Last active
September 28, 2024 13:19
-
-
Save mgeeky/041a8567a82659cbf724e988bad750cf to your computer and use it in GitHub Desktop.
Cleanup-ClickOnce.ps1 - Simple Powershell script that removes ClickOnce deployments entirely from file system and registry. Attempts to remove both installed and online-only deployments.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# | |
# Simple Powershell script that removes ClickOnce deployments entirely from file system and registry. | |
# Attempts to remove both installed and online-only deployments. | |
# | |
# Authored: Mariusz Banach / mgeeky, <mb [at] binary-offensive.com> | |
# | |
# Usage: | |
# PS> . .\Cleanup-ClickOnce.ps1 | |
# PS> Cleanup-ClickOnce -Name MyAppName | |
# | |
# Other than that you might also try using these commands: | |
# PS> rundll32 dfshim.dll,ShArpMaintain C:\Path\To\ClickOnce.application | |
# PS> rundll32 dfshim.dll CleanOnlineAppCache | |
# | |
function Cleanup-ClickOnce($Name) { | |
$NameShort = $Name | |
if ($NameShort.Length -gt 7) { | |
$NameShort = $NameShort.Substring(0, 4) + "\." | |
} | |
$rex = $NameShort + "\..+" | |
Write-Host "`nCleaning ClickOnce leftovers: $rex `n" -ForegroundColor Yellow | |
Get-ChildItem -Recurse "HKCU:\Software\Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0" -EA SilentlyContinue | ForEach-Object { | |
If ($_ -match $rex) { | |
Write-Host "[+] Cleaning: $($_.Name)" -ForegroundColor Green | |
Remove-Item -Force -Recurse "Registry::$_" -EA SilentlyContinue | Out-Null | |
} | |
} | |
Get-ChildItem -Recurse "HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall" -EA SilentlyContinue | ForEach-Object { | |
$reg = $_ | |
$props = ($_ | Get-ItemProperty).PsObject.Properties | |
$props | Where-Object { $_.Name -like "DisplayName" -and $_.Value -match $Name } | ForEach-Object { | |
Write-Host "[+] Cleaning: $($reg)" -ForegroundColor Green | |
Remove-Item -Force -Recurse "Registry::$reg" -EA SilentlyContinue | Out-Null | |
} | |
} | |
$Paths = @( | |
"$env:Localappdata\Apps\2.0" | |
"$env:Localappdata\Deployment" | |
"$env:Localappdata\Microsoft\Windows\INetCache\IE" | |
"$env:Temp\Deployment" | |
) | |
foreach ($Path in $Paths) { | |
Get-ChildItem -Recurse $Path | ForEach-Object { | |
If ($_ -match $rex) { | |
Write-Host "[+] Cleaning: $($_.FullName)" -ForegroundColor Green | |
Remove-Item -Force -Recurse $_.FullName | |
} | |
} | |
} | |
$Path = "$env:Appdata\Microsoft\Windows\Start Menu\Programs\$Name" | |
If (Test-Path -Path $Path ) { | |
Write-Host "[+] Cleaning: $Path" -ForegroundColor Green | |
Remove-Item -Force -Recurse $Path | |
} | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment