Sunday, March 9, 2008

McAfee technical quarry-part 15

BFU - Brute Force Uninstaller

Written by Merijn - http://www.merijn.org/

Description

BFU is a scripting program that can execute a series of preset commands like a Windows batch file, aimed at uninstalled programs that are hard to remove, uninstall improperly or simply unwanted. There are available options to let the script execution manage files, folders, ini files, Registry keys and values, hosts file content, processes loaded in memory, dll files, NT services and Winsock components. Message boxes can be displayed, the system can be rebooted, the Recycle Bin can be used for delete operations and programs can be started. Options for the script itself include unloading the shell (i.e. killing the Explorer.exe process), pausing between commands (or all commands) and setting a minimum required version number for BFU itself to be able to run the script. BFU itself does not store anything on the system and is uninstalled simply by deleting it.

A script can be activated by either downloading the script file (.bfu) and loading it into BFU by means of the 'select scriptfile' button, OR by downloading it directly into BFU with the 'open script url' button. When using the latter option, the scriptfile will be downloaded by BFU and saved on the system before loading it.

Command syntax

The format of the command is very simple, but has a few notes:

||

The is one of the list below, the amount and format (text, number) of arguments depends on the command.

The pipes (|) between the arguments are needed, as they determine how BFU interprets which argument represents what.

For example, if the SystemRun command is used to launch a program without any parameters but it still needs to be hidden from the user's view (default is 1, show it), the command would be:

SystemRun c:\windows\notepad.exe||0

The second argument is empty, but the third is not. The second pipe must not be omitted, or the 0 would be interpreted as parameter for Notepad and the window would be shown.

Whenever brackets are used in the 'Syntax' lines below, this means any of the items seperated by the pipes between them can be used. The brackets should not be used in scripts. For example, when the syntax for a command is DllRegister c:\file.dll|[0|1], this means either DllRegister c:\file.dll|0 or DllRegister c:\file.dll|1 can be used.

Writing scripts

The 'open script' dialog filters on *.bfu. A .bfu script file is plaintext, commands are not case-sensitive (though parameters can be, case depending). The order of commands can be anything, but it is recommended to put script options at the top and a system restart at the end. Any lines that do not start with a recognized command are ignored, but for readability comments should be easily recognizable, for example by starting them with a certain character (', #, //, /*,