BFU - Brute Force Uninstaller
Written by Merijn - http://www.merijn.org/
Last updated: Nov 4, 2005

Description
BFU is a scripting program that can execute a series of preset commands like a Windows batch file, aimed at uninstalled programs that are hard to remove, uninstall improperly or simply unwanted. There are available options to let the script execution manage files, folders, ini files, Registry keys and values, hosts file content, processes loaded in memory, dll files, NT services and Winsock components. Message boxes can be displayed, the system can be rebooted, the Recycle Bin can be used for delete operations and programs can be started. Options for the script itself include unloading the shell (i.e. killing the Explorer.exe process), pausing between commands (or all commands) and setting a minimum required version number for BFU itself to be able to run the script. BFU itself does not store anything on the system and is uninstalled simply by deleting it.

A script can be activated by either downloading the script file (.bfu) and loading it into BFU by means of the 'select scriptfile' button, OR by downloading it directly into BFU with the 'open script url' button. When using the latter option, the scriptfile will be downloaded by BFU and saved on the system before loading it.

Command syntax
The format of the command is very simple, but has a few notes:
<Command> <arg1>|<arg2>|<arg3>

The <Command> is one of the list below, the amount and format (text, number) of arguments depends on the command.

The pipes (|) between the arguments are needed, as they determine how BFU interprets which argument represents what.
For example, if the SystemRun command is used to launch a program without any parameters but it still needs to be hidden from the user's view (default is 1, show it), the command would be:

SystemRun c:\windows\notepad.exe||0

The second argument is empty, but the third is not. The second pipe must not be omitted, or the 0 would be interpreted as parameter for Notepad and the window would be shown.

Whenever brackets are used in the 'Syntax' lines below, this means any of the items seperated by the pipes between them can be used. The brackets should not be used in scripts. For example, when the syntax for a command is DllRegister c:\file.dll|[0|1], this means either DllRegister c:\file.dll|0 or DllRegister c:\file.dll|1 can be used.

Writing scripts
The 'open script' dialog filters on *.bfu. A .bfu script file is plaintext, commands are not case-sensitive (though parameters can be, case depending). The order of commands can be anything, but it is recommended to put script options at the top and a system restart at the end. Any lines that do not start with a recognized command are ignored, but for readability comments should be easily recognizable, for example by starting them with a certain character (', #, //, /*, <!--, whatever you like).

The root keys for the Registry commands are abbreviated:
HKCR: HKEY_CLASSES_ROOT
HKCU: HKEY_CURRENT_USER
HKLM: HKEY_LOCAL_MACHINE
HKUS: HKEY_USERS
HKCC: HKEY_CURRENT_CONFIG
HKPD: HKEY_PERFORMANCE_DATA
HKDD: HKEY_DYNAMIC_DATA

Available aliases for system folders are:
%SYSTEMDRIVE%		- Drive containing the Windows folder (e.g. 'c:')
%WINDIR%			- Windows folder
%SYSDIR%			- Windows system folder
%TEMPDIR%			- Temporary files folder
%PROGRAMFILES%		- Program Files
%DESKTOP%			- Desktop
%MYDOCUMENTS%		- My Documents
%FAVORITES%		- Favorites
%STARTMENU%		- Start Menu root
%STARTUP%			- Startup folder in Start Menu
%PROGRAMS%		- Programs folder in Start Menu
%APPDATA%			- Application Data
%QUICKLAUNCH%		- QuickLaunch folder in Application Data folder
%ALLUSERSDESKTOP%	- All Users (Common) Desktop
%ALLUSERSFAVORITES%	- All Users (Common) Favorites
%ALLUSERSSTARTMENU%	- All Users (Common) Start Menu
%ALLUSERSSTARTUP%	- All Users (Common) Startup folder in Start Menu
%ALLUSERSPROGRAMS%	- All Users (Common) Programs folder in Start Menu
%ALLUSERSAPPDATA%	- All Users (Common) Application Data
%COMPUTERNAME%		- Name of the system
%USERNAME%		- Currently logged on username

Additional system aliases such as %USERPROFILE% are also expanded, if they exist on the system.

