anchor.diff:  echo stage_1_tempclean>tron_stage.txt
   title TRON v%SCRIPT_VERSION% [stage_1_tempclean]
   call :log "%CUR_DATE% %TIME%   stage_1_tempclean jobs begin..."
  -
  -
  -:: JOB: Clean Internet Explorer; Windows built-in method. Only works on Vista and up
  -if /i not "%WIN_VER:~0,9%"=="Microsoft" (
  -	title TRON v%SCRIPT_VERSION% [stage_1_tempclean] [Clean Internet Explorer]
  -	call :log "%CUR_DATE% %TIME%    Launch job 'Clean Internet Explorer'..."
  -	if /i %DRY_RUN%==no rundll32.exe inetcpl.cpl,ClearMyTracksByProcess 4351
  -	call :log "%CUR_DATE% %TIME%    Done."
  -)
  -
  -
  -:: JOB: TempFileCleanup.bat
  -title TRON v%SCRIPT_VERSION% [stage_1_tempclean] [TempFileCleanup]
  -call :log "%CUR_DATE% %TIME%    Launch job 'TempFileCleanup'..."
  -if /i %DRY_RUN%==no call stage_1_tempclean\tempfilecleanup\TempFileCleanup.bat >> "%LOGPATH%\%LOGFILE%" 2>NUL
  -:: Reset window title since TempFileCleanup clobbers it
  -title TRON v%SCRIPT_VERSION% [stage_1_tempclean]
  -call :log "%CUR_DATE% %TIME%    Done."
  -
  -
  -:: JOB: CCLeaner
  -title TRON v%SCRIPT_VERSION% [stage_1_tempclean] [CCleaner]
  -call :log "%CUR_DATE% %TIME%    Launch job 'CCleaner'..."
  -if /i %DRY_RUN%==no (
  -	start "" /wait stage_1_tempclean\ccleaner\ccleaner.exe /auto>> "%LOGPATH%\%LOGFILE%" 2>NUL
  -	ping 127.0.0.1 -n 12 >NUL
  -	)
  -call :log "%CUR_DATE% %TIME%    Done."
  -
  -
  -:: JOB: BleachBit
  -title TRON v%SCRIPT_VERSION% [stage_1_tempclean] [BleachBit]
  -call :log "%CUR_DATE% %TIME%    Launch job 'BleachBit'..."
  -if /i %DRY_RUN%==no (
  -	if %VERBOSE%==yes stage_1_tempclean\bleachbit\bleachbit_console.exe -p --preset
  -	stage_1_tempclean\bleachbit\bleachbit_console.exe --preset -c >> "%LOGPATH%\%LOGFILE%" 2>NUL
  -	ping 127.0.0.1 -n 12 >NUL
  -	)
  -call :log "%CUR_DATE% %TIME%    Done."
  -
  -
  -:: JOB: USB Device Cleanup
  -title TRON v%SCRIPT_VERSION% [stage_1_tempclean] [USB Device Cleanup]
  -call :log "%CUR_DATE% %TIME%    Launch job 'USB Device Cleanup'..."
  -if /i %DRY_RUN%==no (
  -if /i '%PROCESSOR_ARCHITECTURE%'=='AMD64' (
  -	if %VERBOSE%==yes "stage_1_tempclean\usb_cleanup\DriveCleanup x64.exe" -t -n
  -	"stage_1_tempclean\usb_cleanup\DriveCleanup x64.exe" -n >> "%LOGPATH%\%LOGFILE%" 2>NUL
  -) else (
  -	if %VERBOSE%==yes "stage_1_tempclean\usb_cleanup\DriveCleanup x86.exe" -t -n
