• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 605
  • Last Modified:

I need a script to automate the deletion of Norton AntiVirus from the Registry and from Windows Explorer.

I just spent over 2 hours doing this manually, and I don't want to do that again.

I need some way to navigate within the Registry, find "Norton" or "Symnatec" in Keys, Values or Data, then navigate back up to the key and delete it safely. It would be nice if the script also backed up the Registry as well.

I also need a script to navigate within Windows Explorer (or from the DOS prompt) to do the same for all folders and executables for "Norton" and "Symantec".

A Visual Basic script would be nice, as I am very familiar with VB. But any script which is already coded, and which could be modified, would be quite handy. I am a programmer, so I'd rather have the full source code, so that I can modify it, rather than a tool which only has a user interface. I don't have time to code it myself, so please help out. Thanks.
0
coderlen
Asked:
coderlen
3 Solutions
 
Rich RumbleSecurity SamuraiCommented:
Sites typically offer an uninstall tool, or can tell you where what is located on your hd/registry
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2004040815592148

There are also two tools here that fit your needs http://www.billsway.com/vbspage/ at least they will locate what your looking for
The uninstall file (that norton uses) should contain the information to completely remove the critical traces of the programs, and sometimes programs have an install.log file also.
And some additional VB/WMI examples can be found here
http://www.microsoft.com/technet/scriptcenter/scripts/os/registry/default.mspx
http://www.microsoft.com/technet/scriptcenter/scripts/apps/user/default.mspx

Regfind is built-in to xp, and might have to be installed from the resource kit on win2k I can't check right now.
regfind –p hkey_local_machine norton
regfind –p hkey_local_machine symantec (use regfind.exe /? for more options)
-rich



0
 
Chris DentPowerShell DeveloperCommented:

This is potentially the file system bit... it could be a lot neater and I'll make it so, just after I've been to the pub ;)

All setup to just echo, not to do any damage. I also set Program Files as the starting point for recursion.

If we use WMI to handle the registry section then it'll be pretty much identical to the file system section.

But is this the kind of thing you had in mind?

Chris


Option Explicit

' Constants

Const SEARCH_PATTERN_1 = "Symantec"
Const SEARCH_PATTERN_2 = "Norton"
Const TEXT_COMPARE = 1

' Variables

Dim objFileSystem, objShell, objFolder
Dim strPath, strDistinct, strProgramFiles
Dim booMatch
Dim arrPaths(), arrDistinct()
Dim intPaths, intDistinct

' Object Initialisation

Set objFileSystem = CreateObject("Scripting.FileSystemObject")
Set objShell = CreateObject("WScript.Shell")

'
' Functions
'

Sub FindFolder(objFolder)

      Dim objSubFolder

      For Each objSubFolder in objFolder.SubFolders
            If InStr(1, objSubFolder.Name, SEARCH_PATTERN_1, TEXT_COMPARE) <> 0 Then
                  intPaths = intPaths + 1
                  ReDim Preserve arrPaths(intPaths)
                  arrPaths(intPaths) = objSubFolder.Path
            End If
            If InStr(1, objSubFolder.Name, SEARCH_PATTERN_2, TEXT_COMPARE) <> 0 Then
                  intPaths = intPaths + 1
                  ReDim Preserve arrPaths(intPaths)
                  arrPaths(intPaths) = objSubFolder.Path
            End If
      Next

      For Each objSubFolder in objFolder.SubFolders
            FindFolder(objSubFolder)
      Next
End Sub


Sub FindDistinct(arrPaths)

      Dim intPatternOccurs

      For Each strPath in arrPaths
            intPatternOccurs = InStr(1, strPath, SEARCH_PATTERN_1, TEXT_COMPARE)
            If intPatternOccurs <> 0 Then
                  booMatch = FALSE
                  strPath = Mid(strPath, 1, (intPatternOccurs + Len(SEARCH_PATTERN_1) - 1))
                  For Each strDistinct in arrDistinct
                        If strPath = strDistinct Then
                              booMatch = TRUE
                        End If
                  Next
                  If booMatch = FALSE Then
                        intDistinct = intDistinct + 1
                        ReDim Preserve arrDistinct(intDistinct)
                        arrDistinct(intDistinct) = strPath
                  End If
            End If
            intPatternOccurs = InStr(1, strPath, SEARCH_PATTERN_2, TEXT_COMPARE)
            If intPatternOccurs <> 0 Then
                  booMatch = FALSE
                  strPath = Mid(strPath, 1, (intPatternOccurs + Len(SEARCH_PATTERN_2) - 1))
                  For Each strDistinct in arrDistinct
                        If strPath = strDistinct Then
                              booMatch = TRUE
                        End If
                  Next
                  If booMatch = FALSE Then
                        intDistinct = intDistinct + 1
                        ReDim Preserve arrDistinct(intDistinct)
                        arrDistinct(intDistinct) = strPath
                  End If
            End If
      Next
End Sub

