RogueCleaner review: a Windows tool for auditing context menu, startup and service residue

What RogueCleaner is trying to fix, and for whom

The README states the motivation directly: some software that should be an input method, a cloud drive client, a document viewer or an image tool quietly inserts itself into the right-click menu, startup, browser extensions and background services. RogueCleaner is aimed at that residue. It is a Windows-only C# WinForms application whose interface is in Chinese, and the author is explicit that user-facing semantics are Chinese while third-party brand names may stay in their original form with a Chinese purpose note.

The audience is a person sitting in front of one machine. Nothing in the README describes a server component, an agent, a remote console or an export format for fleet inventory. Reports are written to a local data directory next to the executable. If you administer hundreds of endpoints, this is not the shape of tool you want, and the project does not claim otherwise.

How the v2 scan engine is structured

Version 2 moved the scanning core into C# and removed the external sidecar files. According to the README, the runtime no longer depends on RogueCleaner.ps1, a rules directory, or other external files, and the repository and source packages no longer keep the old PowerShell engine, the old launcher, or the WinRAR SFX one-click script. On first run the executable creates a single data directory beside itself named 流氓软件克星数据.

The scan is multithreaded and covers context menu entries, This PC and Explorer entry points, startup registry keys and the startup folder, Windows services, scheduled tasks, Chrome and Edge extension policies plus Native Messaging Hosts, Firefox and Mozilla Native Messaging Hosts, and file associations for common image, video, archive and Office document types. Release notes for v2.0.13 state that scheduled task operations were moved to the Windows Task Scheduler COM interface while service operations still use sc.exe, and that services are not created or modified through WMI.

Vendor attribution is the part worth reading closely. The README says vendor names are not guessed by fuzzy substring matching across registry text. The program checks display name, Publisher, file version information, valid Authenticode signatures, MSI metadata and install directory ownership separately. GUIDs, hashes, PIDs, full registry paths and system hosts such as msiexec.exe and rundll32.exe cannot on their own establish a vendor. The v2.0.14 notes add that the main program and bundled products are kept strictly separate to reduce false positives from vendor keyword matches.

Installing and running a first scan

The README recommends downloading the direct EXE from the GitHub Release page rather than the archive. The archive is described as being for people who want to review the source or keep the full release package. The executable is portable in the sense that it does not move itself: wherever you put it, it runs there and creates its data directory alongside.

After download, verify the checksum. Each packaging run produces a SHA256SUMS file, and the README says to check the downloaded file against it, especially if security software flags the binary. That flag is expected behaviour for a tool that reads, backs up and deletes registry keys and disables services.

To run it, double-click the executable. No command line is required for normal use. The program starts with normal privileges by default; it requests Windows UAC only when you act on system-level items such as HKLM keys, services or scheduled tasks. If you cancel the elevation prompt or lack administrator credentials, scanning, viewing results and exporting reports still work.

There is a headless smoke path if you want to confirm the scanner runs without opening the GUI:

.\流氓软件克星.exe --scan-smoke

According to the README, this flag scans and writes a report without showing the GUI and without performing any cleanup. If a GUI scan fails, the program writes reports\scan-error-*.json so the failure evidence can be sent back.

If you want to build from source instead, the README specifies the .NET Framework 4.x compiler that ships with Windows and this build script:

powershell -NoProfile -ExecutionPolicy Bypass -File .\Build-Exe.ps1

The documented outputs are 流氓软件克星.exe and dist\流氓软件克星\流氓软件克星.exe.

Cleaning, backup and the restore centre

The risk controls are stated as defaults rather than options. Opening the program does not clean anything. Scan results are not pre-checked. The 勾选可清理 action does not select items marked as notice-only. There is a second confirmation before cleaning. After cleaning, each item is re-checked and anything that failed or remains stays in the rescan list.

Every cleaning run produces a backup batch under 流氓软件克星数据\backups\. The restore centre lets you pick a batch and roll back registry keys, moved files, service startup state and scheduled task state. It also offers two ways to reclaim space: 删除当前批次 deletes the selected restore record and its batch report after showing the size and asking for confirmation, and 清理旧记录 keeps everything from the last 30 days plus the newest 20 batches and only removes older backlog. Deletion is bounded to the tool's own backup directory and is re-checked afterwards. Once a restore record is deleted it can no longer be used for rollback.

