In Progress Forever to Wake Up

[Malnutrition]

No problem I'm sure it's something simple that is being missed. I work for a friend of mine on the side who owns a computer repair shop here and there I usually remove malware and speed up slow computers for him when he is overloaded.
I have set this batch file kill.bat up on several computers including my own with no issues, this will be the first time I have ran into a problem doing this. I'll look for your reply.

 

[Difficult_Man]

I ran the Fix scan & rebooted, log attached.

Kill.bat did not work from the Start menu nor from the .exe in the Tools folder, even when the only app open was Notepad.

 

[Malnutrition]

Now I see the issue, Not sure why this slipped my mind before. I was wandering what was going on!

Something simple like I said!

I apologize for that.

These command are not working to due to spaces in your user name, which means I should have enclosed the command in "" marks any time there are spaces in a name or service or anything of that manner when running in command prompt the console will stop at the first space and assume that is the full command you are intending to send.

Here is the new kill.bat content below, replace the current text inside with this.

@echo off
IF EXIST "C:\Users\Bruce Kleinberg\OneDrive\Documents\tools\KillEmAll.exe" (
"C:\Users\Bruce Kleinberg\OneDrive\Documents\tools\KillEmAll.exe" /auto
) ELSE (
"C:\Users\Bruce Kleinberg\Documents\tools\KillEmAll.exe" /auto
)

IF EXIST "C:\Users\Bruce Kleinberg\OneDrive\Documents\tools\ReduceMemory_x64.exe" (
"C:\Users\Bruce Kleinberg\OneDrive\Documents\tools\ReduceMemory_x64.exe" /O
) ELSE (
"C:\Users\Bruce Kleinberg\Documents\tools\ReduceMemory_x64.exe" /O
)

exit

---

---

Also here is new fixlist.txt which covers that issue.
Run this as you have before.

 

[Difficult_Man]

Replaced fixlist code, ran FRST fix, then rebooted.
Opened 3 programs in addition to Chrome (Notepad, Excel, Acrobat).
Ran Kill from Start menu, a black window flashed briefly but, unfortunately, no programs were closed.
Ran Kill as Admin from the Desktop .exe and nothing at all happened.
I appear to have a very stubborn computer.

 

[Malnutrition]

You will need to delete the shortcut, as it contains the old commands. FRST fix worked properly.

Open tools delete that shortcut

Then delete the one in start menu

Then create a new shortcut in the tools folder as before.

Send that to the start menu, as before

 

[Difficult_Man]

You will need to delete the shortcut, as it contains the old commands. FRST fix worked properly.

Open tools delete that shortcut

Then delete the one in start menu

Then create a new shortcut in the tools folder as before.

Send that to the start menu, as before

Kill.bat Shortcut deleted and replaced.
I tried it from Start with and nothing happened.
I ran as Admin from Tools and nothing happened.

 

[Malnutrition]

Delete all Kill.bat the you have, You also need to delete from the start menu as well. All of them.

Then I will need the exact paths for:

KillemAll.exe & ReduceMemory_x64.exe

To do this:

Download this tool.
Install.
Go to Documents then tools .
Right click each of those in the tools folder and get me the full path.
Mouse Hover over Copy Paths in the right click menu
Left click Copy Full paths.
Post each path here.
I know this works, and I know what the issue was, it should be resolved with the new commands but I want to be sure..

---

---

What happens when you run Killemall by it's self?

This is really all it could be, but....


New Kill.bat

@echo off
"%USERPROFILE%\OneDrive\Documents\tools\KillEmAll.exe" /auto
"%USERPROFILE%\OneDrive\Documents\tools\ReduceMemory_x64.exe" /O
"%USERPROFILE%\Documents\tools\KillEmAll.exe" /auto
"%USERPROFILE%\Documents\tools\ReduceMemory_x64.exe" /O
exit

 

[Difficult_Man]

Download this tool.
Install.

Nothing happened when I clicked the link. Neither could I open the link in a new tab. Clicking 'Downloads' in Chrome settings confirmed that nothing downloaded (two attempts).

Before replying I looked at Properties of both programs.
The visible path for each program is
C:\Users\Bruce Kleinberg\OneDrive\CPM\New Folder\Tools (which you probably already know).

