IT Pro Tips for Sophos Plc Sophos Anti-Virus 5

Deployment Tips (3)

Most Common Setup Type

Not Determined

Average Package Difficulty Rating

Rated 3 / 5 (Average) based on 1 ratings

Most Commonly Reported Deployment Method

Vendor Provided Command Line (switch driven)

121

Command Line

Usually you have a file called savxp50sasfx.exe
Extract it and there will be two subfolders:

- savxp: The Antivirus Software
- sau: The AutoUpdater

Install both of these using the MSI Installer msiexec
(Following are the appropriate MSI parameters that setup.exe would use)

sophos anti-virus.msi
CHECKFORCOMPETITORS=1 REBOOT=ReallySuppress TRANSFORMS=1033.mst INSTALLDIR="C:\Program Files\Sophos\Sophos Anti-Virus"

sophos autoupdate.msi
REBOOT=ReallySuppress TRANSFORMS=1033.mst INSTALLDIR="C:\Program Files\Sophos\AutoUpdate" BOOTSTRAP=NOUPDATE RMSACTION=0

Setup Information:

Setup Type: unspecified

Deployment Method Used: unspecified

Deployment Difficulty: unspecified

Platform(s): Windows

jmroth
10/25/2005
Show Comments ( 0 )

0

Command Line

This batch file worked for me. Please see related links sections for additional info.

@ECHO OFF
REM --- Check for an existing installation of Sophos AutoUpdate
if exist "C:\Program Files\Sophos\AutoUpdate\ALsvc.exe" goto _End
REM --- Deploy to Windows 2000/XP/2003
\\<SERVER>\InterChk\ESXP\Setup.exe -updp "\\<SERVER>\InterChk\ESXP" -user "USER" -pwd "PWD" -mng yes
REM --- End of the script
:_End

Setup Information:

Setup Type: unspecified

Deployment Method Used: unspecified

Deployment Difficulty: unspecified

Platform(s): Windows

vinay.raj
11/04/2008
Show Comments ( 0 )

0

Script

@ECHO OFF

ECHO ====================================================================

ECHO Sophos Removal v3.0 - Ed Cooper/Kyle Weller/Sam Woodard

ECHO Removes Sophos v7 - v10

:: Original Pulled from: https://gist.github.com/ion-storm/11ff973495002f228b0f7949f3c52e13

:: Additions made based on https://community.sophos.com/kb/en-us/122126 and leftovers as determined by Sam Woodard

ECHO ====================================================================

ECHO.

ECHO Administrative permissions required. Detecting permissions...

ECHO.

net session >NUL 2>&1

IF %errorLevel% == 0 (

ECHO Administrative Permission Detected.

ECHO.

ECHO Sophos Uninstall Beginning. Please be patient as this can take several minutes.

ECHO.

ECHO Please consider rebooting at the end of the day.

GOTO GO

) ELSE (

ECHO Not running as Administrator. Please Re-run as Administrator.

ECHO.

PAUSE

EXIT

)

:GO

ECHO.