'
' Main Code
'

strProgramFiles = objShell.ExpandEnvironmentStrings("%ProgramFiles%")
Set objFolder = objFileSystem.GetFolder(strProgramFiles)

intPaths = -1
intDistinct = -1

FindFolder(objFolder)
FindDistinct(arrPaths)

For Each strPath in arrDistinct
      wscript.echo "Deleting: " & strPath
'      Set objFolder = objFileSystem.GetFolder(strPath)
'      objFolder.Delete
'      Set objFolder = Nothing
Next
0
 
blue_zeeCommented:

Use this tool to cleanup your system of Norton/Symantec:

http://ca.huji.ac.il/bf/mcafee/NoNav.exe

NONAV is an unsupported Symantec tool for removing files and registry keys from Norton Antivirus / Symantec Antivirus. This is helpful for example when an upgrade from an older version fails and you need to prepare the machine for a clean re-installation.


The tool can be sent out to customers as long as they have been informed that nonav is an unsupported tool / without warranty and provided "as-is".

NONAV removes the following products from filesystem/registry:

NAV            Norton Antivirus 4.x / 5.x
NAVCE            Norton Antivirus Corporate Edition 7.0x 7.5x 7.6x
SAVCE            Symantec Antivirus Corporate Edition 8.0x 8.1x 9.x
SSC            Symantec System Center (from CE 7.x / 8.x / 9.x)
AMS            Alert Management System (from CE 7.x / 8.x / 9.x)
SCF            Symantec Client Firewall 5.x 7.x

NONAV can also be set to remove the following components:

Symevent drivers
LiveUpdate (1.5-2.0)
shared Virus Definitions
Central Quarantine Server / Quarantine Console

NONAV should leave other Symantec products alone on the machine but only very limited testing has been done on this.

PcAnywhere 10.5 / 11, Ghost 8.0/2003 and the Central Quarantine Server has been tested and appear to work fine after running nonav.

NONAV is designed to work on the following OS:

Windows 2003 Server
Windows XP
Windows 2000 Professional / Server
Windows NT4 Workstation / Server
Windows ME
Windows 98
Windows 95

Restart when finished.

Zee
0
Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

 
coderlenAuthor Commented:
blue_zee, your link http://ca.huji.ac.il/bf/mcafee/NoNav.exe is either dead, or not accessible from my system.
I found a link using Google:
http://home.utm.utoronto.ca/~keith/uninstaller/
which has everything needed for "nonav", including a zip file and a pdf file describing everything about nonav.
I almost feel like not giving you points because of the dead link, but it is Friday, so what the heck, you get points.

Chris-Dent, I like your VB script, so you get points, too.

richrumble, I appreciated the links to Microsoft examples. Not exactly what I had in mind, but I'm giving you points, too.

Here's how I awarded points:

richrumble, 50
blue_zee, 250 (Accepted Answer, Grade A)
Chris-Dent, 200

Thanks for the replies. I got the information I needed. You guys are great!
0
 
blue_zeeCommented:

>>but it is Friday, so what the heck<<

Friday, 13!

Thanks,

Zee
0
 
blue_zeeCommented:

It seems this little tool is playing hard to get.

The Zip on the link above requires a password...

If anyone needs it try this one, but I don't know for how long it will be available:

http://www.mickelson.org/files/zips/nonav.zip

So... GET IT NOW!
;-)

Zee
0

Featured Post

A Cyber Security RX to Protect Your Organization

Join us on December 13th for a webinar to learn how medical providers can defend against malware with a cyber security "Rx" that supports a healthy technology adoption plan for every healthcare organization.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now