TechdawgI found this on Micro$ofts site somewhere. Havent tried it yet, but the code looks right. '============================================================================== ' LANG : VBScript ' NAME : FCS-SampleScript Uninstall McAfee AV.vbs ' VERSION : 1.0003 3/2/2007 ' AUTHOR : wstack@microsoft.com - based on code by P. Charles, ADI ' Description : Script to uninstall McAfee AV components ' ' THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, ' EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED ' WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE. ' ' Copyright (C) 2007. Microsoft Corporation. All rights reserved. ' ' NOTES : ALL SAMPLE SCRIPTS BEGIN WITH THE SAME SETUP ELEMENTS ' You can use this script standalone or incoporate the ' subroutines in this script into a larger script. '============================================================================== Option Explicit Dim bDEBUG : bDEBUG=False 'Set to TRUE to help with script debugging. ' Constants Declarations Const WAIT_ON_RETURN = True Const DO_NOT_WAIT_ON_RETURN = False Const HIDE_WINDOW = 0 Const SHOW_WINDOW = 1 Const ThisComputer = "." '============================================================================== ' Main Routine On Error Resume Next If bDEBUG then On Error Goto 0 ' Create system objects Dim WshShell : Set WshShell = WScript.CreateObject("WScript.Shell") Dim objRegistry : Set objRegistry = GetObject("winmgmts:{impersonationLevel=Impersonate}!\\" & _ ThisComputer & "\root\defaulttdRegProv") Dim objWMIService : Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" &_ ThisComputer & "\root\cimv2") ' Call the installation functions 'Call FCS_InstallXPSP2Hotfix Call UninstallMcAfeeAV ' Clean out the McAfee Quarantine folder ' NOTE: The location may vary depending on your installation On Error Resume Next WshShell.Run "erase /F /S /Q C:\VIRUS\*.*",HIDE_WINDOW,WAIT_ON_RETURN If bDEBUG Then On Error Goto 0 ' Clean up objects and exit Set objWMIService = Nothing Set objRegistry = Nothing Set WshShell = Nothing wscript.quit '===================================================================================== ' SubRoutine UninstallMcAfeeAV ' This routine stops the McAfee framework services and uninstalls the AV client ' ' INPUTS: None ' OUTPUT: Logs MSI uninstall event ' ASSUMES: The existence of the WshShell, objRegistry, and objWMIService objects ' MsiExec.exe is in the directory the script was executed from or in the ' file search PATH ' NOTES: This script is set to uninstall McAfee Enterprise version 8 ' Other versions are included as well. ' If your organization uses multiple versions you may want to use the ' registry based uninstall routine. ' '====================================================================================== Private Sub UninstallMcAfeeAV 'Query for McAfee Framework Service Dim colServiceList, objService, errReturn Set colServiceList = objWMIService.ExecQuery("Associators of {Win32_Service.Name='McAfeeFramework'} Where " &_ "AssocClass=Win32_DependentService Role=Antecedent") If IsArray(colServiceList) Then For Each objService In colServiceList objService.StopService() Next Wscript.Sleep 20000 Set colServiceList = objWMIService.ExecQuery("Select * from Win32_Service where Name='McAfeeFramework'") If IsArray(colServiceList) Then For Each objService In colServiceList errReturn = objService.StopService() Next Wscript.Sleep 10000 If bDEBUG then wscript.echo "DEBUG: Uninstalling McAfee AV Framework" On Error Resume Next ' Uninstall McAfee AV Framework WshShell.Run """C:\Program Files\Network Associates\Common Framework\FrmInst.exe"" /forceuninstall /Silent",HIDE_WINDOW,WAIT_ON_RETURN WshShell.LogEvent 4, "Uninstalled McAfee AV Framework" If bDEBUG then wscript.echo "DEBUG: Uninstalling McAfee VirusScan client" ' Uninstall