Script to remove Nod32

Good Day

How would I go about creating a script to remove Nod32 on user pc's via Kaseya?

Or is there a script available

Thanks in advance

How much is it worth to ya :D

Can always use some ginger beer money...

(for the ranters this is just a joke, I don't work for Kaseya and I didn't actually expect to get paid)

WOW! Further confirmation that the new forum is crap. I have NEVER seen a response like that to a script request.

This NOD32 uninstall script was aided by checking the uninstall string in the system registry from add/remove programs. that's a different script. :)

Here you go, your mileage may vary:

Script Name: Uninstall NOD32 v3 or v4
Script Description: Uninstalls NOD32

IF Application is Running 
   Parameter 1 : ekrn.exe
THEN
   Get Variable
     Parameter 1 : 0
     Parameter 2 : HKEY_LOCAL_MACHINE\SOFTWARE\ESET\ESET Security\CurrentVersion\Info\ProductCode
     Parameter 3 : ProductCode
         OS Type : 0
   Get Variable
     Parameter 1 : 0
     Parameter 2 : HKEY_LOCAL_MACHINE\SOFTWARE\ESET\ESET Security\CurrentVersion\Info\InstallDir
     Parameter 3 : InstallDir
         OS Type : 0
   Execute File
     Parameter 1 : #InstallDir#callmsi.exe
     Parameter 2 :  /x #ProductCode# /qn /promptrestart
     Parameter 3 : 1
         OS Type : 0
   Write Script Log Entry
     Parameter 1 : NOd 32 uninstall finished.
         OS Type : 0
ELSE
   Write Script Log Entry
     Parameter 1 : NOD32 was not detected
         OS Type : 0

Says the guy named Ghettomaster... Instead of whining, how about doing something about it? Email your sales rep or Bendan and let them know what is good, and what is bad about the new forum. Let them know whats missing so they can IMPROVE it.

Regarding the bonehead (HardKnoX) who was looking to make a dime off of ya, I do agree that his kind of answer doesn't fit the whole spirit of these forums (he would have replied to you the same way in the old forum too!). Maybe it would be nice of him to join in with the "lets help each other out" philosophy of these forums.

@ghettomaster

I don't work for Kaseya don't get paid for any of the helpful responses I have posted (not even in stars it seems) nor do I expect to just thought it would be funny as I see so many of these script request post especially from ppl who don't even bother to give it a go them selves.

@David Bourgeois

Really don't know what to say so I won't bother...

@HardKnox  ..... Cheers!!! I'd like this but I forgot we're not on Facebook ! Next time add a smiley  :D

@myArch-man : can you add the other script that checks the reg key? I've got a vbscript that I've sort of got working that does the same but if you've got one working in kaseya that could really help with automation in other areas as well.

Hi All,

I do work for Kaseya and I can tell you that this forum is only as good as the people on it.  I've seen HardKnoX post some really valuable info on these boards and I don't think he had any ill intentions.  Let's just move on and keep collaborating as much as we can.  

HardKnoX - If it makes you feel any better, I answer a lot of questions and get no stars either :)  

- Max

I could use some beer money too. :) In order to get anything out of scripting, you need good logic and deductive reasoning skills. This is also a prereq to being a good IT support person.

With that said, when i was a begineer kaseya scripter, I looked to this forum to help me understand. It was the scripts posted in the forum that gave me understanding, and some nice nuggets too.

Most of the scripts I've used from the forum do not work "out of the box". They need tweaking to fit your needs, and it is this process that will make you a master scripter. Only then will you be able to make your own. This NOD32 uninstall script took about 40 minutes to create, however, if I didn't have any scripting experience, I'd never get there.

YES! I do deserve to get paid for my scripts. Karma demands me to give back to the forum, and I will get paid back some way.

this is sad, but I just figured out we could add stars :D

@Max Pruger

Since we have your attention. How much resources in personel does Kaseya put into the forums? How often are YOU expected to join discussions and offer advice?

The reason why I am here is that I get faster/quicker responses from people here than Kaseya support themselves. That's a thumbs up to the more veteran guys around here.

I don't mind building a community, I just hope that Kaseya isn't expecting us to do the support for you guys.

@ brandon kim

I can 2nd your support issues, but I can say that when ever I call into Ksupport someone answers the phone (they may not have the answer but they pick up).

@ Max Pruger  -- brandon makes a good point, Can people who post on the forums get a discount on maintenance and support fees?