ECHO ====================================================

ECHO Modifying Services

ECHO ====================================================

net stop "Sophos Agent" >NUL 2>&1

net stop "Sophos Anti-Virus" >NUL 2>&1

net stop "Sophos Anti-Virus status reporter" >NUL 2>&1

net stop "Sophos AutoUpdate Service" >NUL 2>&1

net stop "Sophos Message Router" >NUL 2>&1

net stop "Sophos Web Intelligence Service" >NUL 2>&1

net stop "Sophos Client Firewall" >NUL 2>&1

net stop "Sophos Client Firewall Manager" >NUL 2>&1

net stop "Sophos Web Control Service" >NUL 2>&1

net stop "SAVService" >NUL 2>&1

net stop "SAVAdminService" >NUL 2>&1

net stop "Sophos AutoUpdate Service" >NUL 2>&1

net stop "Sophos Health Service" >NUL 2>&1

net stop "Sophos MCS Agent" >NUL 2>&1

net stop "Sophos MCS Client" >NUL 2>&1

net stop "Sophos MCS Heartbeat" >NUL 2>&1

net stop "SntpService" >NUL 2>&1

net stop "sophossps" >NUL 2>&1

net stop "Sophos Web Control Service" >NUL 2>&1

net stop "swi_filter" >NUL 2>&1

net stop "swi_service" >NUL 2>&1

net stop "Sophos Heartbeat" >NUL 2>&1

net stop "Sophos Clean Service" >NUL 2>&1

net stop "Sophos File Scanner Service" >NUL 2>&1

net stop "Sophos Safestore Service" >NUL 2>&1

net stop "Sophos System Protection Service" >NUL 2>&1

sc config "SAVService" start= disabled >NUL 2>&1

sc config "SAVAdminService" start= disabled >NUL 2>&1

sc config "Sophos AutoUpdate Service" start= disabled >NUL 2>&1

sc config "Sophos Health Service" start= disabled >NUL 2>&1

sc config "Sophos MCS Agent" start= disabled >NUL 2>&1

sc config "Sophos MSC Client" start= disabled >NUL 2>&1

sc config "Sophos MCS Heartbeat" start= disabled >NUL 2>&1

sc config "SntpService" start= disabled >NUL 2>&1

sc config "sophosssps" start= disabled >NUL 2>&1

sc config "Sophos Web Control Service" start= disabled >NUL 2>&1

sc config "swi_filter" start= disabled >NUL 2>&1

sc config "Sophos Heartbeat" start= disabled >NUL 2>&1

sc config "Sophos Clean Service" start= disabled >NUL 2>&1

sc config "Sophos File Scanner Service" start= disabled >NUL 2>&1

sc config "Sophos Safestore Service" start= disabled >NUL 2>&1

sc config "Sophos System Protection Service" start= disabled >NUL 2>&1

sc config sharedaccess start= disabled >NUL 2>&1

sc config browser start= auto >NUL 2>&1

sc config remoteregistry start= auto >NUL 2>&1

sc config lanmanserver start= auto >NUL 2>&1

sc config schedule start= auto >NUL 2>&1

sc config msiserver start= auto >NUL 2>&1

sc config lanmanworkstation start= auto >NUL 2>&1

net stop sharedaccess >NUL 2>&1

net start lanmanworkstation >NUL 2>&1

net start msiserver >NUL 2>&1

net start schedule >NUL 2>&1

net start lanmanserver >NUL 2>&1

net start remoteregistry >NUL 2>&1

net start browser >NUL 2>&1

ECHO.

ECHO Done

ECHO.

ECHO ====================================================

ECHO Performing MSI Uninstall

ECHO ====================================================

msiexec.exe /x "c:\program files\sophos\autoupdate\cache\savxp\sophos anti-virus.msi" /q /norestart >NUL 2>&1

msiexec.exe /x "c:\program files\sophos\autoupdate\cache\rms\sophos remote management system.msi" /q /norestart >NUL 2>&1

msiexec.exe /x "c:\program files\sophos\autoupdate\cache\sau\sophos autoupdate.msi" /q /norestart >NUL 2>&1

msiexec.exe /x "c:\program files\sophos\autoupdate\cache\scf\sophos client firewall.msi" /q /norestart >NUL 2>&1

set program="Sophos Network Threat Protection"

wmic product where name=%program% call uninstall /nointeractive

set program="Sophos System Protection"

wmic product where name=%program% call uninstall /nointeractive

set program="Sophos Anti-Virus"

wmic product where name=%program% call uninstall /nointeractive

set program="Sophos Management Communications System"

wmic product where name=%program% call uninstall /nointeractive

set program="Sophos AutoUpdate"

wmic product where name=%program% call uninstall /nointeractive

set program="Sophos Heartbeat"

wmic product where name=%program% call uninstall /nointeractive

set program="Sophos Diagnostic Utility"

wmic product where name=%program% call uninstall /nointeractive

set program="Sophos Health"

wmic product where name=%program% call uninstall /nointeractive

MsiExec.exe /X{FED1005D-CBC8-45D5-A288-FFC7BB304121} /qn

MsiExec.exe /X{D929B3B5-56C6-46CC-B3A3-A1A784CBB8E4} /qn

:Sophos AutoUpdate

MsiExec.exe /qn /X{7CD26A0C-9B59-4E84-B5EE-B386B2F7AA16} REBOOT=ReallySuppress >NUL 2>&1

MsiExec.exe /qn /X{BCF53039-A7FC-4C79-A3E3-437AE28FD918} REBOOT=ReallySuppress >NUL 2>&1

MsiExec.exe /qn /X{9D1B8594-5DD2-4CDC-A5BD-98E7E9D75520} REBOOT=ReallySuppress >NUL 2>&1