McAfee AV Client ' McAfee VirusScan Enterprise 8.0i WshShell.Run"MsiExec /X{5DF3D1BB-894E-4DCD-8275-159AC9829B43} /q Reboot=""ReallySuppress""",HIDE_WINDOW,WAIT_ON_RETURN 'WshShell.LogEvent 4, "Uninstalled McAfee VirusScan Enterprise 8.0i" ' McAfee VirusScan Enterprise 7.1 'WshShell.Run"MsiExec /X{59224777-298D-4E9C-9AEB-4A91BDA01B27} /q Reboot=""ReallySuppress""",HIDE_WINDOW,WAIT_ON_RETURN 'WshShell.LogEvent 4, "McAfee VirusScan Enterprise 7.1" ' McAfee VirusScan Enterprise 7.0 'WshShell.Run"MsiExec /X{1912F734-6580-4620-8AFD-ECCCEA19CDE2} /q Reboot=""ReallySuppress""",HIDE_WINDOW,WAIT_ON_RETURN 'WshShell.LogEvent 4, "Uninstalled McAfee VirusScan Enterprise 7.0" ' McAfee VirusScan MultiPlatform 4.5.1 'WshShell.Run "MsiExec /X{87AEFD84-BC0D-11D4-B885-00508B022A51} /q Reboot=""ReallySuppress""",HIDE_WINDOW,WAIT_ON_RETURN 'WshShell.LogEvent 4, "Uninstalled McAfee VirusScan MultiPlatform 4.5.1" If bDEBUG Then On Error Goto 0 ' --> Alternate Uninstall method 'Call RegBasedUninstall("McAfee VirusScan") ElseIf bDEBUG Then wscript.echo "No McAfee Framework services found." End If ElseIf bDEBUG Then wscript.echo "No McAfee Framework found." End If End Sub '===================================================================================== ' SubRoutine RegBasedUninstall ' This routine uninstall applications using the parameters supplied in the ' SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall registry key ' ' INPUTS: The display name of the application to be uninstalled ' OUTPUT: Logs MSI uninstall events ' ASSUMES: The existence of the WshShell and objRegistry objects ' MsiExec.exe is in the directory the script was executed from or in the ' file search PATH ' ' READ THESE NOTES! ' NOTES: This script fairly generic and can be used to uninstall any product ' if you know the display name string. HOWEVER it assumes the use of MSI for all ' uninstalls. If the application does not use MSI the routine will fail. ' CAUTION: This routine uses the InStr() function to locate the input display name in the ' registry display name. It does not do a direct match. Since all enterprise ' versions of McAfee contain "McAfee VirusScan" in the display name this routine will ' find and uninstall multiple versions of the AV client. ' ' HOWEVER passing a poorly formed parameter to this routine could have some ' very bad unintended consequences. For example, if you pass the letter a to this ' routine it will uninstall every product on the system with an "a" in the name! ' '====================================================================================== Sub RegBasedUninstall(InputDisplayName) Const HKEY_LOCAL_MACHINE = &H80000002 Const UninstallRegKey = "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" Dim SubKeyArray, SubKey, DisplayName, UninstallString, StartPtr objRegistry.EnumKey HKEY_LOCAL_MACHINE, UninstallRegKey, SubKeyArray For Each SubKey In SubKeyArray 'Get the Display Name for this product objRegistry.GetStringValue HKEY_LOCAL_MACHINE, UninstallRegKey & "\" & SubKey, "DisplayName", DisplayName If bDEBUG Then wscript.echo "DEBUG: Uninstall Display name is: " & DisplayName If Instr(DisplayName, InputDisplayName) > 0 Then ' Add the automatic, silent and no reboot MSI uninstall options objRegistry.GetStringValue HKEY_LOCAL_MACHINE, _ UninstallRegKey & "\" & SubKey, "UninstallString", UninstallString StartPtr = Instr(1,UninstallString,"/I") + 2 If StartPtr > 2 Then UninstallString = "MsiExec /X " & mid(UninstallString, StartPtr, 38) &_ " /q Reboot=""ReallySuppress""" Else UninstallString = UninstallString & " /q Reboot=""ReallySuppress""" End If If bDEBUG Then wscript.echo "DEBUG: Uninstall string is: " & UninstallString ' WshShell.Run UninstallString,HIDE_WINDOW,WAIT_ON_RETURN WshShell.LogEvent 4, "Uninstalled " & DisplayName End if Next End Sub