+ Post New Thread
Results 1 to 12 of 12
Windows Thread, How to Remove Sophos Site Wide? in Technical; Evening All, I have not really looked into this yet much myself, so it might be pretty straight forward or/ ...
  1. #1

    EduTech's Avatar
    Join Date
    Aug 2007
    Location
    Reading
    Posts
    5,047
    Thank Post
    160
    Thanked 913 Times in 716 Posts
    Blog Entries
    3
    Rep Power
    271

    How to Remove Sophos Site Wide?

    Evening All,

    I have not really looked into this yet much myself, so it might be pretty straight forward or/ the answer may be i have to do what i thought and do it manually.

    In the next 2 weeks i will be replacing a site wide anti-virus (Sophos) with ESET NOD32 due to the old version now coming end of line it was a great chance to get in and upgrade to ESET as planned for a wee while. (Contract Coming up for Renewal After 3 Years)

    I know NOD32 is going to throw a fit at me if i try and deploy it whilst sophos is installed, so is there a way i can remove sophos client from the machines centrally or/ am i going to have to do this manually on ever machine. (bearing in mind i have 1x Head Office and 7x Sites connected via VPN).

    Many Thanks,

    James.

  2. #2
    djwingfield's Avatar
    Join Date
    Mar 2010
    Posts
    33
    Thank Post
    7
    Thanked 10 Times in 10 Posts
    Rep Power
    10
    Hi James,

    I belive this is what you are looking for,

    Remove Sophos script - edugeek

    Dan

  3. Thanks to djwingfield from:

    EduTech (2nd February 2011)

  4. #3
    carvjo's Avatar
    Join Date
    Mar 2010
    Location
    Oxford
    Posts
    195
    Thank Post
    12
    Thanked 39 Times in 34 Posts
    Rep Power
    21
    Hi James -

    It looks like ESET provide an uninstaller for Sophos

    http://www.eset.co.uk/Download/UnInstallers

    I've done a similar exercise with another AV product and it was possible to add the uninstaller (for the old product) to the deployment of the new one.. I am sure ESET support will be able to point you in the direction of some way to deploy a site-wide rollout including the uninstall of Sophos.

    John

  5. Thanks to carvjo from:

    EduTech (2nd February 2011)

  6. #4

    EduTech's Avatar
    Join Date
    Aug 2007
    Location
    Reading
    Posts
    5,047
    Thank Post
    160
    Thanked 913 Times in 716 Posts
    Blog Entries
    3
    Rep Power
    271
    Thanks for the responses chaps! I knew there would be away but just been so busy to even start to investigate it, was just easier to post a thread up on here!

    Quote Originally Posted by carvjo View Post
    Hi James -

    It looks like ESET provide an uninstaller for Sophos

    http://www.eset.co.uk/Download/UnInstallers

    I've done a similar exercise with another AV product and it was possible to add the uninstaller (for the old product) to the deployment of the new one.. I am sure ESET support will be able to point you in the direction of some way to deploy a site-wide rollout including the uninstall of Sophos.

    John
    It appears SOPHOS is not in that list! but yeah i have a few contacts at ESET so probably just ping them an email anyhow.

    Cheers!
    James.

  7. #5

    Edu-IT's Avatar
    Join Date
    Nov 2007
    Posts
    7,121
    Thank Post
    403
    Thanked 619 Times in 566 Posts
    Rep Power
    180
    How did you tackle this in the end James?

  8. #6

    plexer's Avatar
    Join Date
    Dec 2005
    Location
    Norfolk
    Posts
    13,343
    Thank Post
    624
    Thanked 1,584 Times in 1,421 Posts
    Rep Power
    414
    Just take note that those uninstallers are by the respective av makers and not eset themselves.

    The panda one requires user interaction and is not scriptable.

