Posts

Wiki

Tron Script Wiki

What is "Tron Script"?

Tron is a script that "fights for the User." It's a collection of Windows batch files that automate a bunch of scanning, disinfection, and cleanup tools. I got tired of running these utilities manually and automated the whole process. I hope it helps other techs, admins, and users.

Tron's goal: take a badly-running Windows system (bloated, infected, whatever) and automate ~85% of the work needed to get it running well again. That's it, and it accomplishes that goal fairly well on most systems.

The project relies heavily on community input and is updated regularly. If you hit a problem or bug, REPORT IT and we'll fix it as quickly as possible.

Fair Warning

Cleaning or repairing a malware-compromised PC (with Tron or any other tool) can partially or completely disable it, sometimes requiring a full Windows reinstall. This isn't a Tron issue - it's just how PCs are. Your system may not be repairable and your data may not be recoverable. If you run Tron, be prepared for the possibility of reformatting, reinstalling Windows, and restoring your data from backup.

Changelog | Downloads | How to use Tron

Where to Run Tron

Try these environments in order, moving down the list only if Tron won't run:

Normal boot with an elevated Command Prompt and a working internet connection. Always try this first.
Normal boot, no internet. You won't get the latest bloatware/malware removal lists, but the bundled lists should be enough to stabilize the system.
Safe Mode with Networking.
Plain Safe Mode (no networking).

If Tron crashes, quits, or misbehaves in a normal boot, something on the system may be actively fighting it - drop down one level and try again. Once Tron completes successfully in a lower environment, return to a normal boot and run it again.

If Tron is interrupted mid-run (Command Prompt crash, PC crash, power cut, etc.), just re-launch it. It will resume at the beginning of the stage it was on.

Stages of Tron

Prep: rkill, ProcessKiller, TDSSKiller, Stinger, registry backup, WMI repair, sysrestore clean, oldest VSS set purge, create pre-run System Restore point, SMART disk check, NTP time sync
Tempclean: TempFileCleanup, CCleaner, BleachBit, backup & clear event logs, Windows Update cache cleanup, Internet Explorer cleanup, USB device cleanup
De-bloat: remove OEM bloatware; customizable list is in \resources\stage_2_de-bloat\oem\; Metro OEM debloat (Win8 and up only)
Disinfect: Clear CryptNet SSL cache, Kaspersky Virus Removal Tool, Malwarebytes Anti-Malware
Repair: Registry permissions reset, Filesystem permissions reset, DISM image check (Win8 and up only), SFC /scannow, chkdsk
Patch: Updates 7-Zip and disables nag/update screens (uses some of our PDQ packs); then installs any pending Windows updates
Optimize: page file reset, defrag %SystemDrive% (usually C:\; skipped if system drive is an SSD or a VM)
Wrap-up: Send job completion email report (if configured; specify SMTP settings in \resources\stage_7_wrap-up\email_report\SwithMailSettings.xml)
Manual stuff: Additional tools that can't currently be automated (ComboFix, AdwCleaner, aswMBR, autoruns, etc.)

Saves a log to C:\Logs\tron\tron.log (configurable).

A Note About Tron "Freezing"

The most common cause of an apparent freeze is clicking inside the command window while Tron is running. This pauses the script: it finishes the current step but won't proceed to the next.

Check the Command Prompt title bar. If it says "Select Administrator" (example), you've clicked in the window and paused Tron - press RETURN and it will resume. If it says just "Administrator", Tron isn't frozen.

If the title bar looks normal, Tron is most likely on a long-running, disk-bound step: de-bloat (Stage 2), virus removal (Stage 3, multiple antivirus engines), SFC/DISM (Stage 4), or defragmentation (Stage 6, spinning disks only - SSDs are exempt). Slower drives and file-heavy systems can take hours on a single stage.

CQ (Common Questions)

1. Why doesn't Malwarebytes auto-scan?

Two reasons. MBAM has anti-automation measures built into its GUI, so Tron installs it and moves on rather than hanging on user input. More importantly, I (u/vocatus) have spoken with Malwarebytes directly, and they've agreed to let Tron use MBAM free specifically this way: install it, but leave scanning and updating to the tech. To honor that agreement, MBAM stays manual.

2. Why is Tron so big?

Tron is built to be fully portable - it bundles every utility it needs to run out of the box. My military and travel experience taught me that in much of the world (especially where Tron gets used most), internet is unavailable, intermittent, or unusable for large downloads (slow networks, heavy data caps). Standalone operation is worth the size.

