rizaans 0 Posted March 1, 2019 Share Posted March 1, 2019 Greetings people we currently have an issue whereby all our ESET agents stopped reporting back to the ESMC, I did log a ticket with ESET support desk and they advised that I will need to un-install the Agent. the issue we have is that when trying to un-install the agent it does not accept the password that was set. We were then advised by ESET to boot the server in the safemode and then run the un-install, however our servers are provisioned on Azure Portal. I can reboot the servers into Safemode but Azure Portal does not have any means of a console session to login directly to the VM and un-install. I really need assistance as we have 10 VMs that have gone in this state that last updated in January Link to comment Share on other sites More sharing options...
Administrators Marcos 5,271 Posted March 1, 2019 Administrators Share Posted March 1, 2019 Just out of curiosity, did you try continuing with an empty password? Link to comment Share on other sites More sharing options...
rizaans 0 Posted March 1, 2019 Author Share Posted March 1, 2019 Hi Marcos, yes I did try without a password and still didn't work Link to comment Share on other sites More sharing options...
rizaans 0 Posted March 4, 2019 Author Share Posted March 4, 2019 is there any other way to -uninstall ESET agent besides booting the server into Safe-mode? Link to comment Share on other sites More sharing options...
mtrento 0 Posted March 19, 2019 Share Posted March 19, 2019 Hi, There is a method but you have to remove registry entries by hand. Fortunately i made a script partly based on informations i found on various internet sites and forums. I used this script to delete manually the agent since removing it from the console does not remove it completely. After executing it you can re install the agent or any other version but it will register itself as a new entry in the console the old entry must be also removed manually. Good Luck @echo off rem first try to start the official uninstall wmic product where name="ESET Management Agent" call uninstall /nointeractive rem manual delete of agent rem Use at your own risk sc stop EraAgentSvc sc delete EraAgentSvc del /F /S /Q "C:\Program Files\ESET\RemoteAdministrator\" del /F /S /Q "C:\ProgramData\ESET\RemoteAdministrator\" reg delete HKEY_LOCAL_MACHINE\SOFTWARE\ESET\RemoteAdministrator\Agent /f reg delete HKEY_CLASSES_ROOT\Installer\Products\8C5B454B78C542F49B5FA2A991F9805F /f reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\8C5B454B78C542F49B5FA2A991F9805F /f reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\ /v C:\Windows\Installer\{B454B5C8-5C87-4F24-B9F5-2A9A199F08F5}\ /f reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8C5B454B78C542F49B5FA2A991F9805F /f rem eset 6.5 reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B454B5C8-5C87-4F24-B9F5-2A9A199F08F5} /f rem agent ESET Management Agent 7.0.577.0 reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9BF80F33-FAA3-4F96-9CE6-ECCC808CA7BA} /F reg delete HKEY_CLASSES_ROOT\Installer\Features\8C5B454B78C542F49B5FA2A991F9805F /f reg delete HKEY_CLASSES_ROOT\Installer\UpgradeCodes\786A20824144DB1449FA500C3A98D88D /f reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\8C5B454B78C542F49B5FA2A991F9805F /f reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\786A20824144DB1449FA500C3A98D88D /f reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\786A20824144DB1449FA500C3A98D88D /f reg delete HKEY_CLASSES_ROOT\Installer\Products\33F08FB93AAF69F4C96ECECC08C87AAB /f reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\33F08FB93AAF69F4C96ECECC08C87AAB /f reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\33F08FB93AAF69F4C96ECECC08C87AAB /f reg delete "HKEY_CLASSES_ROOT\Installer\Products\07F21F149AF55F34494F355BE44BEE4C" /f reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\07F21F149AF55F34494F355BE44BEE4C" /f reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\07F21F149AF55F34494F355BE44BEE4C" /f reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{41F12F70-5FA9-43F5-94F4-53B54EB4EEC4}" /f Link to comment Share on other sites More sharing options...
Recommended Posts