I know we've got the Symantec Antivirus/Endpoint Protection v8 - 11 agent procedure removal (I can post it here if anyone wants it), but there's so many more antiviruses that we need to make scripts for!
Here's a list I'm working on:
Symantec Endpoint Protection v12
Kaspersky Internet Security 2011
Does anyone have any to contribute? :) If you already have one of the above, please post it. Thanks.
Are you asking about graceful uninstall with unique identifiers or "manual" removal? There is a pretty big difference.
If you're talking about the easy way, check out Sunbelt's AV removal tools. I'm pretty sure most of them can be scripted. Someone else pointed out the page in another thread: www.sunbeltsoftware.com/.../Agent-Uninstallers
Wow, that tool is pretty amazing. Unfortunately though, it looks like you'll need VIPRE Enterprise in order to run it.. I hope I'm wrong.
Yes, I'm talking about the unique identifiers uninstall. For example for one of the versions of Symantec Endpoint Protection the script looks like this:
A the seminar in Vegas last summer we heard about an app called "App Remover" http://www.appremover.com/ it works great especially for AV's that have an unistall password. I have not created any procedure for it yet as we did not have enough machines to warrant one, however I have heard that it is very easy, there may even be one posted here somewhere. This program will remove all Versions of AV and antispyware, it will also help you remove a failed install, and best of all it is FREE!!
Appremover is a sweet program! Thanks for letting me know about. However, I do not know how to create a script for it without purchasing the SDK version, which is Appremover CLI (Command line interface). The free version doesn't have command line capability. Nonetheless, thank you.
Here is one for SEP, read the comments though...
I gotta say, I'm surprised there isn't a list of Global Unique Identifiers of every antivirus and version for msiexec silent uninstalls. I think that's all we're missing to have a single universal antivirus removal script.
Anyone ever find a solution on this?
There are no single universal uninstall solution to this at this point and time. The main reason for this is you don't want Antivirus products to be too easy to uninstall else every black hat out there could uninstall them.
We ran a set of scripts to uninstall antivirus originally but have found the only one we need is the Symantec script. The script i use is vb based and will search the registry for the uninstall command on Symantec and thus works for every version.
From there we are a Trend site and trend uninstalls other antivirus by itself and is successful with most (besides Symantec) so we don't need many scripts.
I would suggest getting an AV product that will uninstall other AV's by itself as this works very nicely and cleanly.
Right, so Trend Micro (what product/version?) is a good program that we can use to just UNINSTALL the antivirus, but not install trend micro itself afterward? Or will I have to uninstall trend after that?
We use trend worry free but yes it will uninstall all other AV's on the trend install so not practical to use as an av uninstalling app. Sorry.
Hey aabbasi, if you look at my previous post I said that I have used App Remover to get rid of any AV that has a password and you can not remember it, it will also work with other AV and spyware removal software, (ie: malware bytes and spybot). The only downside is that you have to login to the machine you want to remove the AV from and run the software manually.
I could use the Symantec Antivirus/Endpoint Protection v8 - 11 agent procedure removal if you wouldn't mind posting it.
Its one I received a while ago from another kaseya member so its only right to share. It uses the kaseya script, a vb script and regfind.exe.