@danrche... I posted the add/remove script here:

community.kaseya.com/.../536.aspx

It is someone elses script from the old k forum. It comes in handy to find uninstall strings for possible further scripting.

How much resources in personel does Kaseya put into the forums?  

> We have an admin, Brendan Cosgrove, who's sole job is to build out the Kaseya Community.  He has dedicated resources for different parts of the forum.  What you see today is just the tip of the iceberg.

How often are YOU expected to join discussions and offer advice?  

> There is no expectation, I post because I've been with Kaseya a long time and even though I'm a sales guy, my background is IT.  For those who know me, they know that I am always happy to help when I can.  That said, I know several Kaseya employees that post on a regular basis.  Brendan, Ben, Jeff & I are just a few.

@danrche - I have no control over support or maintenance fees but hopefully you get as much out of the forums as you put in.  I did notice you got 5 stars on that question :)

Thanks Max.

I think the more the merrier, whether regular veteran folks who know Kaseya or Kaseya employees. I try to catch Brendan when I can, I know he's busy so I don't bother him too much.

I look forward to conversing with you and others here in the community.....

@Max

I love busting chops on Kaseya but in all fairness you guys had a great product in ver 5. K2 will be awesome too after all the stability issues are worked out (K2 just doesn't seem like it's a finished product). I think like all companies that grow at such a fast rate support always lag's b/c of the time it takes to ramp up staff to support all the new customers. add to the mix an ambitious dev schedule and it's not long before you guys have your hands full.

I'm sure it'll get better, but like all things will take time.

I tried this script, and it didn't work at all.  I got the error

"FAILED in processing THEN step 1, Get Variable, with error Registry Query Failed, Registry Value = HKEY_LOCAL_MACHINE\SOFTWARE\ESET\ESET Security\CurrentVersion\Info\ProductCode"

Somebody please give me a hint: how the h*** do I go about troubleshooting this, other than making wild stabs in the dark?  

I've confirmed that the registry value is there and that there aren't any typos in the string.    An error message of "FAILED" is about as useful the apocryphal "General Car Fault" light in the middle of your dashboard.

Help?  Ideas?

/kenw

If I recall correctly NOD32 has 64bit AV clients, is your test machine a 64bit or 32bit?

If it is 64bit machine then use the 64bit commands and the query should work.

There's a 64 bit version of "Get Variable, with Registry Query"?    

So far as I can see, it must be a bug, but Kaseya support refused to take scripting queries seriously.

/kenw

There are 64bit Get Variable registry queries in K2, can't recall if they were in Kaseya 5.x or not. So can you tell me if your test machine has 64bit Windows installed?

I devised this script on an as needed bases. I really only had to deal with 32bit XP and 32bit 2k3 server, so i can not comment on the 64bit part. As far as I'm concerned, the script is fully baked for my purposes. :) your mileage may vary.

I had high hopes, but nope -- not either 32- or 64-bit.   Here's the script:

-------------

Uninstall NOD32 x64

Applicationekrn.exe is running

Create variableProductCodeand store64-Bit Registry Value"HKEY_LOCAL_MACHINE\SOFTWARE\ESET\ESET Security\CurrentVersion\Info\ProductCode"

Create variableInstallDirand store64-Bit Registry Value"HKEY_LOCAL_MACHINE\SOFTWARE\ESET\ESET Security\CurrentVersion\Info\InstallDir"

Execute#InstallDir#callmsi.exe /x #ProductCode# /qn /promptrestart as Execute as the system accountand wait for completion

Write'ESET NOD32 uninstall finished'into the procedure log

Else

Write'ESET NOD32 not detected running'into the procedure log

-----------

Errors I get depending on whether it's x86 or x64:

-----------

FAILED in processing THEN step 1, Get Variable, with error Invalid Parameter, 64-bit Registry Value = "HKEY_LOCAL_MACHINE\SOFTWARE\ESET\ESET Security\CurrentVersion\Info\ProductCode"

FAILED in processing THEN step 1, Get Variable, with error Registry Query Failed, Registry Value = HKEY_LOCAL_MACHINE\SOFTWARE\ESET\ESET Security\CurrentVersion\Info\ProductCode"

---------

I've confirmed those keys again with 'reg'.

Interestingly, 'reg' requires the variable to specified separately with a /v....

/kenw

Here is a slightly updated script for K2 that checks for 32 or 64 bit OS.

