EduTech Posted February 1, 2011 Posted February 1, 2011 Evening All, I have not really looked into this yet much myself, so it might be pretty straight forward or/ the answer may be i have to do what i thought and do it manually. In the next 2 weeks i will be replacing a site wide anti-virus (Sophos) with ESET NOD32 due to the old version now coming end of line it was a great chance to get in and upgrade to ESET as planned for a wee while. (Contract Coming up for Renewal After 3 Years) I know NOD32 is going to throw a fit at me if i try and deploy it whilst sophos is installed, so is there a way i can remove sophos client from the machines centrally or/ am i going to have to do this manually on ever machine. (bearing in mind i have 1x Head Office and 7x Sites connected via VPN). Many Thanks, James.
djwingfield Posted February 2, 2011 Posted February 2, 2011 Hi James, I belive this is what you are looking for, Remove Sophos script - edugeek Dan 1
carvjo Posted February 2, 2011 Posted February 2, 2011 Hi James - It looks like ESET provide an uninstaller for Sophos http://www.eset.co.uk/Download/UnInstallers I've done a similar exercise with another AV product and it was possible to add the uninstaller (for the old product) to the deployment of the new one.. I am sure ESET support will be able to point you in the direction of some way to deploy a site-wide rollout including the uninstall of Sophos. John 1
EduTech Posted February 2, 2011 Author Posted February 2, 2011 Thanks for the responses chaps! I knew there would be away but just been so busy to even start to investigate it, was just easier to post a thread up on here! Hi James - It looks like ESET provide an uninstaller for Sophos http://www.eset.co.uk/Download/UnInstallers I've done a similar exercise with another AV product and it was possible to add the uninstaller (for the old product) to the deployment of the new one.. I am sure ESET support will be able to point you in the direction of some way to deploy a site-wide rollout including the uninstall of Sophos. John It appears SOPHOS is not in that list! but yeah i have a few contacts at ESET so probably just ping them an email anyhow. Cheers! James.
plexer Posted March 16, 2011 Posted March 16, 2011 Just take note that those uninstallers are by the respective av makers and not eset themselves. The panda one requires user interaction and is not scriptable. Ben
EduTech Posted March 16, 2011 Author Posted March 16, 2011 In the end i just had to uninstall it manually, but i believe that script above would of worked fine. James.
Edu-IT Posted March 16, 2011 Posted March 16, 2011 In the end i just had to uninstall it manually, but i believe that script above would of worked fine. James. Through Add/Remove? Did that do a nice uninstall?
EduTech Posted March 16, 2011 Author Posted March 16, 2011 Through Add/Remove? Did that do a nice uninstall? It did shockingly! and ESET NOD deployed very nice (even over the VPN Connections) Server Software was a pain with reg entries but soon sorted, and a quick ccleaner Happy Days! James.
Edu-IT Posted March 16, 2011 Posted March 16, 2011 (edited) Did you document which reg keys to remove or is there a list online somewhere? I can't find a list on the Sophos site. This perhaps? http://www.edugeek.net/forums/how-do-you-do/8858-uninstalling-sophos.html#post90784 Edited March 16, 2011 by Edu-IT
EduTech Posted March 16, 2011 Author Posted March 16, 2011 *Some of the things in last steps may not apply (always) ---- Manual Removal Instructions ** Indicate the removing the components of the Sophos instance MSDE, if you wish to keep MSDE ignore lines with these marking. 1. Please make a full system backup of the server. 2. Goto Control Panel and remove the following components from the list: **Microsoft SQL Server Desktop Engine (SOPHOS) Sophos Anti-Virus Sophos AutoUpdate Sophos EM Library Sophos Enterprise Console (Select Remove) Sophos Remote Management System 3. Click Start then click Run... type in 'regedit' (without quotes) and press enter. 4. Navigate to this location and modify this key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Sources Delete the following lines from the list: **SQLCTR$SOPHOS **SQLAgent$SOPHOS SophosAntiVirus Sophos Message Router Sophos Management Service Sophos Anti-Virus SOPHOS Leave regedit open to do point 8 further on. 5. Click Start then click Run... type in 'services.msc' (without quotes) and press enter. 6. Stop the following services: Sophos Agent Sophos Anti-Virus Sophos Anti-Virus status reporter Sophos AutoUpdate Service Sophos Certification Manager Sophos EMLibUpdate Agent Sophos Enterprise Manager Scheduler Sophos Management Service Sophos Message Router **SQLAgent$SOPHOS **MSSQL$SOPHOS 7. Return to regedit and navigate to the following keys and delete the corresponding registry folders: HKEY_CURRENT_USER\Software\Sophos HKEY_LOCAL_MACHINE\Software\Sophos HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\SOPHOS HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Sophos Anti-Virus HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Sophos Management Service HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Sophos Message Router HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\SophosAntiVirus **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\SQLAgent$SOPHOS **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\SQLCTR$SOPHOS HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Sophos EM Library HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos Agent HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SAVService HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SAVAdminService HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SAVOnAccess Control HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SAVOnACcess Filter HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SCFDriver HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos AutoUpdate Service HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos Certification Manager HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos EMLib Update Agent HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SEMscheduler HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos Management Service HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos Message Router **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SQLAgent$SOPHOS **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSSQL$SOPHOS **HKLM\Software\Microsoft\MSSQLServer\client\SuperSocketNetLib\Last connect [blank the entry if it refers to Sophos] **HKLM\Software\Microsoft\Microsoft SQL Server\ [blank the entry 'InstalledInstances' if it refers to Sophos] **HKLM\Software\Microsoft\Microsoft SQL Server\SOPHOS\ **HKLM\Software\Microsoft\Microsoft SQL Server\80\Tools\Service Manager\ [blank the entry 'Default' if it refers to Sophos] **HKLM\Software\Microsoft\Microsoft SQL Server\Component Set\ [Delete InstalledComponentSet REG_SZ {E09B48B5-E141-427A-AB0C-D3605127224A}] 8. Click Start goto Programs and delete the following shortcuts: Sophos Startup\AutoUpdate Monitor **Startup\Service Manager 9. At this point you will need to restart the computer. 10. After the reboot delete the following folders: C:\Program Files\Sophos\ C:\Program Files\Sophos Sweep for NT\ C:\Program Files\Sophos Enterprise Manager\ **C:\Program Files\Microsoft SQL Server\MSSQL$SOPHOS\ C:\Documents And Settings\All Users\Application Data\Sophos\ 11. If you encountered errors on the reboot check your event log for details. 12. Navigate to the following folder and delete the contents (some files maybe in use and cannot be deleted, this is expected): (Windows XP/2003) C:\Windows\Temp\ OR (Windows 2000) C:\WINNT\Temp\ C:\Documents And Settings\Administrator\Local Settings\Temp\ 13. If you are using Active Directory click Start navigate through settings then click on Control Panel. Open Administrative Tools and double-click on 'Active Directory Users and Computers', delete the following accounts and groups: If you are on a workgroup server, right click on My Computer and select Manage. Expand Local Users and Groups and delete the following accounts and groups: Reference: = group = user EMLibrary Users EMLibUser1 Sophos Console Administrators Sophos DB Admins Sophos DB Users SophosAdministrator SophosOnAccess SophosPowerUser SophosSAU0 (Maybe more than one, delete all variants 0, 1 ,2 etc) SophosUser
SteveFarr Posted March 17, 2011 Posted March 17, 2011 Ive spent the last three days doing exactly the same, installing eset - nod32 and removing sophos! not the easiest job in the world but im about there....... the eset manual aint that great! just to say ive got the script working perfectly, its worth taking out the first and last "pause" the script will then run silently on log off via group policy! it does extend log of times by about a minute but with a network of 1250 machines its by far the best option! s
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now