Removal of Sophos

[discoveranother]

Hi all,

 

Just wondered if anyone had a quick script that will remove Sophos Enterprise Console or Sophos Antivirus from clients, as removing this product from clients is a time consuming job ?

 

Thanks all

[3s-gtech]

 net stop "Sophos Anti-Virus" net stop "Sophos AutoUpdate Service" "C:\program files\Sophos\Sophos Endpoint Agent\uninstallcli.exe" :Sophos AutoUpdate MsiExec.exe /qn /X{7CD26A0C-9B59-4E84-B5EE-B386B2F7AA16} REBOOT=ReallySuppress MsiExec.exe /qn /X{BCF53039-A7FC-4C79-A3E3-437AE28FD918} REBOOT=ReallySuppress MsiExec.exe /qn /X{9D1B8594-5DD2-4CDC-A5BD-98E7E9D75520} REBOOT=ReallySuppress MsiExec.exe /qn /X{AFBCA1B9-496C-4AE6-98AE-3EA1CFF65C54} REBOOT=ReallySuppress MsiExec.exe /qn /X{E82DD0A8-0E5C-4D72-8DDE-41BB0FC06B3E} REBOOT=ReallySuppress :Sophos Anti-Virus (Endpoint) MsiExec.exe /qn /X{8123193C-9000-4EEB-B28A-E74E779759FA} REBOOT=ReallySuppress MsiExec.exe /qn /X{36333618-1CE1-4EF2-8FFD-7F17394891CE} REBOOT=ReallySuppress MsiExec.exe /qn /X{DFDA2077-95D0-4C5F-ACE7-41DA16639255} REBOOT=ReallySuppress MsiExec.exe /qn /X{CA3CE456-B2D9-4812-8C69-17D6980432EF} REBOOT=ReallySuppress MsiExec.exe /qn /X{3B998572-90A5-4D61-9022-00B288DD755D} REBOOT=ReallySuppress :Sophos Anti-Virus (Server) MsiExec.exe /qn /X{72E30858-FC95-4C87-A697-670081EBF065} REBOOT=ReallySuppress :Sophos System Protection MsiExec.exe /qn /X{934BEF80-B9D1-4A86-8B42-D8A6716A8D27} REBOOT=ReallySuppress MsiExec.exe /qn /X{1093B57D-A613-47F3-90CF-0FD5C5DCFFE6} REBOOT=ReallySuppress :Sophos Network Threat Protection MsiExec.exe /qn /X{66967E5F-43E8-4402-87A4-04685EE5C2CB} REBOOT=ReallySuppress :Sophos Health MsiExec.exe /qn /X{A5CCEEF1-B6A7-4EB4-A826-267996A62A9E} REBOOT=ReallySuppress MsiExec.exe /qn /X{D5BC54B8-1DA1-44F4-AE6F-86E05CDB0B44} REBOOT=ReallySuppress MsiExec.exe /qn /X{E44AF5E6-7D11-4BDF-BEA8-AA7AE5FE6745} REBOOT=ReallySuppress :SDU (1.x) MsiExec.exe /qn /X{4627F5A1-E85A-4394-9DB3-875DF83AF6C2} REBOOT=ReallySuppress :Heartbeat MsiExec.exe /qn /X{DFFA9361-3625-4219-82C2-9EF011E433B1} REBOOT=ReallySuppress :Sophos Management Communications System MsiExec.exe /qn /X{A1DC5EF8-DD20-45E8-ABBD-F529A24D477B} REBOOT=ReallySuppress MsiExec.exe /qn /X{1FFD3F20-5D24-4C9A-B9F6-A207A53CF179} REBOOT=ReallySuppress MsiExec.exe /qn /X{D875F30C-B469-4998-9A08-FE145DD5DC1A} REBOOT=ReallySuppress MsiExec.exe /qn /X{2C14E1A2-C4EB-466E-8374-81286D723D3A} REBOOT=ReallySuppress :UI MsiExec.exe /qn /X{D29542AE-287C-42E4-AB28-3858E13C1A3E} REBOOT=ReallySuppress :SophosClean "C:\Program Files\Sophos\Clean\uninstall.exe" :SED "C:\Program Files\Sophos\Endpoint Defense\uninstall.exe" /quiet

I can only apologise for the formatting. Something with our filtering has broken the Edugeek editing tools and /br never works in my posts from work.

[6Foot2]

I used this batch file that I was deploying to workstations when we were moving away from Sophos as our AV solution:

 

@echo off

REM Auto Update
echo Old AutoUpdate
MsiExec.exe /qn /X {D924231F-D02D-4E0B-B511-CC4A0E3ED547} /norestart
echo Newer AutoUpdate
MsiExec.exe /qn /X {7CD26A0C-9B59-4E84-B5EE-B386B2F7AA16} /norestart

echo Remote Management
REM Sophos Remote Management
MsiExec.exe /qn /X {FED1005D-CBC8-45D5-A288-FFC7BB304121} /norestart

REM Sophos AV
echo Old AV
MsiExec.exe /qn /X {D929B3B5-56C6-46CC-B3A3-A1A784CBB8E4} /norestart
echo New AV
MsiExec.exe /qn /X {D929B3B5-56C6-46CC-B3A3-A1A784CBB8E4} /norestart

 

HTH.

 

Edited October 5, 2018 by 6Foot2

[Boredguy]

We added a bit more to that script DaveP when we moved

 

 @echo off
C:
IF NOT EXIST "C:\Program Files\Sophos" GOTO EOF
IF EXIST "C:\Program Files\NewAVFolderName" GOTO SAVREM
GOTO EOF

:SAVREM
Echo Stop Service
net stop "Sophos AutoUpdate Service"
echo NTP removal
MsiExec.exe /X{66967E5F-43E8-4402-87A4-04685EE5C2CB} /qn REBOOT=SUPRESS
echo SSP Removal
MsiExec.exe /X{1093B57D-A613-47F3-90CF-0FD5C5DCFFE6} /qn REBOOT=SUPRESS
echo SAV Removal
MsiExec.exe /X{65323B2D-83D4-470D-A209-D769DB30BBDB} /qn REBOOT=SUPRESS
echo RMS Removal
MsiExec.exe /X{FED1005D-CBC8-45D5-A288-FFC7BB304121} /qn REBOOT=SUPRESS
echo SAU Removal
MsiExec.exe /X{AFBCA1B9-496C-4AE6-98AE-3EA1CFF65C54} /qn REBOOT=SUPRESS
MsiExec.exe /X{BCF53039-A7FC-4C79-A3E3-437AE28FD918} /qn REBOOT=SUPRESS
echo SED Removal
"C:\Program Files\Sophos\Endpoint Defense\uninstall.exe"

IF EXIST "C:\Program Files\Sophos" GOTO CLEANUP
GOTO EOF

:CLEANUP
RD /S /Q "C:\Program Files\Sophos"
reg delete "HKLM\SYSTEM\CurrentControlSet\services\Sophos Message Router" /f
reg delete "HKLM\SYSTEM\CurrentControlSet\services\Sophos Agent" /f

:EOF

[discoveranother]

Thanks Guys