Steps to Uninstall ESET 6.5 from AWS EC2 Instance

[inflectra 0]

We had to uninstall ESET 6.5 from some AWS instances so that we could install ESET 7.1. However you cannot boot EC2 into Safe Mode, so we had to use the following process to detach the drive and remove the ESET drivers manually and then re-attach:

Steps to Uninstall ESET 6.5 from AWS EC2 Instance

Preconditions

·        You have a running EC2 instance with ESET 6.5

Steps

1.      Inside AWS Console

a.      Create an image from the current instance (or use a new server instance)

b.      Launch that other instance.

c.      Stop the first instance

d.      Go to EC2 > Volumes

e.      Detach the C: drive volume on the first instance

f.       Attach this volume to the second instance (using a different EBS block name), e.g. xvdf

2.      RDP into the second instance

3.      Launch Administrative Tools > Computer Management > Disk Management

a.      Locate the new drive (listed as offline)

b.      In the lower pane, open the context (right-click) menu for the left panel for the disk for the EBS volume. Choose Online.

c.      It will now become the new E: drive

4.      Delete the three .sys files listed in the registry files below

5.      Copy across the bootsect.exe utility from a Windows 10 machine to this new instance

6.      Run the ‘Make Attached Drive Bootable Batch Script’

7.      Make the Mounted Drive E: Offline again

8.      Disconnect from RDP (optional)

9.      Stop the second instance (optional)

10.   Detach the E: volume from the second EC2 instance and reattach to the first instance as root volume device (C:) – usually named /dev/sda1

11.   Start the first EC2 instance

12.   RDP into the first instance

13.   You should now be able to uninstall ESET from the Control Panel

Registry Keys to Delete Files For

·        HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ehdrv

o   \SystemRoot\system32\DRIVERS\ehdrv.sys

·        HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eamonm

o   \SystemRoot\system32\DRIVERS\eamonm.sys

·        HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\epfwwfpr

o   \SystemRoot\system32\DRIVERS\epfwwfpr.sys

 

Make Attached Drive Bootable Batch Script

C:\bootsect /nt60 E: /mbr

C:\windows\system32\bcdboot.exe E:\Windows /s E:

bcdedit /store E:\Boot\BCD /set {default} device partition=E:

bcdedit /store E:\Boot\BCD /set {default} osdevice partition=E:

bcdedit /store E:\Boot\BCD /set {bootmgr} device partition=E: