Last active
May 5, 2025 05:45
-
-
Save mgeeky/041a8567a82659cbf724e988bad750cf to your computer and use it in GitHub Desktop.
Revisions
-
mgeeky revised this gist
Jun 28, 2023 . No changes.There are no files selected for viewing
-
mgeeky revised this gist
Jun 28, 2023 . 1 changed file with 5 additions and 0 deletions.There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode charactersOriginal file line number Diff line number Diff line change @@ -1,4 +1,9 @@ # # Simple Powershell script that removes ClickOnce deployments entirely from file system and registry. # Attempts to remove both installed and online-only deployments. # # Authored: Mariusz Banach / mgeeky, <mb [at] binary-offensive.com> # # Usage: # PS> . .\Cleanup-ClickOnce.ps1 # PS> Cleanup-ClickOnce -Name MyAppName -
mgeeky revised this gist
Jun 28, 2023 . No changes.There are no files selected for viewing
-
mgeeky revised this gist
Jun 28, 2023 . 1 changed file with 20 additions and 3 deletions.There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode charactersOriginal file line number Diff line number Diff line change @@ -9,12 +9,13 @@ # function Cleanup-ClickOnce($Name) { $NameShort = $Name if ($NameShort.Length -gt 7) { $NameShort = $NameShort.Substring(0, 4) + "\." } $rex = $NameShort + "\..+" Write-Host "`nCleaning ClickOnce leftovers: $rex `n" -ForegroundColor Yellow @@ -25,6 +26,15 @@ function Cleanup-ClickOnce($Name) { } } Get-ChildItem -Recurse "HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall" -EA SilentlyContinue | ForEach-Object { $reg = $_ $props = ($_ | Get-ItemProperty).PsObject.Properties $props | Where-Object { $_.Name -like "DisplayName" -and $_.Value -match $Name } | ForEach-Object { Write-Host "[+] Cleaning: $($reg)" -ForegroundColor Green Remove-Item -Force -Recurse "Registry::$reg" -EA SilentlyContinue | Out-Null } } $Paths = @( "$env:Localappdata\Apps\2.0" "$env:Localappdata\Deployment" @@ -40,4 +50,11 @@ function Cleanup-ClickOnce($Name) { } } } $Path = "$env:Appdata\Microsoft\Windows\Start Menu\Programs\$Name" If (Test-Path -Path $Path ) { Write-Host "[+] Cleaning: $Path" -ForegroundColor Green Remove-Item -Force -Recurse $Path } } -
mgeeky revised this gist
Jun 27, 2023 . 1 changed file with 2 additions and 1 deletion.There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode charactersOriginal file line number Diff line number Diff line change @@ -9,7 +9,8 @@ # function Cleanup-ClickOnce($Name) { if ($Name.Length -gt 7) { $Name = $Name.Substring(0, 4) + "\." } -
mgeeky revised this gist
Jun 27, 2023 . 1 changed file with 4 additions and 0 deletions.There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode charactersOriginal file line number Diff line number Diff line change @@ -3,6 +3,10 @@ # PS> . .\Cleanup-ClickOnce.ps1 # PS> Cleanup-ClickOnce -Name MyAppName # # Other than that you might also try using these commands: # PS> rundll32 dfshim.dll,ShArpMaintain C:\Path\To\ClickOnce.application # PS> rundll32 dfshim.dll CleanOnlineAppCache # function Cleanup-ClickOnce($Name) { if ($Name.Length -gt 6) { -
mgeeky revised this gist
Jun 27, 2023 . 1 changed file with 0 additions and 3 deletions.There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode charactersOriginal file line number Diff line number Diff line change @@ -5,7 +5,6 @@ # function Cleanup-ClickOnce($Name) { if ($Name.Length -gt 6) { $Name = $Name.Substring(0, 4) + "\." } @@ -18,8 +17,6 @@ function Cleanup-ClickOnce($Name) { If ($_ -match $rex) { Write-Host "[+] Cleaning: $($_.Name)" -ForegroundColor Green Remove-Item -Force -Recurse "Registry::$_" -EA SilentlyContinue | Out-Null } } -
mgeeky created this gist
Jun 27, 2023 .There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode charactersOriginal file line number Diff line number Diff line change @@ -0,0 +1,41 @@ # # Usage: # PS> . .\Cleanup-ClickOnce.ps1 # PS> Cleanup-ClickOnce -Name MyAppName # function Cleanup-ClickOnce($Name) { if ($Name.Length -gt 6) { $Name = $Name.Substring(0, 4) + "\." } $rex = $Name + "\..+" Write-Host "`nCleaning ClickOnce leftovers: $rex `n" -ForegroundColor Yellow Get-ChildItem -Recurse "HKCU:\Software\Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0" -EA SilentlyContinue | ForEach-Object { If ($_ -match $rex) { Write-Host "[+] Cleaning: $($_.Name)" -ForegroundColor Green Remove-Item -Force -Recurse "Registry::$_" -EA SilentlyContinue | Out-Null } } $Paths = @( "$env:Localappdata\Apps\2.0" "$env:Localappdata\Deployment" "$env:Localappdata\Microsoft\Windows\INetCache\IE" "$env:Temp\Deployment" ) foreach ($Path in $Paths) { Get-ChildItem -Recurse $Path | ForEach-Object { If ($_ -match $rex) { Write-Host "[+] Cleaning: $($_.FullName)" -ForegroundColor Green Remove-Item -Force -Recurse $_.FullName } } } }