Kaseya Community

Scripts to remove McAfee and Symantec

  • Anyone have any scripts to remove all versions of Symantec and McAfee? I am having a heck of a time at scripting. Everything I'm trying does not work. Someone told me about a program called nonav.exe. Anyone ever use this?

    -Pete

    Legacy Forum Name: Scripts to remove McAfee and Symantec,
    Legacy Posted By Username: pete.gilbride
  • Nobody, huh? Please help a fellow techie out and post your scripts if you have any. Smile

    -Pete

    Legacy Forum Name: Scripts Forum,
    Legacy Posted By Username: pete.gilbride
  • I believe both scripts already exist in the forums. Please use the search tools to find. Also, I do know that K is working on building an uninstall set of tools in a future release of K.

    Legacy Forum Name: Scripts Forum,
    Legacy Posted By Username: boudj
  • Nonav is a util from Symantec to strip out Symantec Antivirus out of the registry. There are 2 versions of it. From my understanding, an older one for pre 11.0 and a newer version. The util is a DOS util that prompts you with about 6 options before it goes thru the processes of ripping out SAV. Not sure on a command line option for the prompting to use in scripts. The util is great and totally cleans the box.

    Legacy Forum Name: Scripts Forum,
    Legacy Posted By Username: shickey
  • I have used nonav but not remotely or with Kaseya. It is a necessity if you are planning on replacing Symantec AV with something like Sophos. Unfortunately, there is no "silent run" option with nonav that I know of. You could schedule it to run after hours. It should (theoretically) be as simple as downloading it to the agent and triggering to run remotely.

    You could (once again, theoretically) manually remove all the reg keys and files removed through running nonav using a script but it may take you some time and considerable testing.

    Legacy Forum Name: Scripts Forum,
    Legacy Posted By Username: jor@qualcom.ie
  • I just posted the answer to the NoNav question here:



    http://community.kaseya.com/xsp/f/28/t/6029.aspx

    Legacy Forum Name: Scripts Forum,
    Legacy Posted By Username: Lmhansen
  • What version of McAfee are you looking to remove?

    Legacy Forum Name: Scripts Forum,
    Legacy Posted By Username: Lmhansen
  • McAfee 8.5i Uninstall.zip
    As we're just beginning to deploy Kaseya, and have been a McAfee shop for quite a while, I had to find out how to automate/script McAfee removal to take advantage of KES/AVG. Necessity and all... Anyway, did a little research on McAfee's website and found the msiexec.exe command, and created the following script. Runs silent, the McAfee icon disappears from the tray, registry keys are removed, files removed from the Program Files folder, however note that it doesn't remove the McAfee Framework Service. The other McAfee services get removed upon next reboot. Will work on one to get rid of Framework.

    Since 98% of our customer base that runs McAfee uses 8.5i, I wasn't inclined to change this to accomodate all three versions of 8.xi, but I suppose if I changed the IF to just check for the existence of the Uninstall Command key, have three steps for uninstallation (one for each version) and check the continue if script fails box on the first two, that might work.

    Also attached is a .zip file of the script.

    Script Name: McAfee 8.5i Uninstall
    Script Description: Uninstalls McAfee Viruscan Enterprise 8.5i

    Command to uninstall 8.7i:
    msiexec /x {147BCE03-C0F1-4C9F-8157-6A89B6D2D973} REMOVE=ALL REBOOT=R /q

    Command to uninstall 8.0i:
    msiexec.exe /x {5DF3D1BB-894E-4DCD-8275-159AC9829B43} REMOVE=ALL REBOOT=R /q

    IF Check Registry Value
    Parameter 1 : HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\ePolicy Orchestrator\Application Plugins\VIRUSCAN8600\Uninstall Command
    = :msiexec /x {35C03C04-3F1F-42C2-A989-A757EE691F65} REMOVE=ALL REBOOT=R /q
    THEN
    Execute Shell Command
    Parameter 1 : msiexec /x {35C03C04-3F1F-42C2-A989-A757EE691F65} REMOVE=ALL REBOOT=R /q
    Parameter 2 : 1
    OS Type : 13
    Write Script Log Entry
    Parameter 1 : McAfee 8.5i uninstalled
    OS Type : 13
    ELSE
    Write Script Log Entry
    Parameter 1 : McAfee 8.5i not installed on this machine
    OS Type : 13

