diff --git a/BlockWindows.bat b/BlockWindows.bat
index fbe65fc..a10f5f2 100644
--- a/BlockWindows.bat
+++ b/BlockWindows.bat
@@ -9,76 +9,7 @@ if not %errorlevel% equ 0 (
 SETLOCAL
 
 REM --- uninstall updates
-echo uninstalling updates, be patient...
-echo Delete KB971033 (license validation)
-start "title" /b /wait wusa.exe /kb:971033 /uninstall /quiet /norestart
-echo  - next
-echo Delete KB2902907 (Microsoft Security Essentials)
-start "title" /b /wait wusa.exe /kb:2902907 /uninstall /quiet /norestart
-echo  - next
-echo Delete KB2952664 (Get Windows 10 assistant)
-start "title" /b /wait wusa.exe /kb:2952664 /uninstall /quiet /norestart
-echo  - next
-echo Delete KB2976978 (update for windows 8.1 and windows 8)
-start "title" /b /wait wusa.exe /kb:2976978 /uninstall /quiet /norestart
-echo  - next
-echo Delete KB2977759 (update for windows 7 rtm)
-start "title" /b /wait wusa.exe /kb:2977759 /uninstall /quiet /norestart
-echo  - next
-echo Delete KB2990214 (Get Windows 10 for Win7)
-start "title" /b /wait wusa.exe /kb:2990214 /uninstall /quiet /norestart
-echo  - next
-echo Delete KB3012973 (Upgrade to Windows 10 Pro)
-start "title" /b /wait wusa.exe /kb:3012973 /uninstall /quiet /norestart
-echo  - next
-echo Delete KB3014460 (Upgrade for windows insider preview / upgrade to windows 10)
-start "title" /b /wait wusa.exe /kb:3014460 /uninstall /quiet /norestart
-echo  - next
-echo Delete KB3015249 (Upgrade that adds telemetry points to consent.exe in Windows 8.1 and Windows 7)
-start "title" /b /wait wusa.exe /kb:3015249 /uninstall /quiet /norestart
-echo  - next
-echo Delete KB3021917 (update to Windows 7 SP1 for performance improvements)
-start "title" /b /wait wusa.exe /kb:3021917 /uninstall /quiet /norestart
-echo  - next
-echo Delete KB3022345 (telemetry)
-start "title" /b /wait wusa.exe /kb:3022345 /uninstall /quiet /norestart
-echo  - next
-echo Delete KB3035583 (GWX Update installs Get Windows 10 app in Windows 8.1 and Windows 7 SP1)
-start "title" /b /wait wusa.exe /kb:3035583 /uninstall /quiet /norestart
-echo  - next
-echo Delete KB3044374 (Get Windows 10 for Win8.1)
-start "title" /b /wait wusa.exe /kb:3044374 /uninstall /quiet /norestart
-echo  - next
-echo Delete KB3050265 (update for Windows Update on Win7)
-start "title" /b /wait wusa.exe /kb:3050265 /uninstall /quiet /norestart
-echo  - next
-echo Delete KB3050267 (update for windows update client for windows 8.1 june 2015)
-start "title" /b /wait wusa.exe /kb:3050267 /uninstall /quiet /norestart
-echo  - next
-echo Delete KB3065987 (update for Windows Update on Win7/Server 2008R2)
-start "title" /b /wait wusa.exe /kb:3065987 /uninstall /quiet /norestart
-echo  - next
-echo Delete KB3068708 (telemetry)
-start "title" /b /wait wusa.exe /kb:3068708 /uninstall /quiet /norestart
-echo  - next
-echo Delete KB3075249 (telemetry for Win7/8.1)
-start "title" /b /wait wusa.exe /kb:3075249 /uninstall /quiet /norestart
-echo  - next
-echo Delete KB3075851 (update for Windows Update on Win7/Server 2008R2)
-start "title" /b /wait wusa.exe /kb:3075851 /uninstall /quiet /norestart
-echo  - next
-echo Delete KB3075853 (update for Windows Update on Win8.1/Server 2012R2)
-start "title" /b /wait wusa.exe /kb:3075853 /uninstall /quiet /norestart
-echo  - next
-echo Delete KB3080149 (Telemetry)
-start "title" /b /wait wusa.exe /kb:3080149 /uninstall /quiet /norestart
-echo  - done.
