From 117ba004f0998354b4b4867baac01b8b4bdcbf41 Mon Sep 17 00:00:00 2001
From: WindowsAddict <windowsaddict@protonmail.com>
Date: Fri, 16 Aug 2024 03:03:12 +0530
Subject: [PATCH] better check for malware if sppsvc.exe is not found

---
 MAS/Separate-Files-Version/Activators/HWID_Activation.cmd   | 6 +++++-
 MAS/Separate-Files-Version/Activators/KMS38_Activation.cmd  | 6 +++++-
 .../Activators/Ohook_Activation_AIO.cmd                     | 6 +++++-
 .../Activators/Online_KMS_Activation.cmd                    | 6 +++++-
 4 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/MAS/Separate-Files-Version/Activators/HWID_Activation.cmd b/MAS/Separate-Files-Version/Activators/HWID_Activation.cmd
index 9c68127..c2583c9 100644
--- a/MAS/Separate-Files-Version/Activators/HWID_Activation.cmd
+++ b/MAS/Separate-Files-Version/Activators/HWID_Activation.cmd
@@ -1084,7 +1084,11 @@ reg query HKLM\SYSTEM\CurrentControlSet\Services\%%# /v %%G %nul% || (set _corru
 if %wucount% GEQ 1 set "results=%results%[WU registry is corrupt]"
 
 sc start sppsvc %nul%
-echo "%errorlevel%" | findstr "577 225" %nul% && set "results=%results%[Likely File Infector]"
+echo "%errorlevel%" | findstr "577 225" %nul% && (
+set "results=%results%[Likely File Infector]"
+) || (
+if not exist %SysPath%\sppsvc.exe if not exist %SysPath%\alg.exe (set "results=%results%[Likely File Infector]")
+)
 
 if not "%results%%pupfound%"=="" (
 if defined pupfound call :dk_color %Gray% "Checking PUP Activators                 [Found%pupfound%]"
diff --git a/MAS/Separate-Files-Version/Activators/KMS38_Activation.cmd b/MAS/Separate-Files-Version/Activators/KMS38_Activation.cmd
index 2c6dcba..4037bea 100644
--- a/MAS/Separate-Files-Version/Activators/KMS38_Activation.cmd
+++ b/MAS/Separate-Files-Version/Activators/KMS38_Activation.cmd
@@ -1227,7 +1227,11 @@ reg query HKLM\SYSTEM\CurrentControlSet\Services\%%# /v %%G %nul% || (set _corru
 if %wucount% GEQ 1 set "results=%results%[WU registry is corrupt]"
 
 sc start sppsvc %nul%
-echo "%errorlevel%" | findstr "577 225" %nul% && set "results=%results%[Likely File Infector]"
+echo "%errorlevel%" | findstr "577 225" %nul% && (
+set "results=%results%[Likely File Infector]"
+) || (
+if not exist %SysPath%\sppsvc.exe if not exist %SysPath%\alg.exe (set "results=%results%[Likely File Infector]")
+)
 
 if not "%results%%pupfound%"=="" (
 if defined pupfound call :dk_color %Gray% "Checking PUP Activators                 [Found%pupfound%]"
diff --git a/MAS/Separate-Files-Version/Activators/Ohook_Activation_AIO.cmd b/MAS/Separate-Files-Version/Activators/Ohook_Activation_AIO.cmd
index ac3674f..8d35a67 100644
--- a/MAS/Separate-Files-Version/Activators/Ohook_Activation_AIO.cmd
+++ b/MAS/Separate-Files-Version/Activators/Ohook_Activation_AIO.cmd
@@ -1534,7 +1534,11 @@ reg query HKLM\SYSTEM\CurrentControlSet\Services\%%# /v %%G %nul% || (set _corru
 if %wucount% GEQ 1 set "results=%results%[WU registry is corrupt]"
 
 sc start sppsvc %nul%
-echo "%errorlevel%" | findstr "577 225" %nul% && set "results=%results%[Likely File Infector]"
+echo "%errorlevel%" | findstr "577 225" %nul% && (
+set "results=%results%[Likely File Infector]"
+) || (
+if not exist %SysPath%\sppsvc.exe if not exist %SysPath%\alg.exe (set "results=%results%[Likely File Infector]")
+)
 
 if not "%results%%pupfound%"=="" (
 if defined pupfound call :dk_color %Gray% "Checking PUP Activators                 [Found%pupfound%]"
diff --git a/MAS/Separate-Files-Version/Activators/Online_KMS_Activation.cmd b/MAS/Separate-Files-Version/Activators/Online_KMS_Activation.cmd
index 70274f1..057328a 100644
--- a/MAS/Separate-Files-Version/Activators/Online_KMS_Activation.cmd
+++ b/MAS/Separate-Files-Version/Activators/Online_KMS_Activation.cmd
@@ -2557,7 +2557,11 @@ reg query HKLM\SYSTEM\CurrentControlSet\Services\%%# /v %%G %nul% || (set _corru
 if %wucount% GEQ 1 set "results=%results%[WU registry is corrupt]"
 
 sc start sppsvc %nul%
-echo "%errorlevel%" | findstr "577 225" %nul% && set "results=%results%[Likely File Infector]"
+echo "%errorlevel%" | findstr "577 225" %nul% && (
+set "results=%results%[Likely File Infector]"
+) || (
+if not exist %SysPath%\sppsvc.exe if not exist %SysPath%\alg.exe (set "results=%results%[Likely File Infector]")
+)
 
 if not "%results%%pupfound%"=="" (
 if defined pupfound call :dk_color %Gray% "Checking PUP Activators                 [Found%pupfound%]"