We replaced McAfee and canceled our contract but are still trying to get it off of hosts. Without a valid grant I can't log in to get the newest version. Any hero's out there willing to share the new version?
Posted May 31, 2023, 5:44 PM UTC
I ran through this a few years ago. I made the following batch file script to remove everything I could find. The place I work at now was heavy on McAfee when I first started. I also downloaded a tool called MCPR.exe. You can download it with this link under Option 2:
https://www.mcafee.com/support/?articleId=TS101331&page=shell&shell=article-view
I ran the below script manually on EVERY workstation by copying it out and running it as an admin mainly because the removal tool couldn't be automated. It sucked. The script and the tool in most cases got rid of everything, but there was still some stuff left behind that didn't cause any issues. Here is the script below. Adapt it for your own uses as you wish. You might need to change some stuff.
@ echo off
REM Copy this script to the local computer and runas administrator. Otherwise everything can be uninstalled individually from the console.
echo Uninstalling HIPS
"%Programfiles%\McAfee\Host Intrusion Prevention\clientcontrol.exe" /stop %password% (if it needs a password)
msiexec.exe /x{6B005DF6-6B6E-4551-B632-B0001DF50499} EPOSPAWNED=True /passive /norestart
MsiExec.exe /X{D2B9C003-A3CD-44A0-9DE5-52FE986C03E5} EPOSPAWNED=True /passive /norestart
echo Uninstalling VirusScan Enterprise
MsiExec.exe /X{CE15D1B6-19B6-4D4D-8F43-CF5D2C3356FF} REMOVE=ALL /passive /norestart
echo Uninstalling Site Advisor
MsiExec.exe /X{C44506FC-B846-4782-AC2B-8C30236CE075} /passive /norestart
MsiExec.exe /X{00FC3F65-86EB-475E-881F-A5B1CF731320} /passive /norestart
echo Uninstalling Drive Encryption
msiexec /x{c35c2466-bfda-47f6-8245-bc9c4fed434a} /passive /norestart
msiexec /x{11637DBF-6F0D-48D5-B77C-443B6EA016E5} /passive /norestart
msiexec /x{0b392dfa-18cb-4a3e-b0b6-3c82359b86c8} /passive /norestart
echo Uninstalling Agents
"%Programfiles%\McAfee\Agent\FrmInst.exe" /Forceuninstall /Silent
"%Programfiles%\McAfee\Agent\x86\FrmInst.exe" /Forceuninstall /Silent
"C:\Program Files (x86)\McAfee\Common Framework\x86\FrmInst.exe" /Forceuninstall /Silent
MsiExec.exe /X{386A9C46-C31F-42E8-AC39-583A3174945A} /passive /norestart
MsiExec.exe /x{68E2C405-E164-4338-A6C5-18503C8CADD2} /passive /norestart
echo Call clean up tool. Captcha's are case sensitive
"%\\servername%\%share%\MCPR.exe"
Sorry I know this isn't what you asked for, but I was in a similar boat and ended up running this powershell command via our RMM:
(Get-WmiObject -Class Win32_Product -filter "Name like 'mcafee%'").uninstall()
**BUT, if there is an uninstall password required, this won't work!
Future readers should be aware: the win32_product class can cause "mysterious" reboots on your servers.
https://xkln.net/blog/please-stop-using-win32product-to-find-installed-software-alternatives-inside/
Might do something like this if we can't get a newer removal tool so thank you!
I removed the expiry date from this with Ghidra. PM sent.
If you disable network access and then set the clock back you can run older versions even after they expire, it's a pain to do at scale but for clearing up the last few devices it is an option at least.
Yeah, we tested that as working but have larger concerns about the unknown impact of rolling back the time on a variety of hosts that might use it for any number of mission critical functions (Like logging)
Yeah, thats a valid concern.
If you still have a working EPO console what I did was push out uninstall packages from that which removed most of AV components (eventually), and then had my script for our new AV (S1 in our case), check to see if the AV had been removed and then issued the commands to uninstall the mcafee agent before then installing S1.
It's pretty basic but I through the script I built with PSADT into github here:
https://github.com/Nick-C/Migrate-McAfee-to-SentinelOne/blob/main/Deploy-Application.ps1
It doesn't catch all edge cases as there were a couple of really ancient agent installs that used different paths but it might offer to inspiration for your own removal efforts :)
I tell people about this when they talk about looking into AV solutions in their offices. McAfee is a solution worse than the problem.