    Ben

  9. #7

    EduTech's Avatar
    Join Date
    Aug 2007
    Location
    Reading
    Posts
    5,047
    Thank Post
    160
    Thanked 913 Times in 716 Posts
    Blog Entries
    3
    Rep Power
    271
    In the end i just had to uninstall it manually, but i believe that script above would of worked fine.

    James.

  10. #8

    Edu-IT's Avatar
    Join Date
    Nov 2007
    Posts
    7,121
    Thank Post
    403
    Thanked 619 Times in 566 Posts
    Rep Power
    180
    Quote Originally Posted by EduTech View Post
    In the end i just had to uninstall it manually, but i believe that script above would of worked fine.

    James.
    Through Add/Remove? Did that do a nice uninstall?

  11. #9

    EduTech's Avatar
    Join Date
    Aug 2007
    Location
    Reading
    Posts
    5,047
    Thank Post
    160
    Thanked 913 Times in 716 Posts
    Blog Entries
    3
    Rep Power
    271
    Quote Originally Posted by Edu-IT View Post
    Through Add/Remove? Did that do a nice uninstall?
    It did shockingly! and ESET NOD deployed very nice (even over the VPN Connections)

    Server Software was a pain with reg entries but soon sorted, and a quick ccleaner Happy Days!

    James.

  12. #10

    Edu-IT's Avatar
    Join Date
    Nov 2007
    Posts
    7,121
    Thank Post
    403
    Thanked 619 Times in 566 Posts
    Rep Power
    180
    Did you document which reg keys to remove or is there a list online somewhere? I can't find a list on the Sophos site.

    This perhaps?
    Uninstalling Sophos
    Last edited by Edu-IT; 16th March 2011 at 10:55 PM.

  13. #11

    EduTech's Avatar
    Join Date
    Aug 2007
    Location
    Reading
    Posts
    5,047
    Thank Post
    160
    Thanked 913 Times in 716 Posts
    Blog Entries
    3
    Rep Power
    271
    *Some of the things in last steps may not apply (always)

    ---- Manual Removal Instructions

    ** Indicate the removing the components of the Sophos instance MSDE, if you wish to keep MSDE ignore lines with these marking.

    1. Please make a full system backup of the server.
    2. Goto Control Panel and remove the following components from the list:

    **Microsoft SQL Server Desktop Engine (SOPHOS)
    Sophos Anti-Virus
    Sophos AutoUpdate
    Sophos EM Library
    Sophos Enterprise Console (Select Remove)
    Sophos Remote Management System

    3. Click Start then click Run... type in 'regedit' (without quotes) and press enter.

    4. Navigate to this location and modify this key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Eventlog\Sources

    Delete the following lines from the list:
    **SQLCTR$SOPHOS
    **SQLAgent$SOPHOS
    SophosAntiVirus
    Sophos Message Router
    Sophos Management Service
    Sophos Anti-Virus
    SOPHOS

    Leave regedit open to do point 8 further on.

    5. Click Start then click Run... type in 'services.msc' (without quotes) and press enter.

    6. Stop the following services:

    Sophos Agent
    Sophos Anti-Virus
    Sophos Anti-Virus status reporter
    Sophos AutoUpdate Service
    Sophos Certification Manager
    Sophos EMLibUpdate Agent
    Sophos Enterprise Manager Scheduler
    Sophos Management Service
    Sophos Message Router
    **SQLAgent$SOPHOS
    **MSSQL$SOPHOS

    7. Return to regedit and navigate to the following keys and delete the corresponding registry folders:

    HKEY_CURRENT_USER\Software\Sophos
    HKEY_LOCAL_MACHINE\Software\Sophos

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Eventlog\Application\SOPHOS
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Eventlog\Application\Sophos Anti-Virus
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Eventlog\Application\Sophos Management Service
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Eventlog\Application\Sophos Message Router
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Eventlog\Application\SophosAntiVirus
    **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Serv ices\Eventlog\Application\SQLAgent$SOPHOS
    **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Serv ices\Eventlog\Application\SQLCTR$SOPHOS
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Eventlog\Sophos EM Library

