Advertisement
Daveid

Remove ClearBar, ClearBrowser & OneLaunch

Sep 16th, 2024
153
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PowerShell 6.23 KB | Cybersecurity | 0 0
  1. # This script is used to REMOVE the presence of Clear, ClearBrowser, ClearBar, and OneLaunch on devices
  2.  
  3. # Find Clearbar related processes and stop them
  4. $valid_clear_path = "C:\Users\*\AppData\Local\*"
  5. $process_names = @("Clear", "clearbrowser", "Clear.Remoting.Native", "chrome_proxy", "chrome_pwa_launcher", "elevation_service", "notification_helper")
  6. ForEach ($proc in $process_names) {
  7.     $clear_processes = Get-Process | Where-Object { $_.Name -like $proc }
  8.     if ($clear_processes.Count -eq 0) {
  9.         Write-Output "No $proc processes were found."
  10.     } else {
  11.         Write-Output "The following processes contained Clear and file paths will be checked: $clear_processes"
  12.         ForEach ($process in $clear_processes) {
  13.             $path = $process.Path
  14.             if ($path -like $valid_clear_path) {
  15.                 Stop-Process $process -Force -Confirm:$false
  16.                 Write-Output "$process.Name process file path matches and has been stopped."
  17.             } else {
  18.                 Write-Output "$process.Name file path doesn't match and process was not stopped."
  19.             }
  20.         }
  21.     }
  22. }
  23.  
  24. Start-Sleep -Seconds 2
  25.  
  26. # Find Clearbar related directories and deletes them
  27. $file_paths = @("\AppData\Local\Clear", "\AppData\Local\Clearbar", "\AppData\Local\ClearBrowser", "\AppData\Local\Programs\Clear", "\AppData\Local\Programs\Clearbar", "\AppData\Local\Temp\ClearBrowser_topsites", "\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Clear.lnk", "\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Clearbar.lnk", "\Desktop\Clear.lnk", "\Desktop\Clearbar.lnk")
  28. ForEach ($folder in (Get-ChildItem c:\Users)) {
  29.     ForEach ($fpath in $file_paths){
  30.         $path = $folder.pspath + $fpath
  31.         if (Test-Path $path) {
  32.             Remove-Item -Path $path -Recurse -Force -Confirm:$false -ErrorAction SilentlyContinue
  33.             Write-Output "$path has been deleted."
  34.         }
  35.     }
  36. }
  37.  
  38. # Find Clearbar related registry keys and removes them
  39. $reg_paths = @("\Software\Clearbar", "\Software\Clearbar.app", "\Software\ClearBrowser")
  40. ForEach ($registry_hive in (Get-ChildItem registry::hkey_users)) {
  41.     ForEach ($regpath in $reg_paths) {
  42.         $path = $registry_hive.pspath + $regpath
  43.         if (Test-Path $path) {
  44.             Remove-Item -Path $path -Recurse -Force -Confirm:$false -ErrorAction SilentlyContinue
  45.             Write-Output "$path has been removed."
  46.         }
  47.     }
  48. }
  49.  
  50. $reg_properties = @("Clearbar", "Clearbar.app", "ClearBrowser", "Clear")
  51. ForEach ($registry_hive in (Get-ChildItem registry::hkey_users)) {
  52.     ForEach ($property in $reg_properties) {
  53.         $path = $registry_hive.pspath + "\Software\Microsoft\Windows\CurrentVersion\Run"
  54.         if (Test-Path $path) {
  55.             $reg_key = Get-Item $path
  56.             if ($reg_key.GetValue($property)) {
  57.                 Remove-ItemProperty $path $property -Force -Confirm:$false
  58.                 Write-Output "$path\$property registry property value has been removed."
  59.             }
  60.         }
  61.     }
  62. }
  63.  
  64. # Find Clearbar related scheduled tasks and unregister them
  65. $schtasknames = @("ClearStartAtLoginTask", "ClearbarStartAtLoginTask", "ClearUpdateChecker", "ClearbarUpdateChecker")
  66. $c = 0
  67. ForEach ($task in $schtasknames) {
  68.     $clear_tasks = Get-ScheduledTask -TaskName $task -ErrorAction SilentlyContinue
  69.     if ($clear_tasks) {
  70.         $c++
  71.         Unregister-ScheduledTask -TaskName $task -Confirm:$false
  72.         Write-Output "Scheduled task '$task' has been removed."
  73.     }
  74. }
  75. if ($c -eq 0) {
  76.     Write-Output "No Clear scheduled tasks were found."
  77. }
  78.  