3. Tron is slow

Yes it is. Typical runs take 4-7 hours; the record is 89 hours (!), set by u/MCGamer20000. Tron runs three antivirus engines (Kaspersky VRT, Sophos, MBAM), several other scanners, SFC and DISM repair (Vista and up), and a defrag of C: on mechanical drives - all disk-bound tasks on a system that's probably already running slowly. And cmd.exe isn't known for its blazing speed.

My personal philosophy is to spend more time to "do it right" rather than take shortcuts. Letting Tron run all stages is almost always worth it - 99 times out of 100 the system runs better afterward. When speed matters, use the command-line switches to skip stages at the expense of cleaning depth.

4. During Stage 2: De-Bloat there's a message along the lines of "ERROR: Shutting down"

Safe to ignore. This is a known bug with no workaround yet. It means a removed program triggered the "reboot required to finish removal" flag, so Windows won't remove any more programs until a reboot. It doesn't affect anything else in Tron - let it finish, then manually remove any leftovers.

5. The computer reboots in the middle of Stage 2: De-Bloat

Another known bug I'm working on. Some programs hard-force a reboot when uninstalled via command line (e.g. via WMI), with no way to cancel or prevent it, and no way to know in advance which programs do it (Toshiba OEM apps are frequent offenders). Workaround: skip the de-bloat stage, or just re-launch Tron after the reboot and it will pick up where it left off.

6. Why not just use Ninite or Ketarin to auto-download tools at runtime?

I'm a Ninite fan and have considered it, but a fully standalone package is more useful than the extra effort of keeping everything updated. A batch file also gives granular control over exactly what gets installed, versus blindly trusting Ninite's maintainers.

As for Ketarin: I couldn't figure out its interface and don't have time to learn another language. Download URLs also change constantly, and with as many sub-tools as Tron uses, an update script would be a separate project in itself. That said, if you build one, I'd happily integrate it.

7. Why don't you bundle WSUS Offline updates with Tron?

As of v10.0.0, Tron supports bundled WSUS Offline updates. See the instructions for how to supply the update packages.

8. Can I run Tron from a boot disk or PE environment?

Short answer: no.

Long answer: Most of Tron's tools automatically target %SystemDrive% (typically C:\) with no option to specify a different drive, and Tron depends on system variables that only exist correctly on a live system. It's not really possible the way Tron is built - though I'm a hacky batch scripter, not a real programmer, so some enterprising individual could probably figure it out.

9. ComboFix // MBAMSERVICE.exe // etc get flagged as a virus

Some antivirus products (Symantec and McAfee in particular) have overly aggressive heuristics that flag legitimate tools as PUPs ("potentially unwanted programs"). These warnings are safe to ignore. If concerned, compare the MD5 or SHA256 hashes of the flagged binaries against the official files. Simplest fix: disable local antivirus before running Tron.

10. Why is Tron written in batch? Why not PowerShell?

Ultimately it doesn't matter what language Tron's written in - what matters is that it works, and it does.

That said, batch was chosen deliberately. On an infected or broken system, the Windows cmd engine is the lowest common denominator and almost always just works. PowerShell often won't: it may be broken, not installed (XP/2003), disabled by default (Vista and up), or missing one of its many dependencies. Batch is more work to write, but consistent reliability across diverse environments matters more than extra features.

We'll likely move to pure PowerShell once XP support is deprecated. I'm a big fan of it - Tron's deployment script is PowerShell - and would like its extra power and flexibility.

11. Why not just re-image/format+reinstall?

The Enterprise mentality is that the only cure for infection is wiping the box and starting from scratch or the latest master image. I agree - when a master image exists. But often:

a) There is no master image (small business, personal machine, etc.)

b) The machine is too specialized

c) Backing up user data, reinstalling Windows, hunting down drivers, restoring data, and re-customizing the system takes far more effort than just running Tron

TL;DR: Tron is for situations where recovery makes more sense than rebuilding from scratch.

12. When I launch Tron the window appears for a second or two and then closes

There's an inconsistent Windows bug (UAC-related?) where command-line programs sometimes appear and immediately close. Workaround: open an Administrator Command Prompt (or admin PowerShell), cd to wherever tron.bat is (usually cd c:\users\MYUSERNAME\Desktop\tron\), type tron.bat, and hit Enter.

13. Why not build a Chocolatey package?

Too much work, not enough time. A few people have built them though - search /r/TronScript and you'll find some floating around.

14. Tron 'stalls' with an error saying it can't access `pagefile.sys` (or similar)

Tron is not stalled - do not cancel it. Tron hides most scanner output to speed up scanning, reporting only locked system files it can't access. Files like pagefile.sys and hiberfile.sys are always inaccessible; these errors are normal and safe to ignore.

To see full output while scanning, use the -v (verbose) switch. Note this greatly increases run time.

