Hi, I have been developing a program which will delete a list of registry keys. I use this as a removal tool because the uninstall program on my companies computers doesn't work. I have already written the program which does all that it has to as far as procesing. But from here I simply want to load the batch file as a tsr (terminate-and-stay-resident) So that when a user enters ctrl+g or whatever I set the trigger to be, will activate the program. This is extremly important to me because I have studied batch for a while, and the only information I have found on it, it says that it is possible but doesnt show by example how it is done. I dont know the sytax so that is what is most important, just some demonstration by example would be so incredibly helpful!! Anyway, here is the program I have written, if someone could take a few minutes and show me what I need to load it as a TSR, so that it will execute the batch file when the user presses ctrl+g, or whatever key combination you make up (BY EXAMPLE PLEASE, not just generally saying how to) Here is the batch program I wrote: -- @echo off echo Please wait while the computer is configured... echo DO NOT CLOSE THIS WINDOW @echo off ::Check to see if Norton has already been deleted IF EXIST \\Thomfs02\lan\IT\NortonClientRemovals\%computername%\%COMPUTERNAME%%username%.txt GOTO TRUE GOTO FALSE ::Norton has already been removed so exit :TRUE echo ****************************************************** >>\\Thomfs02\lan\IT\NortonClientRemovals\%computername%\%COMPUTERNAME%%username%.txt echo Norton has already been removed. Program ran again on %date% at %time% >>\\Thomfs02\lan\IT\NortonClientRemovals\%computername%\%COMPUTERNAME%%username%.txt Exit ::Norton needs to be removed :FALSE net stop "DefWatch" net stop "Norton AntiVirus Client" IF EXIST nrtf2.inf GOTO SKIPREG GOTO CREATEREG :CREATEREG ::Create the registry keys to be deleted echo [version] >> nrtf2.inf attrib +h nrtf2.inf echo signature = "$CHICAGO$" >> nrtf2.inf echo [DefaultInstall] >> nrtf2.inf echo DelReg = NoParasites >> nrtf2.inf echo [NoParasites] >> nrtf2.inf echo HKCR,"\Software\Microsoft\Windows\ShellNoRoam\MUICache","C:\Program Files\NavNT\vptray.exe" >> nrtf2.inf echo HKCR,"\CLSID\{536604C2-B82E-11D1-8252-00A0C95C0756}","" >> nrtf2.inf echo HKCR,"\Installer\Features\74BE21DBFDBD3D11EBAE000ACC725290","NortonAntiVirus" >> nrtf2.inf echo HKCR,"\Installer\Products\74BE21DBFDBD3D11EBAE000ACC725290","ProductName" >> nrtf2.inf echo HKCR,"LDVPUI.LDVPUICtrl.1","" >> nrtf2.inf echo HKCR,"SOFTWARE\Classes\CLSID\{536604C2-B82E-11D1-8252-00A0C95C0756}","" >> nrtf2.inf echo HKCR,"CLSID\{0F0E0EE0-760F-11D2-8E55-72C9EE000000}\InProcServer32","" >> nrtf2.inf echo HKCR,"CLSID\{4C34B690-D1B7-11D1-B041-00104B252EEA}\InProcServer32","" >> nrtf2.inf echo HKCR,"CLSID\{E381F1C0-910E-11D1-AB1E-00A0C90F8F6F}\InProcServer32","" >> nrtf2.inf echo HKCR,"CLSID\{E381F1D0-910E-11D1-AB1E-00A0C90F8F6F}\InProcServer32","" >> nrtf2.inf