The Clever Geek

A while ago I wrote an uninstall script for a version of NOD32 to be used in a domain setting. It may have been 2.7, it may have been 2.5. Either way, the one that I needed recently was for their new ESET “NOD32 Antivirus version 3.0″. This is a batch script that worked for me by using the current Active Directory login script to point to this batch file:

::uninstall nod32
::create a registry file that prohibits the kernel as well as the gui from loading
echo Windows Registry Editor Version 5.00>removenod32.reg
echo.>>removenod32.reg
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ekrn]>>removenod32.reg
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]>>removenod32.reg
echo "egui"=->>removenod32.reg
regedit.exe /s removenod32.reg
taskkill /im egui.exe
::SHUTDOWN -r -t 01
DEL removenod32.reg

Keep in mind that I use the term ”uninstall” loosely and that it doesn’t remove
the links in the start menu (which wouldn’t be hard to add), the files, or the remaining registry keys.  This just prevents it from
running when you start your computer and enables you to install another
antivirus of choice without conflicts.

 If you are using version 2.5 or 2.7, I think you can get away with merely changing ”egui.exe” to “nod32kui.exe” and changing
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ekrn]
to
[-HKEY_LOCAL_MACHINE\ system \ CurrentControlSet \ NOD32krn]
or whatever it happens to be.

Either way, I spent 10 minutes or so completely disabling their security software
which is cool for the sake of administration, but not too promising for the software
since they seem to be adhering to the ”security by obscurity”
concept in that, while their definitions seem to be pretty
up-to-date, if anyone maliciously targeted their AV software, you might be in trouble.
That makes me wonder how hard it would be to make a script for Norton or McAfee to
do the same thing (not that I really care to since I had no practical use for such a script
previously).

If anyone happens to modify this script to make a cleaner uninstall, let me know and I’ll post it here while giving credit where it’s due.

I used this on ESET NOD32 Antivirus 3.0.563.0 with the signature database 2658 on Windows XP.
Click here to download the file remove.txt then make sure to change the extension from .txt to .bat.


UPDATE: Someone told me (in a previous blog, before we migrated the posts) they were receiving the error "(114) Setup.xml file is damaged or missing" and used the batch uninstall to remedy the problem.

Also note that ESET says you can use the NOD32 Remote Administrator to remove the install as well,  though I haven't personally ever tried it.

< Prev