LazyNetworkAdmin.com - Remove Symantec AV 10

Main Menu

Home

Knowledgebase

RSS Feeds

Links

Downloads

LNA Blogs

Cheyenne Harden's Blog

LazyNetworkAdmin Blog

Login Form

Syndicate

Home

Remove Symantec AV 10

Written by Cheyenne Harden

I will be rolling out Symantec's new SEP 11 soon and I need to remove the previous Symantec AV install.
This Script should work on all SAV 9-10 installs.

This script can be easily modified to run remotely. Maybe in the near future I will add this functionality.

----------COPY EVERYTHING BELOW THIS LINE for the Script----------
'Script to uninstall SAV 10
'Created by Chey Harden 11.26.07

On Error Resume Next

Const HKLM = &H80000002

strComputer = "."
strKeyPath = "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
strRegPath = "SOFTWARE\Intel\LANDesk\VirusProtect6\CurrentVersion\AdministratorOnly\Security"
strValue2 = ""
intShortSleep = 5000
intSleep = 240000
strProcessKill = "'msiexec.exe'"
strProcessKill2 = "'cmd.exe'"

Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\default:StdRegProv")
oReg.EnumKey HKLM, strKeyPath, arrSubKeys

SetRegKey()
RemoveSAV()

Function RemoveSAV()
For Each subkey In arrSubKeys
  'WScript.Echo subkey ' For Trouble shooting
  strNewKeyPath = strKeyPath & "\" & subkey
  strValueName = "DisplayName"
  strValueNameUninstall = "UninstallString"
  oReg.GetStringValue HKLM,strNewKeyPath,strValueName,strValue
   If strValue = "Symantec AntiVirus" Then 'edit this for software key
    'WScript.Echo "Found Key"'used for trouble shooting
    'WScript.Echo strValue'used for trouble shooting
    oReg.GetStringValue HKLM,strNewKeyPath,strValueNameUninstall,strValue2
    'WScript.Echo strValue2'used for trouble shooting
    If InStr(strValue2, "/I") Then
     strValue2 = Replace(strValue2,"/I","/X")
     'WScript.Echo "Replaced " & strValue2 'used for trouble shooting
    Else
     'WScript.Echo "Not Found " & strValue2 'used for trouble shooting
    End If
    ExecuteUninstall()
   Else
    'WScript.Echo "Not Found" 'used for trouble shooting
   End If
Next
End Function

Function ExecuteUninstall()
Set WShell = CreateObject("WScript.Shell")
'WScript.Echo strValue2'used for trouble shooting
WShell.Run "%COMSPEC% /c " & strValue2 & " /qn",0,TRUE
Set WShell = Nothing
WScript.Sleep intSleep
'KillProcess() ' Used to kill the process if it runs too long, curently this function is disabled
End Function

Function SetRegKey()
strValueNameDword1 = "UseVPUninstallPassword"
strValueNameDword2 = "LockUnloadServices"
dwSetValue = 0

oReg.GetDWORDValue HKLM,strRegPath,strValueNameDword1,dwValue
If dwValue = 1 Then
oReg.SetDWORDValue HKLM,strRegPath,strValueNameDword1,dwSetValue
oReg.SetDWORDValue HKLM,strRegPath,strValueNameDword2,dwSetValue
End If
End Function

Function KillProcess()
Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colProcess = objWMIService.ExecQuery ("Select * from Win32_Process Where Name = " & strProcessKill )
  For Each objProcess in colProcess
   objProcess.Terminate()
  Next
WScript.Sleep intShortSleep
Set colProcess = objWMIService.ExecQuery ("Select * from Win32_Process Where Name = " & strProcessKill2 )
  For Each objProcess in colProcess
   objProcess.Terminate()
  Next
End Function

----------COPY EVERYTHING ABOVE THIS LINE for the Script----------

PLEASE MAKE SURE NO WORD WRAPPING IS HAPPENING IN YOUR SCRIPT!!!

1. Run this as a Logon Script.
2. Make sure to be an admin on the target machines.

This information is provided "AS IS" with no warranties expressed or implied.

Comments

Add New

Ken	\| 66.81.103.xxx \| 02-01-2008 16:02:59

I'd love the ability to run this remotely. I need to remove SAV 10 from over 200 machines. I would hate to have to log into 200 machines to run this. Thanks for the great scripts though. I just implemented the Exchange 2003 login fix and my users were thankful as well!

Reply | Quote