YeOldeStonecat
Well-Known Member
- Reaction score
- 6,661
- Location
- Englewood Florida
So have a client, small private school, many computers getting wave browser installed.
It's a sneaky one that is very elusive, can install without admin rights, and it creates some scheduled tasks...so if it's removed, the next day or so it'll reinstall.
Fun thread here.....lost of posting today about it...
Some IT guys in that thread stating pretty much any/any tools they try, won't get it. Someone did say MalwareBytes started removing some/(most?) of it...with definitions released today.
Someone posted a script...but I'm trying to modify it so the script can be run on multiple computers. Script was written assuming you'd fill in certain areas.
Original version of script.....
*******************************
C:\Users<user>\Wavesor Software\WaveBrowser<version>\Installer\setup.exe --uninstall
taskkill /IM wavebrowser.exe /F
schtasks | findstr "wavebrowser.exe"
schtasks /delete /tn "\Wave Browser_<user sid>\WaveBrowser-StartAtLogin" /f
schtasks /delete /tn "WavesorSWUpdaterTaskUser<user sid>Core" /f
schtasks /delete /tn "WavesorSWUpdaterTaskUser<user sid>UA" /f
rmdir /Q /S "C:\Users<user>\Wavesor Software"
rmdir /Q /S C:\Users<user>\AppData\Local\WaveBrowser
del C:\Users<user>\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\WaveBrowser.lnk
del C:\Users<user>\Desktop\WaveBrowser.lnk
del C:\Users<user>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WaveBrowser.lnk
Sometimes that Wavesor Software directory will not uninstall. I had to check the processes again, and kill them again. Other times, you need to check permissions and make sure your permissions are not denied. The files underneath seem to delete though - as long as processes aren't using them - just the folder giving issues uninstalling.
del /Q /S "C:\Users<user>\Wavesor Software"
************************************************
I edited it...swapping out %userprofile% wild card...but I'm stuck on what to use for a wild card for <user sid>
so see the following.....
************************************************
%USERPROFILE%\Wavesor Software\WaveBrowser<version>\Installer\setup.exe --uninstall
taskkill /IM wavebrowser.exe /F
schtasks | findstr "wavebrowser.exe"
schtasks /delete /tn "\Wave Browser_<user sid>\WaveBrowser-StartAtLogin" /f
schtasks /delete /tn "WavesorSWUpdaterTaskUser<user sid>Core" /f
schtasks /delete /tn "WavesorSWUpdaterTaskUser<user sid>UA" /f
rmdir /Q /S "%USERPROFILE%\Wavesor Software"
rmdir /Q /S %USERPROFILE%\AppData\Local\WaveBrowser
del %USERPROFILE%\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\WaveBrowser.lnk
del %USERPROFILE%\Desktop\WaveBrowser.lnk
del %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WaveBrowser.lnk
del /Q /S "%USERPROFILE%\Wavesor Software"
It's a sneaky one that is very elusive, can install without admin rights, and it creates some scheduled tasks...so if it's removed, the next day or so it'll reinstall.
Fun thread here.....lost of posting today about it...
Some IT guys in that thread stating pretty much any/any tools they try, won't get it. Someone did say MalwareBytes started removing some/(most?) of it...with definitions released today.
Someone posted a script...but I'm trying to modify it so the script can be run on multiple computers. Script was written assuming you'd fill in certain areas.
Original version of script.....
*******************************
C:\Users<user>\Wavesor Software\WaveBrowser<version>\Installer\setup.exe --uninstall
taskkill /IM wavebrowser.exe /F
schtasks | findstr "wavebrowser.exe"
schtasks /delete /tn "\Wave Browser_<user sid>\WaveBrowser-StartAtLogin" /f
schtasks /delete /tn "WavesorSWUpdaterTaskUser<user sid>Core" /f
schtasks /delete /tn "WavesorSWUpdaterTaskUser<user sid>UA" /f
rmdir /Q /S "C:\Users<user>\Wavesor Software"
rmdir /Q /S C:\Users<user>\AppData\Local\WaveBrowser
del C:\Users<user>\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\WaveBrowser.lnk
del C:\Users<user>\Desktop\WaveBrowser.lnk
del C:\Users<user>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WaveBrowser.lnk
Sometimes that Wavesor Software directory will not uninstall. I had to check the processes again, and kill them again. Other times, you need to check permissions and make sure your permissions are not denied. The files underneath seem to delete though - as long as processes aren't using them - just the folder giving issues uninstalling.
del /Q /S "C:\Users<user>\Wavesor Software"
************************************************
I edited it...swapping out %userprofile% wild card...but I'm stuck on what to use for a wild card for <user sid>
so see the following.....
************************************************
%USERPROFILE%\Wavesor Software\WaveBrowser<version>\Installer\setup.exe --uninstall
taskkill /IM wavebrowser.exe /F
schtasks | findstr "wavebrowser.exe"
schtasks /delete /tn "\Wave Browser_<user sid>\WaveBrowser-StartAtLogin" /f
schtasks /delete /tn "WavesorSWUpdaterTaskUser<user sid>Core" /f
schtasks /delete /tn "WavesorSWUpdaterTaskUser<user sid>UA" /f
rmdir /Q /S "%USERPROFILE%\Wavesor Software"
rmdir /Q /S %USERPROFILE%\AppData\Local\WaveBrowser
del %USERPROFILE%\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\WaveBrowser.lnk
del %USERPROFILE%\Desktop\WaveBrowser.lnk
del %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WaveBrowser.lnk
del /Q /S "%USERPROFILE%\Wavesor Software"
