cancel
Showing results for 
Search instead for 
Did you mean: 

cannot remove the agent with the frminst /remove=agent command

Jump to solution

Hi,

We have our file server that is going on a loop. He's fine and then suddenly he 's working 100% (it's the system process that takes everything) cpu all time and it slows the access for every user. We are pretty sure it's the antivirus since there is nothing else on it apart VM tools. A saw that kind of behavior on workstations too a few years back and it was Mcafee.

When he was at 100%, i put the command frminst /remove=agent to remove it. After two hours or so it finally seemed to have removed itself but it's not the case. The client is there and he's stuck hard. Is there a more radical way to remove it?  After the removal, we are going to be able to verify if Mcafee is really the problem here.

Dag

1 Solution

Accepted Solutions

Re: cannot remove the agent with the frminst /remove=agent command

Jump to solution

Have you tried removing it via MSIEXEC? If you nav to HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\McAfee\HIP and look at the UninstallCmd key, it provides the uninstall command. I would follow this KB, but below is the jist of it. https://kc.mcafee.com/corporate/index?page=content&id=KB73127

msiexec.exe /x{D2B9C003-A3CD-44A0-9DE5-52FE986C03E5} EPOSPAWNED=True /q /l+*v C:\Windows\Temp\McAfeeLogs\McAfeeHip8_UnInstall.log

You can change the path of the log. Run that as admin from cmd and see what the log provides if it fails.

If you completely get stuck for some reason, you can call McAfee and they can also provide you with a ripper utility that works very well.

2 Replies

Re: cannot remove the agent with the frminst /remove=agent command

Jump to solution

Have you tried removing it via MSIEXEC? If you nav to HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\McAfee\HIP and look at the UninstallCmd key, it provides the uninstall command. I would follow this KB, but below is the jist of it. https://kc.mcafee.com/corporate/index?page=content&id=KB73127

msiexec.exe /x{D2B9C003-A3CD-44A0-9DE5-52FE986C03E5} EPOSPAWNED=True /q /l+*v C:\Windows\Temp\McAfeeLogs\McAfeeHip8_UnInstall.log

You can change the path of the log. Run that as admin from cmd and see what the log provides if it fails.

If you completely get stuck for some reason, you can call McAfee and they can also provide you with a ripper utility that works very well.

Re: cannot remove the agent with the frminst /remove=agent command

Jump to solution

Thank you fitch,

I found this in the regisrty:

msiexec /x {CE15D1B6-19B6-4D4D-8F43-CF5D2C3356FF} REMOVE=ALL REBOOT=R /q. it is in the VSE section while the agent section is empty. The weird thing is that in the control panel/program section, the agent is there but VSE is not. Seems that mcafee in there is all screwed up on my file server.

Dag