-timeout 5
-
-REM --- Hide updates
-echo Hiding updates, may take a while be patient...
-
-start "title" /b /wait cscript.exe "%~dp0HideWindowsUpdates.vbs" 971033 2902907 2952664 2976978 2977759 2990214 3012973 3014460 3015249 3021917 3022345 3035583 3044374 3050265 3050267 3065987 3068708 3075249 3075851 3075853 3080149 
+start "title" /b /wait cscript.exe /nologo "%~dp0CleanMaliciousUpdates.js"
 echo  - done.
 
 REM --- Disable tasks
diff --git a/CleanMaliciousUpdates.js b/CleanMaliciousUpdates.js
new file mode 100644
index 0000000..12ce09b
--- /dev/null
+++ b/CleanMaliciousUpdates.js
@@ -0,0 +1,102 @@
+"use strict";
+// Inspired by Opmet and Colin Bowern: http://serverfault.com/a/341318
+// rewritten by KOLANICH
+var shell = new ActiveXObject("WScript.Shell");
+var fs = new ActiveXObject("Scripting.FileSystemObject");
+
+function getFileText(fn) {//<reads text from file and puts into JS string
+	fn = fs.OpenTextFile(shell.ExpandEnvironmentStrings(fn), 1, false);
+	var text = fn.ReadAll();
+	fn.Close();
+	return text;
+}
+eval(getFileText("./libMSUpdater.js"));
+var cfgText = getFileText("./config.js");//<loads config
+eval("var config=" + cfgText); //Sorry, there is no JSON.parse in WSH, so we have to use evil
+WScript.Echo("Current config:\n" + cfgText);
+
+
+function detectMaliciousUpdates(updates){//<detects malicious updates in 2 ways: db of malicious kb and heuristics
+	var  res={
+		toUninstall:[],//<needed to be uninstalled
+		toHide:[],//<needed to be hidden
+		suspicious:[]//<suspicious updates, we need to check them manually
+	};
+	for (var i = 0, j; i < updates.length; i++) {
+		var update = updates[i];
+		var badUpdate = false;//<flag to exit loop
+		for (var name in update.kbs) {//one update can have multiple kbs
+			for (j = 0; j < config.blacklists.kbs.length; ++j) {//checks wheither kb number of update is within blacklist
+				if (name == config.blacklists.kbs[j]) {
+					if (update.installed) {
+						res.toUninstall.push(update);
+					}
+					if (!update.hidden) {
+						res.toHide.push(update);
+					}
+					badUpdate = true;
+					break;
+				}
+			}
+			if (badUpdate) break;
+		}
+		if (
+			!badUpdate //<already blacklisted update, doesn't need to check
+			&& (
+				!update.cves.length //< update fixes security vulnerabilities, so it is not very probable that it is related to surveillance
+				&& config.heuristics //< heuristics enabled
+			)
+		) {
+			for (var prop in config.blacklists.keywords) {//enumerating blacklists, each blacklist corresponds to property of MSUpdate
+				try {
+					var target = (prop.indexOf("get") ? update[prop] : update[prop]()).toLowerCase();//< if the blacklist's name starts with get, we call getter. Also we make text lowercase to make case-insensitive matches.
