Manual uninstallation of ExplorerPatcher. Evil corporate software blocked all other methods

[Ruskie-it]

Hello guys,
I am here begging your help on how to remove ExplorerPatcher from my office laptop 'cause all other uninstallation methods have failed because of corporate antivirus.

---

TLDR: Windows Defender on corporate pc recognized EP as malicious software and:

1. removed some EP dll (not all)
2. removed "uninstall" entry from Windows settings
3. blocked ep_setup.exe as soon as it was downloaded
4. Lately it has also isolated the pc: no longer internet connection or usb data drives available.
5. Local IT support managed to remove EP installation directory, but there must be some service/dll that still gets loaded at OS start because I see EP menu entries in taskbar.

Need help to remove those dll/service manually, as I can't determine their names

---

I have been using ExplorerPatcher with Start10/11 with extreme satisfaction for the last x years, never had troubles on my office pc. Lately however corporate security decided that it was a dangerous and risky program and decided to put it in the banned software, and also used Windows Defender to automatically uninstall it (of course, without giving you the option to proceed on your own). However, it did a horrible job: as a matter of fact, it didn't fully uninstall EP, it only removed some dll; EP still loads up when Windows start, but I can't really change preferences or anything.
I have to uninstall it because Corporate Security at global level isolated my laptop (no teams, no internet whatsoever except for mail), but local support is unable to remove it.

I can tell that EP is loaded primarily because I can see the it in the taskbar menu when I right click on it. In particular, I see the familiar "Properties" menu entry from which you access to EP menu and can change properties, but if I click on it I get the error message:

"There was a problem starting C:<path_to_EP>\ep_gui.dll The specified module could not be found"

This is true: ep_gui.dll is not present anymore in EP installation directory, most likely deleted by Windows Defender. However as I said, Defender did not remove everything, because the program actually starts.
I can't use the Windows Programs and apps uninstallation option because it has been removed by Defender as well. I tried to download ep_setup.exe to launch it with /uninstall flag, I also tried to download it saving it with ep_uninstall.exe, but Defender recognizes it as a malicious software and immediately deletes it before I can launch it. (And, I can't now put any other software on pc because it has been isolated: no internet nor usb keys).
Local IT support has done some stuff and with their administrative privileges have been able now to remove all of the files in EP installation directory and the directory as well, but there must be some service and/or .dll that it is placed elsewhere and still gets loaded because as I said I can see EP running, but I am unable to understand which dll it is and which service is EP one. Could you please help?

Thanks a lot in advance

[pyrates999]

This is being worked on: #3670 (comment)

Please close this.

[pyrates999]

You misunderstand. It doesn't exist yet, it is still being worked on.

[Ruskie-it]

Will it be done also for uninstalling? And with no connection available?

Even if so, I still believe in my specific case there should be some "simpler" step in my specific case (as it might be difficult to type the script by hand in my pc). Most of the uninstallation job has already been done, either by Windows Defender or by local IT staff.
There should only be some remnant: services or dll that EP places outside the installation directory.

I just would need to know what and where they are and how to unregister them, if valinet would be so kind to help...

[pyrates999]

it will be a powershell script file that you download.

[Amrsatrio]

@pyrates999 I am holding off from continuing to work on that thing. The situation is uncertain right now. I am pausing my work on EP for now. Further updates and fixes will be privately only for me and my friends till further notice.

@Ruskie-it Delete C:\Windows\dxgi.dll.

[Ruskie-it]

@pyrates999 I am holding off from continuing to work on that thing. The situation is uncertain right now. I am pausing my work on EP for now. Further updates and fixes will be privately only for me and my friends till further notice.

@Ruskie-it Delete C:\Windows\dxgi.dll.

Thanks Amrsatrio, I found that reference somewhere around and considered removing it, but then I also found that it is (at least it has the same name of) a DirectX dll and I was afraid to tamper with it. Is it safe to delete it? (I assume it is, since you're telling me to do) Do I have to reinstall DirectX afterwards?

Thanks

[Amrsatrio]

It is EP injecting into explorer.exe. You can delete it.

[Ruskie-it]

It is EP injecting into explorer.exe. You can delete it.

Thanks!