Solved

Script to Remove Program from Startup/Logon

Posted on 2015-02-19
9
62 Views
Last Modified: 2015-03-18
Hello, what's the best approach to remove a program that automatically starts during logon? It resides locally in C:\Program Files (x86)\XXXXX.  Is there a script I can utilize? Ideally, I'd like to push it out using GPO.

Thank you!

J
0
Comment
Question by:Ja Che
  • 5
  • 4
9 Comments
 
LVL 65

Expert Comment

by:RobSampson
ID: 40620514
If the program starts at Logon, it is (most commonly) either a shortcut in one of the following locations:
%APPDATA%\Microsoft\Windows\Start Menu\Programs\StartUp
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\<nameofprogram>
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\<nameofprogram>

Check which of those it is in, then remove it with a startup or logon script.

Regards,

Rob.
0
 

Author Comment

by:Ja Che
ID: 40621631
Hi Rob, thanks for the response. I checked each location and the program resides in C:\programdata\microsoft\windows\start menu\programs\StartUp.
0
 
LVL 65

Expert Comment

by:RobSampson
ID: 40622582
OK no problem.  As a StartUp script you should be able to run this VBS:
Set objFSO = CreateObject("Scripting.FileSystemObject")
objFSO.DeleteFile "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\YourLink.lnk", True

Open in new window


Regards,

Rob.
0
 
LVL 65

Expert Comment

by:RobSampson
ID: 40622586
You can also use Group Policy Preferences to delete the shortcut from that folder as well.

Rob.
0
Find Ransomware Secrets With All-Source Analysis

Ransomware has become a major concern for organizations; its prevalence has grown due to past successes achieved by threat actors. While each ransomware variant is different, we’ve seen some common tactics and trends used among the authors of the malware.

 

Author Comment

by:Ja Che
ID: 40636212
Rob that was extremely helpful and works well. 1 question, though.

If the program has already been removed from startup, how can it be specified to ignore the file?

I receive a WSH runtime error saying "File not found". Attached is the error.

Thank you.
WSH-Error.JPG
0
 
LVL 65

Accepted Solution

by:
RobSampson earned 500 total points
ID: 40636550
Hi, that will just be a matter of checking whether the file exists before attempting to delete it.

strFile = "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\YourLink.lnk"
Set objFSO = CreateObject("Scripting.FileSystemObject")
If objFSO.FileExists(strFile) Then objFSO.DeleteFile strFile, True

Open in new window


Rob.
0
 

Author Closing Comment

by:Ja Che
ID: 40640682
Thanks, Rob. Quick and helpful!
0
 
LVL 65

Expert Comment

by:RobSampson
ID: 40640699
No problem. Thanks for the grade.

Rob.
0
 

Author Comment

by:Ja Che
ID: 40674189
You're welcome.
0

Featured Post

Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

Batch, VBS, and scripts in general are incredibly useful for repetitive tasks.  Some tasks can take a while to complete and it can be annoying to check back only to discover that your script finished 5 minutes ago.  Some scripts may complete nearly …
Active Directory replication delay is the cause to many problems.  Here is a super easy script to force Active Directory replication to all sites with by using an elevated PowerShell command prompt, and a tool to verify your changes.
Learn the basics of modules and packages in Python. Every Python file is a module, ending in the suffix: .py: Modules are a collection of functions and variables.: Packages are a collection of modules.: Module functions and variables are accessed us…
The viewer will learn how to create a basic form using some HTML5 and PHP for later processing. Set up your basic HTML file. Open your form tag and set the method and action attributes.: (CODE) Set up your first few inputs one for the name and …

760 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

22 Experts available now in Live!

Get 1:1 Help Now