Script to automate the removal of xhunter1.sys when found. Create a scheduled task that runs at start up as admin.

Remove-XHunter1.ps1

#Requires -Version 5.1 -RunAsAdministrator

function Remove-XHunter1 {
    param ()
    Stop-Service xhunter1 -Force -NoWait -Confirm:$false
    Remove-Item "HKLM:\SYSTEM\CurrentControlSet\Services\xhunter1" -ErrorAction SilentlyContinue
    Remove-Item -Path "C:\Windows\xhunter1.sys" -Force -ErrorAction SilentlyContinue
}

function Test-XHunter1 {
    param ()
    $(Get-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Services\xhunter1" -ErrorAction SilentlyContinue) -or
    $(Get-Service xhunter1 -ErrorAction SilentlyContinue) -or
    $(Test-Path -Path "C:\Windows\xhunter1.sys")
}

if (Test-XHunter1) {
    Remove-XHunter1
    if (Test-XHunter1) {
        Write-EventLog -LogName Application -Source "Remove-XHunter1.ps1" -EntryType Error -EventId 666 -Category "Removal" -Message "Failed to remove xhunter1.sys"
        exit 1
    }
    else {
        Write-EventLog -LogName Application -Source "Remove-XHunter1.ps1" -EntryType Warning -EventId 666 -Category "Removal" -Message "Removed xhunter1.sys"
        exit 0
    }
    
}
else {
    Write-EventLog -LogName Application -Source "Remove-XHunter1.ps1" -EntryType Information -EventId 666 -Category "Removal" -Message "xhunter1.sys was not found."
    exit 0
}