Remove Symantec AV 10

By | December 14, 2007

I will be rolling out Symantec's new SEP 11 soon and I need to remove the previous Symantec AV install.
This Script should work on all SAV 9-10 installs.

This script can be easily modified to run remotely. Maybe in the near future I will add this functionality.

———-COPY EVERYTHING BELOW THIS LINE for the Script———-
'Script to uninstall SAV 10
'Created by Chey Harden 11.26.07

On Error Resume Next

Const HKLM = &H80000002

strComputer = "."
strKeyPath = "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
strRegPath = "SOFTWARE\Intel\LANDesk\VirusProtect6\CurrentVersion\AdministratorOnly\Security"
strValue2 = ""
intShortSleep = 5000
intSleep = 240000
strProcessKill = "'msiexec.exe'"
strProcessKill2 = "'cmd.exe'"
 
Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\default:StdRegProv")
oReg.EnumKey HKLM, strKeyPath, arrSubKeys

SetRegKey()
RemoveSAV()

 

Function RemoveSAV()
 For Each subkey In arrSubKeys
  'WScript.Echo subkey ' For Trouble shooting
  strNewKeyPath = strKeyPath & "\" & subkey
  strValueName = "DisplayName"
  strValueNameUninstall = "UninstallString"
  oReg.GetStringValue HKLM,strNewKeyPath,strValueName,strValue
   If strValue = "Symantec AntiVirus" Then 'edit this for software key
    'WScript.Echo "Found Key"'used for trouble shooting
    'WScript.Echo strValue'used for trouble shooting
    oReg.GetStringValue HKLM,strNewKeyPath,strValueNameUninstall,strValue2
    'WScript.Echo strValue2'used for trouble shooting
    If InStr(strValue2, "/I") Then
     strValue2 = Replace(strValue2,"/I","/X")
     'WScript.Echo "Replaced " & strValue2 'used for trouble shooting
    Else
     'WScript.Echo "Not Found " & strValue2 'used for trouble shooting
    End If
    ExecuteUninstall()
   Else
    'WScript.Echo "Not Found" 'used for trouble shooting
   End If
 Next
End Function

 

Function ExecuteUninstall()
 Set WShell = CreateObject("WScript.Shell")
 'WScript.Echo strValue2'used for trouble shooting
 WShell.Run "%COMSPEC% /c " & strValue2 & " /qn",0,TRUE
 Set WShell = Nothing
 WScript.Sleep intSleep
 'KillProcess() ' Used to kill the process if it runs too long, curently this function is disabled
End Function

 

Function SetRegKey()
 strValueNameDword1 = "UseVPUninstallPassword"
 strValueNameDword2 = "LockUnloadServices"
 dwSetValue = 0
 
 oReg.GetDWORDValue HKLM,strRegPath,strValueNameDword1,dwValue
 If dwValue = 1 Then
  oReg.SetDWORDValue HKLM,strRegPath,strValueNameDword1,dwSetValue
  oReg.SetDWORDValue HKLM,strRegPath,strValueNameDword2,dwSetValue
 End If 
End Function

 

Function KillProcess()
 Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
 Set colProcess = objWMIService.ExecQuery ("Select * from Win32_Process Where Name = " & strProcessKill )
  For Each objProcess in colProcess
   objProcess.Terminate()
  Next
 WScript.Sleep intShortSleep 
 Set colProcess = objWMIService.ExecQuery ("Select * from Win32_Process Where Name = " & strProcessKill2 )
  For Each objProcess in colProcess
   objProcess.Terminate()
  Next 
End Function 

———-COPY EVERYTHING ABOVE THIS LINE for the Script———-

 

 

PLEASE MAKE SURE NO WORD WRAPPING IS HAPPENING IN YOUR SCRIPT!!!

1. Run this as a Logon Script.
2. Make sure to be an admin on the target machines.

 

 
This information is provided "AS IS" with no warranties expressed or implied.

Leave a Reply

Your email address will not be published. Required fields are marked *