cancel
Showing results for 
Search instead for 
Did you mean: 
kink80
Level 12

Manually remove HIPS 8.0.0.1919

I can find instructions to manually remove HIPS 7 form machines but I cannot find any documentation to manually remove HIPS 8 form machines. Does anyone know where to get that documentation? Thanks.

0 Kudos
11 Replies
McAfee Employee

Re: Manually remove HIPS 8.0.0.1919

It does not exist.  Please use the MSIEXEC uninstall commands to uninstall HIPS 8.0 (if you believe you have some kind of partial install issue).  Stop the Host IPS service before running this command (in case self-protection is enabled).

KB73127 - MSIEXEC Uninstallation Commands for Host Intrusion Prevention 7.0 / 8.0

0 Kudos
kink80
Level 12

Re: Manually remove HIPS 8.0.0.1919

Will this work even though HIPS 8 doe snot appear in Add/remove programs but the McAfee Validation Trust Protection Service and McAfee Firewall Core Service services are still running?

0 Kudos
McAfee Employee

Re: Manually remove HIPS 8.0.0.1919

Yes.

0 Kudos
McAfee Employee

Re: Manually remove HIPS 8.0.0.1919

Modify the command to /qf if you want to see the HIPS uninstall taking place.  The /q makes the uninstall silent.

0 Kudos
kink80
Level 12

Re: Manually remove HIPS 8.0.0.1919

Thanks Kary! If this process should fail should I revert back to the HIPS 7.0 Manual removal document? We only have a short window of time to remove HIPS 8.0 form this machine as it is a production server. Thanks!!

0 Kudos
McAfee Employee

Re: Manually remove HIPS 8.0.0.1919

The HIPS 7 manual removal will not work for HIPS 8.0 (completely).  If it fails to uninstall, please contact McAfee Support.

0 Kudos
kink80
Level 12

Re: Manually remove HIPS 8.0.0.1919

When I originally contacted McAfee support they told me that the only way to remove HIPS 8.0 other than through Add/Remove programs was via the HIPS 7.0 manual removal process.

0 Kudos
kink80
Level 12

Re: Manually remove HIPS 8.0.0.1919

Kary, We ran the msiexec uninstall command as you suggested and I have attached the log file from that attempt.

We were unable to run Step 1 of the KB73127 because the MfeFire.exe does not exist on this machine. Literally the only thing that remains of HIPS 8 is the McAfee Firewall Core Service in the services.msc console. It is set to automatic but is not started. If you go into the properties of McAfee Firewall Core Service and try to "Disable" it you get an error saying that MfeFire could not be found and Error 5 Access is denied. The account we are using has Admin rights on this machine. After that we just proceeded to Step 2, running the msiexec uninstall command.

It errors out with a 1605:

ERROR_UNKNOWN_PRODUCT 1605 This action is only valid for products that are currently installed. The log file is listed below.

Would the msiexec.exe /x{D2B9C003-A3CD-44A0-9DE5-52FE986C03E5} EPOSPAWNED=True /q /l+*v C:\Windows\Temp\McAfeeLogs\McAfeeHip8_UnInstall.log also work on a 64-bit server? As this machine is a 64-bit machine.

Thanks for looking at this!

=== Verbose logging started: 5/1/2012  8:07:56  Build type: SHIP UNICODE 3.01.4000.4042  Calling process: C:\WINDOWS\system32\msiexec.exe ===

MSI (c) (AC:A8) [08:07:56:546]: Resetting cached policy values

MSI (c) (AC:A8) [08:07:56:546]: Machine policy value 'Debug' is 0

MSI (c) (AC:A8) [08:07:56:546]: ******* RunEngine:

           ******* Product: {D2B9C003-A3CD-44A0-9DE5-52FE986C03E5}

           ******* Action:

           ******* CommandLine: **********

MSI (c) (AC:A8) [08:07:56:546]: Client-side and UI is none or basic: Running entire install on the server.

MSI (c) (AC:A8) [08:07:56:546]: Grabbed execution mutex.

MSI (c) (AC:A8) [08:07:56:593]: Cloaking enabled.

MSI (c) (AC:A8) [08:07:56:593]: Attempting to enable all disabled priveleges before calling Install on Server

MSI (c) (AC:A8) [08:07:56:609]: Incrementing counter to disable shutdown. Counter after increment: 0

MSI (s) (24:44) [08:07:56:624]: Grabbed execution mutex.

MSI (s) (24:64) [08:07:56:624]: Resetting cached policy values

MSI (s) (24:64) [08:07:56:624]: Machine policy value 'Debug' is 0

MSI (s) (24:64) [08:07:56:624]: ******* RunEngine:

           ******* Product: {D2B9C003-A3CD-44A0-9DE5-52FE986C03E5}

           ******* Action:

           ******* CommandLine: **********

MSI (s) (24:64) [08:07:56:624]: Machine policy value 'DisableUserInstalls' is 0

MSI (s) (24:64) [08:07:56:624]: MainEngineThread is returning 1605

MSI (c) (AC:A8) [08:07:56:624]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1

MSI (c) (AC:A8) [08:07:56:624]: MainEngineThread is returning 1605

=== Verbose logging stopped: 5/1/2012  8:07:56 ===

0 Kudos
McAfee Employee

Re: Manually remove HIPS 8.0.0.1919

Would the msiexec.exe /x{D2B9C003-A3CD-44A0-9DE5-52FE986C03E5} EPOSPAWNED=True /q /l+*v C:\Windows\Temp\McAfeeLogs\McAfeeHip8_UnInstall.log also work on a 64-bit server?

The uninstall command will work on 64-bit systems. 

Please open a McAfee Support Service Request for this issue.

0 Kudos