Adware Removal script

###########################################################
-->> ABOUT
###########################################################
(*

 Phil Stokes -- 2017
 applehelpwriter.com
 sqwarq.com

*)
###########################################################
-->> DESCRIPTION
###########################################################
(*

Remove adware components from a Mac

*)
###########################################################
-->> USAGE
###########################################################
(*

Open this script with the Script Editor.app located at
/Applications/Utilities/Script Editor.app

At the bottom left of the window, click the 3rd icon and click the 'Events' button in the pane.

Click the ▶︎ button in the Editor's toolbar.

Provide an administrator password to authorise the removal of the adware items.

If you receive any error messages, please take a screenshot of the error and contact support@sqwarq.com

If you receive any error messages, do not quit the Script Editor or close the script window as it contains information that you may be asked for. You can dismiss the error message.

*)


# constants
set tLabel to "Sqwarq Adware Removal Script"
set removalList to {"/Library/ZAgxheFe/ZAgxheFe.app/Contents/MacOS/ZAgxheFe", "/Library/ZAgxheFe/ZAgxheFe.app", "/Library/ZAgxheFe", "/Library/outtrick/outtrick", "/Library/outtrick", "~/Library/LaunchAgents/com.outtrick.plist", "/Library/LaunchDaemons/com.ZAgxheFe.plist", "/Library/LaunchAgents/com.filite.plist"}

set refusedToDieList to {}
set msg to ""


#handlers
on checkExistence:suspect
    if suspect begins with "~" then
        set suspect to (POSIX path of (path to home folder)) & text 2 thru -1 of suspect
    end if
    tell application "Finder"
        if exists suspect as POSIX file then
            return true
        else
            return false
        end if
    end tell
end checkExistence:

on doubleEscapeSpaces:aPath
    if aPath contains " " then
        set o to offset of " " in aPath
        set _prefix to text 1 thru (o - 1) of aPath
        set _suffix to text o thru -1 of aPath
        set aPath to _prefix & "\\" & _suffix
    end if
    return aPath
end doubleEscapeSpaces:

#commands
repeat with i from 1 to count of removalList
    set doesExist to false
    set remove_item to item i of removalList
    set doesExist to (its checkExistence:remove_item)
    # 'quoted form' isn't reliable, so:
    set shell_item to (its doubleEscapeSpaces:remove_item)
    try
        if doesExist is true then
            do shell script "rm -rf " & shell_item with administrator privileges
        end if
    on error
        set end of refusedToDieList to remove_item
        log "Could not remove " & remove_item
    end try
    if (its checkExistence:remove_item) then
        set end of refusedToDieList to remove_item
    end if
end repeat


# results
if (count of refusedToDieList) < (count of removalList) then
    set msg to "Restart your Mac to complete the removal of the adware infection." & return & return & "Quit this script, save any other work, and choose 'Restart' from the  Apple menu."
else if (count of refusedToDieList) > 0 then
    set msg to "Error: Could not delete one or more items."
    display dialog msg with title tLabel buttons "OK" default button "OK" with icon 1
else
    set msg to "The script failed for an unknown reason. "
end if
display dialog msg with title tLabel buttons "OK" default button "OK" with icon 1