Kaseya Community

McAfee/Symantec antivirus removal

  • Does anyone have any experience with removing McAfee Antivirus Enterprise, or Symantec Antivirus Enterprise in order to install AVG with Kaseya?
    We are running into major issues pushing out AVG on our internal network. Some PC's are not showing that either Symantec or McAfee are installed. When pushing the AVG installation, we get conflicts with the older software.
    Has anyone here made a script file that will silently remove symantec and mcafee?

    Any help would be greatly appreciated. Thanks.

    Pete Gilbride
    CT Networks

    Legacy Forum Name: McAfee/Symantec antivirus removal,
    Legacy Posted By Username: pete.gilbride
  • If you search the forums you will find what you are looking for.

    Legacy Forum Name: KES,
    Legacy Posted By Username: boudj
  • Thanks. I have tried there. Unfortunately, there doesnt seem to be one "remove all versions" type of script for symantec. McAfee seems to be another difficult issue. There are so many registry entries, and things to remove, rolling this out to 100+ users has the potential to yeild disasterous results.
    -Pete

    Legacy Forum Name: KES,
    Legacy Posted By Username: pete.gilbride
  • Symantec do have a pretty good removal tool that tracks down registry settings and invalid paths. Sorry to say, it's tricky to get rolling silently. Please try it anyway.
    http://www.download3k.com/Install-Norton-Removal-Tool.html

    Legacy Forum Name: KES,
    Legacy Posted By Username: eron
  • Symantec provides 2 tools for removal of their programs.

    The first is NoNav2.611 (latest version as of this date)

    The second is CleanWipe

    NoNav removes everything up to Symantec Corporate Edition 10.1

    CleanWipe removes EVERYTHING. But, it removes everything Symantec, including PCAnywhere, LiveUpdate, all registry keys etc. I had to put in a Symantec ticket to find out this information.

    The link to the file is: http://fileshare.symantec.com

    The username is 'tools' and the password is 'Symantec@123'

    NoNav is located in the home directory. CleanWipe is located in the SEP Tools directory.

    I cannot say for certain if in your particular application of the program that it won't cause problems with your system (insert disclaimer here).

    But I thought I'd share, especially since you cannot find this information on the CleanWipe program anywhere else on the web.

    Ric Lollar
    Lanter Delivery Systems

    Legacy Forum Name: KES,
    Legacy Posted By Username: rlollar
  • Missing the 'S' in http.
    https://fileshare.symantec.com

    Thanks for the posting.

    Legacy Forum Name: KES,
    Legacy Posted By Username: trnetwork
  • When I try to invoke cleanwipe using kaseya -
    start "" "c:\temp\cleanwipe\runcleanwipe.bat"

    I get a window stating that esugunen2 is not recognized as an internal or external command...etc.

    It seems that esugunen and company are for removing reg keys.

    Has anyone else run into this issue? Thus far, I have had to manually run cleanwipe...

    Legacy Forum Name: KES,
    Legacy Posted By Username: jchoponis
  • Over the years I have used a couple tools from McAfee to remove the install but none of those seem to be auto/silent. Anyone come across one?

    Legacy Forum Name: KES,
    Legacy Posted By Username: lorreed
  • You can use msiexec to uninstall any MSI package. I know Symantec is an MSI package but I'm not sure about McAffee. You can create a scrip in Kaseya to do or use psexec or to remotely execute the process. The command would like something like:

    MsiExec.exe /norestart /q/x{9F6F8308-E739-4FE2-B608-7C0475713345}

    The /q is for a quiet removal so the user doesn't see that anything is going on. Just port that over to Kaseya and it works fine that way also. The {9F6F8308-E739-4FE2-B608-7C0475713345} string above isn't going to work for you though. Go to a workstation running the version you need to uninstall and run regedit (or just connect to it across the network). Go to HKLM\Software\Microsoft\Windows\Uninstall and cycle through all of the strings that are in the same context as above and look on the right side to see which one belongs to Symatec. Once you find it, just replace the string above with it. Different versions of Symantec may have different strings so you may need to make a few scripts. I spot check systems by opening Computer Management on my system then connecting to one of the remote systems. I then just check for the Symantec services.

    Hope this helps.

    John

    Legacy Forum Name: KES,
    Legacy Posted By Username: jfhall
  • We use a similar method using msiexec. We have started a script we run against the computers. After we run the script we run an audit and then a repoort to see if the computers have Symantec AntiVirus still running. If it is still running we look in the registry and add the new uninstall string to the script. It is time consuming, but after adding about 12 versions so far, we rarely have to edit the script.

    Legacy Forum Name: KES,
    Legacy Posted By Username: CaseyAdams
  • I found this on Micro$ofts site somewhere. Havent tried it yet, but the code looks right.

    '==============================================================================
    ' LANG : VBScript
    ' NAME : FCS-SampleScript Uninstall McAfee AV.vbs
    ' VERSION : 1.0003 3/2/2007
    ' AUTHOR : wstack@microsoft.com - based on code by P. Charles, ADI
    ' Description : Script to uninstall McAfee AV components
    '
    ' THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND,
    ' EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED
    ' WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE.
    '
    ' Copyright (C) 2007. Microsoft Corporation. All rights reserved.
    '
    ' NOTES : ALL SAMPLE SCRIPTS BEGIN WITH THE SAME SETUP ELEMENTS
    ' You can use this script standalone or incoporate the
    ' subroutines in this script into a larger script.
    '==============================================================================
    Option Explicit
    Dim bDEBUG : bDEBUG=False 'Set to TRUE to help with script debugging.
    ' Constants Declarations
    Const WAIT_ON_RETURN = True
    Const DO_NOT_WAIT_ON_RETURN = False
    Const HIDE_WINDOW = 0
    Const SHOW_WINDOW = 1
    Const ThisComputer = "."
    '==============================================================================
    ' Main Routine
    On Error Resume Next
    If bDEBUG then On Error Goto 0

    ' Create system objects
    Dim WshShell : Set WshShell = WScript.CreateObject("WScript.Shell")
    Dim objRegistry : Set objRegistry = GetObject("winmgmts:{impersonationLevel=Impersonate}!\\" & _
    ThisComputer & "\root\defaulttdRegProv")
    Dim objWMIService : Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" &_
    ThisComputer & "\root\cimv2")

    ' Call the installation functions
    'Call FCS_InstallXPSP2Hotfix
    Call UninstallMcAfeeAV

    ' Clean out the McAfee Quarantine folder
    ' NOTE: The location may vary depending on your installation
    On Error Resume Next
    WshShell.Run "erase /F /S /Q C:\VIRUS\*.*",HIDE_WINDOW,WAIT_ON_RETURN
    If bDEBUG Then On Error Goto 0

    ' Clean up objects and exit
    Set objWMIService = Nothing
    Set objRegistry = Nothing
    Set WshShell = Nothing

    wscript.quit

    '=====================================================================================
    ' SubRoutine UninstallMcAfeeAV
    ' This routine stops the McAfee framework services and uninstalls the AV client
    '
    ' INPUTS: None
    ' OUTPUT: Logs MSI uninstall event
    ' ASSUMES: The existence of the WshShell, objRegistry, and objWMIService objects
    ' MsiExec.exe is in the directory the script was executed from or in the
    ' file search PATH
    ' NOTES: This script is set to uninstall McAfee Enterprise version 8
    ' Other versions are included as well.
    ' If your organization uses multiple versions you may want to use the
    ' registry based uninstall routine.
    '
    '======================================================================================
    Private Sub UninstallMcAfeeAV

    'Query for McAfee Framework Service
    Dim colServiceList, objService, errReturn
    Set colServiceList = objWMIService.ExecQuery("Associators of {Win32_Service.Name='McAfeeFramework'} Where " &_
    "AssocClass=Win32_DependentService Role=Antecedent")
    If IsArray(colServiceList) Then
    For Each objService In colServiceList
    objService.StopService()
    Next
    Wscript.Sleep 20000

