# 1. Define the UltraViewer service wildcard pattern
$ServicePatterns = @("*UltraViewer*")

Write-Host "=== ULTRAVIEWER SERVICE RESTORATION SCRIPT ===" -ForegroundColor Cyan

# 2. Enumerate, re-enable, and start matching background system services
Write-Host "`n[+] Scanning and restoring services..." -ForegroundColor White
foreach ($Pattern in $ServicePatterns) {
    $Services = Get-Service -Name $Pattern -ErrorAction SilentlyContinue
    if ($Services) {
        foreach ($Service in $Services) {
            Write-Host " -> Found Service: $($Service.Name) [Current Status: $($Service.Status)]" -ForegroundColor Yellow
            
            # Change startup type back to Automatic so it persists through reboots
            Set-Service -Name $Service.Name -StartupType Automatic -Confirm:$false -ErrorAction SilentlyContinue
            Write-Host "    [✓] Startup type set to Automatic." -ForegroundColor Green
            
            # Start the background service back up
            if ($Service.Status -ne "Running") {
                Start-Service -Name $Service.Name -ErrorAction SilentlyContinue
                Write-Host "    [✓] Service started successfully." -ForegroundColor Green
            } else {
                Write-Host "    [-] Service was already running." -ForegroundColor Gray
            }
        }
    } else {
        Write-Host "[-] No matching UltraViewer services found to restore." -ForegroundColor Gray
    }
}

# 3. Final verification output
Write-Host "`n=== POST-RESTORATION CHECK ===" -ForegroundColor Cyan
$FinalServices = Get-Service -Name $ServicePatterns -ErrorAction SilentlyContinue

if ($FinalServices) {
    $FinalServices | Select-Object Name, Status, StartType | Format-Table -AutoSize
} else {
    Write-Host "[!] No UltraViewer services are present on this machine." -ForegroundColor Yellow
}




# Define all known UltraViewer executable files and common installer variations
$executables = @(
    "UltraViewer_Service.exe",
    "UltraViewer.exe",
    "UltraViewer_Desktop.exe",
    "uv_printer.exe",
    "UltraViewer_Printer.exe",
    "UltraViewer_Portable.exe",
    "UltraViewer_setup_6.6_en.exe"
)

# Base path for Image File Execution Options
$basePath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options"

# The alert message payload using native msg.exe
$msgPayload = 'msg * "The execution of UltraViewer has been blocked by security policies."'

# Loop through each executable and apply the restriction
foreach ($exe in $executables) {
    $targetPath = Join-Path $basePath $exe
    
    # Ensure the registry key exists
    if (-not (Test-Path $targetPath)) {
        New-Item -Path $targetPath -Force | Out-Null
    }
    
    # Set the Debugger property to intercept execution with the message
    New-ItemProperty -Path $targetPath -Name "Debugger" -Value $msgPayload -PropertyType String -Force | Out-Null
    
    Write-Host "[Blocked] Applied restriction to: $exe" -ForegroundColor Cyan
}

Write-Host "`nAll UltraViewer application blocks have been successfully configured." -ForegroundColor Green


# Define all UltraViewer executable files and installer variations used in the previous steps
$executables = @(
    "UltraViewer_Service.exe",
    "UltraViewer.exe",
    "UltraViewer_Desktop.exe",
    "uv_printer.exe",
    "UltraViewer_Printer.exe",
    "UltraViewer_Portable.exe",
    "UltraViewer_setup_6.6_en.exe"
)

# Base path for Image File Execution Options
$basePath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options"

# Loop through each executable name and completely delete its IFEO block key
foreach ($exe in $executables) {
    $targetPath = Join-Path $basePath $exe
    
    # Check if the registry key exists before attempting deletion
    if (Test-Path $targetPath) {
        Remove-Item -Path $targetPath -Force -Recurse
        Write-Host "[Restored] Removed all blocks and payloads for: $exe" -ForegroundColor Green
    } else {
        Write-Host "[Clean] No registry block found for: $exe" -ForegroundColor Gray
    }
}

Write-Host "`nAll UltraViewer registry blocks have been successfully removed." -ForegroundColor Green