Sign in to follow this  
Followers 0
xeroplasmic

Help with Automated Mcafee removal?

4 posts in this topic

I am trying to write a simple script to remove Mcafee Security as a Service from workstations and will push it out through GPO - I am trying to have the AIT to run a batch file ( my batch file runs the mcafee uninstaller with a few switches) however when Mcafee Endpoint Security Uninstall application starts the Uninstall and it asks me to Hit Yes or No, I cannot get my script to hook to the Yes button and click Yes. Any help would be greatly appreciated.

 

Run(@ComSpec & " /c " & "start mcafee_uninstall_jake.bat")

WinWaitActive ("McAfee Endpoint Security Uninstall", "") ; here is where I wait till the Actual uninstaller begins it's process

WinActivate ("McAfee Endpoint Security Uninstall") ; activate Window

ControlClick ("Mcafee Endpoint Security Uninstall", "Yes", 6 ) ; here is where it is supposed to click Yes to begin uninstall

If anyone can help me get through this, I will be eternally greatful. thank you!
 

Share this post


Link to post
Share on other sites



Are you using the uninstall utility (MVSUninst.exe)? You should be able to run this silently. You'll still have some cleanup to do, as it leaves crap behind (McAfee sucks more than most in this department).


√-1 2^3 ∑ π, and it was delicious!

Share this post


Link to post
Share on other sites

I have tried both mvs and the vss tool, I am specifically trying to use vss as the software we deployed to our clients is the security as a service version of mcafee. I need to push the Uninstaller as a group policy so when a station logs in, it starts the script and when prompted it selects yes. However control click  won't won't select yes and I can't send key press either on activated window for the uninstaller

Share this post


Link to post
Share on other sites

#4 ·  Posted (edited)

... I am specifically trying to use vss as the software we deployed to our clients is the security as a service version of mcafee.

doesn't MVSUninst apply for SaaS too? this McAfee KB says it does.

I have tried both mvs and the vss tool...

with the result being...?

...when a station logs in, it starts the script and when prompted it selects yes.

you are on the wrong track. if your script is running in the user context, no go there. will fail on all tasks as the removal requires administrative privileges. if your script is running as local SYSTEM account, making it interact with controls is not something i ever managed to perform reliably over large deployment scenarios.

 

now, this McAfee KB suggests you can perform the removal automatically and silently. first, before you go there, be aware that when they say "Automated" they really mean "to be performed by the user using his mouse and keyboard.". Intel is a hardware company after all, they have no idea about software. i dare say McAfee don't either, even before Intel bought them. so, you go directly to the "Manual Removal" section. it does instruct you to use your mouse and keyboard, but only to perform actions that are sooooo meant to be scripted, like stopping processes, deleting files and registry entries, etc.

what you do from here is scripting their instructions, compile to exe and deploy.

note:

1. most of the actions are system-wide, but there is a step of deleting user registry entries. i don't think it's really really needed, but if you insist, you can compile this part into a different script, to be run at user logon. this is the one thing that user logon is good for. all the rest should be launched at system level, in whatever method you wish other than user logon.

2. removal of non-PnP devices can be automated with DevCon

frankly, reading that KB over, i'm thinking that scripting it is actually far easier than it sounds; i'm quite curious to see how you get along with it. good luck! ;)

 

EDIT: i hope it's clear that when i said "what you do from here is scripting their instructions" i most definitely did not mean by simulating mouse clicks and keystrokes, i meant by using ProcessClose() or taskkill.exe, RegDelete(), FileDelete() etc.

 

Edited by orbs

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0