MsiExec.exe /qn /X{AFBCA1B9-496C-4AE6-98AE-3EA1CFF65C54} REBOOT=ReallySuppress >NUL 2>&1

MsiExec.exe /qn /X{E82DD0A8-0E5C-4D72-8DDE-41BB0FC06B3E} REBOOT=ReallySuppress >NUL 2>&1

MsiExec.exe /qn /X{72E136F7-3751-422E-AC7A-1B2E46391909} REBOOT=ReallySuppress >NUL 2>&1

:Sophos Anti-Virus (Endpoint)

MsiExec.exe /qn /X{6654537D-935E-41C0-A18A-C55C2BF77B7E} REBOOT=ReallySuppress >NUL 2>&1

MsiExec.exe /qn /X{8123193C-9000-4EEB-B28A-E74E779759FA} REBOOT=ReallySuppress >NUL 2>&1

MsiExec.exe /qn /X{36333618-1CE1-4EF2-8FFD-7F17394891CE} REBOOT=ReallySuppress >NUL 2>&1

MsiExec.exe /qn /X{DFDA2077-95D0-4C5F-ACE7-41DA16639255} REBOOT=ReallySuppress >NUL 2>&1

MsiExec.exe /qn /X{CA3CE456-B2D9-4812-8C69-17D6980432EF} REBOOT=ReallySuppress >NUL 2>&1

MsiExec.exe /qn /X{CA524364-D9C5-4804-92DE-2800BDAC1AA4} REBOOT=ReallySuppress >NUL 2>&1

MsiExec.exe /qn /X{3B998572-90A5-4D61-9022-00B288DD755D} REBOOT=ReallySuppress >NUL 2>&1

MsiExec.exe /qn /X{4BAF6F55-FFE4-4A3A-8367-CC2EBB0F11C3} REBOOT=ReallySuppress >NUL 2>&1

:Sophos Anti-Virus (Server)

MsiExec.exe /qn /X{72E30858-FC95-4C87-A697-670081EBF065} REBOOT=ReallySuppress >NUL 2>&1

MsiExec.exe /qn /X{66967E5F-43E8-4402-87A4-04685EE5C2CB} REBOOT=ReallySuppress >NUL 2>&1

MsiExec.exe /qn /X{2519A41E-5D7C-429B-B2DB-1E943927CB3D} REBOOT=ReallySuppress >NUL 2>&1

:Sophos System Protection

MsiExec.exe /qn /X{934BEF80-B9D1-4A86-8B42-D8A6716A8D27} REBOOT=ReallySuppress >NUL 2>&1

MsiExec.exe /qn /X{1093B57D-A613-47F3-90CF-0FD5C5DCFFE6} REBOOT=ReallySuppress >NUL 2>&1

:Sophos Network Threat Protection

MsiExec.exe /qn /X{604350BF-BE9A-4F79-B0EB-B1C22D889E2D} REBOOT=ReallySuppress >NUL 2>&1

:Sophos Health

MsiExec.exe /qn /X{A5CCEEF1-B6A7-4EB4-A826-267996A62A9E} REBOOT=ReallySuppress >NUL 2>&1

MsiExec.exe /qn /X{D5BC54B8-1DA1-44F4-AE6F-86E05CDB0B44} REBOOT=ReallySuppress >NUL 2>&1

MsiExec.exe /qn /X{E44AF5E6-7D11-4BDF-BEA8-AA7AE5FE6745} REBOOT=ReallySuppress >NUL 2>&1

:SDU (1.x)

MsiExec.exe /qn /X{4627F5A1-E85A-4394-9DB3-875DF83AF6C2} REBOOT=ReallySuppress >NUL 2>&1

:Heartbeat

MsiExec.exe /qn /X{DFFA9361-3625-4219-82C2-9EF011E433B1} REBOOT=ReallySuppress >NUL 2>&1

:Sophos Management Communications System

MsiExec.exe /qn /X{A1DC5EF8-DD20-45E8-ABBD-F529A24D477B} REBOOT=ReallySuppress >NUL 2>&1

MsiExec.exe /qn /X{1FFD3F20-5D24-4C9A-B9F6-A207A53CF179} REBOOT=ReallySuppress >NUL 2>&1

MsiExec.exe /qn /X{D875F30C-B469-4998-9A08-FE145DD5DC1A} REBOOT=ReallySuppress >NUL 2>&1

