Kaseya Community

MSE still shows as conflicting software after silent uninstall

This question is not answered

After silently uninstalling MSE using /x /s strings, Kaseya still displays it as conflicting software although it is not running and gone from the workstations. Any idea on how to fix this?

All Replies
  • Did you run an audit after uninstalling MSE?

  • Run Latest Audit

  • Yes, I did.

  • ok run this below VBS file to affected machine manually ..it will show the result current list of AV product installed  you can see if any conflict found ..if you found conflict you need run clean up

    ' to test on a remote system, set strComp = TheComputerNameOfTheRemoteSystem

    ' script will fail if you don't have permission to query the system

    Dim strComp, iAVCount, iFWCount, iASCount, sAV, sFW, sAS, bXP

    Dim objFSO, objFolder, objShell, objTextFile, objFile

    Dim strDirectory, strFile, strText

    strDirectory = "c:\logs3"

    strFile = "\Summer.txt"

    strText = "Book Another Holiday"

    strComp = "."

    Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComp & "\root\cimv2")

    Set colOperatingSystems = objWMIService.ExecQuery ("Select * from Win32_OperatingSystem")

    For Each objOperatingSystem in colOperatingSystems

      if instr(objOperatingSystem.Caption, "XP") <> 0 then

         call XPSub

         bXP = True

      else

         call VistaSub

         bXP = False

      end if

    Next

    select case iAVCount

       case 0

      sAVMsg = "WARNING - No AntiVirus Product Detected!" & vbnewline  & vbnewline

       case 1

      sAVMsg = "AntiVirus Product:  " & sAV & vbnewline  & vbnewline

       case else

      sAVMsg = "WARNING - " & iAVCount & " AntiVirus Products Detected:" & vbnewline & vbtab & sAV & vbnewline  & vbnewline

    end select

    if bXP = False then

      select case iASCount

          case 0

         sASMsg = "WARNING - No AntiSpyware Product Detected!" & vbnewline  & vbnewline

          case 1

         sASMsg = "AntiSpyware Product:  " & sAS & vbnewline  & vbnewline

          case else

         sASMsg = "WARNING - " & iASCount & " AntiSpyware Products Detected:" & vbnewline & vbtab & sAS & vbnewline  & vbnewline

      end select

    end if

    select case iFWCount

       case 0

      sFWMsg = "No 3rd Party Firewall Detected." & vbnewline  & vbnewline

       case 1

      sFWMsg = "Firewall Product:  " & sFW & vbnewline  & vbnewline

       case else

      sFWMsg = "WARNING - " & iFWCount & " Firewall Products Detected:" & vbnewline & vbtab & sFW & vbnewline  & vbnewline

    end select

    Msgbox sAVMsg & sASMsg & sFWMsg, , "Security Product Detection VBS by KITS"

    Sub VistaSub

      Set oWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComp & "\root\SecurityCenter2")    

      Set colAVItems = oWMI.ExecQuery("Select * from AntiVirusProduct")

      For Each objAntiVirusProduct In colAVItems

          If LenB(objAntiVirusProduct.DisplayName) > 1 Then

         sAVState = right(hex(objAntiVirusProduct.productstate), 4)

         if left(sAVState, 1) = "1" then

             sAVActive = "Enabled"

         else

             sAVActive = "Disabled"

         end if

         if mid(sAVState, 3, 1) = "0" then

             sAVCurrent = "Up to Date"

         else

             sAVCurrent = "Outdated!"

              end if

              if lenb(sAV) < 1 then

             ' only one here

             sAV = objAntiVirusProduct.DisplayName & " (" & sAVActive & ", " & sAVCurrent & ")"

             iAVCount = 1

         else

             ' multiple products end up here

             sAV = sAV & vbnewline & vbtab & objAntiVirusProduct.DisplayName & " (" & sAVActive & ", " & sAVCurrent & ")"

             iAVCount = iAVCount + 1

         End if

          End if

      Next

      Set colASItems = oWMI.ExecQuery("Select * from AntiSpywareProduct")

      For Each objAntiSpywareProduct In colASItems

          If LenB(objAntiSpywareProduct.DisplayName) > 1 Then

         sASState = right(hex(objAntiSpywareProduct.productstate), 4)

         if left(sASState, 1) = "1" then

             sASActive = "Enabled"

         else

             sASActive = "Disabled"

         end if

         if mid(sASState, 3, 1) = "0" then

             sASCurrent = "Up to Date"

         else

             sASCurrent = "Outdated!"

              end if

              if lenb(sAS) < 1 then

             ' only one here

             sAS = objAntiSpywareProduct.DisplayName & " (" & sASActive & ", " & sASCurrent & ")"

             iASCount = 1

         else

             ' multiple products end up here

             sAS = sAS & vbnewline & vbtab & objAntiSpywareProduct.DisplayName & " (" & sASActive & ", " & sASCurrent & ")"

             iASCount = iASCount + 1

         End if

          End if

      Next

      Set colFWItems = oWMI.ExecQuery("Select * from FirewallProduct")

      For Each objFirewallProduct In colFWItems

          If LenB(objFirewallProduct.DisplayName) > 1 Then

         sFWState = right(hex(objFirewallProduct.productstate), 4)

         if left(sFWState, 1) = "1" then

             sFWActive = "Enabled"

         else

             sFWActive = "Disabled"

         end if

              if lenb(sFW) < 1 then

             ' only one here

             sFW = objFirewallProduct.DisplayName & " (" & sFWActive & ")"

             iFWCount = 1

         else

             ' multiple products end up here

             sFW = sFW & vbnewline & vbtab & objFirewallProduct.DisplayName & " (" & sFWActive & ")"

             iFWCount = iFWCount + 1

         End if

          End if

      Next

    end sub

    sub XPSub

      Set oWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComp & "\root\SecurityCenter")  

         Set colAVItems = oWMI.ExecQuery("Select * from AntiVirusProduct")

         For Each objAntiVirusProduct In colAVItems

                If LenB(objAntiVirusProduct.DisplayName) > 1 Then

               if objAntiVirusProduct.onAccessScanningEnabled = True then  

                   sAVActive = "Enabled"

               else

                   sAVActive = "Disabled"

               end if

               if objAntiVirusProduct.productUpToDate = true then

                   sAVCurrent = "Up to Date"

               else

                   sAVCurrent = "Outdated!"

               end if

               if lenb(sAV) < 1 then

                   ' only one antivirus here

                   sAV = objAntiVirusProduct.DisplayName & " (" & sAVActive & ", " & sAVCurrent & ")"

                   iCount = 1

               else

                   ' multiple antivirus ends up here

                   sAV = sAV & vbnewline & objAntiVirusProduct.DisplayName & " (" & sAVActive & ", " & sAVCurrent & ")"

                   iCount = iCount + 1

               End if

             End if

         Next

      Set colFWItems = oWMI.ExecQuery("Select * from FirewallProduct")

      For Each objFirewallProduct In colFWItems

          If LenB(objFirewallProduct.DisplayName) > 1 Then

         if objFirewallProduct.enabled = True then  

             sFWActive = "Enabled"

         else

             sFWActive = "Disabled"

         end if

              if lenb(sFW) < 1 then

             ' only one here

             sFW = objFirewallProduct.DisplayName & " (" & sFWActive & ")"

             iFWCount = 1

         else

             ' multiple PRODUCTS end up here

             sFW = sFW & vbnewline & vbtab & objFirewallProduct.DisplayName & " (" & sFWActive & ")"

             iFWCount = iFWCount + 1

         End if

          End if

      Next

    end sub

  • Check Microsoft Security Center and see if MSE is still listed.  If it's not then run a new baseline audit (warning you will lose the old baseline).  Make sure you give it about 10 minutes to update the data.  If you're still seeing a conflict then you can either a) enter a support ticket or b) ignore it since it's not there.

  • Need to run a baseline audit.

  • Looks like that was it, it needs a new baseline audit and not a latest audit. Thanks

  • I spoke too fast. It did clear for one test computer, but since, it hasn't cleared for others.

  • Looks like a baseline and then a latest does the trick.

  • The baseline should do it (I've also had success with only running a latest).  Typically, you just have to wait long enough for the audit to complete and send the XML files to the KServer for processing.  Regardless, glad it worked.