Uninstall McAfee Agent & AntiVirus - Completely remove McAfee via command line/script

Submitted by justin on Mon, 11/01/2010 - 15:34

If you're like most admins out there, you've had a need to completely remove McAfee components whether it's troubleshooting or getting rid of the product.

McAfee is a stubborn product to remove.  They offer a tool to assist with removing their consumer products.  This won't work on managed installations (ePO) unfortunately.  So I've assembled a batch file to handle the dirty work.  As always, use at your own risk.

 

@ECHO OFF
REM McAfee Removal Script
REM Last Update: 11/01/2010
REM

ECHO Removing AntiSpyware
"C:\Program Files\McAfee\VirusScan Enterprise\scan32.exe" /UninstallMAS
"C:\Program Files (x86)\McAfee\VirusScan Enterprise\scan32.exe" /UninstallMAS

REM Kill McTray & Trusted Validation
ECHO Killing processes
taskkill.exe /f /t /im mctray.exe
taskkill.exe /f /t /im mfevtps.exe

ECHO Removing VirusScan 8.0
msiexec.exe /x {5DF3D1BB-894E-4DCD-8275-159AC9829B43} REMOVE=ALL REBOOT=R /q

ECHO Removing VirusScan 8.5
msiexec.exe /x {35C03C04-3F1F-42C2-A989-A757EE691F65} REMOVE=ALL REBOOT=R /q

ECHO Removing VirusScan 8.7
msiexec.exe /x {147BCE03-C0F1-4C9F-8157-6A89B6D2D973} REMOVE=ALL REBOOT=R /q

ECHO Remove McAfee Agent
"C:\Program Files\McAfee\Common Framework\frminst.exe" /forceuninstall /silent
"C:\Program Files (x86)\McAfee\Common Framework\frminst.exe" /forceuninstall /silent
"c:\Program Files\Network Associates\Common Framework\frminst.exe" /forceuninstall /silent

REM Remove McAfee Registry Keys
ECHO Removing Registry Keys
REG DELETE HKLM\SYSTEM\CurrentControlSet\services\McShield /f
REG DELETE HKLM\SYSTEM\CurrentControlSet\services\McTaskManager /f
REG DELETE HKLM\SYSTEM\CurrentControlSet\Services\mfeapfk /f
REG DELETE HKLM\SYSTEM\CurrentControlSet\Services\mfeavfk /f
REG DELETE HKLM\SYSTEM\CurrentControlSet\Services\mfebopk /f
REG DELETE HKLM\SYSTEM\CurrentControlSet\Services\mfehidk /f
REG DELETE HKLM\SYSTEM\CurrentControlSet\Services\mferkdet /f
REG DELETE HKLM\SYSTEM\CurrentControlSet\Services\mfetdik /f
REG DELETE HKLM\SYSTEM\CurrentControlSet\Services\mfevtp /f
REG DELETE HKLM\SOFTWARE\McAfee /f

 

If you have suggestions, problems, etc. please post below.  Happy hunting!

Your rating: None Average: 4.6 (11 votes)

Uninstall script

Submitted by Anonymous on Thu, 01/05/2012 - 07:06.

Thanks for this wonderful script ,made my work easier

Danke! Gute Arbeit. Beste

Submitted by Anonymous on Fri, 10/21/2011 - 08:03.

Danke!
Gute Arbeit.
Beste Gruesse aus Deutschland!

thank you for ever Justin!

Submitted by Anonymous on Tue, 10/11/2011 - 09:36.

It worked perfectly, so thank you.

Abedoss@Yahoo.com

You might want to add an

Submitted by Anonymous on Thu, 09/22/2011 - 05:06.

You might want to add an extra line on the agent removal:

"c:\Program Files\Network Associates\Common Framework\frminst.exe" /forceuninstall /silent

Good thought. Forgot about

Submitted by justin on Tue, 11/08/2011 - 15:39.

Good thought. Forgot about the NA path.

Awesome!

Submitted by Anonymous on Wed, 09/21/2011 - 08:16.

Thanks!

Made my life a lot easier.

V8.8 on win 7 64bit

Submitted by Anonymous on Mon, 09/12/2011 - 12:40.

I had agent and virus scan enterprise installed.
Watned to get rid of the agent.
Ran the bat file specified. It gave me a bunch of errors:
process id can't be terminated
access denied
system cannot find path specified

which i guess is all part of the trying a bunch of different directories.

Anyways, this got rid of the agent! Exactly what I wanted, but did not delete virus can enterprise

Would love to see a complete bat file that would delete everything starting with v8.5 and completing with current version.

also would love to see a separate bat file to remove agent only

Well I (fortunately) don't

Submitted by justin on Tue, 11/08/2011 - 15:41.

Well I (fortunately) don't work with McAfee much anymore. I would guess that some of the errors you mentioned are the result of files not existing (as you said). With Windows 7 and Vista, try launching it from an elevated command prompt. Even if you have UAC "off" some actions still require the admin token.

Thank you!

Submitted by Anonymous on Tue, 04/12/2011 - 15:53.

WONDERFUL script, makes my administrative life that much easier.

Thanks a lot for posting it

Thank's Dude

Submitted by Anonymous on Sun, 09/04/2011 - 16:35.

WONDERFUL script,