Who's up to the challange???

[blastman]

hey all,

I've got 5 machines that I have to uninstall Symantec's endpoint Anti-Virus from. Sadly I don't have the uninstall password as these machines have come from another company (that we recently brought out) and their IT dept are less than helpful.

Below is a link to Symantec's website detailing how to manually remove the software.

Is anybody willing to have a crack at creating a script for it??? I've built loads of scripts before I've not really done much with the registry so I'm not really willing to give it a go myself.

A shiny new donkey to the winner???!!!???


linky;

http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/5db8e519e16d42f2882573290005aa1d?OpenDocument



Cheers in advance!! 

[Dias de verano]

a script that manipulates the registry to remove virus protection? Hmmm......

[blastman]

this is what I have so far...

Code: [Select]


smc -stop

Rem stopping symantec endpoint protection
net stop "Symantec AntiVirus"

Rem stopping symantec event manager
net stop ccEvtMgr

Rem stopping symantec network access control
net stop SNAC

Rem stopping symantec settings manager
net stop ccSetMgr

Rem stopping windows installer
net stop MSIServer

Rem disabling windows installer
sc config MSIServer start=disabled




Rem Step 2

Rem killing "ccApp.exe" process
taskkill /F /IM ccApp.exe




Rem Step 3


Rem creating backup of registry
regedit /E C:\RegBackup.reg

Rem removing reg keys
regedit.exe /s c:\removeKeys.reg




I have no idea how to change the values of certain reg keys, or that what I've posted is any good.

I'm I on the right track???

Any help appreciated. 

[recovering disk space -- attachment deleted by admin]

[Carbon Dudeoxide]

....why not remove them in Safe Mode.... 

[macdad-]

or just get some software that is professinally made to change registry keys, not saying that your stupid, im just saying that you may acceidently change one of the keys that may be vital to your system. but if you get software made from a company, then you'll have less of a risk.

[BC_Programmer]

or just get some software that is professinally made to change registry keys

REGEDIT.

[blastman]

not saying that your stupid

There are many that have..... 


This is what I've got so far. I've completed all steps listed on Symantec's website but after I've removed Endpoint I can't install my version as it fails half way through the installation process. (Something about the wizard being interrupted)

Can someone have a quick look at the attached .zip file for me and make sure I've got it right???

There is no big drama about screwing the registry as I'd just reinstall XP if it does fail, but I'd rather fix an issue than cover over it's cracks. (plus backing up users profile's and installing XP on 5 machines isn't a job I want to fo on a Friday!!)


You'll notice that it's in quite a few parts, I was following the instructions completely, doing everything in order. (I hope!)

Cheers in advance



[recovering disk space -- attachment deleted by admin]

[blastman]

ok, I've found a snag.....


I'm having troblue editting the vaule of a REG_EXPAND_SZ key.

I'm doing this via a reg file;

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\PPP\EAP\13]
"ConfigUiPath"=C:\WINDOWS\system32\ratls.dll

(also tried) - "ConfigUiPath"=hexadecimal(2):C:\WINDOWS\system32\ratls.dll


but no matter what i do I can't change the value. I can delete the key, but that no good as I can't re=create it.

I think the secound : might be casuing issues.

Any ideas???

[blastman]

ok, fixed that bit.

I had to use hex as the value in the reg file;

"ConfigUiPath"=hex(2):43,00,3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,\
  00,53,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,72,00,\
  61,00,73,00,74,00,6c,00,73,00,2e,00,64,00,6c,00,6c,00,00,00

Only trouble now is I still get the same error when trying to install the next version.

Grrrrrrrr 

[ghostdog74]

hey all,

I've got 5 machines that I have to uninstall Symantec's endpoint Anti-Virus from. Sadly I don't have the uninstall password as these machines have come from another company (that we recently brought out) and their IT dept are less than helpful.

Below is a link to Symantec's website detailing how to manually remove the software.

Is anybody willing to have a crack at creating a script for it??? I've built loads of scripts before I've not really done much with the registry so I'm not really willing to give it a go myself.

A shiny new donkey to the winner???!!!???


linky;

http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/5db8e519e16d42f2882573290005aa1d?OpenDocument



Cheers in advance!! 

hmm... you mean you haven't solve this?
its been that long and its only 5 machines. you could have manually done it and solve it by now.

[blastman]

hmm... you mean you haven't solve this?
its been that long and its only 5 machines. you could have manually done it and solve it by now.

lol, I forgot I started that thread. 

Yes it is the same set of machines. The problem is that the users work so many long hours and I can't really get near the *censored* things, and when they first arrvied (time of first post) the priority was to get them on the desks and working otherwise I'd have used the 2 hour long script. - which I've now lost...

I had used a script supplied by the previous company and it worked, but the machine had "issues" after that so I ended up doing a fresh install of XP anyway.

I reckon I have everything removed and all the steps covered on Symantec's website, but I'm having problems installing our version of antivirus now. It seems that the removal process deleted a few services and the install process keeps failing when it try's to start the "Symantec AntiVirus" service.

It has a dependent (ccSetMgr) that was removed during the instructions from Symantec and every attempt to recover it has failed. I managed to the revalent key back, and the service appears in service.msc but it won't start, giving "The process didn't start or respond to the control request in a timely fashion." error.


I'm left with a machine that won't install cos a poxy service won't start right!!!

GRRRRRRR - time for a coffee

[ghostdog74]

doesn't your company use cloning technology ? If it does, i am sure you can get a new OS up and running within few hours.