An option for validating the CRC32 checksum of a script is available that will display the checksum and ask for confirmation. This checksum can be provided with the script (not IN the script of course) on a webpage or as part of the script's filename for example. This can be used to verify the script file was downloaded correctly.

Available commands
NB: all commands are independent of Windows version, unless specifically noted.

OptionUnloadShell
Kills the Explorer shell before executing further commands. Be warned, on Windows NT4, 2000 and XP, Explorer will automatically reload after a few seconds.
Syntax: OptionUnloadShell

OptionUseRecycleBin
Makes all FileDelete and FolderDelete commands move items into the Recycle Bin instead of deleting directly.
Syntax: OptionUseRecycleBin

OptionPauseBetweenCmds
Waits the specified amounts of time, in milliseconds, between commands. Not recommended to use together with OptionUnloadShell.
Syntax: OptionPauseBetweenCmds 500

OptionPauseNow
Waits the specified amounts of time, in milliseconds, once only
Syntax: OptionPauseNow 500.

OptionBFUMinVersion
Will not execute the script if the specified version is newer than the current version.
Syntax: OptionBFUMinVersion 1000000 (meaning 1.00.0000)

OptionCalcScriptCRC32
This will make BFU calculate the CRC32 checksum of the script file loaded and prompt the user for confirmation before continuing.
Syntax: OptionCalcScriptCRC32

OptionSetStatus
Sets the current script status, instead of the default status (which displays the current script line). Can be used wherever in a script.
Syntax: OptionSetStatus Cleaning up Registry...

OptionOnDeleteFailUseReboot
If this option is set, if deleting a file using FileDelete fails, BFU will make Windows attempt to delete the file on a reboot. Note that when a file is set for deletion on reboot, it will not be moved to the Recycle Bin regardless of the OptionUseRecycleBin option.
Syntax: OptionOnDeleteFailUseReboot

OptionRunSilent
With this option set, BFU will run completely hidden (no window visible) and not display message boxes, excluding the 'reboot?' confirmation dialog. 
Syntax: OptionRunSilent

OptionSetBFURunOnReboot
Set a BFU script to run when the system is next restarted. The RunOnceEx key is used for this. It is recommended to use the OptionRunSilent option together with this option, so BFU auto-exits on script completion. If a full path to the script is not provided, BFU assumes the script is in the same folder as the BFU.exe file.
Syntax: OptionSetBFURunOnReboot onreboot.bfu

OptionBFUExit
Quits BFU without executing any further commands. No user intervention required.
Syntax: OptionBFUExit

--------------------------------------

SystemMsgBox
Shows an information messagebox with text in it. The code '\n' will be replaced with a carriage return.
Syntax: SystemMsgBox text to display

SystemRun
Runs a program. The boolean at the end specifies if the program should be hidden (0) or shown (1, default).
Syntax: SystemRun c:|program.exe|parameters|[0|1]

SystemResetWebSettings
Resets the IE Web Settings to the default values.
Syntax: SystemResetWebSettings

SystemEmptyRecycleBin
Empties the Recycle Bin (on all drives) without user intervention.
Syntax: SystemEmptyRecycleBin

SystemEmptyInternetCache
Empties the Internet Explorer cache.
Syntax: SystemEmptyInternetCache

SystemEmptyTempFolder
Empties the content of the current user's temp folder, as well as the Windows\temp folder.
Syntax: SystemEmptyTempFolder

SystemRestart
Shows the 'system settings have changed. reboot?' message box. Text can be added to the default. The boolean at the and specifies if apps that are not responding should be ended forcefully (1) or not (0, default).
Syntax: SystemRestart extra text|[0|1]

SystemRestartIfNeeded
The same command as above, but is only processed if a system restart is needed, i.e. if 1) a Winsock LSP has been removed, 2) a Service has been deleted, 3) a file has been marked for deletion on reboot, or 4) a BFU script has been setup to run at the next reboot.
Syntax: SystemRestartIfNeeded extra text|[0|1]

--------------------------------------

DllRegister
Registers the dll by calling it's DllRegisterServer export. The boolean specifies whether the call should be done silent (1, default) or not (0).
Syntax: DllRegister c:\file.dll|[0|1]

