# 1. Define known TeamViewer service wildcard strings and process names
$ServicePatterns = @("*TeamViewer*")
$ProcessNames    = @("TeamViewer", "TeamViewer_Service", "tv_w32", "tv_x64")

Write-Host "=== TEAMVIEWER ALL-INSTANCE TERMINATION SCRIPT ===" -ForegroundColor Cyan

# 2. Enumerate, disable, and kill matching background system services
Write-Host "`n[+] Scanning and disabling services..." -ForegroundColor White
foreach ($Pattern in $ServicePatterns) {
    $Services = Get-Service -Name $Pattern -ErrorAction SilentlyContinue
    if ($Services) {
        foreach ($Service in $Services) {
            Write-Host " -> Found Service: $($Service.Name) [Current Status: $($Service.Status)]" -ForegroundColor Yellow
            
            # Change startup to Disabled so it cannot restart automatically on a reboot
            Set-Service -Name $Service.Name -StartupType Disabled -Confirm:$false -ErrorAction SilentlyContinue
            
            # Forcibly stop the service
            Stop-Service -Name $Service.Name -Force -Confirm:$false -ErrorAction SilentlyContinue
            Write-Host "    [!] Disabled and commanded to stop." -ForegroundColor Red
        }
    }
}

# 3. Forcibly kill any lingering active processes
Write-Host "`n[+] Hunting for active client processes..." -ForegroundColor White
foreach ($ProcName in $ProcessNames) {
    $RunningProcs = Get-Process -Name $ProcName -ErrorAction SilentlyContinue
    if ($RunningProcs) {
        foreach ($Proc in $RunningProcs) {
            Write-Host " -> Found Running Process: $($Proc.Name) (PID: $($Proc.Id))" -ForegroundColor Yellow
            Stop-Process -Id $Proc.Id -Force -ErrorAction SilentlyContinue
            Write-Host "    [!] Process terminated successfully." -ForegroundColor Red
        }
    }
}

# 4. Final verification output
Write-Host "`n=== POST-REMEDIATION CHECK ===" -ForegroundColor Cyan
$FinalServices = Get-Service -Name $ServicePatterns -ErrorAction SilentlyContinue
$FinalProcesses = Get-Process -Name $ProcessNames -ErrorAction SilentlyContinue

if (-not $FinalServices -and -not $FinalProcesses) {
    Write-Host "[✓] Success: No active TeamViewer services or processes detected." -ForegroundColor Green
} else {
    if ($FinalServices) {
        Write-Host "[!] Warning: The following services are still present on the system:" -ForegroundColor Yellow
        $FinalServices | Select-Object Name, Status, StartType | Format-Table -AutoSize
    }
    if ($FinalProcesses) {
        Write-Host "[!] Critical: The following processes could not be stopped:" -ForegroundColor Red
        $FinalProcesses | Select-Object Name, Id | Format-Table -AutoSize
    }
}



# Define all known TeamViewer executable files
$executables = @(
    "TeamViewer_Service.exe",
    "TeamViewer.exe",
    "TeamViewer_Desktop.exe",
    "TeamViewerQS.exe",
    "TeamViewerQJ.exe",
    "tv_w32.exe",
    "tv_x64.exe",
    "TeamViewer_Setup.exe",
    "tv_host_setup.exe",
    "AssignmentTool.exe"
)

# Base path for Image File Execution Options
$basePath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options"

# The alert message payload using native msg.exe
$msgPayload = 'msg * "The execution of TeamViewer has been blocked by security policies."'

# Loop through each executable and apply the restriction
foreach ($exe in $executables) {
    $targetPath = Join-Path $basePath $exe
    
    # Ensure the registry key exists
    if (-not (Test-Path $targetPath)) {
        New-Item -Path $targetPath -Force | Out-Null
    }
    
    # Set the Debugger property to intercept execution with the message
    New-ItemProperty -Path $targetPath -Name "Debugger" -Value $msgPayload -PropertyType String -Force | Out-Null
    
    Write-Host "[Blocked] Applied restriction to: $exe" -ForegroundColor Cyan
}

Write-Host "`nAll TeamViewer application blocks have been successfully configured." -ForegroundColor Green