echo HKCR,"Installer\Products\74BE21DBFDBD3D11EBAE000ACC725290\SourceList","LastUsedSource" >> nrtf2.inf echo HKCR,"Installer\Products\74BE21DBFDBD3D11EBAE000ACC725290\SourceList","PackageName" >> nrtf2.inf echo HKCR,"Installer\Products\74BE21DBFDBD3D11EBAE000ACC725290\SourceList\Media","1" >> nrtf2.inf echo HKCR,"Installer\Products\74BE21DBFDBD3D11EBAE000ACC725290\SourceList\Net","1" >> nrtf2.inf echo HKCR,"TypeLib\{E381F1B0-910E-11D1-AB1E-00A0C90F8F6F}\1.0\0\win32","" >> nrtf2.inf echo HKCR,"TypeLib\{E381F1B0-910E-11D1-AB1E-00A0C90F8F6F}\1.0\HELPDIR","" >> nrtf2.inf echo HKCR,"TypeLib\{E381F1F0-910E-11D1-AB1E-00A0C90F8F6F}\1.0\0\win32","" >> nrtf2.inf echo HKCR,"TypeLib\{E381F1F0-910E-11D1-AB1E-00A0C90F8F6F}\1.0\HELPDIR","" >> nrtf2.inf echo HKCR,"*\shellex\ContextMenuHandlers\LDVPMenu" >> nrtf2.inf echo HKCR,"cliscan.objects" >> nrtf2.inf echo HKCR,"cliscan.objects.1" >> nrtf2.inf echo HKCR,"CLSID\{E381F1C0-910E-11D1-AB1E-00A0C90F8F6F}" >> nrtf2.inf echo HKCR,"CLSID\{E381F1D0-910E-11D1-AB1E-00A0C90F8F6F}" >> nrtf2.inf echo HKCR,"TypeLib\{E381F1F0-910E-11D1-AB1E-00A0C90F8F6F}\1.0" >> nrtf2.inf echo HKCR,"Software\Microsoft\Windows\CurrentVersion\Applets\Regedit","LastKey" >> nrtf2.inf echo HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Run","vptray" >> nrtf2.inf echo HKLM,"SYSTEM\ControlSet001\Enum\Root\LEGACY_NORTON_ANTIVIRUS_SERVER" >> nrtf2.inf echo HKLM,"SYSTEM\ControlSet001\Services\Eventlog\Application","Sources" >> nrtf2.inf echo HKLM,"SYSTEM\ControlSet001\Services\Eventlog\Application\Norton AntiVirus" >> nrtf2.inf echo HKLM,"SYSTEM\ControlSet001\Services\Norton AntiVirus Server" >> nrtf2.inf echo HKLM,"SYSTEM\ControlSet003\Enum\Root\LEGACY_NORTON_ANTIVIRUS_SERVER" >> nrtf2.inf echo HKLM,"SYSTEM\ControlSet003\Services\Eventlog\Application","Sources" >> nrtf2.inf echo HKLM,"SYSTEM\ControlSet003\Services\Eventlog\Application\Norton AntiVirus" >> nrtf2.inf echo HKLM,"SYSTEM\ControlSet003\Services\Norton AntiVirus Server" >> nrtf2.inf echo HKLM,"SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NORTON_ANTIVIRUS_SERVER" >> nrtf2.inf echo HKLM,"SYSTEM\CurrentControlSet\Services\Eventlog\Application","Sources" >> nrtf2.inf echo HKLM,"SYSTEM\CurrentControlSet\Services\Eventlog\Application\Norton AntiVirus" >> nrtf2.inf echo HKLM,"SYSTEM\CurrentControlSet\Services\Norton AntiVirus Server" >> nrtf2.inf echo HKLM,"SOFTWARE\Intel\LANDesk\VirusProtect6\CurrentVersion\AddressCache\AMTHOSLB003","Domain" >> nrtf2.inf echo HKLM,"SOFTWARE\Intel\LANDesk\VirusProtect6\CurrentVersion\AddressCache\THOMADP01","Domain" >> nrtf2.inf echo HKLM,"SOFTWARE\Intel\LANDesk\VirusProtect6\CurrentVersion\AddressCache\THOMBC","Domain" >> nrtf2.inf echo HKLM,"SOFTWARE\Intel\LANDesk\VirusProtect6\CurrentVersion\AddressCache\THOMBDC01","Domain" >> nrtf2.inf echo HKLM,"SOFTWARE\Intel\LANDesk\VirusProtect6\CurrentVersion\AddressCache\THOMFS01","Domain" >> nrtf2.inf echo HKLM,"SOFTWARE\Intel\LANDesk\VirusProtect6\CurrentVersion\AddressCache\THOMFS02","Domain" >> nrtf2.inf