Jump to content

Remote or unattended uninstall?


Recommended Posts

A department within my agency has insisted we remove Malware Bytes from their machines. Unfortunately this department is at a remote location so I'm looking for a solution to uninstalling remotely. Is there a command line uninstall that I could push via PowerShell? 

 

Does the unins000.exe have any parameters?

Link to post
Share on other sites

Hello Zarberg, and welcome to the forums!

 

 

You can create a script that uses our mbam-clean utilityand send to the remote system.  You can download MbamClean from here: http://downloads.malwarebytes.org/file/mbam_clean

 

There are two switches usable with the clean tool:

/silent
/silentnoreboot
 
If you do not use any switches with the script, the system will reboot after the utility runs. 
 
I hope this helps!  Please let us know if you have any other questions.
 
 
Thank you. 
Link to post
Share on other sites

 

Hello Zarberg, and welcome to the forums!

 

 

You can create a script that uses our mbam-clean utilityand send to the remote system.  You can download MbamClean from here: http://downloads.malwarebytes.org/file/mbam_clean

 

There are two switches usable with the clean tool:

/silent
/silentnoreboot
 
If you do not use any switches with the script, the system will reboot after the utility runs. 
 
I hope this helps!  Please let us know if you have any other questions.
 
 
Thank you. 

 

Just an FYI, the e-mail I got from Malwarebytes support contradicts what you say here:

 

"unfortunately there are no parameters that can be added to the executable file to customize its execution."

 

You might want to inform the support folks responding to e-mails that is incorrect.

 

Anyway, I greatly appreciate your help.

Link to post
Share on other sites

  • 4 months later...

A little late to help the original poster, but hopefully someone else will save some time.  I was getting irritated trying to find this solution on the Web or in these forums, but I found a working silent uninstall today. 

YES, there are switches for the unins000.exe file that are very helpful and non-standard!  
Try this:

"C:\program files\malwarebytes' anti-malware\unins000.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART

 

(change location for 64-bit OS to \program files (x86)\)

This worked beautifully for me.  As far as I can tell this is the standard uninstall file and location for all versions of MWB.  So you should be able to remove rogue installs of MWB by users with install permissions with it as well.

 


 

Link to post
Share on other sites

  • 2 months later...

Ever,

 

This works perfectly and I was able to incorporate this into a Labtech Malwarebytes uninstall script and also for our Malwarebytes MSP Deployment Script to remove existing versions before installing our own.  Thank you much better than the mbam clean which will close all processes and reboot the machine regardless of switches. 

Link to post
Share on other sites

  • 4 months later...

I built some cmdlets for PowerShell:

 

Function List-Programs {
    [cmdletbinding()]
    [cmdletbinding()]
    param(
    [parameter(ValueFromPipeline=$true,ValueFromPipelineByPropertyName=$true)]
    [string[]]$ComputerName = $env:computername            
    
    )            
    
    begin {
        $UninstallRegKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall"
        }            
    
    process {
        foreach($Computer in $ComputerName) {
            Write-Verbose "Working on $Computer"
            if(Test-Connection -ComputerName $Computer -Count 1 -ea 0) {
                $HKLM   = [microsoft.win32.registrykey]::OpenRemoteBaseKey('LocalMachine',$computer)
                $UninstallRef  = $HKLM.OpenSubKey($UninstallRegKey)
                $Applications = $UninstallRef.GetSubKeyNames()            
                                
                foreach ($App in $Applications) {
                    $AppRegistryKey  = $UninstallRegKey + "\\" + $App
                    $AppDetails   = $HKLM.OpenSubKey($AppRegistryKey)
                    $AppGUID   = $App
                    $AppDisplayName  = $($AppDetails.GetValue("DisplayName"))
                    $AppVersion   = $($AppDetails.GetValue("DisplayVersion"))
                    $AppPublisher  = $($AppDetails.GetValue("Publisher"))
                    $AppInstalledDate = $($AppDetails.GetValue("InstallDate"))
                    $AppUninstall  = $($AppDetails.GetValue("UninstallString"))
                    if(!$AppDisplayName) { continue }
                    $OutputObj = New-Object -TypeName PSobject
                    $OutputObj | Add-Member -MemberType NoteProperty -Name ComputerName -Value $Computer.ToUpper()
                    $OutputObj | Add-Member -MemberType NoteProperty -Name AppName -Value $AppDisplayName
                    $OutputObj | Add-Member -MemberType NoteProperty -Name AppVersion -Value $AppVersion
                    $OutputObj | Add-Member -MemberType NoteProperty -Name AppVendor -Value $AppPublisher
                    $OutputObj | Add-Member -MemberType NoteProperty -Name InstalledDate -Value $AppInstalledDate
                    $OutputObj | Add-Member -MemberType NoteProperty -Name UninstallKey -Value $AppUninstall
                    $OutputObj | Add-Member -MemberType NoteProperty -Name AppGUID -Value $AppGUID
                    $OutputObj# | Select ComputerName, DriveName
                    }
                }
            }
        }            
    
    end {}
    }

Function Uninstall-Program {
    [cmdletbinding()]
    param (
    [parameter(ValueFromPipeline=$true,ValueFromPipelineByPropertyName=$true)]
    [string]$ComputerName = $env:computername,
    [parameter(ValueFromPipeline=$true,ValueFromPipelineByPropertyName=$true,Mandatory=$true)]
    [string]$AppGUID
    )
    try {
        $returnval = ([WMICLASS]"\\$computerName\ROOT\CIMV2:win32_process").Create("msiexec `/x$AppGUID `/qn")
        }
    catch {
        write-error "Failed to trigger the uninstallation. Review the error message"
        $_
        exit
        }
    switch ($($returnval.returnvalue)){
        0 { "Uninstallation command triggered successfully" }
        2 { "You don't have sufficient permissions to trigger the command on $Computer" }
        3 { "You don't have sufficient permissions to trigger the command on $Computer" }
        8 { "An unknown error has occurred" }
        9 { "Path Not Found" }
        9 { "Invalid Parameter"}
        }
    }

function Uninstall-MBAM {
    param($computername)
    try
    {
        $AppGUID = (List-Programs -ComputerName $computername | where {$_.AppName -like "*Malwarebytes*"}).AppGUID
        Uninstall-Program -computername $computername -AppGUID $AppGUID
    }
    Catch
    {
        $ErrorMessage = $_.Exception.Message
        $FailedItem = $_.Exception.ItemName
        Write-Host "There was an error on $computername.`r`n$FailedItem`r`nMessage: $ErrorMessage"
        Break
    }
}

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.