+				} catch (x) {
+					WScript.Echo("Warning: there is no property/method " + prop + " in the lib");
+				}
+				for (j = 0; j < config.blacklists.keywords[prop].length; ++j) {
+					if (target.indexOf(config.blacklists.keywords[prop]) > -1) {
+						badUpdate=true;
+						res.suspicious.push(update);
+						break;
+					}
+				}
+				if (badUpdate)break;
+			}
+		}
+	}
+	return res;
+}
+
+function main(simulate) {
+	if ("undefined" == typeof simulate) {
+		simulate = 1;
+	}
+	function updatesToKbs(updates) {//<convert array of update objects to array of kb codes
+		var kbs = [];
+		for (var i = 0; i < updates.length; i++) {
+			for (var update in updates[i].kbs) {
+				kbs.push(update);
+			}
+		}
+		return kbs;
+	}
+	WScript.Echo("Getting list of updates...");
+	var project = new MSUpdater;
+	var updates = project.getUpdates("IsHidden=1 OR IsHidden=0");
+	WScript.Echo(updates.length + " updates found. Filtering ....");
+	var res=detectMaliciousUpdates(updates);
+	
+	WScript.Echo(
+		"Following updates will be uninstalled:\n" + updatesToKbs(res.toUninstall).join(", ") +
+		"\nFollowing updates will be hidden:\n" + updatesToKbs(res.toHide).join(", ") +
+		"\nThe following updates are suspicious (you may want to examine them manually):\n" + updatesToKbs(res.suspicious).join(", ")
+	);
+	if (!simulate) {
+		project.uninstall(res.toUninstall);//ms update (un)installs bunch of updates at once
+		i = 0;
+		for (; i < res.toHide.length; i++) {
+			res.toHide[i].hide();//hide the updates
+		}
+	}
+}
+main();
\ No newline at end of file
diff --git a/HideWindowsUpdates.vbs b/HideWindowsUpdates.vbs
deleted file mode 100644
index 5b859e8..0000000
--- a/HideWindowsUpdates.vbs
+++ /dev/null
@@ -1,39 +0,0 @@
-'// Inspired by Opmet and Colin Bowern: http://serverfault.com/a/341318
-If Wscript.Arguments.Count < 1 Then
-    WScript.Echo "Syntax: HideWindowsUpdates.vbs [Hotfix Article ID]" & vbCRLF & _
-        " - Examples: HideWindowsUpdates.vbs 2990214" & vbCRLF & _
-        " - Examples: HideWindowsUpdates.vbs 3022345 3035583"
-    WScript.Quit 1
-End If
-
-Dim objArgs
-Set objArgs = Wscript.Arguments
-Dim updateSession, updateSearcher
-Set updateSession = CreateObject("Microsoft.Update.Session")
-Set updateSearcher = updateSession.CreateUpdateSearcher()
-
-Wscript.Stdout.Write "Searching for pending updates..." 
-Dim searchResult
-Set searchResult = updateSearcher.Search("IsInstalled=0")
-
-Dim update, kbArticleId, index, index2
-WScript.Echo CStr(searchResult.Updates.Count) & " found."
-For index = 0 To searchResult.Updates.Count - 1
-    Set update = searchResult.Updates.Item(index)
-    For index2 = 0 To update.KBArticleIDs.Count - 1
-        kbArticleId = update.KBArticleIDs(index2)
-
-        For Each hotfixId in objArgs
-            If kbArticleId = hotfixId Then
-                If update.IsHidden = False Then
-                    WScript.Echo "Hiding update: " & update.Title
-                    update.IsHidden = True
-                Else
-                    WScript.Echo "Already hidden: " & update.Title
-                End If          
-            End If
-        Next
-
-    Next
-Next
-'// EOF
diff --git a/README.md b/README.md
index 71aae90..cb15d7e 100644
--- a/README.md
+++ b/README.md
@@ -17,7 +17,11 @@ hostlist MS Hosts file to blocking for router or firewall use
 
 hosts-dnsmasq Hosts file for dd-wrt and other routers 
 
-HideWindowsUpdates.vbs Hides blocked updates, to reinstall click 'show hidden updates'
+CleanMaliciousUpdates.js Hides blocked updates, to reinstall enter 'show hidden updates'. Also detects suspicious updates.
+
+libMSUpdater.js A wrapper to deal with updates from WSH
+
+config.js A JSON config for ```CleanMaliciousUpdates.js.``` Extension ```.js``` is used because there is no ```JSON.parse``` in WSH
 
 DisableWiFiSense.reg Adds registry to disable WiFi Sense, which steals your wifi password without your consent.
 
diff --git a/config.js b/config.js
new file mode 100644
index 0000000..2953e92
--- /dev/null
+++ b/config.js
@@ -0,0 +1,13 @@
+{
+	blacklists : {
+		kbs : [971033, 2902907, 2952664, 2976978, 2977759, 2990214, 3012973, 3014460, 3015249, 3021917, 3022345, 3035583, 3044374, 3050265, 3050267, 3065987, 3068708, 3075249, 3075851, 3075853, 3080149],
+		keywords : {
+			title : ["telemetry", "assistant", "license"],
+			getReleaseNotes : ["telemetry"],
+			getEULA : ["grant", "privacy", "telemetry", "government"],
+			getDescription : ["assistant", "telemetry"]
+		}
+
+	},
+	heuristics : true
+}
\ No newline at end of file
diff --git a/libMSUpdater.js b/libMSUpdater.js
new file mode 100644
index 0000000..2380c79
--- /dev/null
+++ b/libMSUpdater.js
@@ -0,0 +1,178 @@
+"use strict";
+/*
+This is free and unencumbered software released into the public domain.
+
+Anyone is free to copy, modify, publish, use, compile, sell, or
+distribute this software, either in source code form or as a compiled
+binary, for any purpose, commercial or non-commercial, and by any
+means.
+
+In jurisdictions that recognize copyright laws, the author or authors
+of this software dedicate any and all copyright interest in the
+software to the public domain. We make this dedication for the benefit
+of the public at large and to the detriment of our heirs and
+successors. We intend this dedication to be an overt act of
+relinquishment in perpetuity of all present and future rights to this
+software under copyright law.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+OTHER DEALINGS IN THE SOFTWARE.
+
+For more information, please refer to <http://unlicense.org/>
+ */
+ //@author KOLANICH
+
+function MSUpdateArticle(kb) {//< represents a kb article
+	this.kb = kb;
+}
+MSUpdateArticle.kb = null;
+
+function MSUpdate(updObj) {//<represents update
+	this.updateObj = updObj;
+
+	this.title = this.updateObj.Title;//<update's title
+	this.installed = this.updateObj.IsInstalled;//<is update installed in system?
+	this.uninstallable = this.updateObj.IsUninstallable;//<can update be uninstalled?
+	this.hidden = this.updateObj.IsHidden;//<is update hidden?
+	this.mandatory = this.updateObj.IsMandatory;//<is update mandatory?
+	this.beta = this.updateObj.IsBeta;//<is it beta?
+	this.downloaded = this.updateObj.IsDownloaded;//<was the update downloaded
+	this.requiresReboot = this.updateObj.RebootRequired;//<does installation/uninstallation
+	this.id = this.updateObj.Identity.UpdateID;//< uuid of update
+	this.revision = this.updateObj.Identity.RevisionNumber;//< its revision
+	this.deadline = this.updateObj.Deadline ? new Date((this.updateObj.Deadline + 0)) : null;//< its date of 
+	this.eulaAccepted = this.updateObj.EulaAccepted;//< have we accepted EULA?
+	this.severity = this.updateObj.MsrcSeverity;//how much is it dangerous?
+
+	switch (this.updateObj.AutoDownload) {
+	case 0:
+		this.autoDownload = "auto";
+		break;
+	case 1:
+		this.autoDownload = "never";
+		break;
+	case 2:
+		this.autoDownload = "always";
+		break;
+	default:
+		this.autoDownload = "?";
+		break;
+	}
+	switch (this.updateObj.Type) {
+	case 1:
+		this.type = "software";
+		break;
+	case 2:
+		this.type = "driver";
+		break;
+	default:
+		this.type = "?";
+		break;
+	}
+
+	this.kbs = {};
+	for (var j = 0; j < this.updateObj.KBArticleIDs.Count; j++) {
+		var kb = Number(this.updateObj.KBArticleIDs(j));
+		this.kbs[kb] = new MSUpdateArticle(kb);
+	}
+	this.cves = [];
+	for (var j = 0; j < this.updateObj.CveIDs.Count; j++)
+		this.cves.push(this.updateObj.CveIDs(j));
+	this.supportUrl = this.updateObj.SupportUrl;
+
+}
+
+MSUpdate.prototype.kbs = {};//< kb articles related to update
