-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathUltimate_Sophos_Removal.bat
1713 lines (1259 loc) · 87 KB
/
Ultimate_Sophos_Removal.bat
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
:: ---------------------- PREREQUISITES --------------------------
echo Ready to run this script?
pause
@setlocal EnableDelayedExpansion
:: Script cannot be run on servers
FOR /F "TOKENS=1,* DELIMS==" %%u IN ('WMIC OS GET CAPTION /VALUE') DO IF /I "%%u"=="Caption" SET vers=%%v
ECHO.%vers% | FIND /I "Microsoft Windows Server">Nul && (echo You cannot run this script on a server&pause&exit)
@setlocal DisableDelayedExpansion
:: Script must be run with elevation
openfiles>nul 2>&1
if %errorlevel% EQU 0 goto ElevatedTrue
echo Script NOT executed with administrative elevation
pause
exit
:ElevatedTrue
echo Script executed with administrative elevation
:: ----------------------- MAIN INDEX ----------------------------
:: This script is constructed to apply an order of operation for Sophos components and services as defined by Sophos company, as best as possible, from https://community.sophos.com/kb/en-us/122126 and https://community.sophos.com/kb/en-us/109668 . The application of this OOO in this script is not 100% perfect, but I tried my best to match the words of the Sophos company. Here is the OOO list that I have assembled based on these resources and some educated guesses (some Sophos products are missing from this list because I was unable to find resources on them):
:: Sophos Patch Agent
:: Sophos Compliance Agent / NAC / Network Access Compliance
:: Sophos Network Threat Protection / NTP / Endpoint / Server
:: Sophos System Protection / SSP
:: Sophos Client Firewall / SCF
:: Sophos Endpoint Firewall / Endpoint / Server
:: Sophos Anti-Virus Endpoint
:: Sophos Anti-Virus Server
:: Sophos Anti-Virus / SAV
:: Sophos Exploit Prevention / SEP
:: Sophos Remote Management System / RMS
:: Sophos Health / Endpoint / Server
:: Sophos Diagnostic Utility / Endpoint / Server
:: Sophos Management Communications System / MCS / Server
:: Sophos Management Communications System Endpoint
:: Sophos Management Console
:: Sophos Management Server
:: Sophos Management Database
:: Sophos [MCS?] Heartbeat
:: Sophos Endpoint Self Help / Endpoint / Server
:: Sophos Lockdown
:: Sophos File Scanner / Endpoint / Server
:: Sophos Standalone Engine / Endpoint / Server
:: Sophos ML Engine
:: Sophos Endpoint
:: Sophos Endpoint Agent
:: Sophos Clean / Endpoint / Server
:: Sophos AutoUpdate XG / Endpoint / Server
:: Sophos AutoUpdate / SAU
:: Sophos Endpoint Defense / SED / Endpoint / Server
:: HitmanPro / HMPA managed
:: HitmanPro
:: Others - Sophos Message Router
:: Others - Sophos Cache Manager / Update Manager
:: Others - Sophos Certification Manager
:: Others - Sophos Cloud AD Sync Utility
:: Others - Sophos Data Recorder
:: Others - Sophos File Integrity Monitoring
:: Others - Sophos Management Host
:: Others - Sophos Management Service
:: Others - Sophos Patch Endpoint Communicator
:: Others - Sophos Patch Endpoint Orchestrator
:: Others - Sophos Patch Server Communicator
:: Others - Sophos Policy Evaluation Service
:: Others - Sophos PureMessage
:: Others - Sophos PureMessage Web Agent
:: Others - Sophos PureMessage Running Object Table (ROT)
:: Others - Sophos PureMessage Content Extractor
:: Others - Sophos PureMessage Watchdog Agent
:: Others - Sophos PureMessage Scanner
:: Others - Sophos Encryption For Cloud Storage
:: Others - Sophos Central AD Sync Utility
:: Others - Sophos Virus Removal Tool
:: Others - Unknown
:: This script is not specifically targetting HitmanPro but includes some entries because of someone's Sophos removal script
:: Here is the general procedure we are following for removal of Sophos:
:: 1. Disable, gracefully stop, and forcefully stop "Sophos AutoUpdate Service" service (as advised at ttps://community.sophos.com/kb/en-us/109668)
:: 2. Perform graceful Sophos MSI/EXE uninstalls to allow the product the opportunity to properly remove itself
:: 3. Set all Sophos services to disabled
:: 4. Stop all Sophos services gracefully
:: 5. Kill all Sophos services by force
:: 6. Set all Sophos driver services to disabled
:: 7. Stop all Sophos driver services gracefully
:: 8. Kill all Sophos driver services by force
:: 9. Uninstall all Sophos driver services via INF files
:: 10. Kill all Sophos processes by force
:: 11. Repeat steps 1-10 (we attempted graceful uninstall outright, this time we will retry gracefull uninstall but with all services and processes stopped and some drivers unhooked. We haven't deleted anything yet!)