  79. # Find OneLaunch related processes and stop them
  80. $valid_path = "C:\Users\*\AppData\Local\OneLaunch\*"
  81. $process_names = @("OneLaunch", "OneLaunchTray", "Chromium")
  82. ForEach ($proc in $process_names) {
  83.     $OL_processes = Get-Process | Where-Object { $_.Name -like $proc }
  84.     if ($OL_processes.Count -eq 0) {
  85.         Write-Output "No $proc processes were found."
  86.     } else {
  87.         Write-Output "The following processes contained $proc and file paths will be checked: $OL_processes"
  88.         ForEach ($process in $OL_processes) {
  89.             $path = $process.Path
  90.             if ($path -like $valid_path) {
  91.                 Stop-Process $process -Force -Confirm:$false
  92.                 Write-Output "$proc process file path matches and has been stopped."
  93.             } else {
  94.                 Write-Output "$proc file path doesn't match and process was not stopped."
  95.             }
  96.         }
  97.     }
  98. }
  99.  
  100. Start-Sleep -Seconds 2
  101.  
  102. # Find OneLaunch related directories and deletes them
  103. $file_paths = @("\AppData\Local\OneLaunch", "\Desktop\Onelaunch Software.exe", "\Desktop\Onelaunch Software.lnk", "\Desktop\OneLaunch.lnk", "\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneLaunch.lnk", "\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneLaunchUpdater.lnk", "\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneLaunchChromium.lnk", "\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneLaunch")
  104. ForEach ($folder in (Get-ChildItem C:\Users)) {
  105.     ForEach ($fpath in $file_paths) {
  106.         $path = $folder.pspath + $fpath
  107.         if (Test-Path $path) {
  108.             Remove-Item -Path $path -Recurse -Force -Confirm:$false -ErrorAction SilentlyContinue
  109.             Write-Output "$path has been deleted."
  110.         }
  111.     }
  112. }
  113.  
  114. # Find OneLaunch related registry keys and removes them
  115. $reg_paths = @("\Software\OneLaunch")
  116. ForEach ($registry_hive in (Get-ChildItem registry::hkey_users)) {
  117.     ForEach ($regpath in $reg_paths) {
  118.         $path = $registry_hive.pspath + $regpath
  119.         if (Test-Path $path) {
  120.             Remove-item -Path $path -Recurse -Force -Confirm:$false -ErrorAction SilentlyContinue
  121.             Write-Output "$path has been removed."
  122.         }
  123.     }
  124. }
  125.  
  126. $reg_properties = @("OneLaunch")
  127. ForEach ($registry_hive in (Get-ChildItem registry::hkey_users)) {
  128.     ForEach ($property in $reg_properties) {
  129.         $path = $registry_hive.pspath + "\Software\Microsoft\Windows\CurrentVersion\Run"
  130.         if (Test-Path $path) {
  131.             $reg_key = Get-Item $path
  132.             if ($reg_key.GetValue($property)) {
  133.                 Remove-ItemProperty $path $property -Force -Confirm:$false
  134.                 Write-Output "$path\$property registry property value has been removed."
  135.             }
  136.         }
  137.     }
  138. }
  139.  
  140. # Find OneLaunch related scheduled tasks and unregister them
  141. $schtasknames = @("ChromiumLaunchTask", "OneLaunchLaunchTask")
  142. $c = 0
  143. ForEach ($task in $schtasknames) {
  144.     $clear_tasks = Get-ScheduledTask -TaskName $task -ErrorAction SilentlyContinue
  145.     if ($clear_tasks) {
  146.         $c++
  147.         Unregister-ScheduledTask -TaskName $task -Confirm:$false
  148.         Write-Output "Scheduled task '$task' has been removed."
  149.     }
  150. }
  151.  
  152. if ($c -eq 0) {
  153.     Write-Output "No OneLaunch scheduled tasks were found."
  154. }
  155.  
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement