security

@echo off
setlocal enabledelayedexpansion

:: Admin check
net session >nul 2>&1
if %errorLevel% neq 0 (
    echo ERROR: Run as Administrator!
    pause
    exit
)

:monitor
set "alert="
:: List of dangerous processes
for %%p in (wscript.exe cscript.exe certutil.exe mshta.exe vssadmin.exe bitsadmin.exe) do (
    tasklist /nh /fi "imagename eq %%p" 2>nul | findstr /i "%%p" >nul && (
        echo [%time%] !!! CRITICAL THREAT DETECTED: %%p !!!
        taskkill /f /im %%p >nul 2>&1
        set "alert=1"
    )
)

if defined alert (
    echo [%time%] EMERGENCY: Executing full network isolation...

    :: All possible ipconfig reset commands
    ipconfig /flushdns
    ipconfig /release
    ipconfig /release6
    ipconfig /registerdns

    echo [%time%] Network ISOLATED. System protected.
    echo Press any key to reconnect...
    pause >nul

    echo [%time%] Reconnecting...
    ipconfig /renew >nul 2>&1
    ipconfig /renew6 >nul 2>&1
)

:: Fast scan loop
goto monitor