:: 12. Delete all Sophos services
:: 13. Delete all Sophos driver services
:: 14. Unregister EXEs to known Sophos files (/UnRegServer and -Uninstall methods)
:: 15. Unregister DLLs to known Sophos files (REGSVR32 method)
:: 16. Kill all Sophos processes by force
:: 17. Delete all Sophos registry keys and values
:: 18. Nuke all Sophos folders and files from orbit
:: 19. Repeat steps 1-18 (if something still lingers on the system by this point in time then there is a possibility that rerunning all the steps one last time will annihilate them. Ultimately, a reboot will be necessary to confirm that the system comes back online and to allow PendingFileRenameOperations to do its thing for remaining files)
:: This script was put together through extremely thorough research and analysis of/using:
:: - SysInternals Autoruns, Process Explorer, and Process Monitor
:: - Search Everything
:: - RevoUninstaller Pro install/uninstall logs
:: - MSI GUID, Service Name, Service Display Name, Install Path, and Uninstall String search from RMM system of 11000 agents
:: - Probably more than 10 different Sophos removal scripts found via Googling
:: - More than 40 hours of time
set TryAgain=TRUE
set OneLastTime=TRUE
:TryAgain
call :proxy Prerequisites
call :proxy Uninstall
call :proxy Services
if "%TryAgain%"=="TRUE" (set TryAgain=FALSE&goto :TryAgain)
:: Uncomment the next two lines + the 'pause' under labels :proxy and :proxytwo to aide with debugging
::echo You should have seen MSI stuff happen twice
::pause
call :proxytwo Unregister
call :proxytwo Deletion
:: The purpose of OneLastTime is to do one last round for the absolutely stubborn files
if "%OneLastTime%"=="TRUE" (set OneLastTime=FALSE&goto :TryAgain)
echo Script is at the end of the line and has finished
pause
exit
:: ---------------------------- CHAPTERS -----------------------------
:Prerequisites
:: The first order of operation is to stop and cripple the AutoUpdate service as instructed at https://community.sophos.com/kb/en-us/109668
:: Sophos AutoUpdate Service
sc config "Sophos AutoUpdate Service" start= disabled
net stop "Sophos AutoUpdate Service"
taskkill /T /F /IM "ALsvc.exe"
sc delete "Sophos AutoUpdate Service"
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Sophos AutoUpdate Service" /f
exit /b 0
:Uninstall
:: The second thing we are going to do is try to uninstall all Sophos products gracefully and let them complete most of the removal work.
:: The sources of some GUIDs (not in any particular order):
:: (1) https://community.sophos.com/products/endpoint-security-control/f/sophos-endpoint-software/93514/endpoint-agent-installation/338867?pi2147=246
:: (2) https://www.itninja.com/software/sophos/anti-virus/7-201
:: (3) https://kc.mcafee.com/corporate/index?page=content&id=KB85522&locale=en_SG&viewlocale=en_SG
:: (4) https://gist.github.com/Coopeh/8470068
:: (5) https://rmccurdy.com/scripts/SOSO.txt
:: (6) Personally examining a virtual machine with Sophos Endpoint Agent installed using tools RevoUninstaller, Autoruns, Everything, Process Explorer
:: (7) And scripts written by others
:: Sophos Patch Agent
call :msiexec "{2FB80981-C6B6-4FCA-BC65-24437DF4C8CB}"
call :msiexec "{29006785-9EF7-4E84-ABE8-6244D12E7909}"
call :msiexec "{391530CF-3500-404D-867C-42514304917A}"
call :msiexec "{5565E71F-091B-42B8-8514-7E8944860BFD}"
:: Sophos Compliance Agent / NAC / Network Access Compliance
call :msiexec "{486FEABF-70EB-48C1-9C35-700B74A8EBE6}"
call :msiexec "{8BCFF7E3-E241-4230-BB5D-A6676E840F65}"
call :msiexec "{79406B81-26C4-4EAA-8CE2-5637B3279AC2}"
call :msiexec "{53613148-723B-4EF2-B45E-21F2BE0C0DB3}"
call :msiexec "{1A7EE8FF-391D-4030-8021-5F560189B87F}"
call :msiexec "{8BD17D77-227B-4CF6-BC9A-4304F569D8E9}"
:: Sophos Network Threat Protection / NTP / Endpoint / Server
call :msiexec "{604350BF-BE9A-4F79-B0EB-B1C22D889E2D}"
call :msiexec "C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos Network Threat Protection.msi"
call :msiexec "{66967E5F-43E8-4402-87A4-04685EE5C2CB}"
:: Sophos System Protection / SSP
call :msiexec "{934BEF80-B9D1-4A86-8B42-D8A6716A8D27}"
call :msiexec "{1093B57D-A613-47F3-90CF-0FD5C5DCFFE6}"
:: Sophos Client Firewall / SCF
call :msiexec "{12C00299-B8B4-40D3-9663-66ABEA3198AB}"
call :msiexec "{17071117-5BB2-4737-B05B-C5FABD367313}"
:: Sophos Endpoint Firewall / Endpoint / Server
call :msiexec "{2831282D-8519-4910-B339-2302840ABEF3}"
call :msiexec "C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\efw64\Sophos Endpoint Firewall.msi"
:: Sophos Anti-Virus Endpoint
call :msiexec "{8123193C-9000-4EEB-B28A-E74E779759FA}"
call :msiexec "{36333618-1CE1-4EF2-8FFD-7F17394891CE}"
call :msiexec "{DFDA2077-95D0-4C5F-ACE7-41DA16639255}"
call :msiexec "{CA3CE456-B2D9-4812-8C69-17D6980432EF}"
call :msiexec "{CA524364-D9C5-4804-92DE-2800BDAC1AA4}"
call :msiexec "{3B998572-90A5-4D61-9022-00B288DD755D}"
call :msiexec "{4BAF6F55-FFE4-4A3A-8367-CC2EBB0F11C3}"
call :msiexec "{BA8752FE-75E5-43DD-9913-23509EFEB409}"
call :msiexec "{034759DA-E21A-4795-BFB3-C66D17FAD183}"
call :msiexec "{9ACB414D-9347-40B6-A453-5EFB2DB59DFA}"
:: Sophos Anti-Virus Server
call :msiexec "{72E30858-FC95-4C87-A697-670081EBF065}"
call :msiexec "{2519A41E-5D7C-429B-B2DB-1E943927CB3D}"
call :msiexec "{6654537D-935E-41C0-A18A-C55C2BF77B7E}"
:: Sophos Anti-Virus / SAV
call :msiexec "{6CA90A07-433B-4859-A785-006771D72109}"
call :msiexec "C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\savxp\Sophos Anti-Virus.msi"
call :msiexec "{09C6BF52-6DBA-4A97-9939-B6C24E4738BF}"
call :msiexec "{09863DA9-7A9B-4430-9561-E04D178D7017}"
call :msiexec "{23E4E25E-E963-4C62-A18A-49C73AA3F963}"
call :msiexec "{65323B2D-83D4-470D-A209-D769DB30BBDB}"
call :msiexec "{C4EDC7DA-3AF8-4E99-ACAC-4C1A70F88CFB}"
call :msiexec "{D929B3B5-56C6-46CC-B3A3-A1A784CBB8E4}"
:: Sophos Exploit Prevention / SEP
:: Sophos Remote Management System / RMS
call :msiexec "{FED1005D-CBC8-45D5-A288-FFC7BB304121}"
call :msiexec "{FF11005D-CBC8-45D5-A288-25C7BB304121}"
:: Sophos Health / Endpoint / Server
call :msiexec "{E44AF5E6-7D11-4BDF-BEA8-AA7AE5FE6745}"
call :msiexec "C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\shs\Sophos Health.msi"
call :msiexec "{A5CCEEF1-B6A7-4EB4-A826-267996A62A9E}"
call :msiexec "{D5BC54B8-1DA1-44F4-AE6F-86E05CDB0B44}"
:: Sophos Diagnostic Utility / Endpoint / Server
call :msiexec "{4627F5A1-E85A-4394-9DB3-875DF83AF6C2}"
call :msiexec "C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\sdu\Sophos Diagnostic Utility.msi"
:: "C:\Program Files (x86)\Sophos\Sophos Diagnostic Utility\setup.exe" remove
:: "C:\Program Files\Sophos\Sophos Diagnostic Utility\setup.exe" remove
:: Sophos Management Communications System / MCS / Server
call :msiexec "{A1DC5EF8-DD20-45E8-ABBD-F529A24D477B}"
call :msiexec "{1FFD3F20-5D24-4C9A-B9F6-A207A53CF179}"
call :msiexec "{D875F30C-B469-4998-9A08-FE145DD5DC1A}"
call :msiexec "{2C14E1A2-C4EB-466E-8374-81286D723D3A}"
:: Sophos Management Communications System Endpoint
"C:\Program Files\Sophos\Management Communication System\Endpoint\uninstall.exe" /uninstall /quiet
"C:\Program Files\Sophos\Management Communications System\Endpoint\uninstall.exe" /uninstall /quiet
"C:\Program Files (x86)\Sophos\Management Communication System\Endpoint\uninstall.exe" /uninstall /quiet
"C:\Program Files (x86)\Sophos\Management Communications System\Endpoint\uninstall.exe" /uninstall /quiet
:: Sophos Management Console
call :msiexec "{6D313E00-539A-4EDC-913B-0B1B349D1860}"
call :msiexec "{FC2876E5-3698-4534-A126-52792C4F0350}"
:: Sophos Management Server
call :msiexec "{9BCC5C9E-94B6-40CA-A025-2A33C78256C6}"
call :msiexec "{E9366D3F-ED09-42D1-BAFF-1EF2E3BF8A37}"
:: Sophos Management Database
call :msiexec "{8A911FCC-F927-4CEA-8B0B-C72BEFEA1034}"
call :msiexec "{E3C70B2C-0549-4F4C-87BE-B3D0EBDDAF26}"
:: Sophos [MCS?] Heartbeat
call :msiexec "{DFFA9361-3625-4219-82C2-9EF011E433B1}"
:: Sophos Endpoint Self Help / Endpoint / Server
call :msiexec "{9F69FA12-E3FE-4754-B7E3-B4DEEC8F6B5D}"
call :msiexec "{4EFCDD15-24A2-4D89-84A4-857D1BF68FA8}"
call :msiexec "{BB36D9C2-6AE5-4AB2-BC91-ECD247092BD8}"
:: Sophos Lockdown
call :msiexec "{77F92E90-ED4F-4CFF-8F60-3E3E4AEB705C}"
:: Sophos File Scanner / Endpoint / Server
"C:\Program Files\Sophos\Sophos File Scanner\Uninstall.exe"
"C:\Program Files (x86)\Sophos\Sophos File Scanner\Uninstall.exe"
:: Sophos Standalone Engine / Endpoint / Server
"C:\Program Files\Sophos\Sophos Standalone Engine\uninstall.exe"
"C:\Program Files (x86)\Sophos\Sophos Standalone Engine\uninstall.exe"
:: Sophos ML Engine
"C:\Program Files\Sophos\Sophos ML Engine\uninstall.exe"
"C:\Program Files (x86)\Sophos\Sophos ML Engine\uninstall.exe"
:: Sophos Endpoint
call :msiexec "{D29542AE-287C-42E4-AB28-3858E13C1A3E}"
:: Sophos Endpoint Agent
call :msiexec "C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ui64\Sophos UI.msi"
:: This pops up a GUI message + the message may be "The computer must be restarted before Sophos Endpoint Agent can be uninstalled."
