Jump to content

K1000 script to uninstall Malwarebytes


Recommended Posts

I need to uninstall Malwarebytes on workstations here in our department via Kace, but the file unin00.exe is missing, is there another executable or method with Kace to uninstall silently?

Link to post
Share on other sites
10 minutes ago, Josefius said:

I need to uninstall Malwarebytes on workstations here in our department via Kace, but the file unin00.exe is missing, is there another executable or method with Kace to uninstall silently?

Are these Malwarebytes the stand alone consumer versions? Are just trying to uninstall and need to reinstall at a later time?

Link to post
Share on other sites
1 minute ago, Porthos said:

Are these Malwarebytes the stand alone consumer versions? Are just trying to uninstall and need to reinstall at a later time?

The trial or the free version, we just want to take them off for possible licensing issues.

Link to post
Share on other sites
1 minute ago, Josefius said:

The trial or the free version, we just want to take them off for possible licensing issues.

How many workstations? Are they domain connected?

Link to post
Share on other sites

Might want to try the following string.

C:\Program Files\Malwarebytes\Anti-Malware\mbuns.exe" /Uninstall /uselocalisvc MB

Link to post
Share on other sites
Just now, Josefius said:

Yes, it's on a domain and it's in a pool of about 350 workstations.

 

That is well over the small business exemption.
Good idea to remove.

1 minute ago, Porthos said:

Might want to try the following string.

C:\Program Files\Malwarebytes\Anti-Malware\mbuns.exe" /Uninstall /uselocalisvc MB

 

Link to post
Share on other sites
23 minutes ago, Porthos said:

 

That is well over the small business exemption.
Good idea to remove.

 

Yeah, I don't think all of those workstations have it installed, we want to make sure they aren't installed. Also, the script is still running, does it normally take awhile to finish?

Link to post
Share on other sites
1 minute ago, Josefius said:

Also, the script is still running, does it normally take awhile to finish?

All of the above advice is an educated guess based on the uninstall location. I have not personally had to do an uninstall that way as I do not manage networks like that.

I will have your post moved to the business section for more ideas.

 

 

Link to post
Share on other sites
  • Root Admin

Hello @Josefius

That is a very old file name from an older installer we used in the past. Can you please start Malwarebytes on one of the machines and get me the version number or run the following tool on one of them so that I can try to locate a tool to assist you.

 

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system.
You can check here if you're not sure if your computer is 32-bit or 64-bit

  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press the Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
  • The first time the tool is run, it also makes another log (Addition.txt). Please attach it to your reply as well.

Thank you

 

 

Link to post
Share on other sites

Thanks, I installed the latest version from the Malwarebytes website, I should have clarified, all the info I could find about a script mentions the older unins000.exe, I need a way to add a silent uninstall string to an executable that is with the distribution via K1000 Kace appliance. Thanks :)

Link to post
Share on other sites
  • Root Admin

I understand but if you have 300+ systems with the old version then I need to figure out which one you have installed because none of our current tools will address removing the old versions especially silent. But depending on the version I may be able to find a tool for you.

 

Link to post
Share on other sites
  • Root Admin

WARNING !! This removal tool should not be used on any current 4.x versions of Malwarebytes

Please try the following older tool on one of your computers to verify the removal woks as expected.

You can create a script that uses our older mbam-clean utility and send to the remote system.  You can download mbam-clean from the following link: https://downloads.malwarebytes.org/file/mbam_clean

There are two switches usable with the clean tool:

/silent
/silentnoreboot
 
If you do not use any switches with the script, the system will reboot after the utility runs. 
 
Link to post
Share on other sites
16 hours ago, Porthos said:

All of the above advice is an educated guess based on the uninstall location. I have not personally had to do an uninstall that way as I do not manage networks like that.

I will have your post moved to the business section for more ideas.

 

 

It fails, but the logs say it ran successfully:

 

Output Log

Running with credntials provided: domain [.] user [cisuser]
Creating process returned non-zero: C:\Program Files\Malwarebytes\Anti-Malware\\mbuns.exe /Uninstall /uselocalisvc MB: (0) The operation completed successfully.
Error Code: 0
Status Code: 1

Activity Log

verify - on_verify_success
verify - on_verify_failure
verify - launch_program
Launching program: 'C:\Program Files\Malwarebytes\Anti-Malware\\mbuns.exe' '/Uninstall /uselocalisvc MB' wait='true'

Debug Log

Running kbot: runkbot 229 1596204963
KBotScript::LogScriptInfo - Start
id=229 name=Uninstall Malwarebytes version=1596204962 type=policy
execute disconnected=false logged_off=true
execute events
KBotScript::LogScriptInfo - Finish
KBotScript::LogScriptInfo - Start
id=229 name=Uninstall Malwarebytes version=1596204962 type=policy
execute disconnected=false logged_off=true
execute events
KBotScript::LogScriptInfo - Finish
runkbot    ----- launching [path='C:\Program Files\Malwarebytes\Anti-Malware\' program='mbuns.exe' parms='/Uninstall /uselocalisvc MB' wait='true'] -----
Link to post
Share on other sites
15 hours ago, AdvancedSetup said:

WARNING !! This removal tool should not be used on any current 4.x versions of Malwarebytes

Please try the following older tool on one of your computers to verify the removal woks as expected.

You can create a script that uses our older mbam-clean utility and send to the remote system.  You can download mbam-clean from the following link: https://downloads.malwarebytes.org/file/mbam_clean

There are two switches usable with the clean tool:

/silent
/silentnoreboot
 
If you do not use any switches with the script, the system will reboot after the utility runs. 
 

I would love to try this, but I'm not sure if I can push that to every machine via Kace, I know I can upload dependencies to the appliance. I just don't have an example to compare it to, since we don't run executables from the appliance. 

Link to post
Share on other sites

 

@Josefius

I noticed you are browsing around other topics trying to find a solution for your issue. I suggest you find out what version of Malwarebytes is on these machines so a solution can be made for you. Not all versions of Malwarebytes are uninstalled the same.

If you can use Kace to "poll" the different workstations to find version numbers it would help us to assist you.

Edited by Porthos
Link to post
Share on other sites
9 minutes ago, AdvancedSetup said:

Great, glad you were able to resolve the issue. If you don't mind sharing the process used that might be helpful for others in the future.

Thank you for the status update @Josefius

 

The issue was with the K1000 scripting. I was able to get it working by using the wizard which prompted me for the software and the version. Navigating to  Scripting > Configuration Policies > Uninstall, it just tied everything together. When you create the script without the wizard it leaves a lot of things out.

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    No registered users viewing this page.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.