Uninstalling Sophos remotely

[edie209]

Hi all, our LEA has just decided to move us away from Sophos to McAlfee antivirus, this leaves me with the problem of uninstalling Sophos from all of our machines (laptops and desktops).

SAVADMIN allows me to install remotely, but how do I uninstall remotely?

[john]

uum, according to my research, its called walk to each PC, logon as a local administrator, then uninstall Auto Update, RMS and Anti-Virus, then delete the folders that its left behind, and remove the registry entries, repeat this process for each machine you have Sophos installed on, then install the replacement. Sucks I know, but thats Sophos's (and the other makers) idea to stop you changing provider, just as the woman from Sophos said today when I said I am thinking of moving to another firm when asked why I had not renwed yet, but when she gave me the price, i fell of my chair!

A costs are going up on Monday, and she thinks a big rise is going to be on the cards this time as they have not gone up for 2 years!
B for 280 workstations and 20 servers its going to cost for 1yr for round figures, near enough £3K! Yowzas thats gone expensive, and when I raised the issue of 10 outstanding support tickets, she went silent and said on Monday the new product range should be launched (or very soon after) and we will have no problems with that one as its much better than the last as V5 was a fiasco she said, I am now full of confidence! NOT!!! So be prepared.

[edie209]

Thanks for the reply John,

I thought that was going to be the case but I just hoped that maybe someone had a solution.

[ChrisH]

Sounds like it could be scripted for some parts at least.

[IanB]

If you are running the V5 client with Enterprise Console, you should find some .msi files under the path 'C:\Program Files\Sophos\AutoUpdate\Cache\<folder>', one for each component. If you run the command:

msiexec /x "C:\Program Files\Sophos\AutoUpdate\Cache\<folder>\<installer name>.msi" /qn

you will run a silent uninstall of the software. Do it for each component in turn (I would start with AutoUpdate) by Group Policy startup script or by using Psexec from Sysinternals to run the command remotely on each PC in turn. Again this can be scripted.
If you are still using the v4.0x version with SAVadmin, you can run the command

"C:\Program Files\Sophos Sweep for NT\setup.exe" -remove

on each PC as administrator, but it requires interaction and so can't be automated. I think there are switches -ni for non-interactive and -s for silent, but I havn't tested them.
There are command line tools to remove registry entries and services, and scripts to do the file removal. I havn't experimented with these but hopefully you won't need to go that far. If you do, let me know if you would like my help.
Good luck.
Ian

[ChrisH]

Interaction calls for an AutoIt script then

[IanB]

AutoIt! I really have to start using that one

[ajbritton]

The following did it for me V5 BTW

MsiExec.exe /X{09C6BF52-6DBA-4A97-9939-B6C24E4738BF} /q /noreboot
MsiExec.exe /X{C12953C2-4F15-4A6C-91BC-511B96AE2775} /q /noreboot
MsiExec.exe /X{FF11005D-CBC8-45D5-A288-25C7BB304121} /q /noreboot

[edie209]

Thanks guys
I'm running V4 with SAVADMIN so I will have a look at this autoIT and see what that is all about

[ajbritton]

BTW You can find the uninstall string for any app from the windows registry

HKLM\Software\Microsoft\Windows\CurrentVersion\Uni nstall then do a search for the app you want to uninstall. The key entry is UninstallString.

I've seen some apps with a SilentUninstallString (perfect).

If it's of the form 'MSIEXEC /X {GUID}' then just add /q to make it quiet and /noreboot to suppress reboots.

For full MSIEXEC syntax, do MSIEXEC /?

[edie209]

I have just tried

"C:\Program Files\Sophos Sweep for NT\setup.exe" -remove -ni -s

and it worked logged on to the local machine, so now its just case of trying it remotely

[sahmeepee]

I just ran the GNU strings utility against my Sophos setup.exe to see if I could see which commandline arguments it would take and look what came up!

N:\>strings -n 6 "c:\Program Files\Sophos SWEEP for NT\SETUP.EXE" | findstr pans
Get a load of this, you steaming great pansy

What's that about?!

[ZeroHour]

The problem is AV software usually removes poorly. Rebuild is the safest option.
What ya think of McAffee?

[edie209]

What do I think of Mcaffee ??

Early days but it has found one virus that sophos didn't find. The worst bit about it was the lack of centralized management, but I have now found a utility from mcaffee called Protection Pilot and I am able to monitor my network virus situation just like SavAdmin from sophos

[Norphy]

We use McAfee here along with EPo. v8.0i can be a bit of a pain as it has that very annoying port blocker which just happens to block certain ports by default. It rendered my Ghost useless until I worked out what was going on.

Aside from that, EPo is excellent. It can install or uninstall any version of VirusScan you put in its repositry. You can have evaluation and production areas in it to try out new engines or defintion files. You can schedule scans, updates and installations. You can set all of the supported products settings centrally. It even seems to be able to manage rival products although this is not something I've put to the test. Its a been a real timesaver