Uninstall Malwarebytes Anti-Malware

PHOTO EMBED

Tue Jul 05 2022 10:30:57 GMT+0000 (Coordinated Universal Time)

Saved by @pepo72 #powershell 

# Author cvucic (https://forums.malwarebytes.com/topic/135344-remote-or-unattended-uninstall/?do=findComment&comment=891527)

Function List-Programs {
    [cmdletbinding()]
    [cmdletbinding()]
    param(
    [parameter(ValueFromPipeline=$true,ValueFromPipelineByPropertyName=$true)]
    [string[]]$ComputerName = $env:computername
    )

    begin {
        $UninstallRegKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall"
    }

    process {
        foreach ($Computer in $ComputerName) {
            Write-Verbose "Working on $Computer"
            if (Test-Connection -ComputerName $Computer -Count 1 -ea 0) {
                $HKLM = [microsoft.win32.registrykey]::OpenRemoteBaseKey('LocalMachine', $computer)
                $UninstallRef = $HKLM.OpenSubKey($UninstallRegKey)
                $Applications = $UninstallRef.GetSubKeyNames()

                foreach ($App in $Applications) {
                    $AppRegistryKey = $UninstallRegKey + "\\" + $App
                    $AppDetails = $HKLM.OpenSubKey($AppRegistryKey)
                    $AppGUID = $App
                    $AppDisplayName = $($AppDetails.GetValue("DisplayName"))
                    $AppVersion = $($AppDetails.GetValue("DisplayVersion"))
                    $AppPublisher = $($AppDetails.GetValue("Publisher"))
                    $AppInstalledDate = $($AppDetails.GetValue("InstallDate"))
                    $AppUninstall = $($AppDetails.GetValue("UninstallString"))
                    if (!$AppDisplayName) { continue }
                    $OutputObj = New-Object -TypeName PSobject
                    $OutputObj | Add-Member -MemberType NoteProperty -Name ComputerName -Value $Computer.ToUpper()
                    $OutputObj | Add-Member -MemberType NoteProperty -Name AppName -Value $AppDisplayName
                    $OutputObj | Add-Member -MemberType NoteProperty -Name AppVersion -Value $AppVersion
                    $OutputObj | Add-Member -MemberType NoteProperty -Name AppVendor -Value $AppPublisher
                    $OutputObj | Add-Member -MemberType NoteProperty -Name InstalledDate -Value $AppInstalledDate
                    $OutputObj | Add-Member -MemberType NoteProperty -Name UninstallKey -Value $AppUninstall
                    $OutputObj | Add-Member -MemberType NoteProperty -Name AppGUID -Value $AppGUID
                    $OutputObj# | Select ComputerName, DriveName
                }
            }
        }
    }

    end {}
}

Function Uninstall-Program {
    [cmdletbinding()]
    param (
    [parameter(ValueFromPipeline=$true, ValueFromPipelineByPropertyName=$true)]
    [string]$ComputerName = $env:computername,
    [parameter(ValueFromPipeline=$true,ValueFromPipelineByPropertyName=$true,Mandatory=$true)]
    [string]$UninstallKey
    )
    try {
        $returnval = ([WMICLASS]"\\$computerName\ROOT\CIMV2:win32_process").Create($UninstallKey + " /VERYSILENT /SUPPRESSMSGBOXES /NORESTART")
    }
    catch {
        write-error "Failed to trigger the uninstallation. Review the error message"
        $_
        exit 1
    }
    switch ($($returnval.returnvalue)) {
        0 { "Uninstallation command triggered successfully" }
        2 { "You don't have sufficient permissions to trigger the command on $Computer" }
        3 { "You don't have sufficient permissions to trigger the command on $Computer" }
        8 { "An unknown error has occurred" }
        9 { "Path Not Found" }
        10 { "Invalid Parameter"}
    }
}

function Uninstall-MBAM {
    param($computername)
    try {
        $UninstallKey = (List-Programs -ComputerName $computername | where {$_.AppName -like "*Malwarebytes*"}).UninstallKey
        Uninstall-Program -computername $computername -UninstallKey $UninstallKey
    }
    catch {
        $ErrorMessage = $_.Exception.Message
        $FailedItem = $_.Exception.ItemName
        Write-Host "There was an error on $computername.`r`n$FailedItem`r`nMessage: $ErrorMessage"
        Break
    }
}

Uninstall-MBAM -computername $env:computername
content_copyCOPY

https://forums.malwarebytes.com/topic/135344-remote-or-unattended-uninstall/?do=findComment&comment=891527