::"C:\Program Files\Sophos\Sophos Endpoint Agent\uninstallgui.exe"
::"C:\Program Files (x86)\Sophos\Sophos Endpoint Agent\uninstallgui.exe"
:: This is better! If we temporarily remove PendingFileRenameOperations AND use uninstallcli.exe, no GUI + removal succeeds!
(reg copy "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" "HKLM\SYSTEM\CurrentControlSet\Control\_TMP_SMGR")&&((for /f "tokens=1" %%a in ('reg query "HKLM\SYSTEM\CurrentControlSet\Control\_TMP_SMGR" ^| find /V "PendingFileRenameOperations" ^| find /V "HKEY_LOCAL_MACHINE"') do @(reg delete "HKLM\SYSTEM\CurrentControlSet\Control\_TMP_SMGR" /v "%%~a" /f))® delete "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v PendingFileRenameOperations /f)||(echo Could not copy registry key)
"C:\Program Files\Sophos\Sophos Endpoint Agent\uninstallcli.exe"
"C:\Program Files (x86)\Sophos\Sophos Endpoint Agent\uninstallcli.exe"
reg copy "HKLM\SYSTEM\CurrentControlSet\Control\_TMP_SMGR" "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /f
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\_TMP_SMGR" /f
:: Sophos Clean / Endpoint / Server
"C:\Program Files\Sophos\Clean\uninstall.exe"
"C:\Program Files (x86)\Sophos\Clean\uninstall.exe"
:: Sophos AutoUpdate XG / Endpoint / Server
:: Sophos AutoUpdate / SAU
call :msiexec "C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\sau\Sophos AutoUpdate.msi"
call :msiexec "{72E136F7-3751-422E-AC7A-1B2E46391909}"
call :msiexec "{7CD26A0C-9B59-4E84-B5EE-B386B2F7AA16}"
call :msiexec "{BCF53039-A7FC-4C79-A3E3-437AE28FD918}"
call :msiexec "{9D1B8594-5DD2-4CDC-A5BD-98E7E9D75520}"
call :msiexec "{AFBCA1B9-496C-4AE6-98AE-3EA1CFF65C54}"
call :msiexec "{E82DD0A8-0E5C-4D72-8DDE-41BB0FC06B3E}"
call :msiexec "{15C418EB-7675-42be-B2B3-281952DA014D}"
call :msiexec "{C12953C2-4F15-4A6C-91BC-511B96AE2775}"
call :msiexec "{856A0B42-457D-4BD9-B795-6F942370CA6D}"
:: Sophos Endpoint Defense / SED / Endpoint / Server
"C:\Program Files\Sophos\Endpoint Defense\uninstall.exe"
"C:\Program Files (x86)\Sophos\Endpoint Defense\uninstall.exe"
:: HitmanPro / HMPA managed
"C:\Program Files\HitmanPro.Alert\hmpalert.exe" /uninstall /quiet
"C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe" /uninstall /quiet
:: HitmanPro
"C:\Program Files\HitmanPro.Alert\uninstall.exe"
"C:\Program Files (x86)\HitmanPro.Alert\uninstall.exe"
"C:\Program Files\HitmanPro\HitmanPro.exe" /uninstall /quiet
"C:\Program Files (x86)\HitmanPro\HitmanPro.exe" /uninstall /quiet
:: Others - Sophos Message Router
:: Others - Sophos Cache Manager / Update Manager
call :msiexec "{2C7A82DB-69BC-4198-AC26-BB862F1BE4D0}"
:: Others - Sophos Certification Manager
:: Others - Sophos Cloud AD Sync Utility
call :msiexec "{94A64BF2-0EFC-47EE-9376-0D14E67A2696}"
:: Others - Sophos Data Recorder
:: Others - Sophos File Integrity Monitoring
:: Others - Sophos Management Host
:: Others - Sophos Management Service
:: Others - Sophos Patch Endpoint Communicator
:: Others - Sophos Patch Endpoint Orchestrator
:: Others - Sophos Patch Server Communicator
:: Others - Sophos Policy Evaluation Service
:: Others - Sophos PureMessage
call :msiexec "{946A74A2-D92E-40CE-B3C5-C6174EC6287D}"
:: Others - Sophos PureMessage Web Agent
:: Others - Sophos PureMessage Running Object Table (ROT)
:: Others - Sophos PureMessage Content Extractor
:: Others - Sophos PureMessage Watchdog Agent
:: Others - Sophos PureMessage Scanner
:: Others - Sophos Encryption For Cloud Storage
:: Others - Sophos Central AD Sync Utility
call :msiexec "{84791325-FCDA-429C-85E1-4167EFB2708F}"
:: Others - Sophos SafeGuard (THIS IS THE ONLY ENTRY FOR THIS APPLICATION IN THIS SCRIPT)
call :msiexec "{957BE63D-2202-4618-BA64-12115A1F8C93}"
call :msiexec "{23140C44-685A-4525-B0E1-FCAA33E89805}"
call :msiexec "{7AA09D93-47ED-470F-BE41-53E0D9D8D87F}"
call :msiexec "{67090957-0E4D-4CE2-93E6-22F98DCE1D26}"
call :msiexec "{E42A36EA-F3F8-49C8-9E0E-0E87CDACAF69}"
call :msiexec "{D102EA66-BFC5-44B6-A371-54FAF5A1B27B}"
:: Others - Sophos SSL VPN Client 2.1 (THIS IS THE ONLY ENTRY FOR THIS APPLICATION IN THIS SCRIPT)
:: "C:\Program Files\Sophos\Sophos SSL VPN Client\Uninstall.exe"
:: "C:\Program Files (x86)\Sophos\Sophos SSL VPN Client\Uninstall.exe"
