@echo off
title TreeIQ Anti-Malware - Complete Cleanup / Reset
setlocal

rem ============================================================================
rem  TreeIQ Anti-Malware — COMPLETE cleanup / reset tool.
rem  Double-click on the VM. It self-elevates, then removes EVERYTHING TreeIQ:
rem   - stops + deletes the JrAvService service and kills TQKrn/TQMon/TQAM
rem   - removes the Surf Guard browser policies (Chrome/Edge/Brave) + native host
rem   - removes the install folder, %ProgramData%\JR-AV (license, logs, state)
rem   - removes the watchdog scheduled task + the localhost URL reservation
rem   - re-enables Windows Defender real-time (undoes the coexistence policy)
rem  Touches ONLY TreeIQ keys/paths — nothing else on the machine.
rem  After it finishes: REBOOT, then install the new beta.
rem ============================================================================

rem ---- self-elevate to Administrator ----
net session >nul 2>&1
if %errorLevel% neq 0 (
  echo Requesting administrator rights...
  powershell -NoProfile -Command "Start-Process -FilePath '%~f0' -Verb RunAs"
  exit /b
)

echo.
echo ============================================================
echo   TreeIQ Anti-Malware - COMPLETE CLEANUP
echo   This removes TreeIQ entirely and resets the trial.
echo ============================================================
echo.
echo   Press ENTER to continue, or close this window to cancel.
pause >nul

echo.
echo [1/8] Stopping TreeIQ processes...
taskkill /f /im TQKrn.exe          >nul 2>&1
taskkill /f /im TQMon.exe          >nul 2>&1
taskkill /f /im TQAM.exe           >nul 2>&1
taskkill /f /im SurfGuardExtHost.exe >nul 2>&1

echo [2/8] Removing the JrAvService service...
sc stop   JrAvService >nul 2>&1
sc delete JrAvService >nul 2>&1

echo [3/8] Removing the watchdog scheduled task...
schtasks /Delete /TN "TreeIQ-Defender-Watchdog" /F >nul 2>&1

echo [4/8] Removing Surf Guard browser policies (Chrome / Edge / Brave)...
for %%B in ("Google\Chrome" "Microsoft\Edge" "BraveSoftware\Brave") do (
  reg delete "HKLM\SOFTWARE\Policies\%%~B\ExtensionSettings\iigfobcaodhkclggpleinobffjonlnoh" /f >nul 2>&1
  reg delete "HKLM\SOFTWARE\Policies\%%~B\ExtensionInstallAllowlist" /v 1001 /f >nul 2>&1
  reg delete "HKLM\SOFTWARE\Policies\%%~B\ExtensionInstallForcelist" /v 1001 /f >nul 2>&1
)
reg delete "HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.treeiq.surfguard"          /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Microsoft\Edge\NativeMessagingHosts\com.treeiq.surfguard"         /f >nul 2>&1
reg delete "HKLM\SOFTWARE\BraveSoftware\Brave-Browser\NativeMessagingHosts\com.treeiq.surfguard" /f >nul 2>&1
netsh http delete urlacl url=http://localhost:47563/surfguard/ >nul 2>&1

echo [5/8] Removing TreeIQ registry (license stamp, Run key, context menu, uninstall entry)...
reg delete "HKLM\SOFTWARE\TreeIQ" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "TreeIQ-Tray" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Classes\*\shell\TreeIQScan"         /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Classes\Directory\shell\TreeIQScan" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Classes\Drive\shell\TreeIQScan"     /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C1E4A2B7-8D53-4F19-A0C6-1A2B3C4D5E6F}_is1" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C1E4A2B7-8D53-4F19-A0C6-1A2B3C4D5E6F}_is1" /f >nul 2>&1

echo [6/8] Re-enabling Windows Defender real-time protection...
powershell -NoProfile -Command "try { $rt='HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection'; foreach($v in 'DisableRealtimeMonitoring','DisableBehaviorMonitoring','DisableIOAVProtection','DisableOnAccessProtection','DisableScanOnRealtimeEnable'){ Remove-ItemProperty -Path $rt -Name $v -ErrorAction SilentlyContinue }; Set-MpPreference -DisableRealtimeMonitoring $false -ErrorAction SilentlyContinue; gpupdate /force /target:computer | Out-Null } catch {}" >nul 2>&1

echo [7/8] Deleting the install folder and data...
rmdir /s /q "%ProgramFiles%\TQAV"      >nul 2>&1
rmdir /s /q "C:\Program Files\TQAV"     >nul 2>&1
rmdir /s /q "%ProgramData%\JR-AV"       >nul 2>&1

echo [8/8] Done.
echo.
echo ============================================================
echo   TreeIQ has been completely removed and the trial reset.
echo.
echo   NEXT:
echo     1. REBOOT this VM.
echo     2. Install the new beta:
echo        TreeIQ-Anti-Malware-Sciter-Beta-Setup.exe  (title must read 1.0.9.94)
echo     3. REBOOT again, then open Edge - Surf Guard should install.
echo ============================================================
echo.
pause
endlocal