McAfee ePo uninstall nightmare

RobertKaucher

I'm trying to remove McAfee (8.5) ePo (4.0) agent on a Windows XP machine and I am having 0 luck. I keep getting the error "Can't stop service" when I run FrmInst.exe /forceuninstall.

I have disabled the part of the policy that say "prevent mcafee services from being stopped" and did a wakeup call on the agents.

I have googled this as many ways as I can think and I have found nothing that works.

Any suggestions?

Claymoore

Does killing the service process help? Try this Powershell script:

get-process | where {$_.ProcessName -eq "Notepad"} | Stop-Process

WTF is up with me and Powershell today? You would think I just picked up a copy of the Regular Expressions Cookbook last weekend or something...

RobertKaucher

I can kill it, but without the permissions tot he service I cannot get it to extricate itself. It's not so much killing the proc that is the issue but allowing a user account to modify the service. If the Policy does not allow it, it cannot be done.

mrmcmint

may be a long shot but can you get a scheduled task to uninstall the service as it would run under the system account?

bwcarty

It's been a while since I've dealt with ePO. Is the agent reporting to the server? If so, can you delete the computer from ePO and have it uninstall everything?

RobertKaucher

Thanks for the suggestions. Nothing has worked. This is exactly why I am getting away from McAfee. Their crap doesn't work (8 out of 10 infected systems with av installed have McAfee) and the ePo crap is impossible to navigate and understand.

undomiel

When working for Dell what I loved was on several occasions McAfee released an update that would completely lock down the network connection. Those days were fun.

Silentsoul

Try this as a batch file:

@ECHO ON

If EXIST "C:\Program Files\Network Associates\Common Framework\FrmInst.exe" GOTO STANDARD

If EXIST "C:\Program Files\Network Associates\ePO\Common Framework\FrmInst.exe" GOTO EPO

If EXIST "C:\Program Files\McAfee\Common Framework\FrmInst.exe" GOTO MCAFEE

If EXIST "C:\Program Files\Common Files\McAfee\Common Framework\FrmInst.exe" GOTO MCAFEEEPO

goto end


:STANDARD
"C:\Program Files\Network Associates\Common Framework\FrmInst.exe" /FORCEUNINSTALL
goto end

:EPO
"C:\Program Files\Network Associates\ePO\Common Framework\FrmInst.exe" /FORCEUNINSTALL
goto end

:MCAFEE
"C:\Program Files\McAfee\Common Framework\FrmInst.exe" /FORCEUNINSTALL
goto end

:MCAFEEEPO
"C:\Program Files\Common Files\McAfee\Common Framework\FrmInst.exe" /FORCEUNINSTALL
goto end

:end

mrmcmint

Try this:

http://vs.mcafeeasap.com/MC/enu/vs45/bin/mvsuninst.exe

I have had to use this before now

tiersten

The three words McAfee ePo and nightmare all go together. I've had a few machines which had the same issue you had which is that its nearly impossible to remove the ePo agent.

Not very helpful for you but in the end we just blew the Windows install away and started from scratch. Uninstalling McAfee AV and ePo made the install act oddly and we just didn't want to spend that much time fixing it.

RobertKaucher

This may be what I end up doing. I actually was able to get it to go away by deleting all signs of McAfee from the registry. Deleting McAfee via ePo has worked for most of the machines. We'll see about the rest. It sucks that I am going to have to go and touch every machine in the building.

Thanks for the help and suggestions.

sidsanders

ive had to remove crapafee 8.x + agent several times recently. sometimes the standard removal works fine, other times:
https://kc.mcafee.com/corporate/index?page=content&id=KB65863
https://kc.mcafee.com/corporate/index?page=content&id=KB59996&pmv=print

i take it these links failed also? there were some more articles on the support site that had you mod the registry and startup in safe mode to complete the removal as well.

qwertyiop

McAfee ePo is a mess, i had to tackle removing this while I was an IT intern. Ill try to find the batch script that I created to remove this.

RobertKaucher

qwertyiop wrote: »

McAfee ePo is a mess, i had to tackle removing this while I was an IT intern. Ill try to find the batch script that I created to remove this.

That would be very welcome.

@Sid - I used the manual uninstall as a guide when I was ripping stuff out from the registry. There really should be a removal tool, but I suppose that might just help the hackers.