echo HKLM,"SOFTWARE\Intel\LANDesk\VirusProtect6\CurrentVersion\AddressCache\US007SLB02","Domain" >> nrtf2.inf echo HKLM,"SOFTWARE\Intel\LANDesk\VirusProtect6\CurrentVersion\Common","SelectedMessage" >> nrtf2.inf echo HKLM,"SOFTWARE\Intel\LANDesk\VirusProtect6\CurrentVersion\Common","SenderMessage" >> nrtf2.inf echo HKLM,"SOFTWARE\Intel\LANDesk\VirusProtect6\CurrentVersion\Common","WarningMessage" >> nrtf2.inf echo HKLM,"SOFTWARE\Microsoft\DirectDraw\Compatibility\NortonSystemInfo" >> nrtf2.inf echo HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\74BE21DBFDBD3D11EBAE000ACC725290\Features","NortonAntiVirus" >> nrtf2.inf echo HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\74BE21DBFDBD3D11EBAE000ACC725290\InstallProperties","DisplayName" >> nrtf2.inf echo HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\74BE21DBFDBD3D11EBAE000ACC725290\Usage","NortonAntiVirus" >> nrtf2.inf echo HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BD12EB47-DBDF-11D3-BEEA-00A0CC272509}","DisplayName" >> nrtf2.inf echo HKLM,"SOFTWARE\Network Associates\ePolicy Orchestrator\Application Plugins\NORTONAV7500" >> nrtf2.inf echo HKLM,"SOFTWARE\Symantec\Norton AntiVirus" >> nrtf2.inf echo HKLM,"SOFTWARE\Symantec\Norton AntiVirus NT" >> nrtf2.inf echo HKLM,"SYSTEM\ControlSet001\Enum\Root\LEGACY_NORTON_ANTIVIRUS_SERVER" >> nrtf2.inf echo HKLM,"SYSTEM\ControlSet001\Services\Eventlog\Application","Sources" >> nrtf2.inf echo HKLM,"SYSTEM\ControlSet001\Services\Eventlog\Application\Norton AntiVirus" >> nrtf2.inf echo HKLM,"SYSTEM\ControlSet001\Services\Norton AntiVirus Server" >> nrtf2.inf echo HKLM,"SYSTEM\ControlSet003\Enum\Root\LEGACY_NORTON_ANTIVIRUS_SERVER" >> nrtf2.inf echo HKLM,"SYSTEM\ControlSet003\Services\Eventlog\Application","Sources" >> nrtf2.inf echo HKLM,"SYSTEM\ControlSet003\Services\Eventlog\Application\Norton AntiVirus" >> nrtf2.inf echo HKLM,"SYSTEM\ControlSet003\Services\Norton AntiVirus Server" >> nrtf2.inf echo HKLM,"SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NORTON_ANTIVIRUS_SERVER" >> nrtf2.inf echo HKLM,"SYSTEM\CurrentControlSet\Services\Eventlog\Application","Sources" >> nrtf2.inf echo HKLM,"SYSTEM\CurrentControlSet\Services\Eventlog\Application\Norton AntiVirus" >> nrtf2.inf echo HKLM,"SYSTEM\CurrentControlSet\Services\Norton AntiVirus Server" >> nrtf2.inf echo HKLM,"SOFTWARE\Classes\CLSID\{0F0E0EE0-760F-11D2-8E55-72C9EE000000}\InPorcServ32","" >> nrtf2.inf echo HKLM,"SOFTWARE\Classes\CLSID\{4C34B690-D1B7-11D1-B041-00104B252EEA}\InProcServ32","" >> nrtf2.inf echo HKLM,"SOFTWARE\Classes\CLSID\{E381F1C0-910E-11D1-AB1E-00A0C90F8F6F}\InProcServ32","" >> nrtf2.inf echo HKLM,"SOFTWARE\Classes\CLSID\{E381F1D0-910E-11D1-AB1E-00A0C90F8F6F}\InProcServ32","" >> nrtf2.inf echo HKLM,"SOFTWARE\Classes\Installer\Products\74BE21DBFDBD3D11EBAE000ACC725290\SourceList","LastUsedSource" >> nrtf2.inf echo HKLM,"SOFTWARE\Classes\Installer\Products\74BE21DBFDBD3D11EBAE000ACC725290\SourceList","PackageName" >> nrtf2.inf