BTW, I have no idea why everything is under the OneDrive\CPM. I did a 6-week internship in 2018 with CPM and they hooked me up to their OneDrive system; my computer has wanted me to login to OneDrive ever since! Could this be why it's so hard to remove?

In the Properties window I saw this msg: "This file came from another computer and might be blocked to help protect this computer." There was an unchecked checkbox next to it labeled 'Unblock'. I unblocked it and got the file path C:\Windows\System32\DriverStore\FileRepository\ki125121.inf_amd64_26ca8ba649abc040
It also opened the window where it was located and I found 3 files called ki125121: Security Catalog, Setup Information, PNF file.

I ran KillEmAll.exe again. It worked and gave me a longer file path: "c:\windows\system32\driverstore\filerepository\ki125121.inf_amd64_26ca8ba649abc040\igfxcuiservice.exe"
I gave the CLOSE command and everything but Chrome closed.
It generated the attached log in the Tools folder.

 

[Difficult_Man]

I did not do the above for ReduceMemory_x64

 

[Malnutrition]

Hmm.... Well that would explain why the commands do not work.

So as I said before delete all Kill.bat and all shortcuts to Kill.bat including those on the start menu.

Here is your new kill.bat place this in the same folder, with Kill em All and ReduceMemory

@echo off
"%USERPROFILE%\OneDrive\Documents\tools\KillEmAll.exe" /auto
"%USERPROFILE%\OneDrive\Documents\tools\ReduceMemory_x64.exe" /O
"%USERPROFILE%\Documents\tools\KillEmAll.exe" /auto
"%USERPROFILE%\Documents\tools\ReduceMemory_x64.exe" /O
"C:\Users\Bruce Kleinberg\OneDrive\CPM\New Folder\Tools\KillEmAll.exe" /auto
"C:\Users\Bruce Kleinberg\OneDrive\CPM\New Folder\Tools\ReduceMemory_x64.exe" /O
exit

I would have never guessed Documents would be CPM, and that tools is inside a new folder in the CPM folder.....so there is the issue, I hope.

Here also is the download page for the tool.

Copy as Path ContextMenu for Windows

Copy paths of the seletect files and folders in windows explorer.

www.rentanadviser.com

And I attached the installer in case you are unable to download it.
Also attaching rename.bat to kill Searchapp.exe

 

[Difficult_Man]

Thanks for attaching the setup.zip as I was unable to download from the website. What do I do with it: Run or Run as Admin?
Same question for rename.zip

 

[Difficult_Man]

I ran it as administrator; installed.

 

[Malnutrition]

As for rename.zip unzip to desktop right click run as admin.

You can add the new kill.bat, but if that doesn’t work....

Look at post 127 get me the file path, I need to know for 100 percent sure.

 

[Difficult_Man]

You can add the new kill.bat, but if that doesn’t work....

Add to what? Start list? I replaced the code.

Look at post 127 get me the file path, I need to know for 100 percent sure.

C:\Users\Bruce Kleinberg\OneDrive\CPM\New Folder\Tools\KillEmAll.exe
C:\Users\Bruce Kleinberg\OneDrive\CPM\New Folder\Tools\ReduceMemory_x64.exe

I ran rename as admin, nothing observable happened.

 

[Malnutrition]

Add to what? Start list? I replaced the code.

If you added the new kill.bat to the C:\Users\Bruce Kleinberg\OneDrive\CPM\New Folder\Tools folder, then create a new shortcut for kill.bat and add to start menu, now that we have the correct command all should work as intended. The correct paths are there.

This is all you really need.

@echo off
"C:\Users\Bruce Kleinberg\OneDrive\CPM\New Folder\Tools\KillEmAll.exe" /auto
"C:\Users\Bruce Kleinberg\OneDrive\CPM\New Folder\Tools\ReduceMemory_x64.exe" /o
exit

But leave this one if you wish., as it contains the correct path, and will cover if you remove one drive.