  -	"stage_1_tempclean\usb_cleanup\DriveCleanup x86.exe" -n >> "%LOGPATH%\%LOGFILE%" 2>NUL
  -	)
  -)
  -call :log "%CUR_DATE% %TIME%    Done."
  -
  -
  -:: JOB: Clear Windows event logs
  -title TRON v%SCRIPT_VERSION% [stage_1_tempclean] [Clear Windows Event Logs]
  -call :log "%CUR_DATE% %TIME%    Launch job 'Clear Windows event logs'..."
  -if /i %SKIP_EVENT_LOG_CLEAR%==yes (
  -	call :log "%CUR_DATE% %TIME% ! SKIP_EVENT_LOG_CLEAR ^(-se^) set. Skipping Event Log clear."
  -	goto skip_event_log_clear
  -	)
  -call :log "%CUR_DATE% %TIME%    Saving logs to "%BACKUPS%" first..."
  -:: Backup all logs first. Redirect error output to NUL (2>nul) because due to the way WMI formats lists, there is
  -:: a trailing blank line which messes up the last iteration of the FOR loop, but we can safely suppress errors from it
  -SETLOCAL ENABLEDELAYEDEXPANSION
  -if /i %DRY_RUN%==no for /f %%i in ('%WMIC% nteventlog where "filename like '%%'" list instance') do %WMIC% nteventlog where "filename like '%%%%i%%'" backupeventlog "%BACKUPS%\%%i.evt" >> "%LOGPATH%\%LOGFILE%" 2>NUL
  -ENDLOCAL DISABLEDELAYEDEXPANSION
  -call :log "%CUR_DATE% %TIME%    Backups done, now clearing..."
  -:: Clear the logs
  -if /i %DRY_RUN%==no %WMIC% nteventlog where "filename like '%%'" cleareventlog >> "%LOGPATH%\%LOGFILE%"
  -:: Alternate Vista-and-up only method
  -:: if /i %DRY_RUN%==no for /f %%x in ('wevtutil el') do wevtutil cl "%%x" 2>NUL
  -
  -call :log "%CUR_DATE% %TIME%    Done."
  -:skip_event_log_clear
  -
  -
  -
  -:: JOB: Clear Windows Update cache
  -title TRON v%SCRIPT_VERSION% [stage_1_tempclean] [Clear Windows Update cache]
  -call :log "%CUR_DATE% %TIME%    Launch job 'Clear Windows Update cache'..."
  -if /i %DRY_RUN%==no (
  -	:: Allow us to start the service in Safe Mode. Thanks to /u/GrizzlyWinter
  -	reg add "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\%SAFEBOOT_OPTION%\WUAUSERV" /ve /t reg_sz /d Service /f >> "%LOGPATH%\%LOGFILE%" 2>&1
  -	net stop WUAUSERV >> "%LOGPATH%\%LOGFILE%" 2>&1
  -	if exist %windir%\softwaredistribution\download rmdir /s /q %windir%\softwaredistribution\download >> "%LOGPATH%\%LOGFILE%" 2>&1
  -	net start WUAUSERV >> "%LOGPATH%\%LOGFILE%" 2>&1
  -	)
  -call :log "%CUR_DATE% %TIME%    Done."
  -
  -
  +call stage_1_tempclean\stage_1_tempclean.bat
   call :log "%CUR_DATE% %TIME%   stage_1_tempclean jobs complete."
   
   
  
positive.code: echo stage_4_repair>tron_stage.txt
  title TRON v%SCRIPT_VERSION% [stage_4_repair]
  call :log "%CUR_DATE% %TIME%   stage_4_repair jobs begin..."
  
  
  :: JOB: Check Windows Image for corruptions before running SFC (Windows 8 and up)
  :: Thanks to /u/nomaddave
  title TRON v%SCRIPT_VERSION% [stage_3_disinfect] [DISM Check]
  call :log "%CUR_DATE% %TIME%    Launch job 'Dism Windows image check (Win8 and up)'..."
  if /i %DRY_RUN%==yes goto skip_dism_image_check
  
  :: Read WIN_VER and run the scan if we're on 8 or above
  if "%WIN_VER:~0,19%"=="Windows Server 2012" (
  	Dism /Online /NoRestart /Cleanup-Image /ScanHealth /Logpath:"%LOGPATH%\tron_dism.log"
  	type "%LOGPATH%\tron_dism.log" >> "%LOGPATH%\%LOGFILE%"
  	del /f /q "%LOGPATH%\tron_dism.log"
  	)
  if "%WIN_VER:~0,9%"=="Windows 8" (
  	Dism /Online /NoRestart /Cleanup-Image /ScanHealth /Logpath:"%LOGPATH%\tron_dism.log"
  	type "%LOGPATH%\tron_dism.log" >> "%LOGPATH%\%LOGFILE%"
  	del /f /q "%LOGPATH%\tron_dism.log"
  	)
  if "%WIN_VER:~0,9%"=="Windows 1" (
  	Dism /Online /NoRestart /Cleanup-Image /ScanHealth /Logpath:"%LOGPATH%\tron_dism.log"
  	type "%LOGPATH%\tron_dism.log" >> "%LOGPATH%\%LOGFILE%"
  	del /f /q "%LOGPATH%\tron_dism.log"
  	)
  
  :: If we detect errors try to repair them
  if /i not %ERRORLEVEL%==0 (
  	title TRON v%SCRIPT_VERSION% [stage_3_disinfect] [DISM Repair]
  	if "%WIN_VER:~0,19%"=="Windows Server 2012" (
  		call :log "%CUR_DATE% %TIME% !  DISM: Image corruption detected. Attempting repair..."
  		:: Add /LimitAccess flag to this command to prevent connecting to Windows Update for replacement files
  		Dism /Online /NoRestart /Cleanup-Image /RestoreHealth /Logpath:"%LOGPATH%\tron_dism.log"
  		type "%LOGPATH%\tron_dism.log" >> "%LOGPATH%\%LOGFILE%"
  		)
  	if "%WIN_VER:~0,9%"=="Windows 8" (
  		call :log "%CUR_DATE% %TIME% !  DISM: Image corruption detected. Attempting repair..."
  		:: Add /LimitAccess flag to this command to prevent connecting to Windows Update for replacement files
  		Dism /Online /NoRestart /Cleanup-Image /RestoreHealth /Logpath:"%LOGPATH%\tron_dism.log"
  		type "%LOGPATH%\tron_dism.log" >> "%LOGPATH%\%LOGFILE%"
  		)
  	if "%WIN_VER:~0,9%"=="Windows 1" (
  		call :log "%CUR_DATE% %TIME% !  DISM: Image corruption detected. Attempting repair..."
  		:: Add /LimitAccess flag to this command to prevent connecting to Windows Update for replacement files
  		Dism /Online /NoRestart /Cleanup-Image /RestoreHealth /Logpath:"%LOGPATH%\tron_dism.log"
  		type "%LOGPATH%\tron_dism.log" >> "%LOGPATH%\%LOGFILE%"
  	) else (
  		call :log "%CUR_DATE% %TIME%    DISM: No image corruption detected."
  	)
  )
  
  :skip_dism_image_check
  call :log "%CUR_DATE% %TIME%    Done."
  
  
  
  :: JOB: Reset registry permissions
  title TRON v%SCRIPT_VERSION% [stage_4_repair] [Reset registry permissions]
  if /i %SKIP_REGPERMS_RESET%==no (
  	call :log "%CUR_DATE% %TIME%    Resetting registry permissions..."
  	call :log "%CUR_DATE% %TIME%    THIS WILL TAKE A LONG TIME - BE PATIENT"
  	call :log "%CUR_DATE% %TIME%    You can ignore errors here. Raw logs saved to "%RAW_LOGS%\""
  	if /i %DRY_RUN%==no call "stage_4_repair\reset_registry_and_file_permissions\reset_registry_permissions.bat"
  	call :log "%CUR_DATE% %TIME%    Done."
  ) else (
  	call :log "%CUR_DATE% %TIME% !  SKIP_REGPERMS_RESET (-srr) set. Skipping registry and file permissions reset"
  )
  
