If you search the forums you will find what you are looking for.

Legacy Forum Name: KES,
Legacy Posted By Username: boudj

Thanks. I have tried there. Unfortunately, there doesnt seem to be one "remove all versions" type of script for symantec. McAfee seems to be another difficult issue. There are so many registry entries, and things to remove, rolling this out to 100+ users has the potential to yeild disasterous results.
-Pete

Legacy Forum Name: KES,
Legacy Posted By Username: pete.gilbride

Symantec do have a pretty good removal tool that tracks down registry settings and invalid paths. Sorry to say, it's tricky to get rolling silently. Please try it anyway.
http://www.download3k.com/Install-Norton-Removal-Tool.html

Legacy Forum Name: KES,
Legacy Posted By Username: eron

Symantec provides 2 tools for removal of their programs.

The first is NoNav2.611 (latest version as of this date)

The second is CleanWipe

NoNav removes everything up to Symantec Corporate Edition 10.1

CleanWipe removes EVERYTHING. But, it removes everything Symantec, including PCAnywhere, LiveUpdate, all registry keys etc. I had to put in a Symantec ticket to find out this information.

The link to the file is: http://fileshare.symantec.com

The username is 'tools' and the password is 'Symantec@123'

NoNav is located in the home directory. CleanWipe is located in the SEP Tools directory.

I cannot say for certain if in your particular application of the program that it won't cause problems with your system (insert disclaimer here).

But I thought I'd share, especially since you cannot find this information on the CleanWipe program anywhere else on the web.

Ric Lollar
Lanter Delivery Systems

Legacy Forum Name: KES,
Legacy Posted By Username: rlollar

Missing the 'S' in http.
https://fileshare.symantec.com

Thanks for the posting.

Legacy Forum Name: KES,
Legacy Posted By Username: trnetwork

When I try to invoke cleanwipe using kaseya -
start "" "c:\temp\cleanwipe\runcleanwipe.bat"

I get a window stating that esugunen2 is not recognized as an internal or external command...etc.

It seems that esugunen and company are for removing reg keys.

Has anyone else run into this issue? Thus far, I have had to manually run cleanwipe...

Legacy Forum Name: KES,
Legacy Posted By Username: jchoponis

Over the years I have used a couple tools from McAfee to remove the install but none of those seem to be auto/silent. Anyone come across one?

Legacy Forum Name: KES,
Legacy Posted By Username: lorreed

You can use msiexec to uninstall any MSI package. I know Symantec is an MSI package but I'm not sure about McAffee. You can create a scrip in Kaseya to do or use psexec or to remotely execute the process. The command would like something like:

MsiExec.exe /norestart /q/x{9F6F8308-E739-4FE2-B608-7C0475713345}

The /q is for a quiet removal so the user doesn't see that anything is going on. Just port that over to Kaseya and it works fine that way also. The {9F6F8308-E739-4FE2-B608-7C0475713345} string above isn't going to work for you though. Go to a workstation running the version you need to uninstall and run regedit (or just connect to it across the network). Go to HKLM\Software\Microsoft\Windows\Uninstall and cycle through all of the strings that are in the same context as above and look on the right side to see which one belongs to Symatec. Once you find it, just replace the string above with it. Different versions of Symantec may have different strings so you may need to make a few scripts. I spot check systems by opening Computer Management on my system then connecting to one of the remote systems. I then just check for the Symantec services.

Hope this helps.

John

Legacy Forum Name: KES,
Legacy Posted By Username: jfhall

We use a similar method using msiexec. We have started a script we run against the computers. After we run the script we run an audit and then a repoort to see if the computers have Symantec AntiVirus still running. If it is still running we look in the registry and add the new uninstall string to the script. It is time consuming, but after adding about 12 versions so far, we rarely have to edit the script.

Legacy Forum Name: KES,
Legacy Posted By Username: CaseyAdams

I found this on Micro$ofts site somewhere. Havent tried it yet, but the code looks right.

