8 Replies Latest reply on Oct 28, 2010 5:56 AM by symon

    Can not uninstall HIPS 7.0

      Hello ,

       

       

      I have uninstalled manually HIPS with the procedure describes on url https://kc.mcafee.com/corporate/index?page=content&id=KB51699 ; but I think that uninstallation is not completed.

      In fact I can see in "Add remove Program" of my server an entry about HIPS. When I try to uninstall it from "Add remove Program", I get error "Product is in self-protected mode. Please disable self-protect mode before uninstalling".

      I think that this problem is due to the fact that I have not disable IPS module before the manual uninstallation.

       

      I don't know how to disable self-protected mode since I can not modify IPS module configuration . In fact due to manuel uninstallation, I hare removed HIPS installation directory and HIPS client can not communicate anymore with ePO. 

       

      How can I uninstall completely the old version of HIPS in order to reinstall it ?

       


      Thanks in advance for your help

      Ghislaine

        • 1. Re: Can not uninstall HIPS 7.0
          HupSkiDup

          The manual uninstall should work, I've had to use it before too.  The other thing to try is an uninstaller, I use Revo portable uninstaller and it whacks all mcafee stuff just great.  If there is an entry in add/remove for HIP, it will start with that and when it doesn't find the source files for it, it will look for files and registry entries to delete.  Whack all that and you should be good.  -- as always, be careful on the registry, backups are good...

          1 of 1 people found this helpful
          • 2. Re: Can not uninstall HIPS 7.0

            Normally you would disable IPS by unlocking the clientUI tray icon.  The you could have stopped the Host Intrusion service and proceeded with the manual uninstall.

             

            If it's partially uninstalled, you should be able to boot into safe mode and complete the manual uninstall.

            • 3. Re: Can not uninstall HIPS 7.0

              Hello bgable,

               

              Due to my old manual uninstallation I have neither  clientUI tray icon nor HIPS installation directory; so I can not unlock the clientUI

               

              How can I complete the manual uninstall in safe mode? I have already tried to launch manual uninstall procedure in safe mode but I have always the HIPS entry in "Add or remove Program" and can not uninstall it.

               

              Thanks
              Ghislaine

              • 4. Re: Can not uninstall HIPS 7.0

                The entries in add/remove programs correspond to registry values in the following location:

                 

                HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

                 

                The HIP guid entry should begin with {B332732A...

                 

                Delete this entry (it should have been a step in the manual uninstall document. 

                • 5. Re: Can not uninstall HIPS 7.0

                  Hello bgable,

                   

                  I tried what you have suggested. I also removed all mcafee products and register entries on my server. I have reinstalled mcafee agent and HIPS from ePO server.

                   

                  Installation of HIPS worked but on the HIPS tray icon I have error "driver not installed" and I can not join(ex: ping) my server even with all ports opened on HIPS firewall.

                   

                  I will close the current discussion "Can not uninstall HIPS 7.0"  will open a new discussion for my HIPS driver installation error.

                   

                   

                  Thanks all for your help

                   

                  Ghislaine

                  • 6. Re: Can not uninstall HIPS 7.0
                    BobStasz

                    I have had similar issues in my environment.  If you stop the McAfee HIPs servcies, and then set them to disabled, and reboot the machine, you should be able to uninstall HIPs without issue.

                    • 7. Re: Can not uninstall HIPS 7.0

                      I just encountered this problem myself, and just found a solution.  I had to get to the point that the checkbox for "Enable Host IPS" is not checked.  I think I took a long way around by creating a policy with EPO that had a console password enabled so that the end machine console was available and could be unlocked and then you are able to uncheck the box locally on the machine you are wanting to remove it from.  Once you have that box unchecked you can go to add/remove programs and remove the program like any other program.

                       

                      More or less it boils down to this checkbox is the self protect mode on off switch.

                       

                      I think I could have taken a shortcut and created a copy of my existing policy on the EPO server that has this box unchecked and then apply it to that machine and then apply a task to the machine to remove the application.  Havent tested this path but figure it would work.

                       

                      I was unable to find anything online regarding how I got this done... Hope this helps someone else in fixing this problem without too much headache....

                      • 8. Re: Can not uninstall HIPS 7.0

                        To complete the previous answers, I succesfuly uninstall HIP using ePO.

                        What you have to do is to push a strategy to disable network and host IPS, the "OFF" strategy (under "IPS options" category) provided by Mcafee will do the trick.

                         

                        Please check my attachments for both strategy and client task I used.