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Sophos Agent
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SAVService
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SAVAdminService
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SAVOnAccess Control
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SAVOnACcess Filter
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SCFDriver

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Sophos AutoUpdate Service
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Sophos Certification Manager
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Sophos EMLib Update Agent
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SEMscheduler
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Sophos Management Service
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Sophos Message Router

    **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Serv ices\SQLAgent$SOPHOS
    **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Serv ices\MSSQL$SOPHOS

    **HKLM\Software\Microsoft\MSSQLServer\client\Super SocketNetLib\Last connect [Blank the entry if it refers to Sophos]
    **HKLM\Software\Microsoft\Microsoft SQL Server\ [Blank the entry 'InstalledInstances' if it refers to Sophos]
    **HKLM\Software\Microsoft\Microsoft SQL Server\SOPHOS\
    **HKLM\Software\Microsoft\Microsoft SQL Server\80\Tools\Service Manager\ [Blank the entry 'Default' if it refers to Sophos]
    **HKLM\Software\Microsoft\Microsoft SQL Server\Component Set\ [Delete InstalledComponentSet REG_SZ {E09B48B5-E141-427A-AB0C-D3605127224A}]

    8. Click Start goto Programs and delete the following shortcuts:

    Sophos
    Startup\AutoUpdate Monitor
    **Startup\Service Manager

    9. At this point you will need to restart the computer.

    10. After the reboot delete the following folders:

    C:\Program Files\Sophos\
    C:\Program Files\Sophos Sweep for NT\
    C:\Program Files\Sophos Enterprise Manager\
    **C:\Program Files\Microsoft SQL Server\MSSQL$SOPHOS\
    C:\Documents And Settings\All Users\Application Data\Sophos\

    11. If you encountered errors on the reboot check your event log for details.

    12. Navigate to the following folder and delete the contents (some files maybe in use and cannot be deleted, this is expected):

    (Windows XP/2003) C:\Windows\Temp\ OR (Windows 2000) C:\WINNT\Temp\
    C:\Documents And Settings\Administrator\Local Settings\Temp\

    13. If you are using Active Directory click Start navigate through settings then click on Control Panel. Open Administrative Tools and double-click on 'Active Directory Users and Computers', delete the following accounts and groups:

    If you are on a workgroup server, right click on My Computer and select Manage. Expand Local Users and Groups and delete the following accounts and groups:

    Reference:
    = group
    = user

    EMLibrary Users
    EMLibUser1
    Sophos Console Administrators
    Sophos DB Admins
    Sophos DB Users
    SophosAdministrator
    SophosOnAccess
    SophosPowerUser
    SophosSAU0 (Maybe more than one, delete all variants 0, 1 ,2 etc)
    SophosUser

  14. #12

    Join Date
    Nov 2008
    Posts
    1
    Thank Post
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    0
    Ive spent the last three days doing exactly the same, installing eset - nod32 and removing sophos!

    not the easiest job in the world but im about there....... the eset manual aint that great!

    just to say ive got the script working perfectly, its worth taking out the first and last "pause" the script will then run silently on log off via group policy! it does extend log of times by about a minute but with a network of 1250 machines its by far the best option!

    s

SHARE:
+ Post New Thread

Similar Threads

  1. Replies: 2
    Last Post: 1st February 2011, 04:35 AM
  2. L.E.D. LCD Monitors - 18.5 wide & 21.5 wide
    By CPLTD in forum Our Advertisers
    Replies: 0
    Last Post: 29th October 2010, 11:14 AM
  3. Recommend a site wide cordless voice solution
    By u8dmtm in forum Hardware
    Replies: 2
    Last Post: 25th February 2010, 03:23 PM
  4. Sophos - Unable to remove
    By mmoseley in forum Wireless Networks
    Replies: 3
    Last Post: 9th April 2009, 07:51 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •