From 4f41954d9693eb27146e4dda9f18f96e747f5855 Mon Sep 17 00:00:00 2001
From: David Yoder <dyoder@emberkom.com>
Date: Thu, 14 Apr 2022 10:50:14 -0400
Subject: [PATCH] added script

---
 Uninstall-AteraAgent.ps1 | 128 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 128 insertions(+)
 create mode 100644 Uninstall-AteraAgent.ps1

diff --git a/Uninstall-AteraAgent.ps1 b/Uninstall-AteraAgent.ps1
new file mode 100644
index 0000000..7a38875
--- /dev/null
+++ b/Uninstall-AteraAgent.ps1
@@ -0,0 +1,128 @@
+
+Function Get-UninstallCodes ([string]$DisplayName) {
+    Get-ChildItem -Path 'HKLM:SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall' | ForEach-Object {
+        If ( $(Get-ItemProperty -Path $_.PSPath -Name 'DisplayName' -ErrorAction SilentlyContinue) -and ($(Get-ItemPropertyValue -Path $_.PSPath -Name 'DisplayName' -ErrorAction SilentlyContinue) -eq $DisplayName) ) {
+            $str = (Get-ItemPropertyValue -Path $_.PSPath -Name 'UninstallString')
+            $UninstallCodes += $str.Substring(($str.Length - 37),36)
+        }
+    }
+}
+
+Function Get-ProductKeys ([string]$ProductName) {
+    Get-ChildItem -Path 'HKCR:Installer\Products' | ForEach-Object {
+        If ( $(Get-ItemProperty -Path $_.PSPath -Name 'ProductName' -ErrorAction SilentlyContinue) -and ($(Get-ItemPropertyValue -Path $_.PSPath -Name 'ProductName' -ErrorAction SilentlyContinue) -eq $ProductName) ) {
+            $ProductKeys += $_.PSPath.Substring(($_.PSPath.Length - 32))
+        }
+    }
+}
+
+Function Get-ServiceStatus ([string]$Name) { (Get-Service -Name $Name -ErrorAction SilentlyContinue).Status }
+
+Function Stop-RunningService ([string]$Name) {
+    If ( $(Get-ServiceStatus -Name $Name) -eq "Running" ) { Write-Output "Stopping ${Name} service" ; Stop-Service -Name $Name -Force }
+}
+
+Function Remove-StoppedService ([string]$Name) {
+    If ( $(Get-ServiceStatus -Name $Name) -eq "Stopped" ) {
+        Write-Output "Deleting ${Name} service"
+        Start-Process "sc.exe" -ArgumentList "delete ${Name}" -Wait
+    }
+}
+
+Function Kill-Process ([string]$Name) {
+    $p = (Get-Process -Name $_ -ErrorAction SilentlyContinue)
+    If ( $p ) { Write-Output "Killing ${Name} process" ; $p | Stop-Process -Force }
+}
+
+Function Remove-Path ([string]$Path) {
+    If ( Test-Path $Path ) {
+        Write-Output "Deleting ${Path}"
+        Remove-Item -Path $Path -Force
+    } Else { Write-Output "ERROR: Path not found: ${Path}" }
+}
+
+Function Get-AllExeFiles ([string]$Path) {
+    If ( Test-Path $Path ) {
+        Get-ChildItem -Path $Path -Filter *.exe -Recurse | ForEach-Object { $ExeFiles =+ $_.BaseName }
+    }
+}
+
+# Mount HKEY_CLASSES_ROOT registry hive
+New-PSDrive -Name HKCR -PSProvider Registry -Root HKEY_CLASSES_ROOT | Out-Null
+
+#######
+# START: Information gathering
+#######
+
+# Get MSI package codes from the uninstall key
+$UninstallCodes = @()
+'AteraAgent', 'Splashtop for RMM', 'Splashtop Streamer' | ForEach-Object { Get-UninstallCodes -DisplayName $_ }
+
+# Get product keys from the list of installed products
+$ProductKeys = @()
+'AteraAgent', 'Splashtop for RMM', 'Splashtop Streamer' | ForEach-Object { Get-ProductKeys -ProductName $_ }
+
+# Define all the directories we'll need to cleanup at the end of this script
+$Directories = @(
+    "${Env:ProgramFiles}\ATERA Networks",
+    "${Env:ProgramFiles}\Splashtop\Splashtop Remote\Server",
+    "${Env:ProgramFiles(x86)}\Splashtop\Splashtop Remote\Server",
+    "${Env:ProgramFiles}\Splashtop\Splashtop Software Updater",
+    "${Env:ProgramFiles(x86)}\Splashtop\Splashtop Software Updater",
+    "${Env:ProgramData}\Splashtop\Splashtop Software Updater"
+)
+
+# Get all possible relevant exe files so we can make sure they're closed later on
+$ExeFiles = @()
+$Directories | ForEach-Object { Get-AllExeFiles -Path $_ }
+
+# Define a list of services we need to stop and delete (if necessary)
+$ServiceList = @(
+    'AteraAgent',
+    'SplashtopRemoteService',
+    'SSUService'
+)
+
+# Define a list of registry keys we'll delete
+$RegistryKeys = @(
+    'HKLM:SOFTWARE\ATERA Networks',
+    'HKLM:SOFTWARE\Splashtop Inc.',
+    'HKLM:SOFTWARE\WOW6432Node\Splashtop Inc.'
+)
+
+#######
+# END: Information gathering
+#######
+
+# Uninstall each MSI package code in $UninstallCodes
+$UninstallCodes | ForEach-Object { Write-Output "Uninstalling product code: ${_}" ; Start-Process "msiexec.exe" -ArgumentList "/X{${_}}" -Wait }
+
+# Stop services if they're still running
+$ServiceList | ForEach-Object { Stop-RunningService -Name $_ }
+
+# Kill all relevant processes that may still be running
+$ExeFiles += 'reg'
+$ExeFiles | ForEach-Object { Kill-Process $_ }
+
+# Delete services if they're still present
+$ServiceList | ForEach-Object { Remove-StoppedService -Name $_ }
+
+# This seems unnecessary, but it's included in Atera's official uninstall script so I included it here but left it commented out
+#Start-Sleep -Seconds 4
+
+# Delete products from MSI installer registry
+$ProductKeys | ForEach-Object { Remove-Path -Path "HKCR:Installer\Products\${_}" }
+
+# Unmount HKEY_CLASSES_ROOT registry hive
+Remove-PSDrive -Name HKCR
+
+# Delete registry keys
+$RegistryKeys | ForEach-Object { Remove-Path -Path $_ }
+
+# Delete remaining directories
+$Directories | ForEach-Object { Remove-Path -Path $_ }
+
+# Atera's original script also deleted the following directories and registry keys
+# However, since they are user specific and this script needs to run with admin credentials, I've left them commented out
+# If you want to include them, just uncomment the line below:
+#"${Env:LocalAppData}\Temp\TrayIconCaching", 'HKCU:SOFTWARE\ATERA Networks' | ForEach-Object { Remove-Path -Path $_ }