:: Others - Sophos Virus Removal Tool
call :msiexec "{B829E117-D072-41EA-9606-9826A38D34C1}"
:: Others - Unknown
timeout /t 15 /nobreak
exit /b 0
:Services
call :proxy Services_Disable
call :proxy Services_Stop
call :proxy Services_StopForce
call :proxy Drivers
if "%TryAgain%"=="TRUE" (exit /b 0)
call :proxy Services_Deletion
exit /b 0
:Drivers
call :proxy DriverServices_Disable
call :proxy DriverServices_Stop
call :proxy ProcessesAll_StopForce
call :proxy DriverServices_Uninstall
if "%TryAgain%"=="TRUE" (exit /b 0)
call :proxy DriverServices_Deletion
call :proxy ProcessesAll_StopForce
exit /b 0
:Unregister
call :proxytwo Uninstall_Unreg
call :proxytwo Uninstall_Regsvr
call :proxytwo ProcessesAll_StopForce
exit /b 0
:Deletion
call :proxytwo ScheduledTasks_Deletion
call :proxytwo Registry_Deletion
call :proxytwo Filesystem_Deletion
exit /b 0
:: --------------------------- SUBCHAPTERS ---------------------------
:Services_Disable
:: Graceful attempts of removal are now over. *cracks knuckles* You had your chance, Sophos! The next step is to disable services.
:: Sophos Patch Agent
call :sc_disable "Sophos Patch Agent"
:: Sophos Compliance Agent / NAC / Network Access Compliance
call :sc_disable "Sophos Compliance Agent API"
:: Sophos Network Threat Protection / NTP / Endpoint / Server
call :sc_disable "SntpService"
call :sc_disable "Sophos Network Threat Protection"
:: Sophos System Protection / SSP
call :sc_disable "Sophos System Protection Service"
call :sc_disable "sophossps"
:: Sophos Client Firewall / SCF
call :sc_disable "Sophos Client Firewall Manager"
call :sc_disable "Sophos Client Firewall"
:: Sophos Endpoint Firewall / Endpoint / Server
:: Sophos Anti-Virus / SAV / Endpoint / Server
call :sc_disable "SAVAdminService"
call :sc_disable "Sophos Anti-Virus status reporter"
call :sc_disable "SAVService"
call :sc_disable "Sophos Device Control Service"
call :sc_disable "Sophos Safestore Service"
call :sc_disable "Sophos Safestore"
call :sc_disable "Sophos Web Control Service"
:: Didn't really fall anywhere else - Sophos Web Filter
call :sc_disable "swi_filter"
call :sc_disable "swi_fc"
:: Didn't really fall anywhere else - Sophos Web Intelligence Service
call :sc_disable "swi_service"
call :sc_disable "Sophos Web Intelligence Service"
:: Didn't really fall anywhere else - Sophos Web Intelligence Updater
call :sc_disable "Sophos Web Intelligence Updater"
call :sc_disable "Sophos Web Intelligence Update"
call :sc_disable "swi_update"
call :sc_disable "swi_update_64"
:: Extras
call :sc_disable "Sophos Anti-Virus"
:: Sophos Exploit Prevention / SEP
:: Sophos Remote Management System / RMS
:: Sophos Health / Endpoint / Server
call :sc_disable "Sophos Health Service"
:: Sophos Diagnostic Utility / Endpoint / Server
:: Sophos Management Communications System / MCS / Endpoint / Server
call :sc_disable "Sophos MCS Agent"
call :sc_disable "Sophos MCS Client"
:: Sophos [MCS?] Heartbeat
call :sc_disable "Sophos MCS Heartbeat"
:: Sophos Endpoint Self Help / Endpoint / Server
:: Sophos Lockdown
:: Sophos File Scanner / Endpoint / Server
call :sc_disable "Sophos File Scanner Service"
:: Sophos Standalone Engine / Endpoint / Server
:: Sophos ML Engine
:: Sophos Endpoint / Agent
call :sc_disable "Sophos Agent"
:: Sophos Clean / Endpoint / Server
call :sc_disable "Sophos Clean Service"
call :sc_disable "Sophos Clean"
:: Sophos AutoUpdate XG / Endpoint / Server
:: Sophos AutoUpdate / SAU
call :sc_disable "Sophos AutoUpdate Service"
:: Sophos Endpoint Defense / SED / Endpoint / Server
call :sc_disable "Sophos Endpoint Defense Service"
:: HitmanPro / HMPA managed
:: HitmanPro
:: Others - Sophos Message Router
call :sc_disable "Sophos Message Router"
:: Others - Sophos Cache Manager / Update Manager
call :sc_disable "Sophos Cache Manager"
call :sc_disable "Sophos Update Cache"
call :sc_disable "SUM"
:: Others - Sophos Certification Manager
call :sc_disable "Sophos Certification Manager"
:: Others - Sophos Cloud AD Sync Utility
call :sc_disable "Sophos Cloud AD Sync Utility"
:: Others - Sophos Data Recorder
call :sc_disable "SophosDataRecorderService"
:: Others - Sophos File Integrity Monitoring