+MSUpdate.prototype.cves = [];//<security vulnerabilities related to update
+MSUpdate.prototype.updateObj = null;//<WSH object
+
+MSUpdate.prototype.hide = function (hide) {//<hides/unhides update
+	this.hidden = (typeof hide == "undefined") ? true : false;
+	this.updateObj.IsHidden = this.hidden;
+}
+MSUpdate.prototype.unhide = function () {//<unhides update
+	return this.hide(false);
+}
+MSUpdate.prototype.getEULA = function () {//<gives you update EULA
+	return this.updateObj.EulaText;
+}
+MSUpdate.prototype.getBundled = function () {//< gives you bundled updates (as objects)
+	return this.updater._collection2Arr(this.updateObj.BundledUpdates);
+}
+MSUpdate.prototype.getReleaseNotes = function () {//< gives you release notes for update
+	return this.updateObj.ReleaseNotes;
+}
+MSUpdate.prototype.getDescription = function () {//<gives update's localised description
+	return this.updateObj.Description;
+}
+MSUpdate.prototype.toJSON = function () {//<needed if you want to serialize updates w/o undesired internal fields
+	return {
+		title : this.title,
+		installed : this.installed,
+		uninstallable : this.uninstallable,
+		hidden: this.hidden,
+		mandatory : this.mandatory,
+		beta : this.beta,
+		downloaded : this.downloaded,
+		requiresReboot : this.requiresReboot,
+		id : this.id,
+		revision : this.revision,
+		deadline : this.deadline,
+		eulaAccepted : this.eulaAccepted,
+		severity : this.severity,
+		autoDownload : this.autoDownload,
+		type : this.type,
+		kbs: this.kbs,
+		cves: this.cves
+	};
+}
+
+function MSUpdater() {//<represents MS Update service, singleton
+	MSUpdater.session = MSUpdater.session || new ActiveXObject("Microsoft.Update.Session");
+	MSUpdater.installer = MSUpdater.installer || MSUpdater.session.CreateUpdateInstaller();
+	MSUpdater.downloader = MSUpdater.downloader || MSUpdater.session.CreateUpdateDownloader();
+	MSUpdater.searcher = MSUpdater.searcher || MSUpdater.session.CreateUpdateSearcher();
+	this.session = MSUpdater.session;
+	this.searcher = MSUpdater.searcher;
+	this.installer = MSUpdater.installer;
+	this.downloader = MSUpdater.downloader;
+	//this.searcher.IncludePotentiallySupersededUpdates=true;
+}
+MSUpdater.prototype.session = null;//<represent MS Update session
+MSUpdater.prototype.searcher = null;//<used to discover and filter updates
+MSUpdater.prototype.installer = null;//<used to instal/uninstall updates
+MSUpdater.prototype.getUpdates = function (criteria) {//<givess you updates satisfying the criteria, see https://msdn.microsoft.com/en-us/library/aa386526.aspx to understand query language
+	var searchResult = this.searcher.Search(criteria);
+	var result = [];
+	return this._collection2Arr(searchResult.Updates);
+}
+MSUpdater.prototype._arr2Collection = function (arr) {//<converts  array of MSUpdate objects to IUpdateCollection (https://msdn.microsoft.com/en-us/library/aa386107.aspx)
+	var coll = new ActiveXObject("Microsoft.Update.UpdateColl");
+	for (var i = 0; i < arr.length; i++) {
+		coll.Add(arr[i].updObj);
+	}
+	return coll;
+}
+MSUpdater.prototype._collection2Arr = function (coll) {//<converts IUpdateCollection (https://msdn.microsoft.com/en-us/library/aa386107.aspx) to array of MSUpdate objects
+	var arr = [];
+	for (var i = 0; i < coll.Count; i++) {
+		var up = new MSUpdate(coll.Item(i));
+		if (!up.updater)
+			up.updater = this;
+		arr.push(up);
+	}
+	return arr;
+}
+MSUpdater.prototype.install = function (arr) {//<installs updates
+	this.installer.Updates = this._arr2Collection(arr);
+	this.installer.Install();
+}
+MSUpdater.prototype.uninstall = function (arr) {//uninstalls updates
+	this.installer.Updates = this._arr2Collection(arr);
+	this.installer.Uninstall();
+}
\ No newline at end of file