1 2 Previous Next 11 Replies Latest reply on Jul 7, 2014 6:18 PM by oreodoh

    Manually remove HIPS 8.0.0.1919

    kink80

      I can find instructions to manually remove HIPS 7 form machines but I cannot find any documentation to manually remove HIPS 8 form machines. Does anyone know where to get that documentation? Thanks.

        • 1. Re: Manually remove HIPS 8.0.0.1919
          Kary Tankink

          It does not exist.  Please use the MSIEXEC uninstall commands to uninstall HIPS 8.0 (if you believe you have some kind of partial install issue).  Stop the Host IPS service before running this command (in case self-protection is enabled).

           

          KB73127 - MSIEXEC Uninstallation Commands for Host Intrusion Prevention 7.0 / 8.0

          • 2. Re: Manually remove HIPS 8.0.0.1919
            kink80

            Will this work even though HIPS 8 doe snot appear in Add/remove programs but the McAfee Validation Trust Protection Service and McAfee Firewall Core Service services are still running?

            • 4. Re: Manually remove HIPS 8.0.0.1919
              Kary Tankink

              Modify the command to /qf if you want to see the HIPS uninstall taking place.  The /q makes the uninstall silent.

              • 5. Re: Manually remove HIPS 8.0.0.1919
                kink80

                Thanks Kary! If this process should fail should I revert back to the HIPS 7.0 Manual removal document? We only have a short window of time to remove HIPS 8.0 form this machine as it is a production server. Thanks!!

                • 6. Re: Manually remove HIPS 8.0.0.1919
                  Kary Tankink

                  The HIPS 7 manual removal will not work for HIPS 8.0 (completely).  If it fails to uninstall, please contact McAfee Support.

                  • 7. Re: Manually remove HIPS 8.0.0.1919
                    kink80

                    When I originally contacted McAfee support they told me that the only way to remove HIPS 8.0 other than through Add/Remove programs was via the HIPS 7.0 manual removal process.

                    • 8. Re: Manually remove HIPS 8.0.0.1919
                      kink80

                      Kary, We ran the msiexec uninstall command as you suggested and I have attached the log file from that attempt.

                      We were unable to run Step 1 of the KB73127 because the MfeFire.exe does not exist on this machine. Literally the only thing that remains of HIPS 8 is the McAfee Firewall Core Service in the services.msc console. It is set to automatic but is not started. If you go into the properties of McAfee Firewall Core Service and try to "Disable" it you get an error saying that MfeFire could not be found and Error 5 Access is denied. The account we are using has Admin rights on this machine. After that we just proceeded to Step 2, running the msiexec uninstall command.

                       

                      It errors out with a 1605:

                      ERROR_UNKNOWN_PRODUCT 1605 This action is only valid for products that are currently installed. The log file is listed below.

                       

                      Would the msiexec.exe /x{D2B9C003-A3CD-44A0-9DE5-52FE986C03E5} EPOSPAWNED=True /q /l+*v C:\Windows\Temp\McAfeeLogs\McAfeeHip8_UnInstall.log also work on a 64-bit server? As this machine is a 64-bit machine.

                       

                      Thanks for looking at this!

                       

                      === Verbose logging started: 5/1/2012  8:07:56  Build type: SHIP UNICODE 3.01.4000.4042  Calling process: C:\WINDOWS\system32\msiexec.exe ===

                      MSI (c) (AC:A8) [08:07:56:546]: Resetting cached policy values

                      MSI (c) (AC:A8) [08:07:56:546]: Machine policy value 'Debug' is 0

                      MSI (c) (AC:A8) [08:07:56:546]: ******* RunEngine:

                                 ******* Product: {D2B9C003-A3CD-44A0-9DE5-52FE986C03E5}

                                 ******* Action:

                                 ******* CommandLine: **********

                      MSI (c) (AC:A8) [08:07:56:546]: Client-side and UI is none or basic: Running entire install on the server.

                      MSI (c) (AC:A8) [08:07:56:546]: Grabbed execution mutex.

                      MSI (c) (AC:A8) [08:07:56:593]: Cloaking enabled.

                      MSI (c) (AC:A8) [08:07:56:593]: Attempting to enable all disabled priveleges before calling Install on Server

                      MSI (c) (AC:A8) [08:07:56:609]: Incrementing counter to disable shutdown. Counter after increment: 0

                      MSI (s) (24:44) [08:07:56:624]: Grabbed execution mutex.

                      MSI (s) (24:64) [08:07:56:624]: Resetting cached policy values

                      MSI (s) (24:64) [08:07:56:624]: Machine policy value 'Debug' is 0

                      MSI (s) (24:64) [08:07:56:624]: ******* RunEngine:

                                 ******* Product: {D2B9C003-A3CD-44A0-9DE5-52FE986C03E5}

                                 ******* Action:

                                 ******* CommandLine: **********

                      MSI (s) (24:64) [08:07:56:624]: Machine policy value 'DisableUserInstalls' is 0

                      MSI (s) (24:64) [08:07:56:624]: MainEngineThread is returning 1605

                      MSI (c) (AC:A8) [08:07:56:624]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1

                      MSI (c) (AC:A8) [08:07:56:624]: MainEngineThread is returning 1605

                      === Verbose logging stopped: 5/1/2012  8:07:56 ===

                      • 9. Re: Manually remove HIPS 8.0.0.1919
                        Kary Tankink
                        Would the msiexec.exe /x{D2B9C003-A3CD-44A0-9DE5-52FE986C03E5} EPOSPAWNED=True /q /l+*v C:\Windows\Temp\McAfeeLogs\McAfeeHip8_UnInstall.log also work on a 64-bit server?

                         

                        The uninstall command will work on 64-bit systems. 

                         

                         

                         

                        Please open a McAfee Support Service Request for this issue.

                        1 2 Previous Next