'==============================================================================
' LANG : VBScript
' NAME : FCS-SampleScript Uninstall McAfee AV.vbs
' VERSION : 1.0003 3/2/2007
' AUTHOR : wstack@microsoft.com - based on code by P. Charles, ADI
' Description : Script to uninstall McAfee AV components
'
' THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND,
' EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED
' WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE.
'
' Copyright (C) 2007. Microsoft Corporation. All rights reserved.
'
' NOTES : ALL SAMPLE SCRIPTS BEGIN WITH THE SAME SETUP ELEMENTS
' You can use this script standalone or incoporate the
' subroutines in this script into a larger script.
'==============================================================================
Option Explicit
Dim bDEBUG : bDEBUG=False 'Set to TRUE to help with script debugging.
' Constants Declarations
Const WAIT_ON_RETURN = True
Const DO_NOT_WAIT_ON_RETURN = False
Const HIDE_WINDOW = 0
Const SHOW_WINDOW = 1
Const ThisComputer = "."
'==============================================================================
' Main Routine
On Error Resume Next
If bDEBUG then On Error Goto 0

' Create system objects
Dim WshShell : Set WshShell = WScript.CreateObject("WScript.Shell")
Dim objRegistry : Set objRegistry = GetObject("winmgmts:{impersonationLevel=Impersonate}!\\" & _
ThisComputer & "\root\defaulttdRegProv")
Dim objWMIService : Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" &_
ThisComputer & "\root\cimv2")

' Call the installation functions
'Call FCS_InstallXPSP2Hotfix
Call UninstallMcAfeeAV

' Clean out the McAfee Quarantine folder
' NOTE: The location may vary depending on your installation
On Error Resume Next
WshShell.Run "erase /F /S /Q C:\VIRUS\*.*",HIDE_WINDOW,WAIT_ON_RETURN
If bDEBUG Then On Error Goto 0

' Clean up objects and exit
Set objWMIService = Nothing
Set objRegistry = Nothing
Set WshShell = Nothing

wscript.quit

'=====================================================================================
' SubRoutine UninstallMcAfeeAV
' This routine stops the McAfee framework services and uninstalls the AV client
'
' INPUTS: None
' OUTPUT: Logs MSI uninstall event
' ASSUMES: The existence of the WshShell, objRegistry, and objWMIService objects
' MsiExec.exe is in the directory the script was executed from or in the
' file search PATH
' NOTES: This script is set to uninstall McAfee Enterprise version 8
' Other versions are included as well.
' If your organization uses multiple versions you may want to use the
' registry based uninstall routine.
'
'======================================================================================
Private Sub UninstallMcAfeeAV

'Query for McAfee Framework Service
Dim colServiceList, objService, errReturn
Set colServiceList = objWMIService.ExecQuery("Associators of {Win32_Service.Name='McAfeeFramework'} Where " &_
"AssocClass=Win32_DependentService Role=Antecedent")
If IsArray(colServiceList) Then
For Each objService In colServiceList
objService.StopService()
Next
Wscript.Sleep 20000

Set colServiceList = objWMIService.ExecQuery("Select * from Win32_Service where Name='McAfeeFramework'")

If IsArray(colServiceList) Then
For Each objService In colServiceList
errReturn = objService.StopService()
Next
Wscript.Sleep 10000


If bDEBUG then wscript.echo "DEBUG: Uninstalling McAfee AV Framework"
On Error Resume Next
' Uninstall McAfee AV Framework
WshShell.Run """C:\Program Files\Network Associates\Common Framework\FrmInst.exe"" /forceuninstall /Silent",HIDE_WINDOW,WAIT_ON_RETURN
WshShell.LogEvent 4, "Uninstalled McAfee AV Framework"

If bDEBUG then wscript.echo "DEBUG: Uninstalling McAfee VirusScan client"
' Uninstall McAfee AV Client
' McAfee VirusScan Enterprise 8.0i
WshShell.Run"MsiExec /X{5DF3D1BB-894E-4DCD-8275-159AC9829B43} /q Reboot=""ReallySuppress""",HIDE_WINDOW,WAIT_ON_RETURN
'WshShell.LogEvent 4, "Uninstalled McAfee VirusScan Enterprise 8.0i"

' McAfee VirusScan Enterprise 7.1
'WshShell.Run"MsiExec /X{59224777-298D-4E9C-9AEB-4A91BDA01B27} /q Reboot=""ReallySuppress""",HIDE_WINDOW,WAIT_ON_RETURN
'WshShell.LogEvent 4, "McAfee VirusScan Enterprise 7.1"

