onestart_complete_removal.ps1

onestart_complete_removal.ps1

Completely removes OneStart.ai browser/PUP from Windows systems with automated uninstall and comprehensive cleanup.

Overview

This script completely removes OneStart.ai browser/PUP from Windows systems. First attempts a clean uninstall via NirSoft UninstallView, then performs manual cleanup of any remaining processes, files, registry keys, and scheduled tasks.

Purpose

Completely removes OneStart.ai browser/PUP from Windows systems. First attempts a clean uninstall via NirSoft UninstallView, then performs manual cleanup of any remaining processes, files, registry keys, and scheduled tasks.

Prerequisites

• Windows PowerShell 5.1+
• Administrative privileges required
• Internet access for UninstallView download

Configuration

Required Inputs

• $appName : Application name for uninstall (default: OneStart)

Data Sources & Priority

1. NirSoft UninstallView for silent uninstall attempt
2. Windows Task Scheduler for scheduled task removal
3. File system for leftover folders
4. Windows Registry for leftover keys

Behavior

1. Downloads NirSoft UninstallView (architecture-appropriate)
2. Attempts silent uninstall of OneStart via UninstallView
3. Terminates any running OneStart/DBar processes
4. Removes scheduled tasks matching OneStart patterns
5. Removes leftover files and folders from AppData, ProgramData, Program Files
6. Backs up registry keys to $env:SystemDrive\limehawk\registry_backup before removal
7. Cleans up registry keys in HKCU and HKLM
8. Reports final cleanup status

Security Notes

• No secrets in logs
• Only removes OneStart-related items using known paths/patterns
• Registry keys are backed up before removal for recovery if needed

Exit Codes

• 0 : Success
• 1 : Failure

Example Output

[ INPUT VALIDATION ]
--------------------------------------------------------------
Application Name : OneStart

[ NIRSOFT UNINSTALLVIEW SETUP ]
--------------------------------------------------------------
Architecture : 64-bit
Download URL : https://www.nirsoft.net/utils/uninstallview-x64.zip
Downloading UninstallView...
Download complete
Extracting to C:\limehawk\nirsoft...
Extraction complete

[ UNINSTALL ATTEMPT ]
--------------------------------------------------------------
Searching for : OneStart
Attempting silent uninstall...
Uninstall command issued
Waiting 10 seconds for uninstall to complete...

[ PROCESS TERMINATION ]
--------------------------------------------------------------
Searching for OneStart/DBar processes...
Found process : OneStart (PID: 12345)
Terminated : OneStart
Process cleanup complete

[ SCHEDULED TASK REMOVAL ]
--------------------------------------------------------------
Searching for OneStart scheduled tasks...
Found : OneStartUpdaterTaskUser134.0.6
Removed : OneStartUpdaterTaskUser134.0.6
Removing task folders...
Task cleanup complete

[ FILE CLEANUP ]
--------------------------------------------------------------
Checking known OneStart locations...
Removed : C:\Users\User\AppData\Local\OneStart.ai
Removed : C:\Users\User\AppData\Roaming\OneStart
File cleanup complete

[ REGISTRY BACKUP ]
--------------------------------------------------------------
Creating registry backups before removal...
Backed up : HKCU:\Software\OneStart.ai
Backup location : <SystemDrive>\limehawk\registry_backup\onestart_20251201_120000
Registry backup complete

[ REGISTRY CLEANUP ]
--------------------------------------------------------------
Cleaning registry keys...
Removed : HKCU:\Software\OneStart.ai
Checking startup entries...
Registry cleanup complete

[ FINAL STATUS ]
--------------------------------------------------------------
Result : Success
Uninstall Attempted : Yes
Processes Terminated : 1
Tasks Removed : 1
Folders Removed : 2
Registry Keys Backed Up : 1
Registry Keys Removed : 1

[ SCRIPT COMPLETED ]

Version History

• 2025-12-01 v1.1.0 - Add registry backup before removal to $env:SystemDrive\limehawk\registry_backup
• 2025-12-01 v1.0.0 - Initial release - combines NirSoft uninstall with manual cleanup

Links

• View Script Source
• Scripts - Back to script index