MsiExec.exe /qn /X{2C14E1A2-C4EB-466E-8374-81286D723D3A} REBOOT=ReallySuppress >NUL 2>&1

:UI

MsiExec.exe /qn /X{D29542AE-287C-42E4-AB28-3858E13C1A3E} REBOOT=ReallySuppress >NUL 2>&1

:Sophos Endpoint Firewall

MsiExec.exe /qn /X{2831282D-8519-4910-B339-2302840ABEF3} REBOOT=ReallySuppress >NUL 2>&1

:Sophos Endpoint Self Help

MsiExec.exe /qn /X{4EFCDD15-24A2-4D89-84A4-857D1BF68FA8} REBOOT=ReallySuppress >NUL 2>&1

MsiExec.exe /qn /X{BB36D9C2-6AE5-4AB2-BC91-ECD247092BD8} REBOOT=ReallySuppress >NUL 2>&1

:Sophos Lockdown

MsiExec.exe /qn /X{77F92E90-ED4F-4CFF-8F60-3E3E4AEB705C} REBOOT=ReallySuppress >NUL 2>&1

:Sophos File Scanner

"C:\Program Files\Sophos\Sophos File Scanner\Uninstall.exe /verysilent" >NUL 2>&1

:Sophos Standalone Engine

"C:\Program Files\Sophos\Sophos Standalone Engine\uninstall.exe /verysilent" >NUL 2>&1

:Sophos ML Engine

"C:\Program Files\Sophos\Sophos ML Engine\uninstall.exe /verysilent" >NUL 2>&1

:Sophos Endpoint Agent 2.0.0

"C:\Program Files\Sophos\Sophos Endpoint Agent\uninstallgui.exe /verysilent" >NUL 2>&1

:SophosClean

"C:\Program Files\Sophos\Clean\uninstall.exe /verysilent" >NUL 2>&1

:Sophos Clean 3.8.3.1

"C:\Program Files (x86)\Sophos\Clean\uninstall.exe /verysilent" >NUL 2>&1

:SED

"C:\Program Files\Sophos\Endpoint Defense\uninstall.exe /verysilent" >NUL 2>&1

:HMPA (managed)

"C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe" /uninstall /quiet >NUL 2>&1

:HMPA 1.0.0.699

"C:\Program Files (x86)\HitmanPro.Alert\uninstall.exe /verysilent" >NUL 2>&1

:HMPA 3.7.14.265

"C:\Program Files\HitmanPro\HitmanPro.exe" /uninstall /quietver >NUL 2>&1

reg delete HKLM\Software\Sophos /f >NUL 2>&1

reg delete HKCU\Software\Sophos /f >NUL 2>&1

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Sophos Agent" /f >NUL 2>&1

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\SavService" /f >NUL 2>&1

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\SAVAdminService" /f >NUL 2>&1

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Sophos AutoUpdate Agent" /f >NUL 2>&1

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Sophos AutoUpdate Service" /f >NUL 2>&1

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Sophos Certification Manager" /f >NUL 2>&1

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Sophos EMLib Update Agent" /f >NUL 2>&1

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\SEMscheduler" /f >NUL 2>&1

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Sophos Management Service" /f >NUL 2>&1

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Sophos Message Router" /f >NUL 2>&1

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\SQLAgent$SOPHOS" /f >NUL 2>&1

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MSSQL$SOPHOS" /f >NUL 2>&1

reg delete "HKLM\System\CurrentControlSet\Services\Eventlog\Sophos" /f >NUL 2>&1

reg delete "HKEY_CLASSES_ROOT\ISPSheet" /f >NUL 2>&1

reg delete "HKEY_CLASSES_ROOT\ISPSheet.1" /f >NUL 2>&1

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{061CC07B-BA7A-44D1-81FA-D36BE1CE55D9}" /f >NUL 2>&1

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Sophos UI.exe" /f >NUL 2>&1

TASKKILL /F /IM "Almon.exe" >NUL 2>&1

TASKKILL /F /IM "swc_service.exe" >NUL 2>&1

TASKKILL /F /IM "Sophos UI.exe" >NUL 2>&1

ECHO.

ECHO Done

ECHO.

ECHO Done

ECHO.

ECHO ====================================================

ECHO Performing Registry Cleanup

ECHO ====================================================

reg delete HKLM\Software\Sophos /f >NUL 2>&1

reg delete HKCU\Software\Sophos /f >NUL 2>&1

reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs" /f >NUL 2>&1