    Set colServiceList = objWMIService.ExecQuery("Select * from Win32_Service where Name='McAfeeFramework'")

    If IsArray(colServiceList) Then
    For Each objService In colServiceList
    errReturn = objService.StopService()
    Next
    Wscript.Sleep 10000


    If bDEBUG then wscript.echo "DEBUG: Uninstalling McAfee AV Framework"
    On Error Resume Next
    ' Uninstall McAfee AV Framework
    WshShell.Run """C:\Program Files\Network Associates\Common Framework\FrmInst.exe"" /forceuninstall /Silent",HIDE_WINDOW,WAIT_ON_RETURN
    WshShell.LogEvent 4, "Uninstalled McAfee AV Framework"

    If bDEBUG then wscript.echo "DEBUG: Uninstalling McAfee VirusScan client"
    ' Uninstall McAfee AV Client
    ' McAfee VirusScan Enterprise 8.0i
    WshShell.Run"MsiExec /X{5DF3D1BB-894E-4DCD-8275-159AC9829B43} /q Reboot=""ReallySuppress""",HIDE_WINDOW,WAIT_ON_RETURN
    'WshShell.LogEvent 4, "Uninstalled McAfee VirusScan Enterprise 8.0i"

    ' McAfee VirusScan Enterprise 7.1
    'WshShell.Run"MsiExec /X{59224777-298D-4E9C-9AEB-4A91BDA01B27} /q Reboot=""ReallySuppress""",HIDE_WINDOW,WAIT_ON_RETURN
    'WshShell.LogEvent 4, "McAfee VirusScan Enterprise 7.1"

    ' McAfee VirusScan Enterprise 7.0
    'WshShell.Run"MsiExec /X{1912F734-6580-4620-8AFD-ECCCEA19CDE2} /q Reboot=""ReallySuppress""",HIDE_WINDOW,WAIT_ON_RETURN
    'WshShell.LogEvent 4, "Uninstalled McAfee VirusScan Enterprise 7.0"

    ' McAfee VirusScan MultiPlatform 4.5.1
    'WshShell.Run "MsiExec /X{87AEFD84-BC0D-11D4-B885-00508B022A51} /q Reboot=""ReallySuppress""",HIDE_WINDOW,WAIT_ON_RETURN
    'WshShell.LogEvent 4, "Uninstalled McAfee VirusScan MultiPlatform 4.5.1"
    If bDEBUG Then On Error Goto 0

    ' --> Alternate Uninstall method
    'Call RegBasedUninstall("McAfee VirusScan")

    ElseIf bDEBUG Then
    wscript.echo "No McAfee Framework services found."
    End If
    ElseIf bDEBUG Then
    wscript.echo "No McAfee Framework found."
    End If
    End Sub

    '=====================================================================================
    ' SubRoutine RegBasedUninstall
    ' This routine uninstall applications using the parameters supplied in the
    ' SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall registry key
    '
    ' INPUTS: The display name of the application to be uninstalled
    ' OUTPUT: Logs MSI uninstall events
    ' ASSUMES: The existence of the WshShell and objRegistry objects
    ' MsiExec.exe is in the directory the script was executed from or in the
    ' file search PATH
    '
    ' READ THESE NOTES!
    ' NOTES: This script fairly generic and can be used to uninstall any product
    ' if you know the display name string. HOWEVER it assumes the use of MSI for all
    ' uninstalls. If the application does not use MSI the routine will fail.

    ' CAUTION: This routine uses the InStr() function to locate the input display name in the
    ' registry display name. It does not do a direct match. Since all enterprise
    ' versions of McAfee contain "McAfee VirusScan" in the display name this routine will
    ' find and uninstall multiple versions of the AV client.
    '
    ' HOWEVER passing a poorly formed parameter to this routine could have some
    ' very bad unintended consequences. For example, if you pass the letter a to this
    ' routine it will uninstall every product on the system with an "a" in the name!
    '
    '======================================================================================
    Sub RegBasedUninstall(InputDisplayName)


    Const HKEY_LOCAL_MACHINE = &H80000002
    Const UninstallRegKey = "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"

    Dim SubKeyArray, SubKey, DisplayName, UninstallString, StartPtr
    objRegistry.EnumKey HKEY_LOCAL_MACHINE, UninstallRegKey, SubKeyArray

    For Each SubKey In SubKeyArray
    'Get the Display Name for this product
    objRegistry.GetStringValue HKEY_LOCAL_MACHINE, UninstallRegKey & "\" & SubKey, "DisplayName", DisplayName

    If bDEBUG Then wscript.echo "DEBUG: Uninstall Display name is: " & DisplayName

    If Instr(DisplayName, InputDisplayName) > 0 Then
    ' Add the automatic, silent and no reboot MSI uninstall options
    objRegistry.GetStringValue HKEY_LOCAL_MACHINE, _
    UninstallRegKey & "\" & SubKey, "UninstallString", UninstallString

    StartPtr = Instr(1,UninstallString,"/I") + 2
    If StartPtr > 2 Then
    UninstallString = "MsiExec /X " & mid(UninstallString, StartPtr, 38) &_
    " /q Reboot=""ReallySuppress"""

    Else
    UninstallString = UninstallString & " /q Reboot=""ReallySuppress"""
    End If

    If bDEBUG Then wscript.echo "DEBUG: Uninstall string is: " & UninstallString

    ' WshShell.Run UninstallString,HIDE_WINDOW,WAIT_ON_RETURN
    WshShell.LogEvent 4, "Uninstalled " & DisplayName
    End if

    Next
    End Sub

    Legacy Forum Name: KES,
    Legacy Posted By Username: Techdawg
  • Great script! Has anyone modified to uninstall McAfee Total Protection?

    Thanks!

    Legacy Forum Name: KES,
    Legacy Posted By Username: billmccl
  • Techdawg
    I found this on Micro$ofts site somewhere. Havent tried it yet, but the code looks right.

    '==============================================================================
    ' LANG : VBScript
    ' NAME : FCS-SampleScript Uninstall McAfee AV.vbs
    ' VERSION : 1.0003 3/2/2007
    ' AUTHOR : wstack@microsoft.com - based on code by P. Charles, ADI
    ' Description : Script to uninstall McAfee AV components
    '
    ' THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND,
    ' EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED
    ' WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE.
    '
    ' Copyright (C) 2007. Microsoft Corporation. All rights reserved.
    '
    ' NOTES : ALL SAMPLE SCRIPTS BEGIN WITH THE SAME SETUP ELEMENTS
    ' You can use this script standalone or incoporate the
    ' subroutines in this script into a larger script.
    '==============================================================================
    Option Explicit
    Dim bDEBUG : bDEBUG=False 'Set to TRUE to help with script debugging.
    ' Constants Declarations
    Const WAIT_ON_RETURN = True
    Const DO_NOT_WAIT_ON_RETURN = False
    Const HIDE_WINDOW = 0
    Const SHOW_WINDOW = 1
    Const ThisComputer = "."
    '==============================================================================
    ' Main Routine
    On Error Resume Next
    If bDEBUG then On Error Goto 0

    ' Create system objects
    Dim WshShell : Set WshShell = WScript.CreateObject("WScript.Shell")
    Dim objRegistry : Set objRegistry = GetObject("winmgmts:{impersonationLevel=Impersonate}!\\" & _
    ThisComputer & "\root\defaulttdRegProv")
    Dim objWMIService : Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" &_
    ThisComputer & "\root\cimv2")

    ' Call the installation functions
    'Call FCS_InstallXPSP2Hotfix
    Call UninstallMcAfeeAV

    ' Clean out the McAfee Quarantine folder
    ' NOTE: The location may vary depending on your installation
    On Error Resume Next
    WshShell.Run "erase /F /S /Q C:\VIRUS\*.*",HIDE_WINDOW,WAIT_ON_RETURN
    If bDEBUG Then On Error Goto 0

    ' Clean up objects and exit
    Set objWMIService = Nothing
    Set objRegistry = Nothing
    Set WshShell = Nothing

    wscript.quit

    '=====================================================================================
    ' SubRoutine UninstallMcAfeeAV
    ' This routine stops the McAfee framework services and uninstalls the AV client
    '
    ' INPUTS: None
    ' OUTPUT: Logs MSI uninstall event
    ' ASSUMES: The existence of the WshShell, objRegistry, and objWMIService objects
    ' MsiExec.exe is in the directory the script was executed from or in the
    ' file search PATH
    ' NOTES: This script is set to uninstall McAfee Enterprise version 8
    ' Other versions are included as well.
    ' If your organization uses multiple versions you may want to use the
    ' registry based uninstall routine.
    '
    '======================================================================================
    Private Sub UninstallMcAfeeAV

    'Query for McAfee Framework Service
    Dim colServiceList, objService, errReturn
    Set colServiceList = objWMIService.ExecQuery("Associators of {Win32_Service.Name='McAfeeFramework'} Where " &_
    "AssocClass=Win32_DependentService Role=Antecedent")
    If IsArray(colServiceList) Then
    For Each objService In colServiceList
    objService.StopService()
    Next
    Wscript.Sleep 20000

    Set colServiceList = objWMIService.ExecQuery("Select * from Win32_Service where Name='McAfeeFramework'")

    If IsArray(colServiceList) Then
    For Each objService In colServiceList
    errReturn = objService.StopService()
    Next
    Wscript.Sleep 10000


    If bDEBUG then wscript.echo "DEBUG: Uninstalling McAfee AV Framework"
    On Error Resume Next
    ' Uninstall McAfee AV Framework
    WshShell.Run """C:\Program Files\Network Associates\Common Framework\FrmInst.exe"" /forceuninstall /Silent",HIDE_WINDOW,WAIT_ON_RETURN
    WshShell.LogEvent 4, "Uninstalled McAfee AV Framework"

    If bDEBUG then wscript.echo "DEBUG: Uninstalling McAfee VirusScan client"
    ' Uninstall McAfee AV Client
    ' McAfee VirusScan Enterprise 8.0i
    WshShell.Run"MsiExec /X{5DF3D1BB-894E-4DCD-8275-159AC9829B43} /q Reboot=""ReallySuppress""",HIDE_WINDOW,WAIT_ON_RETURN
    'WshShell.LogEvent 4, "Uninstalled McAfee VirusScan Enterprise 8.0i"

    ' McAfee VirusScan Enterprise 7.1
    'WshShell.Run"MsiExec /X{59224777-298D-4E9C-9AEB-4A91BDA01B27} /q Reboot=""ReallySuppress""",HIDE_WINDOW,WAIT_ON_RETURN
    'WshShell.LogEvent 4, "McAfee VirusScan Enterprise 7.1"

    ' McAfee VirusScan Enterprise 7.0
    'WshShell.Run"MsiExec /X{1912F734-6580-4620-8AFD-ECCCEA19CDE2} /q Reboot=""ReallySuppress""",HIDE_WINDOW,WAIT_ON_RETURN
    'WshShell.LogEvent 4, "Uninstalled McAfee VirusScan Enterprise 7.0"

    ' McAfee VirusScan MultiPlatform 4.5.1
    'WshShell.Run "MsiExec /X{87AEFD84-BC0D-11D4-B885-00508B022A51} /q Reboot=""ReallySuppress""",HIDE_WINDOW,WAIT_ON_RETURN
    'WshShell.LogEvent 4, "Uninstalled McAfee VirusScan MultiPlatform 4.5.1"
    If bDEBUG Then On Error Goto 0

    ' --> Alternate Uninstall method
    'Call RegBasedUninstall("McAfee VirusScan")

    ElseIf bDEBUG Then
    wscript.echo "No McAfee Framework services found."
    End If
    ElseIf bDEBUG Then
    wscript.echo "No McAfee Framework found."
    End If
    End Sub

    '=====================================================================================
    ' SubRoutine RegBasedUninstall
    ' This routine uninstall applications using the parameters supplied in the
    ' SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall registry key
    '
    ' INPUTS: The display name of the application to be uninstalled
    ' OUTPUT: Logs MSI uninstall events
    ' ASSUMES: The existence of the WshShell and objRegistry objects
    ' MsiExec.exe is in the directory the script was executed from or in the
    ' file search PATH
    '
    ' READ THESE NOTES!
    ' NOTES: This script fairly generic and can be used to uninstall any product
    ' if you know the display name string. HOWEVER it assumes the use of MSI for all
    ' uninstalls. If the application does not use MSI the routine will fail.

    ' CAUTION: This routine uses the InStr() function to locate the input display name in the
    ' registry display name. It does not do a direct match. Since all enterprise
    ' versions of McAfee contain "McAfee VirusScan" in the display name this routine will
    ' find and uninstall multiple versions of the AV client.
    '
    ' HOWEVER passing a poorly formed parameter to this routine could have some
    ' very bad unintended consequences. For example, if you pass the letter a to this
    ' routine it will uninstall every product on the system with an "a" in the name!
    '
    '======================================================================================
    Sub RegBasedUninstall(InputDisplayName)


    Const HKEY_LOCAL_MACHINE = &H80000002
    Const UninstallRegKey = "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"

    Dim SubKeyArray, SubKey, DisplayName, UninstallString, StartPtr
    objRegistry.EnumKey HKEY_LOCAL_MACHINE, UninstallRegKey, SubKeyArray

    For Each SubKey In SubKeyArray
    'Get the Display Name for this product
    objRegistry.GetStringValue HKEY_LOCAL_MACHINE, UninstallRegKey & "\" & SubKey, "DisplayName", DisplayName

    If bDEBUG Then wscript.echo "DEBUG: Uninstall Display name is: " & DisplayName

    If Instr(DisplayName, InputDisplayName) > 0 Then
    ' Add the automatic, silent and no reboot MSI uninstall options
    objRegistry.GetStringValue HKEY_LOCAL_MACHINE, _
    UninstallRegKey & "\" & SubKey, "UninstallString", UninstallString

    StartPtr = Instr(1,UninstallString,"/I") + 2
    If StartPtr > 2 Then
    UninstallString = "MsiExec /X " & mid(UninstallString, StartPtr, 38) &_
    " /q Reboot=""ReallySuppress"""

    Else
    UninstallString = UninstallString & " /q Reboot=""ReallySuppress"""
    End If

    If bDEBUG Then wscript.echo "DEBUG: Uninstall string is: " & UninstallString

    ' WshShell.Run UninstallString,HIDE_WINDOW,WAIT_ON_RETURN
    WshShell.LogEvent 4, "Uninstalled " & DisplayName
    End if

    Next
    End Sub


    Could you repost the script within (Code) tags so that the extra spaces aren't added to the text?

    Michael

    Legacy Forum Name: KES,
    Legacy Posted By Username: RCS-Michael
  • I posted a script that does the Symantec Corporate AV uninstall:



    http://community.kaseya.com/xsp/f/28/t/6678.aspx

    Legacy Forum Name: KES,
    Legacy Posted By Username: chadl2
  • mcafee uninstall script.zip
    [QUOTE=RCS-Michael;37388]Could you repost the script within (Code) tags so that the extra spaces aren't added to the text?

    Michael[/QUOTE]

    How about I just attach it Smile

    Legacy Forum Name: KES,
    Legacy Posted By Username: Techdawg