call :sc_disable "SophosFIM"
:: Others - Sophos Management Host
call :sc_disable "SophosManagementHostService"
:: Others - Sophos Management Service
call :sc_disable "Sophos Management Service"
:: Others - Sophos Patch Endpoint Communicator
call :sc_disable "SophosPatchEndpointCommunicator"
:: Others - Sophos Patch Endpoint Orchestrator
call :sc_disable "SophosPatchOrchestratorService"
:: Others - Sophos Patch Server Communicator
call :sc_disable "SophosPatchServerCommunicator"
:: Others - Sophos Policy Evaluation Service
call :sc_disable "Sophos Policy Evaluation Service"
:: Others - Sophos PureMessage
call :sc_disable "SavexSrvc"
:: Others - Sophos PureMessage Web Agent
call :sc_disable "SavexWebAgent"
:: Others - Sophos PureMessage Running Object Table (ROT)
call :sc_disable "MMRot"
:: Others - Sophos PureMessage Content Extractor
call :sc_disable "PMContExtrSvc"
:: Others - Sophos PureMessage Watchdog Agent
call :sc_disable "PMEVizsla"
:: Others - Sophos PureMessage Scanner
call :sc_disable "PMScanner"
:: Others - Sophos Encryption For Cloud Storage
call :sc_disable "SGNCloudEncService"
:: Others - Sophos Central AD Sync Utility
call :sc_disable "Sophos Central AD Sync Utility"
:: Others - Unknown
call :sc_disable "sweepupdate"
call :sc_disable "sweepnet"
timeout /t 15 /nobreak
exit /b 0
:Services_Stop
:: The next step is to stop services
:: Sophos Patch Agent
sc stop "Sophos Patch Agent"
:: Sophos Compliance Agent / NAC / Network Access Compliance
sc stop "Sophos Compliance Agent API"
:: Sophos Network Threat Protection / NTP / Endpoint / Server
sc stop "SntpService"
sc stop "Sophos Network Threat Protection"
:: Sophos System Protection / SSP
sc stop "Sophos System Protection Service"
sc stop "sophossps"
:: Sophos Client Firewall / SCF
sc stop "Sophos Client Firewall Manager"
sc stop "Sophos Client Firewall"
:: Sophos Endpoint Firewall / Endpoint / Server
:: Sophos Anti-Virus / SAV / Endpoint / Server
sc stop "SAVAdminService"
sc stop "Sophos Anti-Virus status reporter"
sc stop "SAVService"
sc stop "Sophos Device Control Service"
sc stop "Sophos Safestore Service"
sc stop "Sophos Safestore"
sc stop "Sophos Web Control Service"
:: Didn't really fall anywhere else - Sophos Web Filter
sc stop "swi_filter"
sc stop "swi_fc"
:: Didn't really fall anywhere else - Sophos Web Intelligence Service
sc stop "swi_service"
sc stop "Sophos Web Intelligence Service"
:: Didn't really fall anywhere else - Sophos Web Intelligence Updater
sc stop "Sophos Web Intelligence Updater"
sc stop "Sophos Web Intelligence Update"
sc stop "swi_update"
sc stop "swi_update_64"
:: Extras
sc stop "Sophos Anti-Virus"
:: Sophos Exploit Prevention / SEP
:: Sophos Remote Management System / RMS
:: Sophos Health / Endpoint / Server
sc stop "Sophos Health Service"
:: Sophos Diagnostic Utility / Endpoint / Server
:: Sophos Management Communications System / MCS / Endpoint / Server
sc stop "Sophos MCS Agent"
sc stop "Sophos MCS Client"
:: Sophos [MCS?] Heartbeat
sc stop "Sophos MCS Heartbeat"
:: Sophos Endpoint Self Help / Endpoint / Server
:: Sophos Lockdown
:: Sophos File Scanner / Endpoint / Server
sc stop "Sophos File Scanner Service"
:: Sophos Standalone Engine / Endpoint / Server
:: Sophos ML Engine
:: Sophos Endpoint / Agent
sc stop "Sophos Agent"
:: Sophos Clean / Endpoint / Server
sc stop "Sophos Clean Service"
sc stop "Sophos Clean"
:: Sophos AutoUpdate XG / Endpoint / Server
:: Sophos AutoUpdate / SAU
sc stop "Sophos AutoUpdate Service"
:: Sophos Endpoint Defense / SED / Endpoint / Server
sc stop "Sophos Endpoint Defense Service"
:: HitmanPro / HMPA managed
:: HitmanPro
:: Others - Sophos Message Router
sc stop "Sophos Message Router"
:: Others - Sophos Cache Manager / Update Manager
sc stop "Sophos Cache Manager"
sc stop "Sophos Update Cache"
sc stop "SUM"
:: Others - Sophos Certification Manager
sc stop "Sophos Certification Manager"
:: Others - Sophos Cloud AD Sync Utility
sc stop "Sophos Cloud AD Sync Utility"
:: Others - Sophos Data Recorder
sc stop "SophosDataRecorderService"
:: Others - Sophos File Integrity Monitoring
sc stop "SophosFIM"
:: Others - Sophos Management Host
sc stop "SophosManagementHostService"