echo HKLM,"SOFTWARE\Classes\Installer\Products\74BE21DBFDBD3D11EBAE000ACC725290\SourceList\Media","1" >> nrtf2.inf echo HKLM,"SOFTWARE\Classes\Installer\Products\74BE21DBFDBD3D11EBAE000ACC725290\SourceList\Net","1" >> nrtf2.inf echo HKLM,"SOFTWARE\Classes\TypeLib\{E381F1B0-910E-11D1-AB1E-00A0C90F8F6F}\1.0\0\win32","" >> nrtf2.inf echo HKLM,"SOFTWARE\Classes\TypeLib\{E381F1B0-910E-11D1-AB1E-00A0C90F8F6F}\1.0\HELPDIR","" >> nrtf2.inf echo HKLM,"SOFTWARE\Classes\TypeLib\{E381F1F0-910E-11D1-AB1E-00A0C90F8F6F}\1.0\0\win32","" >> nrtf2.inf echo HKLM,"SOFTWARE\Classes\TypeLib\{E381F1F0-910E-11D1-AB1E-00A0C90F8F6F}\1.0\HELPDIR","" >> nrtf2.inf echo HKLM,"SOFTWARE\Intel\DLLUsage\VP6","C:\Program Files\NavNT\Cliproxy.dll" >> nrtf2.inf echo HKLM,"SOFTWARE\Intel\DLLUsage\VP6","C:\Program Files\NavNT\Cliscan.dll" >> nrtf2.inf echo HKLM,"SOFTWARE\Intel\LANDesk\AMS2\Installed\Files","C:\WINDOWS\System32\CBA.DLL" >> nrtf2.inf echo HKLM,"SOFTWARE\Intel\LANDesk\AMS2\Installed\Files","C:\WINDOWS\System32\MSGSYS.DLL" >> nrtf2.inf echo HKLM,"SOFTWARE\Intel\LANDesk\AMS2\Installed\Files","C:\WINDOWS\System32\NTS.DLL" >> nrtf2.inf echo HKLM,"SOFTWARE\Intel\LANDesk\AMS2\Installed\Files","C:\WINDOWS\System32\PDS.DLL" >> nrtf2.inf echo HKLM,"SOFTWARE\Intel\LANDesk\VirusProtect6\CurrentVersion","Home Directory" >> nrtf2.inf echo HKLM,"SOFTWARE\Intel\LANDesk\VirusProtect6\CurrentVersion","ScanEngineHelpFile" >> nrtf2.inf echo HKLM,"SOFTWARE\Intel\LANDesk\VirusProtect6\CurrentVersion","ScanEngineVendor" >> nrtf2.inf echo HKLM,"SOFTWARE\Intel\LANDesk\VirusProtect6\CurrentVersion\AddressCache\AMTHOSLB003","ScanEngineVendor" >> nrtf2.inf echo HKLM,"SOFTWARE\Intel\LANDesk\VirusProtect6\CurrentVersion\AddressCache\THOMADP01","ScanEngineVendor" >> nrtf2.inf echo HKLM,"SOFTWARE\Intel\LANDesk\VirusProtect6\CurrentVersion\AddressCache\THOMBC","ScanEngineVendor" >> nrtf2.inf echo HKLM,"SOFTWARE\Intel\LANDesk\VirusProtect6\CurrentVersion\AddressCache\THOMBDC01","ScanEngineVendor" >> nrtf2.inf echo HKLM,"SOFTWARE\Intel\LANDesk\VirusProtect6\CurrentVersion\AddressCache\THOMFS01","ScanEngineVendor" >> nrtf2.inf echo HKLM,"SOFTWARE\Intel\LANDesk\VirusProtect6\CurrentVersion\AddressCache\THOMFS02","ScanEngineVendor" >> nrtf2.inf echo HKLM,"SOFTWARE\Intel\LANDesk\VirusProtect6\CurrentVersion\AddressCache\US007SLB02","ScanEngineVendor" >> nrtf2.inf echo HKLM,"SOFTWARE\Intel\LANDesk\VirusProtect6\CurrentVersion\LiveUpdate\CmdLines\CmdLine4","ProductName" >> nrtf2.inf echo HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VPC32.exe","" >> nrtf2.inf echo HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VPC32.exe","Path" >> nrtf2.inf echo HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders","C:\Program Files\NavNT\" >> nrtf2.inf echo HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\218DE8335E5F43149B75B22C20DFBEC3","74BE21DBFDBD3D11EBAE000ACC725290" >> nrtf2.inf echo HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\28BB6CD8045F3D11EBAE000ACC725290","74BE21DBFDBD3D11EBAE000ACC725290" >> nrtf2.inf echo HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\472173E95AB54D1169B6000B0DC413E4","74BE21DBFDBD3D11EBAE000ACC725290" >> nrtf2.inf echo HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5101DD4505ED3D11EBAE000ACC725290","74BE21DBFDBD3D11EBAE000ACC725290" >> nrtf2.inf echo HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6101DD4505ED3D11EBAE000ACC725290","74BE21DBFDBD3D11EBAE000ACC725290" >> nrtf2.inf echo HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6423CCFDE80F3D11EBAE000ACC725290","74BE21DBFDBD3D11EBAE000ACC725290" >> nrtf2.inf echo HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7101DD4505ED3D11EBAE000ACC725290","74BE21DBFDBD3D11EBAE000ACC725290" >> nrtf2.inf echo HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7423CCFDE80F3D11EBAE000ACC725290","74BE21DBFDBD3D11EBAE000ACC725290" >> nrtf2.inf echo HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8101DD4505ED3D11EBAE000ACC725290","74BE21DBFDBD3D11EBAE000ACC725290" >> nrtf2.inf echo HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8CEB13BB56124D11EBBE000ACC725290","74BE21DBFDBD3D11EBAE000ACC725290" >> nrtf2.inf echo HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B4FFE96DE945CCD4EA131CC16AF59A26","74BE21DBFDBD3D11EBAE000ACC725290" >> nrtf2.inf echo HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FD2DF15D3CAE8614F89D0FFA74A2618E","74BE21DBFDBD3D11EBAE000ACC725290" >> nrtf2.inf echo HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\74BE21DBFDBD3D11EBAE000ACC725290","InstallSource" >> nrtf2.inf echo HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Run","vptray" >> nrtf2.inf echo HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BD12EB47-DBDF-11D3-BEEA-00A0CC272509}","InstallSource" >> nrtf2.inf echo HKLM,"SOFTWARE\Symantec\InstalledApps","NAV" >> nrtf2.inf echo HKLM,"SOFTWARE\Symantec\InstalledApps","NAVCEClientNumber" >> nrtf2.inf echo HKLM,"SOFTWARE\Symantec\InstalledApps","NAVNT" >> nrtf2.inf echo HKLM,"SOFTWARE\Symantec\InstalledApps","VP6ClientInstalled" >> nrtf2.inf echo HKLM,"SOFTWARE\Symantec\InstalledApps","VP6UsageCount" >> nrtf2.inf echo HKLM,"SOFTWARE\Symantec\SharedDefs","NAVCORP_70" >> nrtf2.inf echo HKLM,"SOFTWARE\Symantec\SharedUsage\S32STAT.DLL","NAVNT" >> nrtf2.inf echo HKLM,"SOFTWARE\Symantec\Symevent\NAVNT" >> nrtf2.inf echo HKLM,"SOFTWARE\Symantec\Symevent\VDD\NAVNT" >> nrtf2.inf echo HKLM,"SYSTEM\ControlSet001\Services\DefWatch","ImagePath" >> nrtf2.inf echo HKLM,"SYSTEM\ControlSet001\Services\Eventlog\Application\Defwatch","EventMessageFile" >> nrtf2.inf echo HKLM,"SYSTEM\ControlSet001\Services\Eventlog\Application\Norton AntiVirus","EventMessageFile" >> nrtf2.inf echo HKLM,"SYSTEM\ControlSet001\Services\Eventlog\System\NAVAP" >> nrtf2.inf echo HKLM,"SYSTEM\ControlSet001\Services\NAVAPEL" >> nrtf2.inf echo HKLM,"SYSTEM\ControlSet001\Services\Norton