Detect the presence of and remove CCleaner with PowerShell

Based on the news today, I thought I would share a couple of PowerShell code snippets to detect the presence of and silently uninstall CCleaner.

You can detect the presence of CCleaner along with the version of it you have installed via the registry.

You can use a similar command to run its uninstaller silently if it’s detected.

Give it a couple of minutes and then run the first command again to verify it has been removed.

If PowerShell remoting is enabled on the computers in your environment, you can simply wrap these commands inside of Invoke-Command to detect and remove CCleaner from the machines in your environment. You could also consider adding the command to remove CCleaner to your login script since PowerShell remoting is not enabled by default on desktop operating systems.

The commands shown in this blog article are written to be compatible with PowerShell version 3.0 and higher. They could be made to be compatible with PowerShell version 2.0 (PowerShell version 2.0 is deprecated).


Update – September 20th, 2017
While it doesn’t appear to be possible to install the 32bit version of CCleaner on a 64bit operating system (at least not with the current version), you may also want to check the Wow64 registry settings just in case. I even went so far as to download CCleaner on a 32bit OS and install that version on a 64bit OS which still installed the 64bit version.

I thought about this yesterday when that registry key was referenced in a response to an unrelated Tweet of mine. When it was mentioned again today by Josh Binney, I figured it was worth adding to this blog article.


Based on one of the comments to this blog article, older versions of CCleaner may not be found using the PowerShell eq operator so you may want to consider switching to either the like or match operator. See the comments to this blog article for more details.

µ

3 Comments

  1. Arricc

    You need to change the DisplayName match to a like. I had one old install in my environment called “CCleaner (remove only)”

    Reply
  2. Matt M.

    Thanks for the snippets. If someone wanted to make these into a full-fledged script there are some additional considerations.

    1. If the user has already updated CCleaner to the latest version then this isn’t a threat, no need to remove it.
    2. I would recommend a check for the ‘HKLM:\SOFTWARE\Piriform\Agomo’ key in the registry and remove it, then do an uninstall of CCleaner version 5.33.6162 and CCleaner Cloud version 1.07.3191 specifically since those were the affected versions. Just changing the search condition to

    where-object {$_.DisplayVersion -eq ‘5.33.6162’ -and $_.DisplayName -eq ‘CCleaner’}

    should do the trick.

    Just in case someone comes here to grab a snippet of code to look for installed software there’s something else important to point out. While CCleaner has an installer that will automatically install into Program Files on either 32 or 64bit editions of Windows, Often, 32bit software gets installed on 64bit machines into the Program Files (x86) directory and there’s a different registry key to check for those installs. (Google Chrome, VMWare VSphere client, and WinSCP are three good examples of this) When checking for installed software it’s important to check both registry locations:

    ‘HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\’,
    ‘HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\’

    Reply

Leave a Reply

%d bloggers like this: