Silent uninstallation of Hitman.PRO (Exploit Prevention)

Hello Marek Sznapka,

this pop-up might be intentional though I think that the build of HMPA that is present in EXP doesn't leave anything behind that would require a restart - the "full" version might be different. As far as I can see Uninstall performs some housekeeping and then creates and calls a temporary copy of hmpalert that does the actual uninstall and returns with 3010 (like msiexec) which is then displayed by Uninstall as last action.

Likely there's no need for immediate reboot so arguably the notification could be suppressed as with other uninstalls. It does block Uninstall.exe when you run it without a UI e.g. under the system account and Uninstall is just a custom wrapper for the managed installation.

Christian

Hi,

thank You for answer, but it is not clear, how can be notification suppressed. Proposed solution is not working. Silent uninstallation is still not possible because of popup window.

Any idea?

Marek

Hello Marek,

it is not clear [...] proposed solution is not working
my post was definitely not clear. I didn't propose a solution, I was trying to say that there is none. Sophos would have to amend Uninstall.exe.

But why do you need this silent uninstall? It's not something you'd do on a regular basis.

Christian

I need to do this on a regular basis for the time being as we migrate machines to Sophos Cloud Endpoint - I want to be able to write an automatic uninstall script to remove the current standard Sophos Endpoint software.

Any ideas?

Thanks.

Hello Andrew Johnson,

by regular I meant recurring or periodic uninstalls on the same machine.
Obviously you do it just once per machine. As said, the problem with an unattended uninstall is that Uninstall.exe is blocked. Thus if you run it serialized your script won't finish and you can't determine success or failure. You should be able to work around this though by running the uninstall detached. You can assume success (it's not watertight) by checking whether the HitmanPro.Alert directory has been cleared/removed. Then either kill the process or just reboot.

Christian

Hi Christian.

As per your suggestion, I've got it working with the following:

if exist "C:\Program Files\HitmanPro.Alert\Uninstall.exe" (
 start "" "C:\Program Files\HitmanPro.Alert\Uninstall.exe" /uninstall /quiet
)
:AwaitHMPA
timeout /T 1 /NOBREAK >nul
if exist "C:\Program Files\HitmanPro.Alert\" goto AwaitHMPA
taskkill.exe /im uninstall.exe /f >nul 2>&1

Thanks.

But be aware of infinity loop....

It would be great, if guys from Sopohos can recreate uninstall process and get back silent switch working as should.

Yes a loop is a risk if the uninstall fails to complete.

If I find that happens in practise then I'll write something more involved in VBScript that has a max time to wait.

Note also that the script as written above is for x86 machines only.

Why can't Sophos fix this instead of asking why customers need a silent uninstall?

Ridiculous as usual. IT'S A COMMON REQUIREMENT WHICH IS SUPPORTED BY MILLIONS OF PACKAGES.

Completely useless "tech support".

Hello Lance Simmons,

Completely useless "tech support"
you did contact Support and have been asked this question? As far as I can see it was just me who asked and I'm not Sophos [:)].

Christian