Need help trying to completely remove a "virus pertection software" - powershell

Question

the company I work for is moving to a new virus protection software. I have been tasked with writing the tool that will remove the older virus software since the standard uninstall doesn't seem to remove the entire software package. I have searched around Stack Overflow and found many different examples of how to get different parts of this tool to work and have thrown them together in an attempt to make a working product. For a reason I have yet to figure out I can't seem to get anything to work. Here is what I have so far:
# This section launches Powershell as Admin
PS> Start-Process powershell -Verb runAs
if (!([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")) { Start-Process powershell.exe "-NoProfile -ExecutionPolicy Bypass -File `"$PSCommandPath`"" -Verb RunAs; exit }
PS >Read-Host "Press ENTER"
Press ENTER:
# This section uninstalls Vipre from the program files
$app = Get-WmiObject -Class Win32_Product | Where-Object {
$_.Name -match "VIPRE BUSINESS AGNET"
}
$app.Uninstall()
PS >Read-Host "Press ENTER"
Press ENTER:
# This section searches the Registry for all instances of Vipre and VIPRE BUSINESS AGENT and deletes them
gci HKLM: -rec -ea SilentlyContinue | % { if((get-itemproperty -Path $_.PsPath)
-match "Vipre") { $_.PsPath} } | Remove-Item
gci HKCR: -rec -ea SilentlyContinue | % { if((get-itemproperty -Path $_.PsPath)
-match "Vipre") { $_.PsPath} } | Remove-Item
gci HKCU: -rec -ea SilentlyContinue | % { if((get-itemproperty -Path $_.PsPath)
-match "Vipre") { $_.PsPath} } | Remove-Item
gci HKU: -rec -ea SilentlyContinue | % { if((get-itemproperty -Path $_.PsPath)
-match "Vipre") { $_.PsPath} } | Remove-Item
gci HKLM: -rec -ea SilentlyContinue | % { if((get-itemproperty -Path $_.PsPath)
-match "VIPRE BUSINESS AGENT") { $_.PsPath} } | Remove-Item
gci HKCR: -rec -ea SilentlyContinue | % { if((get-itemproperty -Path $_.PsPath)
-match "VIPRE BUSINESS AGENT") { $_.PsPath} } | Remove-Item
gci HKCU: -rec -ea SilentlyContinue | % { if((get-itemproperty -Path $_.PsPath)
-match "VIPRE BUSINESS AGENT") { $_.PsPath} } | Remove-Item
gci HKU: -rec -ea SilentlyContinue | % { if((get-itemproperty -Path $_.PsPath)
-match "VIPRE BUSINESS AGENT") { $_.PsPath} } | Remove-Item
PS >Read-Host "Press ENTER"
Press ENTER:
I have a pause, "Press Enter" to try and see what the command before it has done and even that doesn't seem to be working. As the screen flashes, I can tell there are errors being thrown, and then goes away.
My questions are:
What am I doing wrong? Are there syntax errors and what are they?
Thank you for all help.
EDIT UPDATE
My file now looks like this:
# This section launches Powershell as Admin
{ Start-Process powershell.exe "-NoProfile -ExecutionPolicy Bypass -File `"$PSCommandPath`"" -verb RunAs; exit }
$code = {
# This section uninstalls Vipre from the program files
$App = Get-WmiObject -Class Win32_Product -Filter 'Name like %"VIPRE BUSINESS AGENT"%"'
if ($App)
{
$App.Uninstall()
}
# This section searches the Registry for all instances of Vipre and VIPRE BUSINESS AGENT and deletes them
Get-ChildItem HKLM: -rec -ea SilentlyContinue | % { if((get-itemproperty -Path $_.PsPath) -match 'Vipre') { $_.PsPath} } | Remove-Item
Get-ChildItem HKCR: -rec -ea SilentlyContinue | % { if((get-itemproperty -Path $_.PsPath) -match 'Vipre') { $_.PsPath} } | Remove-Item
Get-ChildItem HKCU: -rec -ea SilentlyContinue | % { if((get-itemproperty -Path $_.PsPath) -match 'Vipre') { $_.PsPath} } | Remove-Item
Get-ChildItem HKU: -rec -ea SilentlyContinue | % { if((get-itemproperty -Path $_.PsPath) -match 'Vipre') { $_.PsPath} } | Remove-Item
Get-ChildItem HKLM: -rec -ea SilentlyContinue | % { if((get-itemproperty -Path $_.PsPath) -match 'VIPRE BUSINESS AGENT') { $_.PsPath} } | Remove-Item
Get-ChildItem HKCR: -rec -ea SilentlyContinue | % { if((get-itemproperty -Path $_.PsPath) -match 'VIPRE BUSINESS AGENT') { $_.PsPath} } | Remove-Item
Get-ChildItem HKCU: -rec -ea SilentlyContinue | % { if((get-itemproperty -Path $_.PsPath) -match 'VIPRE BUSINESS AGENT') { $_.PsPath} } | Remove-Item
Get-ChildItem HKU: -rec -ea SilentlyContinue | % { if((get-itemproperty -Path $_.PsPath) -match 'VIPRE BUSINESS AGENT') { $_.PsPath} } | Remove-Item
}
$bytes = [System.Text.Encoding]::Unicode.GetBytes($code)
$encodedCommand = [Convert]::ToBase64String($bytes)
powershell.exe -executionpolicy bypass -noprofile -noexit -verb runas -encodedCommand $encodedCommand
The PowerShell script seems to be at least trying to run now but then throws the error:
-verb : The term '-verb' is not recognized as the name of a cmdlet,function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again. At line:1 char:1
+ -verb runas -encodedCommand DQAKACAAIAAgAA0ACgAjACAAVABoAGkAcwAgAHMAZ ...