  
  :: JOB: Reset filesystem permissions
  title TRON v%SCRIPT_VERSION% [stage_4_repair] [Reset filesystem permissions]
  if /i %SKIP_FILEPERMS_RESET%==no (
  	call :log "%CUR_DATE% %TIME%    Resetting filesystem permissions in the Windows system directory..."
  	call :log "%CUR_DATE% %TIME%    THIS WILL TAKE A LONG TIME - BE PATIENT"
  	call :log "%CUR_DATE% %TIME%    You can ignore errors here. Raw logs saved to "%RAW_LOGS%\""
  	if /i %DRY_RUN%==no call "stage_4_repair\reset_registry_and_file_permissions\reset_file_permissions.bat"
  	call :log "%CUR_DATE% %TIME%    Done."
  ) else (
  	call :log "%CUR_DATE% %TIME% !  SKIP_FILEPERMS_RESET (-sfr) set. Skipping registry and file permissions reset"
  )
  
  
  :: JOB: System File Checker (SFC) scan
  title TRON v%SCRIPT_VERSION% [stage_4_repair] [SFC Scan]
  call :log "%CUR_DATE% %TIME%    Launch job 'System File Checker'..."
  if /i %DRY_RUN%==yes goto skip_sfc
  :: Basically this says "If OS is NOT XP or 2003, go ahead and run system file checker." We skip SFC on XP/2k3 because it forces a reboot
  if /i not "%WIN_VER:~0,9%"=="Microsoft" %SystemRoot%\System32\sfc.exe /scannow
  %SystemRoot%\System32\findstr.exe /c:"[SR]" %SystemRoot%\logs\cbs\cbs.log>> "%LOGPATH%\%LOGFILE%" 2>NUL
  :skip_sfc
  call :log "%CUR_DATE% %TIME%    Done."
  
  
  :: JOB: chkdsk the system drive
  title TRON v%SCRIPT_VERSION% [stage_4_repair] [chkdsk]
  call :log "%CUR_DATE% %TIME%    Launch job 'chkdsk'..."
  call :log "%CUR_DATE% %TIME%    Checking %SystemDrive% for errors..."
  :: Run a read-only scan and look for errors. Schedule a scan at next reboot if errors found
  if /i %DRY_RUN%==no %SystemRoot%\System32\chkdsk.exe %SystemDrive%
  if /i not %ERRORLEVEL%==0 (
  	call :log "%CUR_DATE% %TIME% !  Errors found on %SystemDrive%. Scheduling full chkdsk at next reboot."
  	if /i %DRY_RUN%==no fsutil dirty set %SystemDrive%
  ) else (
  	call :log "%CUR_DATE% %TIME%    No errors found on %SystemDrive%. Skipping full chkdsk at next reboot."
  	)
  call :log "%CUR_DATE% %TIME%    Done."
  
  
  :: JOB: Kill Microsoft telemetry (user tracking)
  title TRON v%SCRIPT_VERSION% [stage_4_repair] [kill-telemetry]
  if /i %SKIP_TELEMETRY_REMOVAL%==yes (
  	call :log "%CUR_DATE% %TIME% !  SKIP_TELEMETRY_REMOVAL (-str) set. Disabling Microsoft telemetry (user tracking) instead of purging"
  	REM Only disable telemetry, don't completely purge it
  	reg import stage_4_repair\purge_windows_telemetry\disable_telemetry_registry_entries.reg >nul 2>&1
  	regedit /S stage_4_repair\purge_windows_telemetry\disable_telemetry_registry_entries.reg >nul 2>&1
  	goto skip_telem_removal
  )
  
  :: Windows 10 version
  if /i "%WIN_VER:~0,9%"=="Windows 1" (
  	call :log "%CUR_DATE% %TIME%    Launch job 'Kill Microsoft telemetry (user tracking) (Win10)'..."
  	call :log "%CUR_DATE% %TIME% !  THIS TAKES A WHILE - BE PATIENT!!"
  	if /i %DRY_RUN%==no (
  		REM Normally I try to embed everything directly, but it was quite a bit of code so it's in an external script to avoid bloating tron.bat too much
  		if /i %DRY_RUN%==no call stage_4_repair\purge_windows_telemetry\purge_windows_10_telemetry.bat >> "%LOGPATH%\%LOGFILE%" 2>NUL
  	)
  call :log "%CUR_DATE% %TIME%    Done. Enjoy your privacy."
  )
  