    Legacy Forum Name: Scripts Forum,
    Legacy Posted By Username: rbangel
  • How well did this work for you when you ran it on the machines in your network?

    rbangel
    As we're just beginning to deploy Kaseya, and have been a McAfee shop for quite a while, I had to find out how to automate/script McAfee removal to take advantage of KES/AVG. Necessity and all... Anyway, did a little research on McAfee's website and found the msiexec.exe command, and created the following script. Runs silent, the McAfee icon disappears from the tray, registry keys are removed, files removed from the Program Files folder, however note that it doesn't remove the McAfee Framework Service. The other McAfee services get removed upon next reboot. Will work on one to get rid of Framework.

    Since 98% of our customer base that runs McAfee uses 8.5i, I wasn't inclined to change this to accomodate all three versions of 8.xi, but I suppose if I changed the IF to just check for the existence of the Uninstall Command key, have three steps for uninstallation (one for each version) and check the continue if script fails box on the first two, that might work.

    Also attached is a .zip file of the script.

    Script Name: McAfee 8.5i Uninstall
    Script Description: Uninstalls McAfee Viruscan Enterprise 8.5i

    Command to uninstall 8.7i:
    msiexec /x {147BCE03-C0F1-4C9F-8157-6A89B6D2D973} REMOVE=ALL REBOOT=R /q

    Command to uninstall 8.0i:
    msiexec.exe /x {5DF3D1BB-894E-4DCD-8275-159AC9829B43} REMOVE=ALL REBOOT=R /q

    IF Check Registry Value
    Parameter 1 : HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\ePolicy Orchestrator\Application Plugins\VIRUSCAN8600\Uninstall Command
    = :msiexec /x {35C03C04-3F1F-42C2-A989-A757EE691F65} REMOVE=ALL REBOOT=R /q
    THEN
    Execute Shell Command
    Parameter 1 : msiexec /x {35C03C04-3F1F-42C2-A989-A757EE691F65} REMOVE=ALL REBOOT=R /q
    Parameter 2 : 1
    OS Type : 13
    Write Script Log Entry
    Parameter 1 : McAfee 8.5i uninstalled
    OS Type : 13
    ELSE
    Write Script Log Entry
    Parameter 1 : McAfee 8.5i not installed on this machine
    OS Type : 13


    Legacy Forum Name: Scripts Forum,
    Legacy Posted By Username: chipscc
  • I'm looking to remove 8.7.i and 8.0.i. Maybe 8.5.i as well. I haven't found that one yet on the network in issue. Any suggestions?

    Lmhansen
    What version of McAfee are you looking to remove?


    Legacy Forum Name: Scripts Forum,
    Legacy Posted By Username: chipscc
  • I don't happen to have my actual script handy, but I looked up the uninstall string from regedit and executed that from the script. To get past the Symantec "feature" that requires a password, I used the registry to remove the requirement before executing the uninstall string. We did the same thing for the various components of Symantec, McAfee, and Sophos.

    After testing, we then created several master scripts (ie Uninstall Sophos Workstation) which called each of the potential uninstall scripts for products that might be installed on a workstation. While not perfect, I was very pleased.

    Having said all of that, I don't need the scripts anymore. We are currently using Trend Micro products under our xSP. The Trend products have done a remarkable job of cleaning off the existing product during the push installation. It removes Symantec better then Symantec removes Symantec. On older (slower) machines you may need to push the product to a desktop twice because the push times out before the removal of the old AV finishes. Wait a few minutes and repush the machines that didn't complete.

    Legacy Forum Name: Scripts Forum,
    Legacy Posted By Username: DavePurscell