Video Screencast Help
Protect Your POS Environment Against Retail Data Breaches. Learn More.

Powershell script to force the removal of SEP when the uninstall doesn't work

Created: 24 Jun 2010 • Updated: 28 Jun 2010 | 12 comments
henrycharles99's picture
+2 2 Votes
Login to vote

These scripts will remove SEP from machines were the uninstall doesn't work.

You will need to run Part 1, reboot, then run Part 2

NOTE: rename the file extensions from .TXT to .PS1

Comments 12 CommentsJump to latest comment

hndygmc's picture

How is the script initialized/ run?

I am installing v 12 on my PC (have installed on 49 others already).  The install starts and seems to go but when it gets to the point of doing the Live update it vanishes with no indication in add/ remove programs that it is installed.

Any help would be appreciated.  Thank you.

0
Login to vote
Constantine's picture

exactly i wanted this yesterday....
i ll check it

thanks anyway bro

0
Login to vote
Black Ops's picture
HenryCharles's picture

HenryCharles Thanks much :)

Don't forget to mark your thread as 'solved' with the answer that best helped you!

0
Login to vote
Bodicherla_Raja's picture

Henry

after changing the extension from .txt to .PS1 its going in unknow format..is this extension correct ?

0
Login to vote
henrycharles99's picture

Make sure you have Powershell installed on the affected system(s)

You have to run the script from Powershell prompt "not the DOS command prompt"

You will most likely receive an error about running an unsigned script. The get around that issue you'll need to type the following command in the Powershell prompt "Set-ExecutionPolicy Unrestricted"

Note: don't forget to run this command in the Powershell prompt when you're done to set back the security:
"Set-ExecutionPolicy restricted"

 

Hope this helps!

0
Login to vote
MaRRuT@CC's picture

an update for SEP12.1 would be lovely =)

0
Login to vote
Ian_C.'s picture

A GUI tool that does the same is called CleanWipe. The current version is v12.1.671.4971 and seem to be available only via Symantec Support. No direct download available.

 

About CleanWipe
===============

CleanWipe is a tool that you can use to prepare or clean any supported Windows computer before you install Symantec Endpoint Protection. It is a self-extracting executable that unzips its batch files, utility programs, and data files to the Windows\Temp folder by default. The password for this self-extracting executable is "symantec" (no quotes, all lower case).

Use CleanWipe with caution. You should use CleanWipe as a last resort after all other means to prepare or clean a computer for Symantec Endpoint Protection installation have failed. 
Please mark the post that best solves your problem as the answer to this thread.
0
Login to vote
henrycharles99's picture

I've used CleanWipe [its a great tool] but, there are times even the cleanwipe tool doesn't work. These script rip it out by brute force so that you can re-install it.

0
Login to vote
Kris81's picture

thank you .. however I get below error when i try to excute part 1 of the script...please advise.

 

The string starting:
At C:\Users\username\Documents\SymantecSEPRemoval_Part1.ps1:303 char:78
+ Remove-Item -Path hklm:\SYSTEM\CurrentControlSet\Services\"Symantec AntiVirus <<<< " -Force
is missing the terminator: ".
At C:\Users\username\Documents\SymantecSEPRemoval_Part1.ps1:309 char:75
+ Remove-Item -Path hklm:\SYSTEM\CurrentControlSet\Services\WpsHelper -Force <<<<
    + CategoryInfo          : ParserError: ( -Force
Remove...psHelper -Force:String) [], ParseException
    + FullyQualifiedErrorId : TerminatorExpectedAtEndOfString

 

Removed the below lines from 303 & 309 "Symantec AntiVirus”  and the last line (309)

 

Remove-Item -Path hklm:\SYSTEM\CurrentControlSet\Services\"Symantec AntiVirus" -Force

Remove-Item -Path hklm:\SYSTEM\CurrentControlSet\Services\WpsHelper -Force

 

However we get  the same error again with line which has last "Symantec AntiVirus”  (292)and the last line(307)

The string starting:

At C:\Users\username\Documents\SymantecSEPRemoval_Part1.ps1:292 char:99

+ Remove-Item -Path hklm:\SYSTEM\CurrentControlSet\Services\Eventlog\Application\"Symantec AntiVirus <<<< " -Force

is missing the terminator: ".

At C:\Users\username\Documents\SymantecSEPRemoval_Part1.ps1:307 char:69

+ Remove-Item -Path hklm:\SYSTEM\CurrentControlSet\Services\WPS -Force <<<<

    + CategoryInfo          : ParserError: ( -Force

Remove...ices\WPS -Force:String) [], ParseException

    + FullyQualifiedErrorId : TerminatorExpectedAtEndOfString

 

0
Login to vote
M.Holz's picture

first thx henrycharles for this awesome script.

 

But i found in SymantecSEPRemoval_Part1.TXT in Line 275 Remove-Item -Path hklm:\SOFTWARE\Symantec\"Symantec Endpoint Protection -Force this sign " is missing and throws the error.

So change to Remove-Item -Path hklm:\SOFTWARE\Symantec\"Symantec Endpoint Protection" -Force

and all works fine!

Do not kill lines, just check the code. ;-)

I attached changed script.

 

 

AttachmentSize
SymantecSEPRemoval_Part1.txt 21.76 KB
+1
Login to vote
flightgod's picture

I get the Recursive Warning when it deletes Registry keys.

If I wanted to automate this could I just add -Recursive after each Remove-Item -Path statement?

0
Login to vote