' McAfee VirusScan Enterprise 7.0
'WshShell.Run"MsiExec /X{1912F734-6580-4620-8AFD-ECCCEA19CDE2} /q Reboot=""ReallySuppress""",HIDE_WINDOW,WAIT_ON_RETURN
'WshShell.LogEvent 4, "Uninstalled McAfee VirusScan Enterprise 7.0"

' McAfee VirusScan MultiPlatform 4.5.1
'WshShell.Run "MsiExec /X{87AEFD84-BC0D-11D4-B885-00508B022A51} /q Reboot=""ReallySuppress""",HIDE_WINDOW,WAIT_ON_RETURN
'WshShell.LogEvent 4, "Uninstalled McAfee VirusScan MultiPlatform 4.5.1"
If bDEBUG Then On Error Goto 0

' --> Alternate Uninstall method
'Call RegBasedUninstall("McAfee VirusScan")

ElseIf bDEBUG Then
wscript.echo "No McAfee Framework services found."
End If
ElseIf bDEBUG Then
wscript.echo "No McAfee Framework found."
End If
End Sub

'=====================================================================================
' SubRoutine RegBasedUninstall
' This routine uninstall applications using the parameters supplied in the
' SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall registry key
'
' INPUTS: The display name of the application to be uninstalled
' OUTPUT: Logs MSI uninstall events
' ASSUMES: The existence of the WshShell and objRegistry objects
' MsiExec.exe is in the directory the script was executed from or in the
' file search PATH
'
' READ THESE NOTES!
' NOTES: This script fairly generic and can be used to uninstall any product
' if you know the display name string. HOWEVER it assumes the use of MSI for all
' uninstalls. If the application does not use MSI the routine will fail.

' CAUTION: This routine uses the InStr() function to locate the input display name in the
' registry display name. It does not do a direct match. Since all enterprise
' versions of McAfee contain "McAfee VirusScan" in the display name this routine will
' find and uninstall multiple versions of the AV client.
'
' HOWEVER passing a poorly formed parameter to this routine could have some
' very bad unintended consequences. For example, if you pass the letter a to this
' routine it will uninstall every product on the system with an "a" in the name!
'
'======================================================================================
Sub RegBasedUninstall(InputDisplayName)


Const HKEY_LOCAL_MACHINE = &H80000002
Const UninstallRegKey = "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"

Dim SubKeyArray, SubKey, DisplayName, UninstallString, StartPtr
objRegistry.EnumKey HKEY_LOCAL_MACHINE, UninstallRegKey, SubKeyArray

For Each SubKey In SubKeyArray
'Get the Display Name for this product
objRegistry.GetStringValue HKEY_LOCAL_MACHINE, UninstallRegKey & "\" & SubKey, "DisplayName", DisplayName

If bDEBUG Then wscript.echo "DEBUG: Uninstall Display name is: " & DisplayName

If Instr(DisplayName, InputDisplayName) > 0 Then
' Add the automatic, silent and no reboot MSI uninstall options
objRegistry.GetStringValue HKEY_LOCAL_MACHINE, _
UninstallRegKey & "\" & SubKey, "UninstallString", UninstallString

StartPtr = Instr(1,UninstallString,"/I") + 2
If StartPtr > 2 Then
UninstallString = "MsiExec /X " & mid(UninstallString, StartPtr, 38) &_
" /q Reboot=""ReallySuppress"""

Else
UninstallString = UninstallString & " /q Reboot=""ReallySuppress"""
End If

If bDEBUG Then wscript.echo "DEBUG: Uninstall string is: " & UninstallString

' WshShell.Run UninstallString,HIDE_WINDOW,WAIT_ON_RETURN
WshShell.LogEvent 4, "Uninstalled " & DisplayName
End if

Next
End Sub

Legacy Forum Name: KES,
Legacy Posted By Username: Techdawg

Great script! Has anyone modified to uninstall McAfee Total Protection?

Thanks!

Legacy Forum Name: KES,
Legacy Posted By Username: billmccl

Techdawg

I found this on Micro$ofts site somewhere. Havent tried it yet, but the code looks right.

'==============================================================================
' LANG : VBScript
' NAME : FCS-SampleScript Uninstall McAfee AV.vbs
' VERSION : 1.0003 3/2/2007
' AUTHOR : wstack@microsoft.com - based on code by P. Charles, ADI
' Description : Script to uninstall McAfee AV components
'
' THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND,
' EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED
' WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE.
'
' Copyright (C) 2007. Microsoft Corporation. All rights reserved.
'
' NOTES : ALL SAMPLE SCRIPTS BEGIN WITH THE SAME SETUP ELEMENTS
' You can use this script standalone or incoporate the
' subroutines in this script into a larger script.
'==============================================================================
Option Explicit
Dim bDEBUG : bDEBUG=False 'Set to TRUE to help with script debugging.
' Constants Declarations
Const WAIT_ON_RETURN = True
Const DO_NOT_WAIT_ON_RETURN = False
Const HIDE_WINDOW = 0
Const SHOW_WINDOW = 1
Const ThisComputer = "."
'==============================================================================
' Main Routine
On Error Resume Next
If bDEBUG then On Error Goto 0

' Create system objects
Dim WshShell : Set WshShell = WScript.CreateObject("WScript.Shell")
Dim objRegistry : Set objRegistry = GetObject("winmgmts:{impersonationLevel=Impersonate}!\\" & _
ThisComputer & "\root\defaulttdRegProv")
Dim objWMIService : Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" &_
ThisComputer & "\root\cimv2")

' Call the installation functions
'Call FCS_InstallXPSP2Hotfix
Call UninstallMcAfeeAV

' Clean out the McAfee Quarantine folder
' NOTE: The location may vary depending on your installation
On Error Resume Next
WshShell.Run "erase /F /S /Q C:\VIRUS\*.*",HIDE_WINDOW,WAIT_ON_RETURN
If bDEBUG Then On Error Goto 0

' Clean up objects and exit
Set objWMIService = Nothing
Set objRegistry = Nothing
Set WshShell = Nothing

wscript.quit

'=====================================================================================
' SubRoutine UninstallMcAfeeAV
' This routine stops the McAfee framework services and uninstalls the AV client
'
' INPUTS: None
' OUTPUT: Logs MSI uninstall event
' ASSUMES: The existence of the WshShell, objRegistry, and objWMIService objects
' MsiExec.exe is in the directory the script was executed from or in the
' file search PATH
' NOTES: This script is set to uninstall McAfee Enterprise version 8
' Other versions are included as well.
' If your organization uses multiple versions you may want to use the
' registry based uninstall routine.
'
'======================================================================================
Private Sub UninstallMcAfeeAV

'Query for McAfee Framework Service
Dim colServiceList, objService, errReturn
Set colServiceList = objWMIService.ExecQuery("Associators of {Win32_Service.Name='McAfeeFramework'} Where " &_
"AssocClass=Win32_DependentService Role=Antecedent")
If IsArray(colServiceList) Then
For Each objService In colServiceList
objService.StopService()
Next
Wscript.Sleep 20000

Set colServiceList = objWMIService.ExecQuery("Select * from Win32_Service where Name='McAfeeFramework'")

If IsArray(colServiceList) Then
For Each objService In colServiceList
errReturn = objService.StopService()
Next
Wscript.Sleep 10000


If bDEBUG then wscript.echo "DEBUG: Uninstalling McAfee AV Framework"
On Error Resume Next
' Uninstall McAfee AV Framework
WshShell.Run """C:\Program Files\Network Associates\Common Framework\FrmInst.exe"" /forceuninstall /Silent",HIDE_WINDOW,WAIT_ON_RETURN
WshShell.LogEvent 4, "Uninstalled McAfee AV Framework"

If bDEBUG then wscript.echo "DEBUG: Uninstalling McAfee VirusScan client"
' Uninstall McAfee AV Client
' McAfee VirusScan Enterprise 8.0i
WshShell.Run"MsiExec /X{5DF3D1BB-894E-4DCD-8275-159AC9829B43} /q Reboot=""ReallySuppress""",HIDE_WINDOW,WAIT_ON_RETURN
'WshShell.LogEvent 4, "Uninstalled McAfee VirusScan Enterprise 8.0i"

' McAfee VirusScan Enterprise 7.1
'WshShell.Run"MsiExec /X{59224777-298D-4E9C-9AEB-4A91BDA01B27} /q Reboot=""ReallySuppress""",HIDE_WINDOW,WAIT_ON_RETURN
'WshShell.LogEvent 4, "McAfee VirusScan Enterprise 7.1"

