Return Uninstall string from reg UninstallString value

Content Authoring
1

Problem we often get asked to remove unwanted applications, with few details provided on the product, like how to uninstall it.
thanks to the code from SLB on post Uninstall application
with a slight change to his code it can now be used as a tool to return the uninstall string when you only know what the program might be called. with this we can setup an analysis and return all the uninstall strings for all versions of the product we are trying to remove.

unique values of (values “UninstallString” of keys whose (((it contains “reasonlabs”) of (value “DisplayName” of it as string as lowercase))) of keys “HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall” of (registry ; native registry) as string)

4 Likes
2

Thanks for sharing!

I always introduce a property called “Applications - Uninstall Strings - Windows” that I use relevance like:

unique values of (it as string) of (value "displayName" of it as string | name of it as string, values "uninstallString" of it) of keys of keys "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall" of (x32 registries; x64 registries)

This returns every single app and uninstall string including whether it ends with a null terminator or not.

A: 7-Zip 22.01 (x64), "C:\Program Files\7-Zip\Uninstall.exe"
A: Adobe Acrobat (64-bit), MsiExec.exe /I{AC76BA86-1033-1033-7760-BC15014EA700}%00
A: Adobe Refresh Manager, MsiExec.exe /I{AC76BA86-0804-1033-1959-018244601042}%00

This is great because when I want to build an uninstall fixlet I can go into web reports, search for entries that include “7-Zip” and instantly see all the different uninstall strings for that app in my environment. So for 7-Zip you’d find Uninstall.exe for ones installed with the EXE installer and you’d see msiexec /x for ones installed with the MSI installer. It also helps you figure out if you’ll need different handling across versions or x64/x86.

You can also get relevance to do some of the argument work for you in this with things like this:

(if (it ends with "}" and it as lowercase contains "msiexec") then (it & " /qn REBOOT=ReallySuppress /norestart") else (it)) of (concatenations "" of substrings separated by "%00" of concatenations "MsiExec.exe /x" of substrings separated by "MsiExec.exe /I" of it) of unique values of (it as string) of (value "displayName" of it as string | name of it as string, values "uninstallString" of it) of keys of keys "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall" of (x32 registries; x64 registries)

You can use this to automatically switch it to uninstall instead of configure and add your required skip reboot and silence flags to the msiexec commands.

A: 7-Zip 22.01 (x64), "C:\Program Files\7-Zip\Uninstall.exe"
A: Adobe Acrobat (64-bit), MsiExec.exe /x{AC76BA86-1033-1033-7760-BC15014EA700} /qn REBOOT=ReallySuppress /norestart
A: Adobe Refresh Manager, MsiExec.exe /x{AC76BA86-0804-1033-1959-018244601042} /qn REBOOT=ReallySuppress /norestart

This is really great for beginners because it doesnt require them to know a lot about msiexec to get work done!

And if you really want to go big there’s an exercise left to the reader here where you pull these results from the REST API and use a script to automatically build and upload uninstall fixlets for every app in your environment :slight_smile:

6 Likes
3

This is great stuff!
thank you

4

So this is awesome since I’ve been wondering about how to get uninstall commands for software in our environment, I do have two questions:

1 - Jow do you handle exe’s for silent installation? For example for VLC player running trying to find help on the uninstall.exe C:\Program Files\VideoLAN\VLC>uninstall.exe /? just kicks off the uninstaller itself, there’s no help menu for silent, I tired /q, /qn, /quiet, /s, /silent to no avail.

2 - For those of us that dont know anything about:

Is there cheat-sheet somewhere to help get started on this? :slight_smile:

And before submitting my post the silent switch is /S (capital S), I mean without having to go on a google search for each uninstaller exe file, is there a better option?

Thanks!

5

I have been working on a method to find and uninstall both .exe and .msi based installations, utilising the MS Uninstall strings to detect it and then using altered version in session relevance to create the uninstall commands.

For the relevance of the action I would recommend using it as follows and replacing the application name (currently 7-Zip) in here with the one you need (Obtained from MS Uninstall Strings Analysis):

exists keys whose (value "DisplayName" of it as string as lowercase starts with "7-Zip" as lowercase) of keys "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall" of (x32 registries; x64 registries)

For the action portion of the Task we will extract all relevant uninstall commands from registry and populate it in the __createfile, then change it to a .bat file. The reason I am doing it in this method is grab the different MSI uninstalls if there were multiple versions installed on the system for some reason, or if there are MSI and exe based installs. (Mostly common with 7-Zip)

Added the “START /WAIT” for utilisation in .bat to wait for each action in the .bat to complete before attempting the next action. Also included the silent options for both .msi (as described above) .exe uninstall with the nested if statement. Please find the relevant options for your .msi and .exe and update

The action scrip will be as follows remember to change the application name as needed (Obtained from MS Uninstall Strings Analysis):

delete __createfile
delete Uninstall.bat

createfile until end
{concatenations "%0d%0a" of (if (it as lowercase contains "msiexec") then ("START /WAIT " & it & " /qn REBOOT=ReallySuppress /norestart") else (if (it as lowercase contains ".exe") then ("START /WAIT " & it & " /S") else (it))) of (concatenations "" of substrings separated by "%00" of concatenations "MsiExec.exe /x" of substrings separated by "MsiExec.exe /I" of it) of unique values of (it as string) of (values "uninstallString" of it) of keys whose (value "DisplayName" of it as string as lowercase starts with "7-Zip" as lowercase) of keys "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall" of (x32 registries; x64 registries)}
end

copy __createfile Uninstall.bat

waithidden Uninstall.bat

This is in no way perfect and should get you going in the right direction. There are other methods to remove the software as per OP linked post.

In case you want to uninstall all versions except a specific one you can update the “keys whose statement” like follows:

... of keys whose ((value "DisplayName" of it as string as lowercase starts with "7-Zip" as lowercase) AND (value "DisplayVersion" of it as string as lowercase does not contain "24.09"))  of keys "HKLM...

I have noticed some applications does not define the DisplayVersion and should be tested first.