:: Others - Sophos Management Service
sc stop "Sophos Management Service"
:: Others - Sophos Patch Endpoint Communicator
sc stop "SophosPatchEndpointCommunicator"
:: Others - Sophos Patch Endpoint Orchestrator
sc stop "SophosPatchOrchestratorService"
:: Others - Sophos Patch Server Communicator
sc stop "SophosPatchServerCommunicator"
:: Others - Sophos Policy Evaluation Service
sc stop "Sophos Policy Evaluation Service"
:: Others - Sophos PureMessage
sc stop "SavexSrvc"
:: Others - Sophos PureMessage Web Agent
sc stop "SavexWebAgent"
:: Others - Sophos PureMessage Running Object Table (ROT)
sc stop "MMRot"
:: Others - Sophos PureMessage Content Extractor
sc stop "PMContExtrSvc"
:: Others - Sophos PureMessage Watchdog Agent
sc stop "PMEVizsla"
:: Others - Sophos PureMessage Scanner
sc stop "PMScanner"
:: Others - Sophos Encryption For Cloud Storage
sc stop "SGNCloudEncService"
:: Others - Sophos Central AD Sync Utility
sc stop "Sophos Central AD Sync Utility"
:: Others - Unknown
sc stop "sweepupdate"
sc stop "sweepnet"
timeout /t 15 /nobreak
exit /b 0
:Services_StopForce
:: The next step is to forcibly terminate running services
:: Others - Unknown (moved to be the first item as a special exception because a lot of these are executables not found anywhere)
taskill /T /F /IM "sweepupdate.exe" /IM "sweepnet.exe" /IM "backgroundscanclient.exe" /IM "sav32cli.exe" /IM "savcleanupservice.exe" /IM "savmain.exe" /IM "savprogress.exe" /IM "savproxy.exe" /IM "sdcdevcon.exe" /IM "wscclient.exe" /IM "clientmrinit.exe" /IM "emlibupdateagentnt.exe" /IM "agentapi.exe" /IM "autoupdateagentnt.exe" /IM "agentasst.exe" /IM "alupdate.exe" /IM "scfmanager.exe"
:: Sophos Patch Agent
taskkill /T /F /IM "spa.exe"
:: Sophos Compliance Agent / NAC / Network Access Compliance
:: Sophos Network Threat Protection / NTP / Endpoint / Server
taskkill /T /F /IM "SntpService.exe"
:: Sophos System Protection / SSP
taskkill /T /F /IM "SSPService.exe" /IM "ssp.exe"
:: Sophos Client Firewall / SCF
taskkill /T /F /IM "SCFManager.exe" /IM "SCFService.exe"
:: Sophos Endpoint Firewall / Endpoint / Server
:: Sophos Anti-Virus / SAV / Endpoint / Server
taskkill /T /F /IM "SAVAdminService.exe" /IM "SavService.exe" /IM "sdcservice.exe" /IM "Safestore.exe" /IM "Safestore64.exe" /IM "swc_service.exe" /IM "swi_filter.exe" /IM "swi_service.exe" /IM "swi_update.exe" /IM "swi_update_64.exe" /IM "swi_fc.exe"
:: Sophos Exploit Prevention / SEP
:: Sophos Remote Management System / RMS
:: Sophos Health / Endpoint / Server
taskkill /T /F /IM "Health.exe"
:: Sophos Diagnostic Utility / Endpoint / Server
:: Sophos Management Communications System / MCS / Endpoint / Server
taskkill /T /F /IM "McsAgent.exe" /IM "McsClient.exe"
:: Sophos [MCS?] Heartbeat
taskkill /T /F /IM "Heartbeat.exe"
:: Sophos Endpoint Self Help / Endpoint / Server
:: Sophos Lockdown
:: Sophos File Scanner / Endpoint / Server
taskkill /T /F /IM "SophosFS.exe"
:: Sophos Standalone Engine / Endpoint / Server
:: Sophos ML Engine
:: Sophos Endpoint / Agent
taskkill /T /F /IM "Sophos UI.exe" /IM "ManagementAgentNT.exe"
:: Sophos Clean / Endpoint / Server
taskkill /T /F /IM "Clean.exe"
:: Sophos AutoUpdate XG / Endpoint / Server
:: Sophos AutoUpdate / SAU
taskkill /T /F /IM "ALsvc.exe" /IM "almon.exe"
:: Sophos Endpoint Defense / SED / Endpoint / Server
taskkill /T /F /IM "SEDService.exe"
:: HitmanPro / HMPA managed
:: HitmanPro
:: Others - Sophos Message Router
taskkill /T /F /IM "RouterNT.exe"
:: Others - Sophos Cache Manager / Update Manager
taskkill /T /F /IM "UpdateCacheService.exe" /IM "SUMService.exe"
:: Others - Sophos Certification Manager
taskkill /T /F /IM "CertificationManagerServiceNT.exe"
:: Others - Sophos Cloud AD Sync Utility
taskkill /T /F /IM "SophosADSyncService.exe"
:: Others - Sophos Data Recorder
taskkill /T /F /IM "SDRService.exe"
:: Others - Sophos File Integrity Monitoring
taskkill /T /F /IM "SophosFIMService.exe"
:: Others - Sophos Management Host
taskkill /T /F /IM "Sophos.FrontEnd.Service.exe"
:: Others - Sophos Management Service
taskkill /T /F /IM "MgntSvc.exe"
:: Others - Sophos Patch Endpoint Communicator
taskkill /T /F /IM "PatchEndpointCommunicator.exe"
:: Others - Sophos Patch Endpoint Orchestrator