' McAfee VirusScan Enterprise 7.0
'WshShell.Run"MsiExec /X{1912F734-6580-4620-8AFD-ECCCEA19CDE2} /q Reboot=""ReallySuppress""",HIDE_WINDOW,WAIT_ON_RETURN
'WshShell.LogEvent 4, "Uninstalled McAfee VirusScan Enterprise 7.0"

' McAfee VirusScan MultiPlatform 4.5.1
'WshShell.Run "MsiExec /X{87AEFD84-BC0D-11D4-B885-00508B022A51} /q Reboot=""ReallySuppress""",HIDE_WINDOW,WAIT_ON_RETURN
'WshShell.LogEvent 4, "Uninstalled McAfee VirusScan MultiPlatform 4.5.1"
If bDEBUG Then On Error Goto 0

' --> Alternate Uninstall method
'Call RegBasedUninstall("McAfee VirusScan")

ElseIf bDEBUG Then
wscript.echo "No McAfee Framework services found."
End If
ElseIf bDEBUG Then
wscript.echo "No McAfee Framework found."
End If
End Sub

'=====================================================================================
' SubRoutine RegBasedUninstall
' This routine uninstall applications using the parameters supplied in the
' SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall registry key
'
' INPUTS: The display name of the application to be uninstalled
' OUTPUT: Logs MSI uninstall events
' ASSUMES: The existence of the WshShell and objRegistry objects
' MsiExec.exe is in the directory the script was executed from or in the
' file search PATH
'
' READ THESE NOTES!
' NOTES: This script fairly generic and can be used to uninstall any product
' if you know the display name string. HOWEVER it assumes the use of MSI for all
' uninstalls. If the application does not use MSI the routine will fail.

' CAUTION: This routine uses the InStr() function to locate the input display name in the
' registry display name. It does not do a direct match. Since all enterprise
' versions of McAfee contain "McAfee VirusScan" in the display name this routine will
' find and uninstall multiple versions of the AV client.
'
' HOWEVER passing a poorly formed parameter to this routine could have some
' very bad unintended consequences. For example, if you pass the letter a to this
' routine it will uninstall every product on the system with an "a" in the name!
'
'======================================================================================
Sub RegBasedUninstall(InputDisplayName)


Const HKEY_LOCAL_MACHINE = &H80000002
Const UninstallRegKey = "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"

Dim SubKeyArray, SubKey, DisplayName, UninstallString, StartPtr
objRegistry.EnumKey HKEY_LOCAL_MACHINE, UninstallRegKey, SubKeyArray

For Each SubKey In SubKeyArray
'Get the Display Name for this product
objRegistry.GetStringValue HKEY_LOCAL_MACHINE, UninstallRegKey & "\" & SubKey, "DisplayName", DisplayName

If bDEBUG Then wscript.echo "DEBUG: Uninstall Display name is: " & DisplayName

If Instr(DisplayName, InputDisplayName) > 0 Then
' Add the automatic, silent and no reboot MSI uninstall options
objRegistry.GetStringValue HKEY_LOCAL_MACHINE, _
UninstallRegKey & "\" & SubKey, "UninstallString", UninstallString

StartPtr = Instr(1,UninstallString,"/I") + 2
If StartPtr > 2 Then
UninstallString = "MsiExec /X " & mid(UninstallString, StartPtr, 38) &_
" /q Reboot=""ReallySuppress"""

Else
UninstallString = UninstallString & " /q Reboot=""ReallySuppress"""
End If

If bDEBUG Then wscript.echo "DEBUG: Uninstall string is: " & UninstallString

' WshShell.Run UninstallString,HIDE_WINDOW,WAIT_ON_RETURN
WshShell.LogEvent 4, "Uninstalled " & DisplayName
End if

Next
End Sub

Could you repost the script within (Code) tags so that the extra spaces aren't added to the text?

Michael

Legacy Forum Name: KES,
Legacy Posted By Username: RCS-Michael

I posted a script that does the Symantec Corporate AV uninstall:



http://community.kaseya.com/xsp/f/28/t/6678.aspx

Legacy Forum Name: KES,
Legacy Posted By Username: chadl2

[QUOTE=RCS-Michael;37388]Could you repost the script within (Code) tags so that the extra spaces aren't added to the text?

Michael[/QUOTE]

How about I just attach it

Legacy Forum Name: KES,
Legacy Posted By Username: Techdawg