ESET Agent Un-install

[rizaans 0]

Greetings people

we currently have an issue whereby all our ESET agents stopped reporting back to the ESMC, I did log a ticket with ESET support desk and they advised that I will need to un-install the Agent.

the issue we have is that when trying to un-install the agent it does not accept the password that was set. We were then advised by ESET to boot the server in the safemode and then run the un-install, however our servers are provisioned on Azure Portal. I can reboot the servers into Safemode but Azure Portal does not have any means of a console session to login directly to the VM and un-install. I really need assistance as we have 10 VMs that have gone in this state that last updated in January 

 

[Marcos 5,070]

Just out of curiosity, did you try continuing with an empty password?

[rizaans 0]

Hi Marcos, yes I did try without a password and still didn't work 

[rizaans 0]

is there any other way to -uninstall ESET agent besides booting the server into Safe-mode? 

[mtrento 0]

Hi,

There is a method but you have to remove registry entries by hand.

Fortunately i made a script  partly based on informations i found on various internet sites and forums.

I used this script to delete manually the agent since removing it from the console does not remove it completely. 

After executing it you can re install the agent or any other version but it will register itself as a new entry in the console 

the old entry must be also removed manually.
 

Good Luck

@echo off

rem first try to start the official uninstall
wmic product where name="ESET Management Agent" call uninstall /nointeractive

rem manual delete of agent
rem Use at your own risk


sc stop EraAgentSvc
sc delete EraAgentSvc
del /F /S /Q "C:\Program Files\ESET\RemoteAdministrator\"
del /F /S /Q "C:\ProgramData\ESET\RemoteAdministrator\"

reg delete HKEY_LOCAL_MACHINE\SOFTWARE\ESET\RemoteAdministrator\Agent /f

reg delete HKEY_CLASSES_ROOT\Installer\Products\8C5B454B78C542F49B5FA2A991F9805F /f
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\8C5B454B78C542F49B5FA2A991F9805F /f
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\ /v C:\Windows\Installer\{B454B5C8-5C87-4F24-B9F5-2A9A199F08F5}\ /f
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8C5B454B78C542F49B5FA2A991F9805F /f
rem eset 6.5
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B454B5C8-5C87-4F24-B9F5-2A9A199F08F5} /f
rem  agent ESET Management Agent  7.0.577.0
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9BF80F33-FAA3-4F96-9CE6-ECCC808CA7BA} /F
reg delete HKEY_CLASSES_ROOT\Installer\Features\8C5B454B78C542F49B5FA2A991F9805F /f
reg delete HKEY_CLASSES_ROOT\Installer\UpgradeCodes\786A20824144DB1449FA500C3A98D88D /f
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\8C5B454B78C542F49B5FA2A991F9805F /f
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\786A20824144DB1449FA500C3A98D88D /f
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\786A20824144DB1449FA500C3A98D88D /f

reg delete HKEY_CLASSES_ROOT\Installer\Products\33F08FB93AAF69F4C96ECECC08C87AAB /f
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\33F08FB93AAF69F4C96ECECC08C87AAB /f
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\33F08FB93AAF69F4C96ECECC08C87AAB /f


reg delete "HKEY_CLASSES_ROOT\Installer\Products\07F21F149AF55F34494F355BE44BEE4C" /f
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\07F21F149AF55F34494F355BE44BEE4C" /f
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\07F21F149AF55F34494F355BE44BEE4C" /f
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{41F12F70-5FA9-43F5-94F4-53B54EB4EEC4}" /f