DllUnregister
Unregisters a dll by calling it's DllUnregisterServer export. The boolean specifies whether the call should be done silent (1, default) or not (0).
Syntax: DllUnregister c:\file.dll|[0|1]

--------------------------------------

FileCreate
Creates a blank file, if it doesn't exist.
Syntax: FileCreate c:\file.ext

FileDelete
Deletes a file, if it exists. See also OptionUseRecycleBin. Wildcards supported.
Synta: FileDelete c:\file.ext

FileRename
Renames a file. Both paths must be specified, and both paths must be the same.
Syntax: FileRename c:\file.ext|c:\newfile.ext

FileMove
Moves a file. Note: conditional commands similar to those for FileDelete are available for FileMove: FileMoveIfMD5Match, FileMoveIfSHA1Match, FileMoveIfMD2Match, FileMoveIfMD4Match, FileMoveIfCRC32Match, FileMoveIfContainsText and FileMoveIfContainsHex. See below at FileDeleteIf... for examples.
Syntax: FileMove c:\file.ext|c:\windows
Syntax: FileMoveIfMD5Match c:\file.ext|A1D7304A87FC3093150F5E3CC7B0F338
Syntax: FileMoveIfContainsText c:\file.ext|c:\windows|UPX v1.20!

FileClear
Clears a file from all of its contents.
Syntax: FileClear c:\file.ext

FileSetAttributes
Sets the specified attributes on a file. R = read-only, A = archive, S = system, H = hidden. 'Compressed' attribute not supported.
Syntax: FileSetAttributes c:\file.ext|RA

FileDeleteOnReboot
Marks the file for deletion when the system is next restarted. Wildcards supported.
Syntax: FileDeleteOnReboot c:\file.ext

FileDeleteIfMD5Match
Calculates the MD5 checksum of the given file and matches it against the given MD5 checksum. If the two checksums match, the file is deleted. Wildcards supported.
Syntax: FileDeleteIfMD5Match c:\file.ext|A1D7304A87FC3093150F5E3CC7B0F338

FileDeleteIfSHA1Match
Calculates the SHA1 checksum of the given file and matches it against the given SHA1 checksum. If the two checksums match, the file is deleted. Wildcards supported.
Syntax: FileDeleteIfSHA1Match c:\file.ext|DA39A3EE5E6B4B0D3255BFEF95601890AFD80709

FileDeleteIfMD2Match
Calculates the MD2 checksum of the given file and matches it against the given MD2 checksum. If the two checksums match, the file is deleted. Wildcards supported.
Syntax: FileDeleteIfMD2Match c:\file.ext|8350E5A3E24C153DF2275C9F80692773

FileDeleteIfMD4Match
Calculates the MD4 checksum of the given file and matches it against the given MD4 checksum. If the two checksums match, the file is deleted. Wildcards supported.
Syntax: FileDeleteIfMD4Match c:\file.ext|31D6CFE0D16AE931B73C59D7E0C089C0

FileDeleteIfCRC32Match
Calculates the CRC32 checksum of the given file and matches it against the given CRC32 checksum. If the two checksums match, the file is deleted. Wildcards supported.
Syntax: FileDeleteIfCRC32Match c:\file.ext|CD044977

FileDeleteIfContainsText
Searches the file for a given string of text. If the string is found, the file is deleted. Wildcards supported.
Syntax: FileDeleteIfContainsText c:\file.ext|UPX v1.20!

FileDeleteIfContainsHex
Searches the file for a given (comma-seperated) hexadecimal sequence and deletes the file if found. Similar to the above command, but useful if non-displayable high-ASCII (or low-ASCII) characters are in the target string. Wildcards supported.
Syntax: FileDeleteIfContainsHex c:\file.ext|0A,DE,AD,BE,EF

FileWrite
Writes the specified text to a file. This cannot be binary data, only string data. The boolean specifies of the file should be cleared first (overwrite, 1) or not (append, 0, default).
Syntax: FileWrite c:\file.ext|blablabla|[0|1]

--------------------------------------

FolderCreate
Create a folder, if it doesn't already exist.
Syntax: FolderCreate c:\dummy

FolderDelete
Deletes a folder and all of its contents. See also OptionUseRecycleBin.
Syntax: FolderDelete c:\dummy

FolderRename
Renames a folder, if it exists. Both paths must be specified completely, and both parent paths must be the same.
Syntax: FolderRename c:\dummy|c:\newfolder

FolderMove
Moves a folder, if it exists.
Syntax: FolderMove c:\dummy|c:\windows

FolderSetAttributes
Sets the specified attributes on a folder. Does not affect files or folders in it. R = read-only, A = archive, S = system, H = hidden. 'Compressed' attribute not supported.
Syntax: FolderSetAttributes c:\dummy|SA

FolderClear
Deletes all contents from a folder. If OptionOnDeleteFailUseReboot is set, locked files/folders are deleted on system reboot.
Syntax: FolderClear c:\dummy
--------------------------------------

IniSetValue
Writes the specified data to a value in a .ini file. The four arguments are: file, section in inifile, valuename, data to set.
Syntax: IniSetValue c:\file.ini|settings|data|dummy

IniDeleteValue
Deletes a value from a .ini file, as well as its data. The arguments are: file, section in inifile, valuename.
Syntax: IniDeleteValue c:\file.ini|settings|data

IniDeleteFromValue
Deletes any occurrences of specified data from the existing data in a value in a .ini file. The arguments are: file, section in inifile, valuename, data to delete.
Syntax: IniDeleteFromValue c:\file.ini|settings|data|a

IniClearValue
Deletes all data from a value in a .ini file, but leaves the value itself behind. The arguments are: file, section in inifile, valuename.
Syntax: IniClearValue c:\file.ini|settings|data

IniCreateSection
Create a blank section in a .ini file, if it doesn't already exist.
Syntax: IniCreateSection c:\file.ini|settings

--------------------------------------

RegCreateKey
Create a blank Registry key. If the key already exists, nothing is changed.
Syntax: RegCreateKey HKLM\Software\Test

RegDeleteKey
Deletes a Registry key and all its subkeys and values.
Syntax: RegDeleteKey HKLM\Software\Test

RegSetStringValue
Creates/sets a Registry string value. If the specified Registry key doesn't exist, it is created first.
Syntax: RegSetStringValue HKLM\Software\Test|stringvalue|data

RegSetDwordValue
Creates/sets a Registry dword value. If the specified Registry key doesn't exist, it is created first.
Syntax: RegSetDwordValue HKLM\Software\Test|dwordvalue|1024

RegSetBinaryValue
Creates/sets a Registry binary value. The binary data must be specified in comma-seperated hexadecimal. If the specified Registry key doesn't exist, it is created first.
Syntax: RegSetBinaryValue HKLM\Software\Test|binaryvalue|04,F0,59,A3,BB

RegSetMultiValue
Creates/sets a Registry multistring value. If the specified Registry key doesn't exist, it is created first. Use \0 to denote NULLs in the value data.
Syntax: RegSetMultiValue HKLM\Software\Test|multi|test\0some more

RegDelValue
Deletes a Registry value of any type.
Syntax: RegDelValue HKLM\Software\Test|value

RegDelFromValue
Deletes any occurences of the specified text from a Registry string value.
Syntax: RegDelFromValue HKLM\Software\Test|value|datatodelete

RegRenameValue
Renames a Registry value (string, dword or binary).
Syntax: RegRenameValue HKLM\Software\Test|value|newvalue

RegDelValueIfDataContainsText
Deletes a Registry value of type REG_SZ (string), but only if its data contains a given text string. The last optional parameter determines if the text string is case-sensitive or not (default 0, not case-sensitive).
Syntax: RegDelValueIfDataContainsText HKLM\Software\Test|value|[0|1]

RegDelValueIfDataContainsHex
Deletes a Registry value of type REG_SZ (string), but only if its data contains a given text string in hexadecimal. The last optional parameter determines if the text string is case-sensitive or not (default 0, not case-sensitive).
Syntax: RegDelValueIfDataContainsText HKLM\Software\Test|04,F0,59,A3,BB|[0|1]

RegDelValueIfNameContainsText
Deletes any Registry values of type REG_SZ (string) in a given Registry key if their name contains the given text string. The last optional parameter determines if the text string is case-sensitive or not (default 0, not case-sensitive).
Syntax: RegDelValueIfNameContainsText HKLM\Software\Test|text|[0|1]