<?xml version="1.0" encoding="utf-8"?>
<ScriptExport xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://www.kaseya.com/vsa/2008/12/Scripting">
  <Procedure name="Uninstall NOD32 v3 or v4" treePres="3" id="871342037">
    <Body description="Checks to see if it is 32 or 64 bit OS.&#xD;&#xA;Uninstalls NOD32&#xD;&#xA;">
      <If description="Uninstalls NOD32&#xD;&#xA;">
        <Condition name="ApplicationRunning">
          <Parameter xsi:type="StringParameter" name="ApplicationName" value="ekrn.exe" />
        </Condition>
        <Then>
          <If description="">
            <Condition name="Windows 32 or 64 Bit Check">
              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
              <Parameter xsi:type="StringParameter" name="Value" value="" />
            </Condition>
            <Then>
              <Statement description="" name="GetVariable" continueOnFail="false">
                <Parameter xsi:type="EnumParameter" name="VariableType" value="RegistryValue64" />
                <Parameter xsi:type="StringParameter" name="SourceContent" value="HKEY_LOCAL_MACHINE\SOFTWARE\ESET\ESET Security\CurrentVersion\Info\ProductCode" />
                <Parameter xsi:type="StringParameter" name="VariableName" value="ProductCode" />
              </Statement>
              <Statement description="" name="GetVariable" continueOnFail="false">
                <Parameter xsi:type="EnumParameter" name="VariableType" value="RegistryValue64" />
                <Parameter xsi:type="StringParameter" name="SourceContent" value="HKEY_LOCAL_MACHINE\SOFTWARE\ESET\ESET Security\CurrentVersion\Info\InstallDir" />
                <Parameter xsi:type="StringParameter" name="VariableName" value="InstallDir" />
              </Statement>
              <Statement description="&quot;C:\Program Files\ESET\ESET NOD32 Antivirus\callmsi.exe&quot; /i {B00AAE66-9DE1-43EF-9E99-C485A5D28BC4}&#xD;&#xA;&#xD;&#xA;/x #ProductCode# /qn /promptrestart" name="ExecuteFile" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Path" value="#InstallDir#callmsi.exe" />
                <Parameter xsi:type="StringParameter" name="Arguments" value="/x #ProductCode# /qn /forcerestart" />
                <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="User" />
                <Parameter xsi:type="BooleanParameter" name="WaitComplete" value="True" />
              </Statement>
            </Then>
            <Else>
              <Statement description="" name="GetVariable" continueOnFail="false">
                <Parameter xsi:type="EnumParameter" name="VariableType" value="RegistryValue" />
                <Parameter xsi:type="StringParameter" name="SourceContent" value="HKEY_LOCAL_MACHINE\SOFTWARE\ESET\ESET Security\CurrentVersion\Info\ProductCode" />
                <Parameter xsi:type="StringParameter" name="VariableName" value="ProductCode" />
              </Statement>
              <Statement description="" name="GetVariable" continueOnFail="false">
                <Parameter xsi:type="EnumParameter" name="VariableType" value="RegistryValue" />
                <Parameter xsi:type="StringParameter" name="SourceContent" value="HKEY_LOCAL_MACHINE\SOFTWARE\ESET\ESET Security\CurrentVersion\Info\InstallDir" />
                <Parameter xsi:type="StringParameter" name="VariableName" value="InstallDir" />
              </Statement>
              <Statement description="&quot;C:\Program Files\ESET\ESET NOD32 Antivirus\callmsi.exe&quot; /i {B00AAE66-9DE1-43EF-9E99-C485A5D28BC4}&#xD;&#xA;&#xD;&#xA;/x #ProductCode# /qn /promptrestart" name="ExecuteFile" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Path" value="#InstallDir#callmsi.exe" />
                <Parameter xsi:type="StringParameter" name="Arguments" value="/x #ProductCode# /qn /forcerestart" />
                <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="User" />
                <Parameter xsi:type="BooleanParameter" name="WaitComplete" value="True" />
              </Statement>
            </Else>
          </If>
          <Statement description="" name="WriteScriptLogEntry" continueOnFail="false" osType="None">
            <Parameter xsi:type="StringParameter" name="Comment" value="NOD 32 uninstall finished." />
          </Statement>
        </Then>
        <Else>
          <Statement description="" name="WriteScriptLogEntry" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Comment" value="NOD32 was not detected" />
          </Statement>
        </Else>
      </If>
    </Body>
  </Procedure>
</ScriptExport>