taskkill /T /F /IM "PatchEndpointOrchestrator.exe"
:: Others - Sophos Patch Server Communicator
taskkill /T /F /IM "PatchServerCommunicator.exe"
:: Others - Sophos Policy Evaluation Service
taskkill /T /F /IM "Sophos.PolicyEvaluation.Service.exe"
:: Others - Sophos PureMessage
taskkill /T /F /IM "SavexSrvc.exe"
:: Others - Sophos PureMessage Web Agent
taskkill /T /F /IM "SavexWebAgent.exe"
:: Others - Sophos PureMessage Running Object Table (ROT)
taskkill /T /F /IM "MMRot.exe"
:: Others - Sophos PureMessage Content Extractor
taskkill /T /F /IM "PMContExtrSvc.exe"
:: Others - Sophos PureMessage Watchdog Agent
taskkill /T /F /IM "PMEVizsla.exe"
:: Others - Sophos PureMessage Scanner
taskkill /T /F /IM "PMScanner.exe"
:: Others - Sophos Encryption For Cloud Storage
taskkill /T /F /IM "SGN_MasterServicen.exe"
:: Others - Sophos Central AD Sync Utility
taskkill /T /F /IM "SophosADSyncService.exe"
exit /b 0
:Services_Deletion
:: The next step is to delete all Sophos services
:: Sophos Patch Agent
call :sc_delete "Sophos Patch Agent"
:: Sophos Compliance Agent / NAC / Network Access Compliance
call :sc_delete "Sophos Compliance Agent API"
:: Sophos Network Threat Protection / NTP / Endpoint / Server
call :sc_delete "SntpService"
call :sc_delete "Sophos Network Threat Protection"
:: Sophos System Protection / SSP
call :sc_delete "Sophos System Protection Service"
call :sc_delete "sophossps"
:: Sophos Client Firewall / SCF
call :sc_delete "Sophos Client Firewall Manager"
call :sc_delete "Sophos Client Firewall"
:: Sophos Endpoint Firewall / Endpoint / Server
:: Sophos Anti-Virus / SAV / Endpoint / Server
call :sc_delete "SAVAdminService"
call :sc_delete "Sophos Anti-Virus status reporter"
call :sc_delete "SAVService"
call :sc_delete "Sophos Device Control Service"
call :sc_delete "Sophos Safestore Service"
call :sc_delete "Sophos Safestore"
call :sc_delete "Sophos Web Control Service"
:: Didn't really fall anywhere else - Sophos Web Filter
call :sc_delete "swi_filter"
call :sc_delete "swi_fc"
:: Didn't really fall anywhere else - Sophos Web Intelligence Service
call :sc_delete "swi_service"
call :sc_delete "Sophos Web Intelligence Service"
:: Didn't really fall anywhere else - Sophos Web Intelligence Updater
call :sc_delete "Sophos Web Intelligence Updater"
call :sc_delete "Sophos Web Intelligence Update"
call :sc_delete "swi_update"
sc delete "swi_update_64"
call :sc_delete "swi_update_64"
:: Extras
call :sc_delete "Sophos Anti-Virus"
:: Sophos Exploit Prevention / SEP
:: Sophos Remote Management System / RMS
:: Sophos Health / Endpoint / Server
call :sc_delete "Sophos Health Service"
:: Sophos Diagnostic Utility / Endpoint / Server
:: Sophos Management Communications System / MCS / Endpoint / Server
call :sc_delete "Sophos MCS Agent"
call :sc_delete "Sophos MCS Client"
:: Sophos [MCS?] Heartbeat
call :sc_delete "Sophos MCS Heartbeat"
:: Sophos Endpoint Self Help / Endpoint / Server
:: Sophos Lockdown
:: Sophos File Scanner / Endpoint / Server
call :sc_delete "Sophos File Scanner Service"
:: Sophos Standalone Engine / Endpoint / Server
:: Sophos ML Engine
:: Sophos Endpoint / Agent
call :sc_delete "Sophos Agent"
:: Sophos Clean / Endpoint / Server
call :sc_delete "Sophos Clean Service"
call :sc_delete "Sophos Clean"
:: Sophos AutoUpdate XG / Endpoint / Server
:: Sophos AutoUpdate / SAU
call :sc_delete "Sophos AutoUpdate Service"
:: Sophos Endpoint Defense / SED / Endpoint / Server
call :sc_delete "Sophos Endpoint Defense Service"
:: HitmanPro / HMPA managed
:: HitmanPro
:: Others - Sophos Message Router
call :sc_delete "Sophos Message Router"
:: Others - Sophos Cache Manager / Update Manager
call :sc_delete "Sophos Cache Manager"
call :sc_delete "Sophos Update Cache"
call :sc_delete "SUM"
:: Others - Sophos Certification Manager
call :sc_delete "Sophos Certification Manager"
:: Others - Sophos Cloud AD Sync Utility
call :sc_delete "Sophos Cloud AD Sync Utility"
:: Others - Sophos Data Recorder
call :sc_delete "SophosDataRecorderService"
:: Others - Sophos File Integrity Monitoring
call :sc_delete "SophosFIM"
:: Others - Sophos Management Host
call :sc_delete "SophosManagementHostService"