RegDelValueIfNameContainsHex
Deletes any Registry values of type REG_SZ (string) in a given Registry key if their name contains the given text string in hexadecimal. The last optional parameter determines if the text string is case-sensitive or not (default 0, not case-sensitive).
Syntax: RegDelValueIfNameContainsHex HKLM\Software\Test|04,F0,59,A3,BB|[0|1]

RegResetPermissions
Resets the permissions on a Registry key back to the default, if possible.
Syntax: RegResetPermissions HKLM\Software\Test

--------------------------------------

ProcessKill
Terminates a process or all processes matching a full or partial string. The boolean specifies if all matches (1) or only the first (0, default) must be killed. When using partial paths or filenames, it is recommended to use the last backslash in the path as a dummy delimiter, to prevent ProcessKill svc.exe from stopping navawsvc.exe, for example. Wildcards supported.
Syntax: ProcessKill \notepad.exe|[0|1]

ProcessKillIfMD5Match
Terminates a process or all processes matching a full or partial string and an MD5 checksum. The boolean specifies if all matches (1) or only the first (0, default) must be killed. Wildcards supported.
Syntax: ProcessKillIfMD5Match \notep*|F8771112BF40968D3C2CFAA585A3D2B6|[0|1]

ProcessKillIfSHA1Match
Terminates a process or all processes matching a full or partial string and an SHA1 checksum. The boolean specifies if all matches (1) or only the first (0, default) must be killed. Wildcards supported.
Syntax: ProcessKillIfSHA1Match \notep*|DA39A3EE5E6B4B0D3255BFEF95601890AFD80709|[0|1]

ProcessKillIfMD2Match
Terminates a process or all processes matching a full or partial string and an MD2 checksum. The boolean specifies if all matches (1) or only the first (0, default) must be killed. Wildcards supported.
Syntax: ProcessKillIfMD2Match \notep*|8350E5A3E24C153DF2275C9F80692773|[0|1]

ProcessKillIfMD4Match
Terminates a process or all processes matching a full or partial string and an MD4 checksum. The boolean specifies if all matches (1) or only the first (0, default) must be killed. Wildcards supported.
Syntax: ProcessKillIfMD4Match \notep*|31D6CFE0D16AE931B73C59D7E0C089C0|[0|1]

ProcessKillIfCRC32Match
Terminates a process or all processes matching a full or partial string and an CRC32 checksum. The boolean specifies if all matches (1) or only the first (0, default) must be killed. Wildcards supported.
Syntax: ProcessKillIfCRC32Match \notep*|5A1F559B|[0|1]

ProcessKillIfContainsText
Terminates a process or all processes matching a full or partial string and containing a text string in the file. The boolean specifies if all matches (1) or only the first (0, default) must be killed. Wildcards supported.
Syntax: ProcessKillIfContainsText \notep*|Shell.notepad|[0|1]

ProcessKillIfContainsHex
Terminates a process or all processes matching a full or partial string and containing a hexadecimal sequence in the file. The boolean specifies if all matches (1) or only the first (0, default) must be killed. Wildcards supported.
Syntax: ProcessKillIfContainsHex \notep*|53,68,65,6C,6C,2E,6E,6F,74,65,70,61,64|[0|1]

ProcessSuspend
Suspends a process or all processes matching a full or partial string. The optional boolean at the end specifies if all matches (1) or only the first one (0, default) must be suspended. Wildcards supported. Note that conditional commands similar to those for ProcessKill are available, i.e. ProcessSuspendIfMD5Match, ProcessSuspendIfSHA1Match, ProcessSuspendIfMD2Match, ProcessSuspendIfMD4Match,  ProcessSuspendIfCRC32Match, ProcessSuspendIfContainsText, ProcessSuspendIfContainsHex.
Syntax: ProcessSuspendIf \notep*|[0|1]

ProcessResume
Resumes a process or all processes matching a full or partial string. The optional boolean at the end specifies if all matches (1) or only the first one (0, default) must be resumed. Wildcards supported. Note that conditional commands similar to those for ProcessKill are available, i.e. ProcessResumeIfMD5Match, ProcessResumeIfSHA1Match, ProcessResumeIfMD2Match, ProcessResumeIfMD4Match, ProcessResumeIfCRC32Match, ProcessResumeIfContainsText, ProcessResumeIfContainsHex.
Syntax: ProcessResumeIf \notep*|[0|1]

--------------------------------------

Note: the following group of commands applies to Windows Services, available only in Windows NT4, Windows 2000, Windows XP, Windows 2003 and newer.

ServiceStart
Starts a service, by full name (displayname) or short name (internal name).
Syntax: ServiceStart ServiceName

ServiceStop
Stops a service, by full name (displayname) or short name (internal name).
Syntax: ServiceStop ServiceName

ServiceDisable
Disables a service, by full name (displayname) or short name (internal name). A service does not need to be stopped first for this to work.
Syntax: ServiceDisable ServiceName

ServiceEnable
Enables a service (set to 'Start Automatically'), by full name (displayname) or short name (internal name).
Sytnax: ServiceEnable ServiceName

ServiceDelete
Deletes a service, by full name (displayname) or short name (internal name). It is recommended to reboot after this, since Windows may not be able to delete a service that is in use until a restart. A deleted service can not be recovered! Use with caution!!
Syntax: ServiceDelete ServiceName

--------------------------------------

HostsFileReset
Clears the contents of the hosts file and resets it to the factory default. A custom hosts file location is also reset for Windows NT4, 2000 and XP.
Syntax: HostsFileReset

HostsFileAddLine
Adds a line to the end of the hosts file.
Syntax: HostsFileAddLine 127.0.0.1	localhost

HostsFileDelLine
Deletes a specific line from the hosts file. All occurrances are deleted.
Syntax: HostsFileDelLine 127.0.0.1	auto.search.msn.com

HostsFileDisableLine
Disables a specific line from the hosts file by putting a '#' in front of it. All occurrances are disabled.
Syntax: HostsFileDisableLine 127.0.0.1	auto.search.msn.com

HostsFileEnableLine
Enables a specific line from the hosts file by removing the '#' in front of it. All occurrances are enabled.
Syntax: HostsFileEnableLine #127.0.0.1	localhost

--------------------------------------

WinsockKillProtocol
Deletes all matching Winsock protocols (e.g. Msspi, Webhancer) from the Winsock stack. It is recommended (but not always needed) to reboot after doing this.
Syntax: WinsockKillProtocol msspi

WinsockKillNameSpace
Deletes all matching Winsock namespaces (e.g. New.Net) from the Winsock stack. It is recommended (but not always needed) to reboot after doing this.
Syntax: WinsockKillNameSpace newdotnet

--------------------------------------

LogIfFileExists
Writes a line to the log window if the file exists. Wildcards supported.
Syntax: LogIfFileExists c:\dummy\test.txt

LogIfFileContainsText
Writes a line to the log window if the file contains the given text. Wildcards suppored.
Syntax: LogIfFileContainsText c:\dummy\test.txt|data

LogIfFileContainsHex
Writes a line to the log window if the file contains the given hexadecimal string. Wildcards suppored.
Syntax: LogIfFileContainsHex c:\dummy\test.txt|53,68,65,6C,6C,2E,6E,6F,74,65,70,61,64

LogIfFolderExists
Writes a line to the log window if the folder exists. Wildcards supported.
Syntax: LogIfFolderExists c:\dummy

LogIfRegKeyExists
Writes a line to the log window if the Registry key exists. Wildcards supported.
Syntax: LogIfRegKeyExists HKLM\Software\Test

LogIfRegValExists
Writes a line to the log window if the Registry value exists. Wildcards supported.
Syntax: LogIfRegValExists HKLM\Software\Test|some value

LogIfRegValContainsText
Writes a line to the log window if the Registry value data contains the given text. Wildcards supported.
Syntax: LogIfRegValContainsText HKLM\Software\Test|some value|data

LogIfRegValContainsHex
Writes a line to the log window if the Registry value data contains the given hexadecimal string. Wildcards supported.
Syntax: LogIfRegValContainsHex HKLM\Software\Test|some value|04,F0,59,A3,BB