  :: Spawn temporary variable to check for Win7 and 8. Ugly hack but at least it works
  set RUN_7_OR_8_TELEM=no
  if /i "%WIN_VER:~0,9%"=="Windows 7" set RUN_7_OR_8_TELEM=yes
  if /i "%WIN_VER:~0,9%"=="Windows 8" set RUN_7_OR_8_TELEM=yes
  
  if /i "%RUN_7_OR_8_TELEM%"=="yes" (
  	call :log "%CUR_DATE% %TIME%    Launch job 'Kill Microsoft telemetry (user tracking) (Win7/8/8.1)'..."
  	if /i %DRY_RUN%==no (
  		REM :::::::::::::::::::::::::::::::::::::::::::::
  		REM UPDATES
  
  		REM Compatibility update for Windows 7 (is a scanner)
  		wusa /uninstall /kb:2977759 /quiet /norestart
  
  		REM Compatibility update for Windows 7
  		wusa /uninstall /kb:2952664 /quiet /norestart
  
  		REM Compatibility update for Windows 8.1 and Windows 8
  		wusa /uninstall /kb:2976978 /quiet /norestart
  
  		REM New update client for Windows 7
  		wusa /uninstall /kb:3083710 /quiet /norestart
  
  		REM New update client for Windows 8/8.1
  		wusa /uninstall /kb:3083711 /quiet /norestart
  
  		REM Update that enables you to upgrade from Windows 7 to a later version of Windows
  		wusa /uninstall /kb:2990214 /quiet /norestart
  
  		REM Customer Experience and Diagnostic Telemetry-related updates
  		wusa /uninstall /kb:3022345 /quiet /norestart
  		wusa /uninstall /kb:3068708 /quiet /norestart
  		wusa /uninstall /kb:3080149 /quiet /norestart
  		wusa /uninstall /kb:3021917 /quiet /norestart
  
  		REM Adds telemetry points to consent.exe in Windows 8.1 and Windows 7
  		wusa /uninstall /kb:3075249 /quiet /norestart
  		wusa /uninstall /kb:3015249 /quiet /norestart
  
  		REM "Get Windows 10" nagger in Windows 8.1 and Windows 7 SP1
  		wusa /uninstall /kb:3035583 /quiet /norestart
  
  		REM Enable upgrade from Windows 8.1 to Windows 10
  		wusa /uninstall /kb:3044374 /quiet /norestart
  
  		REM Description of the update for Windows Activation Technologies
  		wusa /uninstall /kb:971033 /quiet /norestart
  
  		REM Descriptions not available, update was pulled by Microsoft
  		wusa /uninstall /kb:2902907 /quiet /norestart
  		wusa /uninstall /kb:2922324 /quiet /norestart
  
  
  		REM :::::::::::::::::::::::::::::::::::::::::::::
  		REM BLOCK BAD UPDATES
  		start "" /b /wait cscript.exe "stage_4_repair\purge_windows_telemetry\block_windows_updates.vbs" 2977759 2952664 2976978 3083710 3083711 2990214 3022345 3068708 3080149 3021917 3075249 3015249 3035583 3044374 971033 2902907 2922324
  
  
  		REM :::::::::::::::::::::::::::::::::::::::::::::
  		REM SCHEDULED TASKS
  		schtasks /delete /F /TN "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser"
  		schtasks /delete /F /TN "\Microsoft\Windows\Application Experience\ProgramDataUpdater"
  		schtasks /delete /F /TN "\Microsoft\Windows\Autochk\Proxy"
  		schtasks /delete /F /TN "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator"
  		schtasks /delete /F /TN "\Microsoft\Windows\Customer Experience Improvement Program\KernelCeipTask"
  		schtasks /delete /F /TN "\Microsoft\Windows\Customer Experience Improvement Program\UsbCeip"
  		schtasks /delete /F /TN "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector"
  		schtasks /delete /F /TN "\Microsoft\Windows\PI\Sqm-Tasks"
  		schtasks /delete /F /TN "\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem"
  		schtasks /delete /F /TN "\Microsoft\Windows\Windows Error Reporting\QueueReporting"
  