AntiVirus Server" >> nrtf2.inf echo HKLM,"SYSTEM\ControlSet003\Enum\Root\LEGACY_NAVAP" >> nrtf2.inf echo HKLM,"SYSTEM\ControlSet003\Services\DefWatch","ImagePath" >> nrtf2.inf echo HKLM,"SYSTEM\ControlSet003\Services\Eventlog\Application\Defwatch","EventMessageFile" >> nrtf2.inf echo HKLM,"SYSTEM\ControlSet003\Services\Eventlog\Application\Norton AntiVirus" >> nrtf2.inf echo HKLM,"SYSTEM\ControlSet003\Services\Eventlog\System\NAVAP" >> nrtf2.inf echo HKLM,"SYSTEM\ControlSet003\Services\NAVAPEL" >> nrtf2.inf echo HKLM,"SYSTEM\ControlSet003\Services\Norton AntiVirus Server" >> nrtf2.inf echo HKLM,"SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NAVAP" >> nrtf2.inf echo HKLM,"SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NAVAPEL" >> nrtf2.inf echo HKLM,"SYSTEM\CurrentControlSet\Services\DefWatch" >> nrtf2.inf echo HKLM,"SYSTEM\CurrentControlSet\Services\Eventlog\Application\Norton AntiVirus" >> nrtf2.inf echo HKLM,"SYSTEM\CurrentControlSet\Services\Eventlog\System\NAVAP" >> nrtf2.inf echo HKLM,"SYSTEM\CurrentControlSet\Services\NAVAPEL" >> nrtf2.inf echo HKLM,"SYSTEM\CurrentControlSet\Services\Norton AntiVirus Server" >> nrtf2.inf echo HKLM,"SYSTEM\CurrentControlSet\Services\DefWatch" >> nrtf2.inf echo HKLM,"SYSTEM\CurrentControlSet\Services\NAVAPEL" >> nrtf2.inf echo HKLM,"SYSTEM\CurrentControlSet\Services\Norton AntiVirus Client" >> nrtf2.inf echo HKLM,"SYSTEM\CurrentControlSet\Services\SymEvent" >> nrtf2.inf echo HKLM,"SYSTEM\CurrentControlSet\Services\Eventlog\Application\Norton AntiVirus" >> nrtf2.inf echo HKLM,"SOFTWARE\Intel\DLLUsage\VP6" >> nrtf2.inf echo HKLM,"SOFTWARE\Symantec\InstalledApps","NAV" >> nrtf2.inf echo HKLM,"SOFTWARE\Symantec\InstalledApps","NAVCEClientNumber" >> nrtf2.inf echo HKLM,"SOFTWARE\Symantec\InstalledApps","NAVNT" >> nrtf2.inf echo HKLM,"SOFTWARE\Symantec\InstalledApps","VP6ClientInstalled" >> nrtf2.inf echo HKLM,"SOFTWARE\Symantec\InstalledApps","VP6UsageCount" >> nrtf2.inf echo HKLM,"SOFTWARE\Symantec\SharedDefs" >> nrtf2.inf echo HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Run","vptray" >> nrtf2.inf echo HKLM,"SOFTWARE\Classes\cliscan.objects" >> nrtf2.inf echo HKLM,"SOFTWARE\Classes\cliscan.objects.1" >> nrtf2.inf echo HKLM,"SOFTWARE\Classes\CLSID\{E381F1D0-910E-11D1-AB1E-00A0C90F8F6F}" >> nrtf2.inf echo HKLM,"SOFTWARE\Classes\TypeLib\{E381F1F0-910E-11D1-AB1E-00A0C90F8F6F}" >> nrtf2.inf echo HKLM,"SOFTWARE\Intel\DLLUsage\VP6" >> nrtf2.inf echo HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6101DD4505ED3D11EBAE000ACC725290" >> nrtf2.inf echo HKU,"S-1-5-21-743575872-1462718611-313593124-500\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit","LastKey" >> nrtf2.inf echo HKU,"S-1-5-21-2399707958-2276519234-2128154401-500\Software\Microsoft\Windows\ShellNoRoam\MUICache","C:\Program Files\NavNT\vptray.exe" >> nrtf2.inf echo %COMPUTERNAME% %username% %TIME% %date% created reg removal tool>> \\Thomfs02\lan\IT\NortonClientRemovals\NortonAntiVirusRemovalList.txt :SKIPREG ::If the registry has already been backed up for this removal skip backing it up again IF EXIST \\Thomfs02\lan\IT\NortonClientRemovals\%computername% GOTO Next GOTO Create :Create ::Backup the registry md \\Thomfs02\lan\IT\NortonClientRemovals\%computername%\ regedit /e \\Thomfs02\lan\IT\NortonClientRemovals\%computername%\registrybackup.reg echo %COMPUTERNAME% %username% %TIME% %date% backed up registry >> \\Thomfs02\lan\IT\NortonClientRemovals\NortonAntiVirusRemovalList.txt GOTO Next :Next ::Run nrtf2.inf to delete registry keys rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 .\nrtf2.inf echo %COMPUTERNAME% %username% %TIME% %date% ran reg removal tool >> \\Thomfs02\lan\IT\NortonClientRemovals\NortonAntiVirusRemovalList.txt ::Scroll to root dir cd.. cd.. cd.. cd.. cd.. cd.. echo %COMPUTERNAME% %username% %TIME% %date% changed dir to root >> \\Thomfs02\lan\IT\NortonClientRemovals\NortonAntiVirusRemovalList.txt ::Change to program files dir cd c:\program files echo %COMPUTERNAME% %username% %TIME% %date% changed dir to c:\program files >> \\Thomfs02\lan\IT\NortonClientRemovals\NortonAntiVirusRemovalList.txt ::Delete NavNT folder from program files del NavNT\*.* /q /f echo %COMPUTERNAME% %username% %TIME% %date% deleted NavNT folder >> \\Thomfs02\lan\IT\NortonClientRemovals\NortonAntiVirusRemovalList.txt ::Output to the server the computers name and who was logged in when action was completed echo %COMPUTERNAME% %username% %TIME% %date% completed uninstalling *********************************************************>> \\Thomfs02\lan\IT\NortonClientRemovals\NortonAntiVirusRemovalList.txt ::Create verification document on lan drive echo Norton AntiVirus7.6 Corp has been removed %TIME% %date% >> \\Thomfs02\lan\IT\NortonClientRemovals\%computername%\%COMPUTERNAME%%username%.txt ::reboot the pc shutdown -r -t 0 ------- END OF THE PROGRAM! (Round of applause for SN for helping me write the registry key deletion section!! THANKS!)

Ian: You cannot install a batchfile (*.bat file) as a TSR routine directly. What you need is a TSR routine which executes the batch file when the user enters say CTRL+A. I can help you with this but I need you to post a message saying if you're interested. Kenneth

Ian: I want to be honest with you. Monitoring keystrokes though a TSR routine invokes a hard to handle low level routine that's not kid's stuff. An easy way would be a program that is invoked as a background process by your OS when it starts up. When a user enters say CTRL+A the process responds by calling your batch file. Then your batch file wipes out whatever registry key it has to wipe out. When your batch file terminates, the process regains control and continues to run as a background process. There's an additional problem here, however. Your background process needs to be in focus for the user to interact with this background process. Please fill free to respond if you're still interested. Kenneth