p 'What do you want to do ? ((e)nable / (d)isable / (C)ANCEL) ' RESPONSE
	case $RESPONSE in
	   ""|"c"|"C")			;;
	   "e"|"E") Start		;;
	   "d"|"D") Stop		;;
	   *) echo "Unrecognized value."
	esac
fi

exit 0

%USERPROFILE%\McAfee.sh

(cygwin bash script)

Download [{{#filelink: McAfee.sh}} this file]. {{#fileanchor: fstab}}

#! /bin/bash

# ===== ENABLE / DISABLE MCAFEE FRAMEWORK SERVICES =====================================================================

# - (Services) McAfee Framework Service, McAfee Task Manager
# - (HKLM/Run) McAfee Host Intrusion, McAfeeUpdaterUI, ShStatEXE,
# - (Hijack) frameworkservice.exe, vstskmgr.exe, naPrdMgr.exe

. "$USERPROFILE/StartFunctions.sh"

echo ===========================================================================
echo ENABLE / DISABLE MCAFEE FRAMEWORK SERVICES
echo ===========================================================================

function GetStatus ()
{
	( net start | grep -q "McAfee Framework Service" ) && RUNNING=1 || RUNNING=0
}

function ShowStatus ()
{
	echo -n "McAfee Framework Services are "
	[[ $RUNNING -eq 1 ]] && echo "*RUNNING*" || echo "*NOT RUNNING*"
}

function Stop ()
{
	hijack "naPrdMgr.exe"
	hijack "frameworkservice.exe"
	hijack "vstskmgr.exe"

	disable_hklm_run "McAfee Host Intrusion Prevention Tray"
	disable_hklm_run "McAfeeUpdaterUI"
	disable_hklm_run "ShStatEXE"

	echo
	echo McAfee Framework Services is disabled. Need reboot for changes to take effect...
}

function Start ()
{
	disable_hijack "naPrdMgr.exe"
	disable_hijack "frameworkservice.exe"
	disable_hijack "vstskmgr.exe"

	start_service "McAfee Framework Service"
	start_service "McAfee Task Manager"

	enable_hklm_run "McAfee Host Intrusion Prevention Tray"
	enable_hklm_run "McAfeeUpdaterUI"
	enable_hklm_run "ShStatEXE"
}

parse_parameters "$@"
GetStatus
ShowStatus

if   [ $P_FORCE_ENABLE ] ; then Start
elif [ $P_FORCE_DISABLE ] ; then Stop
else
	echo
	read -p 'What do you want to do ? ((e)nable / (d)isable / (C)ANCEL) ' RESPONSE
	case $RESPONSE in
	   ""|"c"|"C") 			;;
	   "e"|"E") Start		;;
	   "d"|"D") Stop		;;
	   *) echo "Unrecognized value."
	esac
fi

exit 0

%USERPROFILE%\Miscellaneous.sh

(cygwin bash script)

Download [{{#filelink: Miscellaneous.sh}} this file]. {{#fileanchor: fstab}}

#! /bin/bash

# ===== ENABLE / DISABLE MISCELLANEOUS SERVICES ===========================================================================

# (service) helpsvc, RemoteRegistry, SCardSvr, TrkWks,

. "$USERPROFILE/StartFunctions.sh"

echo ===========================================================================
echo ENABLE / DISABLE MISCELLANEOUS SERVICES
echo ===========================================================================

function GetStatus ()
{
	( net start | grep -q "Help and Support" ) && RUNNING=1 || RUNNING=0
}

function ShowStatus ()
{
	echo -n "Miscellaneous non-essential services are "
	[[ $RUNNING -eq 1 ]] && echo "*RUNNING*" || echo "*NOT RUNNING*"
}

function Stop ()
{
	disable_service "TrkWks"
	disable_service "SCardSvr"
	disable_service "RemoteRegistry"
	disable_service "helpsvc"

	stop_service "Distributed Link Tracking Client"
	stop_service "Smart Card"
	stop_service "Remote Registry"
	stop_service "Help and Support"
}

function Start ()
{
	enable_service "helpsvc"
	enable_service "RemoteRegistry"
	enable_service "SCardSvr"
	enable_service "TrkWks"

	stop_service "Help and Support"
	stop_service "Remote Registry"
	stop_service "Smart Card"
	stop_service "Distributed Link Tracking Client"
}

parse_parameters "$@"
GetStatus
ShowStatus

if   [ $P_FORCE_ENABLE ] ; then Start
elif [ $P_FORCE_DISABLE ] ; then Stop
else
	echo
	read -p 'What do you want to do ? ((e)nable / (d)isable / (C)ANCEL) ' RESPONSE
	case $RESPONSE in
	   ""|"c"|"C") 			;;
	   "e"|"E") Start		;;
	   "d"|"D") Stop		;;
	   *) echo "Unrecognized value."
	esac
fi

exit 0

%USERPROFILE%\Outlook.sh

(cygwin bash script)

Download [{{#filelink: StartFunctions.sh}} this file]. {{#fileanchor: fstab}}