Option Explicit
' 5-verify.vbs -- double-click. Read-only. Tells you whether it worked.
' Output: C:\Users\Public\tool\verify.txt (opened in Notepad)
Dim fso, out, wmi, p, s, sh, v, cnt, fn, sz, ok, pass, fail

fn = "C:\Users\Public\tool\verify.txt"
Set fso = CreateObject("Scripting.FileSystemObject")
Set sh = CreateObject("WScript.Shell")
If Not fso.FolderExists("C:\Users\Public\tool") Then fso.CreateFolder "C:\Users\Public\tool"
Set out = fso.CreateTextFile(fn, True)
Set wmi = GetObject("winmgmts:")

pass = 0
fail = 0

out.WriteLine "VERIFY  " & Now
out.WriteLine ""

cnt = 0
For Each p In wmi.ExecQuery("Select Name,ProcessId from Win32_Process")
  If IsTarget(LCase(p.Name)) Then
    out.WriteLine "  [proc] alive: " & p.Name & " pid=" & p.ProcessId
    cnt = cnt + 1
  End If
Next
chk (cnt = 0), "no assistant process"

ok = -1
For Each s In wmi.ExecQuery("Select Name,State from Win32_Service Where Name='zmserv'")
  out.WriteLine "  [svc] " & s.State
  If LCase(s.State) = "running" Then ok = 0
  If LCase(s.State) = "stopped" Then ok = 1
Next
If ok = -1 Then
  out.WriteLine "  [svc] not installed (1060)"
  ok = 1
End If
chk (ok = 1), "service not running"

sz = -1
On Error Resume Next
Err.Clear
sz = fso.GetFile("C:\Windows\System32\drivers\etc\hosts").Size
Err.Clear
On Error GoTo 0
out.WriteLine "  [hosts] " & sz & " bytes, hosts2 exist=" & fso.FileExists("C:\Windows\System32\drivers\etc\hosts2")
chk (sz > 0 And sz < 2000), "hosts restored (~824)"

v = rv("HKLM\SYSTEM\CurrentControlSet\Services\usbstor\Start")
out.WriteLine "  [usb] Start = " & v & "  (3 = ok, 4 = disabled)"
chk (CStr(v) = "3"), "USB storage enabled"

v = rv("HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall")
out.WriteLine "  [fw] EnableFirewall = " & v
chk (CStr(v) = "1"), "firewall on"

ok = rvcount("HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run") + rvcount("HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run")
out.WriteLine "  [run] prozs/jfglzsn entries = " & ok
chk (ok = 0), "no autostart entries"

out.WriteLine ""
out.WriteLine "PASS " & pass & "   FAIL " & fail
out.Close

If fail = 0 Then
  sh.Popup "ALL PASS (" & pass & " checks)", 6, "5-verify CLEAN", 64
Else
  sh.Popup fail & " check(s) failed, see verify.txt", 8, "5-verify PROBLEM", 48
End If
sh.Run "notepad """ & fn & """", 1, False

Sub chk(cond, label)
  If cond Then
    pass = pass + 1
    out.WriteLine "    -> PASS : " & label
  Else
    fail = fail + 1
    out.WriteLine "    -> FAIL : " & label
  End If
End Sub

Function rv(k)
  Dim t
  On Error Resume Next
  t = sh.RegRead(k)
  If Err.Number <> 0 Then t = "<missing>"
  Err.Clear
  On Error GoTo 0
  rv = t
End Function

Function rvcount(base)
  Dim t
  rvcount = 0
  On Error Resume Next
  t = sh.RegRead(base & "\prozs")
  If Err.Number = 0 Then rvcount = rvcount + 1
  Err.Clear
  t = sh.RegRead(base & "\jfglzsn")
  If Err.Number = 0 Then rvcount = rvcount + 1
  Err.Clear
  On Error GoTo 0
End Function

Function AllInRange(t, lo, hi)
  Dim i, ch
  AllInRange = False
  For i = 1 To Len(t)
    ch = Asc(Mid(t, i, 1))
    If ch < lo Or ch > hi Then Exit Function
  Next
  AllInRange = True
End Function

Function IsTarget(b)
  Dim base
  IsTarget = False
  base = LCase(b)
  If Right(base, 4) = ".exe" Then base = Left(base, Len(base) - 4)
  If base = "jfglzsn" Or base = "zmserv" Or base = "przs" Then
    IsTarget = True
    Exit Function
  End If
  If Len(base) = 5 And AllInRange(base, 105, 114) Then IsTarget = True
End Function