Option Explicit
' 3-restore.vbs -- double-click. It asks for admin by itself.
' Restores USB storage, browser download policy, firewall, IE home page,
' and removes the Run entries the assistant added.
' Output: C:\Users\Public\tool\soft.txt
Const LOGF = "C:\Users\Public\tool\soft.txt"

Dim fso, sh, i, csName, csList, rc

Set fso = CreateObject("Scripting.FileSystemObject")
Set sh = CreateObject("WScript.Shell")
If Not fso.FolderExists("C:\Users\Public\tool") Then fso.CreateFolder "C:\Users\Public\tool"

If Not IsAdmin() Then
  CreateObject("Shell.Application").ShellExecute "wscript.exe", """" & WScript.ScriptFullName & """", "", "runas", 1
  WScript.Quit 0
End If

L "START " & Now

L "=== 1. USB storage Start=3"
csList = Array("CurrentControlSet", "ControlSet001", "ControlSet002", "ControlSet003")
For Each csName In csList
  rw "HKLM\SYSTEM\" & csName & "\Services\usbstor\Start", 3, "REG_DWORD", csName
Next

L "=== 2. browser downloads"
rw "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1803", 0, "REG_DWORD", "IE Z3 1803"
rw "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2200", 0, "REG_DWORD", "IE Z3 2200"
rw "HKCU\Software\Microsoft\Internet Explorer\Restrictions\NoBrowserSaveAs", 0, "REG_DWORD", "IE SaveAs"
rw "HKCU\Software\Policies\Microsoft\Edge\DownloadRestrictions", 0, "REG_DWORD", "Edge DL"
rw "HKCU\Software\Policies\Microsoft\Edge\SaveAs", 1, "REG_DWORD", "Edge SaveAs"
rw "HKCU\Software\Policies\Microsoft\Edge\DeveloperToolsAvailability", 0, "REG_DWORD", "Edge Dev"
rw "HKCU\Software\Policies\Google\Chrome\DownloadRestrictions", 0, "REG_DWORD", "Chrome DL"
rw "HKCU\Software\Policies\Google\Chrome\SaveAs", 1, "REG_DWORD", "Chrome SaveAs"
rw "HKCU\Software\Policies\Google\Chrome\DeveloperToolsAvailability", 0, "REG_DWORD", "Chrome Dev"
rw "HKCU\Software\Policies\Mozilla\Firefox\DisableDownloads", 0, "REG_DWORD", "FF DL"
rw "HKCU\Software\Policies\Mozilla\Firefox\BlockAboutDownloads", 0, "REG_DWORD", "FF BlockDL"
rw "HKCU\Software\Policies\Mozilla\Firefox\DeveloperToolsAvailability", 0, "REG_DWORD", "FF Dev"

L "=== 3. firewall"
rw "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall", 1, "REG_DWORD", "Std"
rw "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall", 1, "REG_DWORD", "Domain"
rw "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall", 1, "REG_DWORD", "Public"
x "netsh advfirewall set allprofiles state on", "netsh firewall on"
x "net start MpsSvc", "start MpsSvc (2182 = already running)"
x "net start BFE", "start BFE (may fail, ignore)"

L "=== 4. IE home page"
rw "HKCU\Software\Microsoft\Internet Explorer\Main\Start Page", "about:blank", "REG_SZ", "HKCU Start Page"
rw "HKCU\Software\Microsoft\Internet Explorer\Main\Default_Page_URL", "about:blank", "REG_SZ", "HKCU Default_Page"
rw "HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page", "about:blank", "REG_SZ", "HKLM Start Page"

L "=== 5. remove Run entries"
rd "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run", "prozs"
rd "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run", "jfglzsn"
rd "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run", "prozs"
rd "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run", "jfglzsn"
rd "HKCU\Software\Microsoft\Windows\CurrentVersion\Run", "prozs"
rd "HKCU\Software\Microsoft\Windows\CurrentVersion\Run", "jfglzsn"

L "=== 6. self check"
L "  usbstor Start = " & rv("HKLM\SYSTEM\CurrentControlSet\Services\usbstor\Start") & "  (want 3)"
L "  IE Z3 1803    = " & rv("HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1803") & "  (want 0)"
L "  Chrome DL     = " & rv("HKCU\Software\Policies\Google\Chrome\DownloadRestrictions") & "  (want 0)"
L "  EnableFirewall= " & rv("HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall") & "  (want 1)"
L "DONE"

MsgBox "Done. USB storage, downloads, firewall, Run entries restored." & vbCrLf & vbCrLf & _
       "Next: right-click 4-restore-hosts.bat -> Run as administrator", 64, "3-restore OK"

Sub L(t)
  Dim ff
  Set ff = fso.OpenTextFile(LOGF, 8, True)
  ff.WriteLine t
  ff.Close
End Sub

Sub rw(k, v, kind, label)
  Dim rc
  rc = "ok"
  On Error Resume Next
  Err.Clear
  sh.RegWrite k, v, kind
  If Err.Number <> 0 Then rc = "err " & Err.Number
  Err.Clear
  On Error GoTo 0
  L "  " & label & " rc=" & rc
End Sub

Sub rd(k, nm)
  Dim rc
  rc = "ok"
  On Error Resume Next
  Err.Clear
  sh.RegDelete k & "\" & nm
  If Err.Number <> 0 Then rc = "none"
  Err.Clear
  On Error GoTo 0
  L "  del " & nm & " rc=" & rc
End Sub

Function rv(k)
  Dim v
  On Error Resume Next
  v = sh.RegRead(k)
  If Err.Number <> 0 Then v = "<missing>"
  Err.Clear
  On Error GoTo 0
  rv = v
End Function

Sub x(cmd, label)
  Dim rc
  rc = 999
  On Error Resume Next
  Err.Clear
  rc = sh.Run(cmd, 0, True)
  If Err.Number <> 0 Then rc = "err " & Err.Number
  Err.Clear
  On Error GoTo 0
  L "  " & label & " rc=" & rc
End Sub

Function IsAdmin()
  IsAdmin = True
  On Error Resume Next
  Err.Clear
  sh.RegWrite "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\__probe", 1, "REG_DWORD"
  If Err.Number <> 0 Then IsAdmin = False
  Err.Clear
  sh.RegDelete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\__probe"
  Err.Clear
  On Error GoTo 0
End Function