#
# Simple Powershell script that removes ClickOnce deployments entirely from file system and registry. 
# Attempts to remove both installed and online-only deployments.
#
# Authored: Mariusz Banach / mgeeky, <mb [at] binary-offensive.com>
#
# Usage:
#    PS> . .\Cleanup-ClickOnce.ps1
#    PS> Cleanup-ClickOnce -Name MyAppName
#
# Other than that you might also try using these commands:
#    PS> rundll32 dfshim.dll,ShArpMaintain C:\Path\To\ClickOnce.application
#    PS> rundll32 dfshim.dll CleanOnlineAppCache
#

function Cleanup-ClickOnce($Name) {
    $NameShort = $Name

    if ($NameShort.Length -gt 7) {
        $NameShort = $NameShort.Substring(0, 4) + "\."
    }

    $rex = $NameShort + "\..+"

    Write-Host "`nCleaning ClickOnce leftovers: $rex `n" -ForegroundColor Yellow
    
    Get-ChildItem -Recurse "HKCU:\Software\Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0" -EA SilentlyContinue | ForEach-Object {
        If ($_ -match $rex) {
            Write-Host "[+] Cleaning: $($_.Name)" -ForegroundColor Green
            Remove-Item -Force -Recurse "Registry::$_" -EA SilentlyContinue | Out-Null
        }
    }

    Get-ChildItem -Recurse "HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall" -EA SilentlyContinue | ForEach-Object {
        $reg = $_
        $props = ($_ | Get-ItemProperty).PsObject.Properties
        $props | Where-Object { $_.Name -like "DisplayName" -and $_.Value -match $Name } | ForEach-Object {
            Write-Host "[+] Cleaning: $($reg)" -ForegroundColor Green
            Remove-Item -Force -Recurse "Registry::$reg" -EA SilentlyContinue | Out-Null
        }
    }

    $Paths = @(
        "$env:Localappdata\Apps\2.0"
        "$env:Localappdata\Deployment"
        "$env:Localappdata\Microsoft\Windows\INetCache\IE"
        "$env:Temp\Deployment"
    )

    foreach ($Path in $Paths) {
        Get-ChildItem -Recurse $Path | ForEach-Object {
            If ($_ -match $rex) {
                Write-Host "[+] Cleaning: $($_.FullName)" -ForegroundColor Green
                Remove-Item -Force -Recurse $_.FullName
            }
        }
    }

    $Path = "$env:Appdata\Microsoft\Windows\Start Menu\Programs\$Name"

    If (Test-Path -Path $Path ) {
        Write-Host "[+] Cleaning: $Path" -ForegroundColor Green
        Remove-Item -Force -Recurse $Path
    }
}