Uninstalling Symantec Endpoint Anti-virus

Actually, we added this to our SEP install policies too. We run it as a script, so I don't know why you saw errors with that? No need for use to make a .pkg as it runs as a script in JSS fine.

Ours runs before the SEP install as we also offer it in Self Service and sometimes there's remnants of old SEP on Macs. It works great and makes sure there are no "can't upgrade" errors.

Here's the top of the script I have:

#!/bin/sh
# File Name: SymantecRemovalTool.command Version=5.53
# Author: Corey Swertfager, Symantec Corporation
# Created: 10/04/2001
# Modified: 11/02/2009

@boettchs

Can you post the full script or link to it? As we are looking into this as well without pushing a .pkg.

@mojo21221][/url - The script is already linked in the original posting. Just go to ftp://ftp.symantec.com/misc/tools/mactools/RemoveSymantecMacFiles.zip and download the script.

@boettchs][/url - The script you posted is from 2009. The link ftp://ftp.symantec.com/misc/tools/mactools/RemoveSymantecMacFiles.zip is the most current script from Dec 10, 2013

[ftp://ftp.symantec.com/misc/tools/mactools/RemoveSymantecMacFiles.zip](ftp://ftp.symantec.com/misc/tools/mactools/RemoveSymantecMacFiles.zip)

@zmbarker][/url - my first post showed that header. I was asked to post it, so I did.
The script I'm using is working great with SEP 11.x. I'll have a look at the other.
Thanks!

*Edit: I'm unable to grab that file on the Symantec ftp site...

Thanks - at the same time I got it from Symantec. Is this the one that was having troubles with renaming to .sh and running in Casper?

I packaged it in a DMG and it worked for me :D

I wasn't able to get it to run properly without adding the '-A' parameter to the command. Removal script looks like this:

SymantecRemoval.command -A &
RemovalPID=`echo "$!"`
wait $RemovalPID
reboot

@acdesigntech can you elaborate on how your script works? do you run this after putting the SymantecRemoval.command onto the machine? thanks!

.

yes you have to put the symantecremoval.command file on the Mac, then invoke it with the '-A' switch. it will tell the removal script to remove symantec from all attached drives.

I think I must be missing something here. I've downloaded the latest removal tool and have it pkg in Casper. I'm able to run it in Self Service only to the point where think it kicks off the .command file. After that it hangs. I'm assuming that it's hanging, because it's expecting some input like what happens if you just run the .command file by double clicking it. I'm sure the answer is right in front of my face, but don't seem to see it. Any thoughts?

I put the .command file in a DMG, so that it gets dropped in the location of my choice on the machine, then use 'execute command' under Files and Processes in a JSS policy to run the script.

I believe there are switches that you have to use, otherwise it will ask which drives to remove Symantec from. try using the '-A' switch I mentioned above.

So I'm trying to package this uninstall command and having issues. Here's what I did:

1) Put it in a folder we keep our policies and scripts in on the machine locally.
2) Used a postinstall script to run the command :
cd <location of file>
SymantecRemovalTool.command -A

But what happens it goes into an endless loop with the following text:
" SymantecRemoval.command 7.0.34 **

WARNING: This script will remove all files and folders created by Symantec OS X products (except Symantec Adminstration Console for Macintosh files) and any files within those folders. Therefore, you will lose ALL files that reside in those folders, including any that you have created.

1 - Remove all Symantec files/folders.

2 - Quit. Do not remove any files.

Enter choice (1 or 2): "

I could run this manually and select 1 and it does the job nicely...but need to be able to automate it so it start and removes the files.

Also, have people had success with removing the file, and then installing a new version and then rebooting vs remove, reboot, install, reboot? Trying to minimize the reboots needed since we have filevault in play and would need to bypass it.

you could just think about editing the script and hard code in choice 1.
you could look into expect scripting.
you could just write a script to do that same things that their tool is doing.

and yes you should probably reboot its going to be much more simple than figuring all the other pieces out that you have try to do. And since Symantec decided rebooting was the best solution you should heed their advice i think.

But why not just install the new version over the old version that i have been doing for years without issue.

@nessts When we install it over the old version the apps don't seem to work. You click on them to open and they bounce in the dock for 5 seconds and then go away. Live Update is the only that actually works and seems to download the update - but the other apps won't open for us to verify that things installed correctly. Hence the uninstall and re-install method. If you have a fix for the apps not working, that would be even better.

sorry @roiegat I have never seen that behavior. Of course I never jumped more than one version at a time, we kept up with the versions as we always needed the newest version.

Hey I think i'm running into the issue with it trying to only look at the boot volume. Can some explain how to put in the -A parameter? I'm not the best at scripting but I have gone over the instructions for hours in their script and I still cannot make the change.

SymantecRemoval.command -A

Im pretty sure i'm doing this right, but maybe something has changed.

Once I run the PGK, self service says this:

it then just hangs there.

@zmbarker Hey I found my issue here..

The link you have in the first post goes to a different command as the old one still exists under: [ftp://ftp.symantec.com/misc/tools/mactools/SymantecRemovalTool.zip](ftp://ftp.symantec.com/misc/tools/mactools/SymantecRemovalTool.zip)

This one does work correctly.

I got the tool from https://support.symantec.com/en_US/article.TECH103489.html to work by creating a policy that installs a package that copies the RemoveSymantecMacFiles.command file to /private/tmp/ and in File and Processes - Execute Command:

echo 1 | /private/tmp/RemoveSymantecMacFiles.command

It'll pipe the 1 to the command and run automatically.

^^^ Thanks @ardukes - that is the ticket. Worked great.