15. How can I know Tron won't do something sketchy to my system?

You can't. Caveat emptor applies to any software written by strangers on the Internet.

However, you can have reasonable trust that it's built in good faith:

All code is open-source and available on Github under the MIT license, heavily commented - you can read exactly what it does yourself
The community reviews the code constantly; hiding something malicious would be difficult
If anything malicious was found, the project's reputation would be ruined and someone would fork a clean version

Tron does rely on third-party tools for heavy lifting, but they're well-known in the PC tech/IT space. Bottom line: you can never fully trust software you didn't write, but you can run Tron with reasonable certainty it does what it says. If interested, read my personal philosophy on how I approach Tron and projects in general.

16. I downloaded tron from an official source but it's being flagged as malware. Is tron infected?

"Malware" originally meant strictly malicious software. Over time, many antivirus vendors broadened it to include dual-use tools - a registry editor, for example, can be beneficial or malicious depending on who's using it. Antivirus engines flag the tool, not the usage. Think of a hammer: useful in the right hands, dangerous in the wrong ones, but not inherently "bad."

Some tools bundled with Tron fall into this category, so some antivirus programs and services (like VirusTotal) flag them. Since Tron doesn't use these tools maliciously (verifiable by examining its code), these are false positives - as long as you downloaded Tron from an official source and follow the documentation.

Common Questions (Post-Tron Execution)

• After running Tron, my antivirus is reporting SettingsModifier:Win32/HostsFileHijack. Did Tron infect my system?

Assuming you downloaded Tron from an official source: no. Recent versions of Windows treat ANY hosts file modification as malicious. Tron disables Microsoft's telemetry via an otherwise-harmless hosts file edit, and Microsoft has decided that blocking their ability to spy on users is "malicious" - hence the warning.

• After running Tron, my (HARDWARE) no longer works properly. Did Tron break my system?

The device drivers were most likely removed during de-bloat. Bloatware publishers often bundle their software with device drivers, so removing the bloatware can remove the driver with it. Fix: download and reinstall the drivers from the device manufacturer's website, or use a driver installer tool like Snappy.

• After running Tron, my (SOFTWARE) no longer works properly. Did Tron break my system?

There are four likely causes:

The software was infected with malware and removed during the antivirus stage.
If it's "cracked" software, the crack was flagged as malicious and removed during the antivirus stage.
The software was flagged as bloatware and removed during the de-bloat stage.
The software depended on a setting or component that Tron changed.

For the first three, the fix is the same: reinstall the software, revert to your last Windows restore point, or restore from backup.

For the fourth, either troubleshoot using general support resources online (not /r/tronscript), or use one of the fixes above.

• After running Tron, there are control panel settings I cannot change; a message says "This setting is managed by your administrator". Did Tron break my system?

Tron uses O&OShutUp10, a Windows antispy tool, to disable a lot of things Microsoft would prefer to have access to. That's what produces the "managed by your administrator" message. To remove it, relaunch the tool and re-enable Microsoft's telemetry settings. It's located in tron\resources\stage_4_repair\disable_windows_telemetry\.

• How do I remove all traces of Tron after running it?

Delete the Tron EXE you downloaded, the tron and integrity_verification folders it created, and the logs folder at the root of your startup drive. Uninstall Malwarebytes. Optionally, run a registry cleaner (such as CCleaner) to clean orphaned registry entries. Empty trash, reboot, and the world will never know.

Contributing

Want to contribute? Great - over half of Tron's code is community-contributed, and many of its functions and utilities came from user suggestions. Even non-coders can suggest ideas, and good ones get implemented.

Code contribution rules:

Before making a big pull request on Github, CHECK WITH ME!! Large unsolicited PRs have been rejected before, wasting hours of the contributor's time.
Pay attention to detail: no sloppy spelling mistakes, inconsistently-named variables, etc.
Match existing format and style - variable names, indentation, and so on must follow the project's style, not your personal one.

Q: Why are you such a big jerk about this?

A: Clean, consistent code is necessary for project longevity and maintainability, and consistent style makes proposed changes quick to review.

Final thought on trust:

From my perspective as maintainer, you're a random person on the Internet proposing changes to a long-running project with many contributors. You earn trust by:

Working well with other people
Writing good code
Sticking around. The longer you're an active community member, the more seriously we'll consider your ideas.

Tron isn't an old boys club where seniority is everything - and don't let the rules scare you off. They just keep the review and integration process quick and efficient.

Development philosophy

Tron's goal is to take a badly-running Windows system (bloated, infected, whatever) and automate ~85% of the work involved in getting it running well again. That's it. At this point it accomplishes that goal fairly well on most systems.