+ ~~~~~
+ CategoryInfo : ObjectNotFound: (-verb:String) [], CommandNotFoundException
+ FullyQualifiedErrorId : CommandNotFoundException
I tried removing -verb from both the top and bottom of the script and that causes PowerShell to give me a bunch of commands that need to follow RUNAS.

Answer 1

This here could work - but I have no idea what the first if-statement is supposed to do:
# This section launches Powershell as Admin
if (!([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] 'Administrator')) { Start-Process powershell.exe "-NoProfile -ExecutionPolicy Bypass -File `"$PSCommandPath`"" -Verb RunAs; exit }
$code = {
Read-Host 'Press ENTER'
Press ENTER:
# This section uninstalls Vipre from the program files
$app = Get-WmiObject -Class Win32_Product | Where-Object {
$_.Name -match 'VIPRE BUSINESS AGNET' ##Typo 'AGNET'?
}
$app.Uninstall()
Read-Host 'Press ENTER'
Press ENTER:
# This section searches the Registry for all instances of Vipre and VIPRE BUSINESS AGENT and deletes them
Get-ChildItem HKLM: -rec -ea SilentlyContinue | % { if((get-itemproperty -Path $_.PsPath) -match 'Vipre') { $_.PsPath} } | Remove-Item
Get-ChildItem HKCR: -rec -ea SilentlyContinue | % { if((get-itemproperty -Path $_.PsPath) -match 'Vipre') { $_.PsPath} } | Remove-Item
Get-ChildItem HKCU: -rec -ea SilentlyContinue | % { if((get-itemproperty -Path $_.PsPath) -match 'Vipre') { $_.PsPath} } | Remove-Item
Get-ChildItem HKU: -rec -ea SilentlyContinue | % { if((get-itemproperty -Path $_.PsPath) -match 'Vipre') { $_.PsPath} } | Remove-Item
Get-ChildItem HKLM: -rec -ea SilentlyContinue | % { if((get-itemproperty -Path $_.PsPath) -match 'VIPRE BUSINESS AGENT') { $_.PsPath} } | Remove-Item
Get-ChildItem HKCR: -rec -ea SilentlyContinue | % { if((get-itemproperty -Path $_.PsPath) -match 'VIPRE BUSINESS AGENT') { $_.PsPath} } | Remove-Item
Get-ChildItem HKCU: -rec -ea SilentlyContinue | % { if((get-itemproperty -Path $_.PsPath) -match 'VIPRE BUSINESS AGENT') { $_.PsPath} } | Remove-Item
Get-ChildItem HKU: -rec -ea SilentlyContinue | % { if((get-itemproperty -Path $_.PsPath) -match 'VIPRE BUSINESS AGENT') { $_.PsPath} } | Remove-Item
Read-Host 'Press ENTER'
Press ENTER:
}
$bytes = [System.Text.Encoding]::Unicode.GetBytes($code)
$encodedCommand = [Convert]::ToBase64String($bytes)
powershell.exe -executionpolicy bypass -noprofile -noexit -verb runas -encodedCommand $encodedCommand

Answer 2

Man, sorry but your code is a mess...
Few remarks:
1. This is not the right way to execute powershell code... save your code text to .PS1 file then execute it on the remote machine like this:
powershell -ExecutionPolicy Bypass -NoProfile -File \\share\script.ps1
2. If you want to check for admin privileges, do it inside your code,
if (([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator"))
{
## if the user is admin the code will be executed
}
else
{
throw "This code must be run with admin privileges"
}
3. Use Get-WMIObject -Filter Parameter - It will be much faster then Where-Object
$App = Get-WmiObject -Class Win32_Product -Filter 'Name like %"VIPRE BUSINESS AGNET"%"'
if ($App)
{
$App.Uninstall()
}
4. Don't Search the whole Registry to find this keys, as Ansgar Suggested, check at the vendor for specific keys, see chapter IV - "Removal of the VIPRE Agent's Registry Entries" on the vendor site in the following link:
https://support.threattracksecurity.com/support/solutions/articles/1000070667-how-to-manually-remove-a-vipre-business-agent