@echo off
"%USERPROFILE%\OneDrive\Documents\tools\KillEmAll.exe" /auto
"%USERPROFILE%\OneDrive\Documents\tools\ReduceMemory_x64.exe" /O
"%USERPROFILE%\Documents\tools\KillEmAll.exe" /auto
"%USERPROFILE%\Documents\tools\ReduceMemory_x64.exe" /O
"C:\Users\Bruce Kleinberg\OneDrive\CPM\New Folder\Tools\KillEmAll.exe" /auto
"C:\Users\Bruce Kleinberg\OneDrive\CPM\New Folder\Tools\ReduceMemory_x64.exe" /O
exit

I ran rename as admin, nothing observable happened.

That's fine, it should have flashed for a second, it only renamed a file.

 

[Difficult_Man]

Kill shortcut added to Start.

I don't understand what te rest of te post is for. Where am I to post these codes?

Also, since I ran rename many of my keys are not consistently working, particularly H, ', and Backspace. Coincidence?

 

[Malnutrition]

I don't understand what te rest of te post is for. Where am I to post these codes?

Never mind that, just run the batch file and let me know if it works as intended?

Also, since I ran rename many of my keys are not consistently working, particularly H, ', and Backspace. Coincidence?

I ran rename as admin, nothing observable happened.

That would have nothing to do with your keyboard, as your H button was working fine right after as evident in this post you made.

It only renamed Searchapp.exe

You can rename it back if you wish, but like I said this has nothing to do with a keyboard,

@echo off
takeown /f "c:\windows\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.bak"
icacls "c:\windows\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.bak" /grant Everyone:F
taskkill /F /IM "searchapp.exe"
rename "c:\windows\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.bak" "searchapp.exe"
exit

 

[Difficult_Man]

KIll.bat black window appeared, said selected path could not be found, closed all apps other than Chrome, window disappeared and shortly later Covenant Eyes booted/rebooted.

 

[Malnutrition]

Now everything is working!

selected path could not be found

That is due to the extra paths, all you need is this below in the kill.bat. If you wish, you can change kill.bat and the shortcut and the shorcut on the start menu.

Meaning open the C:\Users\Bruce Kleinberg\OneDrive\CPM\New Folder\Tools and right click Kill.bat edit and copy and paste this, create new shortcut and move that shortcut to start menu.


Or it's no big deal really, you can leave it as is, since it works fine that is up to you.

@echo off
"C:\Users\Bruce Kleinberg\OneDrive\CPM\New Folder\Tools\KillEmAll.exe" /auto
"C:\Users\Bruce Kleinberg\OneDrive\CPM\New Folder\Tools\ReduceMemory_x64.exe" /o
exit

---

---

As far as Covenant Eyes: You can stop it from running with this. Create this batch file and rename it CeDeny!.bat

@echo off

:: Kill existing processes
taskkill /F /IM "CEWD.exe"
taskkill /F /IM "CovenantEyes.exe"
taskkill /F /IM "covenanteyescommservice.exe"

:: Block CEWD.exe
icacls "C:\Program Files\CE\CEWD.exe" /inheritance:r
icacls "C:\Program Files\CE\CEWD.exe" /deny "*S-1-1-0:(X)"

:: Block CovenantEyes.exe
icacls "C:\Program Files\CE\CovenantEyes.exe" /inheritance:r
icacls "C:\Program Files\CE\CovenantEyes.exe" /deny "*S-1-1-0:(X)"

:: Block covenanteyescommservice.exe
icacls "c:\program files\ce\covenanteyescommservice.exe" /inheritance:r
icacls "c:\program files\ce\covenanteyescommservice.exe" /deny "*S-1-1-0:(X)"

:: Restart Explorer
taskkill /F /IM "explorer.exe"
start explorer.exe

echo CEWD.exe and CovenantEyes.exe & covenanteyescommservice.exe have been blocked and explorer restarted.
pause

 

[Difficult_Man]

1) I updated the code in Kill along w/the shortcuts. It closed three different applications instantly w/no error msgs. Covenant Eyes quickly reloaded. CE t is programmed to immediately reload if a user closes the program. Only the Administrator can close the program using the password. I am not inclined to change or get around this.

2) Am I correct in assuming that Kill, in addition to closing applications, also closes non-vital processes working in the background?

3) I suppose now I'll have to decide which programs go into the Allow list. I'll have to decide which programs I'll never want closed in this manner. Like, which programs I'm most likely to be in the middle of using when stalling and freezing occurs.