richardg867

#
# This Python 3 script disinfects Windows executables modified by the
# Chinese "Synaptics" worm. It was developed with only one sample of
# the worm as a basis, but it should work on any sample, as long as
# it didn't mess with the way I detect the stub and extract the EXE.
#
#   $ python desynaptics.py file_or_directory_path
#
# If you're running this script under Windows, I highly recommend
# disabling Windows Defender and other antivirus software, as well as

richardg867

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\DownloadCenter]

[HKEY_LOCAL_MACHINE\SOFTWARE\DownloadCenter\Sub]
"Google Chrome (R) a faster way to browse the web"="9223372036854775807"
"Google Drive"="9223372036854775807"
"Google Toolbar for Internet Explorer"="9223372036854775807"
"Norton Internet Security(NIS)"="9223372036854775807"

richardg867

Get-ChildItem -Path "hkcu:\Software\Classes" | ForEach-Object { Get-ChildItem "Registry::$($_.Name)\shell\" -ErrorAction ignore | Where-Object { $_.Name.split("\")[-1] -like "NCH*" } | ForEach-Object { Remove-Item "Registry::$($_.Name)" -Recurse } }

richardg867

#
# Comic Chat fixer MITM proxy: fixes Comic Chat to (sort of) work with modern
# IRC servers. Tested with Microsoft Chat 2.5 on Windows XP, 8 and 10
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
# 
# This program is distributed in the hope that it will be useful,