Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 3 replies
  • Subscribers 1 subscriber
  • Views 5537 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Third-party security software removal

Spock

Hi!

I'm new this site and to Sophos Products in general.

While preparing our deployment of Sophos products, I found a document about "Third-party security software removal" dated April 2008 for the Sophos Enterprise Console, version 3.1.

In the document, it is said that two versions of the tool exists. I already tried the standard one found in the CRT folder in the CID of our Sophos Enterprise Console Server. I'm now looking for the non-standard one wich is supposed to be " ... available as a standalone tool from the Sophos website." This other version is supposed to " ... support the removal of more third-party security than the standard tool."

Does this version still exist and, if so, where can it be found?

Thanks for your help!

:8055


This thread was automatically locked due to age.
  • 0

    Hi,

    As far as I recall there was a standalone tool initially.  This was then incorporated into the product but the initial product was still maintained in parallel as it's very similar.  The one in the product should be sufficient.  Are you trying to remove a product the incorporated version isn't detecting?

    I've just tested copying the crt folder from the CID: i.e.: "\\<server>\SophosUpdate\CIDs\S000\SAVSCFXP\crt\", to my client machine and then in a command prompt ran:

    AVRemove.exe --help

    this shows the switches available, so

    AVRemove.exe -l

    will give a list of detected products.

    Does running:

    AVRemove.exe

    on one of your clients tell you that "No products detected on this system"?

    Do you know this to be incorrect as you have another AV/Security product on the machine for example that is not detected currently?

    Thanks

    Jak

    :8065
  • 0

    Hi,

    Yes, the removal tool says that there is nothing to remove but "Site Advisor" from the McAfee Suite is still there even tough the --listproducts option on the command line shows Site Advisor 2.x and 3.x in the list of detectable (and removable) items (Site Advisor Enterprise Plus 3.0.0.476 is the version installed).

    When I initially used the tool, the McAfee agent 4.5.0, the antivirus + antispyware 8.7 were removed but Site Advisor is hanging on!

    Can you confirm that the non-standard tool is not available anymore?

    Thanks!

    :8079
  • 0

    Hi,

    I'm not sure, I think you'll need to contact Support.  I've never had a product not detected.  I would imagine they will add it if requested.  That might take some time to get to you though.  I would therefore consider for the short term identifying a command that will remove the software, ideally silently so it could be deployed as a startup script for example to remove it.

    Typically if the software was installed by an MSI, you can navigate to:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

    Find the product in the list and look at the value of: "UninstallString".

    E.g. in the case of: "Microsoft SQL Server 2008 Setup Support Files" (chosen at random on my machine)

    MsiExec.exe /X{B40EE88B-400A-4266-A17B-E3DE64E94431}

    Additionally, running msiexec /? will give you a list of additional parameters you can add to silence the install or checking on:

    http://msdn.microsoft.com/en-us/library/aa367988(v=vs.85).aspx will give you a reasonable list.

    Otherwise contacting the vendor or checking on their Support site, in this case McAfee to get an uninstall command for Site Advisor product and execute that.  Or finding what running the removal link runs.

    Hope that offers some guidance.  

    Jak

    :8085
Unfiltered HTML