This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Silent uninstallation of Hitman.PRO (Exploit Prevention)

Hi

i am trying silently uninstall HitmanPro.Alert which is part of Sophos(Exploit Prevention), but without any success. Every try ends up with following popup window (see attach).



I am using switches from this knowlege base: community.sophos.com/.../122126


"C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe" /uninstall /quiet
 
"C:\Program Files (x86)\HitmanPro.Alert\uninstall.exe" /uninstall /quiet
 
"C:\Program Files\HitmanPro\HitmanPro.exe" /uninstall /quiet


Version of hmpalert.exe: 3.6.9.610
Version of Uninstall.exe: 3.6.9.113

Support of Hitman.Pro was contacted, they provided us some uninstaller tools, but it does not met our requirements for silent uninstall.
Support of Sophos did not help, maybe here we can find solution.
 

Thanks

 



This thread was automatically locked due to age.
Parents
  • Hello Marek Sznapka,

    this pop-up might be intentional though I think that the build of HMPA that is present in EXP doesn't leave anything behind that would require a restart - the "full" version might be different. As far as I can see Uninstall performs some housekeeping and then creates and calls a temporary copy of hmpalert that does the actual uninstall and returns with 3010 (like msiexec) which is then displayed by Uninstall as last action.

    Likely there's no need for immediate reboot so arguably the notification could be suppressed as with other uninstalls. It does block Uninstall.exe when you run it without a UI e.g. under the system account and Uninstall is just a custom wrapper for the managed installation.

    Christian

Reply
  • Hello Marek Sznapka,

    this pop-up might be intentional though I think that the build of HMPA that is present in EXP doesn't leave anything behind that would require a restart - the "full" version might be different. As far as I can see Uninstall performs some housekeeping and then creates and calls a temporary copy of hmpalert that does the actual uninstall and returns with 3010 (like msiexec) which is then displayed by Uninstall as last action.

    Likely there's no need for immediate reboot so arguably the notification could be suppressed as with other uninstalls. It does block Uninstall.exe when you run it without a UI e.g. under the system account and Uninstall is just a custom wrapper for the managed installation.

    Christian

Children
  • Hi,

    thank You for answer, but it is not clear, how can be notification suppressed. Proposed solution is not working. Silent uninstallation is still not possible because of popup window.

    Any idea?

    Marek

  • Hello Marek,

    it is not clear [...] proposed solution is not working
    my post was definitely not clear. I didn't propose a solution, I was trying to say that there is none. Sophos would have to amend Uninstall.exe.

    But why do you need this silent uninstall? It's not something you'd do on a regular basis.

    Christian

  • I need to do this on a regular basis for the time being as we migrate machines to Sophos Cloud Endpoint - I want to be able to write an automatic uninstall script to remove the current standard Sophos Endpoint software.

    Any ideas?

    Thanks.

  • Hello Andrew Johnson,

    by regular I meant recurring or periodic uninstalls on the same machine.
    Obviously you do it just once per machine. As said, the problem with an unattended uninstall is that Uninstall.exe is blocked. Thus if you run it serialized your script won't finish and you can't determine success or failure. You should be able to work around this though by running the uninstall detached. You can assume success (it's not watertight) by checking whether the HitmanPro.Alert directory has been cleared/removed. Then either kill the process or just reboot.

    Christian

  • Hi Christian.

    As per your suggestion, I've got it working with the following:

     

    if exist "C:\Program Files\HitmanPro.Alert\Uninstall.exe" (
     start "" "C:\Program Files\HitmanPro.Alert\Uninstall.exe" /uninstall /quiet
    )
    :AwaitHMPA
    timeout /T 1 /NOBREAK >nul
    if exist "C:\Program Files\HitmanPro.Alert\" goto AwaitHMPA
    taskkill.exe /im uninstall.exe /f >nul 2>&1

     

    Thanks.

  • But be aware of infinity loop....

    It would be great, if guys from Sopohos can recreate uninstall process and get back silent switch working as should.

  • Yes a loop is a risk if the uninstall fails to complete.

    If I find that happens in practise then I'll write something more involved in VBScript that has a max time to wait.

    Note also that the script as written above is for x86 machines only.

  • Why can't Sophos fix this instead of asking why customers need a silent uninstall?

    Ridiculous as usual. IT'S A COMMON REQUIREMENT WHICH IS SUPPORTED BY MILLIONS OF PACKAGES.

    Completely useless "tech support".

  • Hello Lance Simmons,

    Completely useless "tech support"
    you did contact Support and have been asked this question? As far as I can see it was just me who asked and I'm not Sophos [:)].

    Christian