The v2.0.16 notes describe a specific failure that was fixed: if the registry backup failed, the deletion is now cancelled so a context menu entry cannot be removed without a way to restore it. Core right-click verbs and system commands are now notice-only and are not deleted, to avoid breaking the whole context menu. If a partial restore fails, the failing items are kept and can be retried individually.

Where RogueCleaner gets in the way

The permission model is the main friction. System-level items need elevation, and the README is clear that elevation does not queue work: after an elevated restart the page and pending checkboxes are restored, but cleaning is not executed automatically. If your organisation blocks UAC elevation by policy, the tool will not attempt to bypass it, and you are left with scan and report only.

The vendor recognition is deliberately conservative, and that has a cost. The README states that if a pop-up, ad, watchdog or auto-restore behaviour is genuinely present but local evidence is insufficient to confirm the vendor, the result is labelled 未知第三方 and can only be a notice; it cannot enter the one-click cleaning or automatic uninstall path. The same applies to items with no uninstall command and to hidden components: they are reported, not removed. For suspected bundle, pop-up or watchdog components that do have an uninstall command, the tool opens the original vendor uninstaller and the user confirms; those items are never bulk-selected and must be checked manually.

Context menu management is also not a general-purpose editor. The README distinguishes normal context menu management from risk diagnosis, and v2.0.13 added Shell commands, Shell extensions, file type menus and CommandStore handling. If your goal is to author new context menu entries or manage them across a fleet, this is the wrong tool. It is a residue auditor with a cleaning path, not a configuration manager.

RogueCleaner compared with ContextMenuManager

The README itself acknowledges a reference relationship with ContextMenuManager and states that RogueCleaner is an independent implementation. That acknowledgement is the honest way to frame the comparison, because the two tools overlap on context menu enumeration and both are Windows desktop utilities.

The difference in approach is scope. ContextMenuManager is described by its own project as a context menu manager; RogueCleaner treats the context menu as one of seven scan surfaces alongside startup entries, services, scheduled tasks, browser extensions, file associations and This PC or Explorer entry points. RogueCleaner also carries a backup-and-restore layer with batch rollback and a vendor identity resolver that cross-checks signatures and MSI metadata. If you only need to toggle shell extensions, a focused manager is the smaller dependency. If you are chasing what a bundled installer left across several surfaces at once, the multi-surface scan is the reason to pick RogueCleaner.

Licence, maintenance and what upgrading costs

The repository is MIT licensed, which permits commercial use, modification and redistribution provided the copyright notice and permission notice are retained. That is a permissive arrangement, but it says nothing about the security posture of the binary itself; the README's own guidance is to verify the SHA256 and the download source rather than assume the licence implies safety. Nothing in the README addresses trademark use of the third-party brand names the tool displays, so treat that as an open question rather than a settled one.

Maintenance is visible in the release cadence. The last push was on 2026-08-13, and v2.0.16 was released the same day, following v2.0.15 on 2026-08-08 and v2.0.14 on 2026-08-06. The repository is not archived. Upgrades are user-confirmed: the program checks the GitHub Release page once per day, shows a summary of the latest release notes, and only downloads the direct EXE and replaces and restarts after you confirm in the dialog. There is no silent update path. Because the data directory sits beside the executable, replacing the EXE does not move your backups, reports or quarantine, but the README does not document a migration step for the data directory format, so keep the old executable until you have confirmed the new one reads your existing batches.

Editorial conclusion

Adopt RogueCleaner if you are a Chinese-speaking Windows user who wants to see what a bundled program left behind in the context menu, startup entries, services or scheduled tasks, and you accept reviewing each item before cleaning. Do not adopt it if you need a scriptable, headless or cross-platform tool, or if you manage machines in bulk; the project is a single WinForms executable with no documented CLI beyond its smoke-test flags. Before running it on a working machine, verify the SHA256 against the published SHA256SUMS file, confirm the download came from the GitHub Release page, and read the restore-centre behaviour so you know where 流氓软件克星数据\backups\ lives.

Frequently asked questions

Official sources

1. aakk007/RogueCleaner on GitHub
2. Issues
3. License: MIT
4. README
5. Releases