Emsisoft Removal

[Mainstay]

Can anyone give me some pointers on how to remove the Emsisoft antivirus software from a client's workstation?
Windows uninstaller appears to work, requests a restart to complete, but the software remains. I tried their Emsiclean removal tool and another 3rd party uninstaller with no love.

@Barcelona any tips?

 

[glennd]

Can anyone give me some pointers on how to remove the Emsisoft antivirus software from a client's workstation?
Windows uninstaller appears to work, requests a restart to complete, but the software remains. I tried their Emsiclean removal tool and another 3rd party uninstaller with no love.

@Barcelona any tips?

How do you mean "the software remains"? Does the program still run on startup even after the uninstaller has completed? Does the uninstaller report any errors? Are the services still running? Are the executables still present? Some files are left over?

 

[Archon Prime]

@UmbraEmsisoft might be able to assist you with that.

 

[Mainstay]

Yes, the program still runs on startup, the services are running and all the program files still remain. There are no errors at all, in fact, the software ran it's updates today and says the system is fully protected.

 

[Markverhyden]

Are you sure it's not a managed installation?

 

[Archon Prime]

Ya, if it's a managed install it would just come right back lol

 

[Mainstay]

It is a managed product but the Kabuto software that we are using to manage it only give an "activate" or "deactivate" option from the dashboard. Deactivation sends a prompt to the workstation that is being shutdown for uninstall, the system requests a reboot for completion, and there it is again in all it's glory!

 

[Mainstay]

Thanks for all your help on this! I was finally able to get the software removed. It seems that the uninstall was not successfully stopping the service. The service was hanging and then the restart was relaunching everything all over again. Several restarts later I was finally able to get it to clear.

 

[GTP]

Sorry, late to the funeral. I haven't experienced this scenario so cant offer any tips.
Seems you've got it sorted as others suggested.
Just curious though, was/is this installation a full monitoring + Av or just Av?
Did you "Disable Antivirus" before Deactivating?

 

[Mainstay]

It was a Kabuto >> Emsisoft install.

>>Did you "Disable Antivirus" before Deactivating?

It may be that we didn't. Not sure how the dashboard can override the local install, but it may be.

 

[GTP]

if you don't disable the AV first then deactivate the device the EAM will stay on the system.

AFAIK, disabling then deactivating tells the dashboard to remove it from the Dashboard and the device as well.