  
  		REM :::::::::::::::::::::::::::::::::::::::::::::
  		REM SERVICES
  		REM Diagnostic Tracking
  		sc stop Diagtrack >nul 2>&1
  		sc delete Diagtrack >nul 2>&1
  
  		REM Remote Registry (disable only)
  		sc config remoteregistry start= disabled >nul 2>&1
  		sc stop remoteregistry >nul 2>&1
  
  
  		REM :::::::::::::::::::::::::::::::::::::::::::::
  		REM MISC
  		REM Kill pending tracking reports
  		if not exist %ProgramData%\Microsoft\Diagnosis\ETLLogs\AutoLogger\ mkdir %ProgramData%\Microsoft\Diagnosis\ETLLogs\AutoLogger\
  		echo. > %ProgramData%\Microsoft\Diagnosis\ETLLogs\AutoLogger\AutoLogger-Diagtrack-Listener.etl 2>NUL
  		echo y|cacls.exe "%programdata%\Microsoft\Diagnosis\ETLLogs\AutoLogger\AutoLogger-Diagtrack-Listener.etl" /d SYSTEM 2>NUL
  
  		REM Disable telemetry via master registry key
  		reg import stage_4_repair\purge_windows_telemetry\purge_windows_10_telemetry_registry_entries.reg >nul 2>&1
  		regedit /S stage_4_repair\purge_windows_telemetry\purge_windows_10_telemetry_registry_entries.reg >nul 2>&1
  
  	)
  call :log "%CUR_DATE% %TIME%    Done. Enjoy your privacy."
  )
  
  :skip_telem_removal
  
  
  
  :: JOB: DISM cleanup. After this no updates or service packs can be uninstalled (new updates/SP's can still be installed)
  call :log "%CUR_DATE% %TIME%    Running DISM cleanup against unused binaries..."
  :: Thanks to reddit.com/user/nommaddave
  if /i %DRY_RUN%==no Dism /Online /Cleanup-Image /StartComponentCleanup /Logpath:"%LOGPATH%\tron_dism.log"
  call :log "%CUR_DATE% %TIME%    Done."
  
  
  :: JOB: Network repair (minor). Thanks to /u/chinpopocortez
  title TRON v%SCRIPT_VERSION% [stage_4_repair] [winsock_reset]
  call :log "%CUR_DATE% %TIME%    Launch job 'Network repair'..."
  if /i %DRY_RUN%==no (
  	ipconfig /flushdns >> "%LOGPATH%\%LOGFILE%" 2>&1
  	:: Below command probably not necessary, but just in case there are dodgy static ARP entries
  	netsh interface ip delete arpcache >> "%LOGPATH%\%LOGFILE%" 2>&1
  	netsh winsock reset catalog >> "%LOGPATH%\%LOGFILE%" 2>&1
  )
  call :log "%CUR_DATE% %TIME%    Done."
  
  
  :: JOB: Repair file extensions. Thanks to /u/chinpopocortez
  title TRON v%SCRIPT_VERSION% [stage_4_repair] [repair file extensions]
  call :log "%CUR_DATE% %TIME%    Launch job 'Repair file extensions'..."
  if /i %DRY_RUN%==no (
  	setlocal
  	call stage_4_repair\repair_file_extensions\repair_file_extensions.bat
  	endlocal
  )
  call :log "%CUR_DATE% %TIME%    Done."
  
  
  call :log "%CUR_DATE% %TIME%   stage_4_repair jobs complete."
  
  
  
  
negative.code: :: STAGE 5: Patches ::
  ::::::::::::::::::::::
  :stage_5_patch
  :: Stamp current stage so we can resume if we get interrupted by a reboot
  echo stage_5_patch>tron_stage.txt
  title TRON v%SCRIPT_VERSION% [stage_5_patch]
  call :log "%CUR_DATE% %TIME%   stage_5_patch jobs begin..."
  call stage_5_patch\stage_5_patch.bat
  call :log "%CUR_DATE% %TIME%   stage_5_patch jobs complete."
  
  
  