SCSCleanWipe 1.0

SCSCleanWipe 1.0

Users Guide

Table of Contents

Revision Information 

Document Overview 

Application Overview 

SCSCleanWipe Support

SCSCleanWipe 1.0 Contents 

SCSCleanWipe 1.0 Flow 

SCSCleanWipe 1.0 Flow (detail)

SCSCleanWipe tool grouping 

Custom Batch File Overview 

SCSCleanWipe.bat 

RunCleanWipe.bat 

UnEngVar.bat 

DynamicSetEnVar.bat

TerminateProcesses.bat

UnregisterDLLs.bat

DeleteDirectoryTree.bat

ModifyRegistryValues.bat 10110v216k

Custom Tool Overview 

GenEnVar.exe 

ServiceShutdown.exe 

GenDynamicFilesKeys.exe 

DeleteFiles.exe 

Input/Data File Overview 

nolu.reg 

noquar.reg 

noSymEvent.reg 

removecomponentkeys.reg 

removeproductkeys.reg 

SCSKeys.reg 

DeleteFiles_in_AllApps_files.txt

DeleteFiles_in_AllApps_folders.txt

DeleteFiles_in_LiveUpdate.txt

DeleteFiles_in_SymEvent.txt

DeleteFilesEnVar.txt

GenEnVar_in.txt 

GenerateRegKeys_in.txt

ServiceShutdown_in.txt

UnEngVar.txt 

Revision Information

Document Overview

• This document outlines the features of SCSCleanWipe 1.0 detailing the flow, batch file information, executable information and input file data comprising the application.

Application Overview

• SCSCleanWipe 1.0 is a compilation of executables which when run together, removes the presence of Symantec Client Security 1.0, 2.0, and 3.0 from a target system. RunCleanWipe.bat, is the core batch file comprising of the following executables which can also function individually as modules. SCSCleanWipe is an unsupported Symantec tool provided as a fallback resource in case a regular uninstallation cannot properly commence. The tool is provided at an "as is" state and Symantec takes no responsibilities with any unforeseen errors resulting from usage of the tool.

SCSCleanWipe Support

Application Support

• SCSCleanWipe 1.0 is designed to handle all SCS applications including

SSC  10.0.0.0

SAV-Server  10.0.297.0

SAV-Client  10.0.297.0

SCS  SAV 10.0.297.0 and SCF 8.5.0.47

Quarantine Server 3.3.0

Quarantine Console 3.3.0

SCFA  8.5.0.0

AMS  9.0.0.0

SCF 1.0 5.0.0.375

SAVC 1.0 8.0.0.374

O/S Support

• SCSCleanWipe 1.0 is designed to function on Windows 2000 and Windows XP

Language Support

• SCSCleanWipe 1.0 is designed to function on all 18 International O/S languages so long as installations are to non HI-ASCII and non DBCS paths.

Installation Path Support

• SCSCleanWipe 1.0 is designed to remove installations on default and custom folders, however, files located in system folders (WINNT/Windows \System32, System ) will be left behind.

Package 1.0 Contents

• SCSCleanWipe 1.0 is distributed in a compressed zip file named SCSCleanWipe.zip.
• Two main folders are created including App and Docs
• The App folder contains all the core files comprising SCSCleanWipe including all the batch files, executables, input files, and log files
• The Docs folder contains all associated documentation for SCSCleanWipe

WinZip is a registered trademark of WinZip Computing, Inc

Uninstallation Flow

Uninstallation Flow (detail)

Determine static SCSCleanWipe user-set variables

Determine silent/interactive mode

Determine if SymEvent will be deleted

Determine if LU will be deleted

Determine if Def/IDS/Certs folders will be removed

Determine reboot/suppress reboot

Determine if user will be warned before proceeding

Determine main log file folder

Dynamically set environment variables (GenEnVar.exe)

Get and set environment variables

Search for and set SCS Installation path variables from (\\HKLM\Software\Symantec\InstalledApps) but if key(s) and/or values are not preset, set pre-defined default paths

Shutdown Services (ServiceShutdown.exe)

From pre-defined list of services to shutdown, determine which service is currently running and shut it down

Terminate processes (TerminateProcesses.bat)

From pre-defined list of processes to shutdown, determine which process is currently running and shut it down

Generate dynamic files and registry keys (GenDynamicFilesKeys.exe)

From pre-defined list of upgrade codes corresponding to applications to be removed, determine corresponding product keys, component keys, uninstall keys and msi file names in preparation for deletion.

Remove Static Registry keys

Remove dynamically generated registry keys from step #4

Remove pre-defined static keys corresponding to applications to be removed

Remove keys associated with SymEvent,  LU, Def/IDS/Certs if selected

Unregister DLL's (UnregisterDLLs.bat)

From pre-defined list of DLL's, unregister these dll's

Remove Files (Deletefiles.exe)

From a pre-defined list of files corresponding to applications to be removed, delete the files from the system ONLY if access to them is not denied.

From a pre-defined list of folders corresponding to applications to be removed, delete the folders from the system ONLY if they are not empty.

Remove Directory trees (DeleteDirectoryTree.bat)

From a pre-defined list of folders corresponding to applications to be removed, delete the folders from the system including all files and subdirectories within the folder

Remove Dynamic Registry values (ModifyRegistryValues.bat 10110v216k )

Similar to step #5, remove remaining key names and values

Reboot the computer

(if applicable)

SCSCleanWipe tool grouping

Custom Batch File Overview

SCSCleanWipe.bat

Overview:

• SCSCleanWipe.bat is a simple batch file which calls RunCleanWipe.bat and exists purely so that the user has a singe batch fie to click on making launching the Application simpler.

Dependencies:

• Existence of App\RunCleanWipe.bat

Input:

• None

Output:

• Execution of App\RunCleanWipe.bat

RunCleanWipe.bat

Overview:

• RunCleanWipe.bat is the main batch file comprising SCSCleanWipe. It contains calls to all the batch files and tools that need to execute for SCSCleanWipe to complete. RunCleanWipe can be configured to run silently or interactively and each executable called can be configured to be individually silent or interactive.

Dependencies:

• DeleteFiles.exe
• ESUGUnEn.exe
• GenEnVar.exe
• GenDynamicFilesKeys.exe
• ServiceShutdown.exe
• DeleteDirectorytree.bat
• DynamicSetEnVar.bat
• ModifyregistryValues.bat
• TerminateProcesses.bat
• UnEngVar.bat
• UnregistrDLLs.bat
• Nolu.reg (optional)
• Noquar.reg (optional)
• noSymEvent.reg (optional)
• removecomponentkeys.reg (dynamically generated)
• removeproductkeys.reg (dynamically generated)
• SCSKeys.reg

Input:

• <See Dependencies>
• Silent Mode enablement (SILENT=1 to enable, 0 to disable)
• SymEvent File and RegKey removal (REMOVE_SYMEVENT=1 to remove, 0 to retain)
• LiveUpdate File and RegKey remove (REMOVE_LIVEUPDATE=1 to remove, 0 to retain)
• Full Folder path removal (REMOVE_DEFS=1 to remove, 0 to retain)
• Reboot enablement (REBOOT=1 to enable, 0 to suppress)
• Execution confirmation (WARN_FIRST=1 to warn user, 0 to execute w/o confirmation)
• Log file location and name

Output:

• System environment and installation path variable setup
• Shutdown of pre-defined existing and running services
• Termination of pre-defined processes
• Dynamic generation of component and product keys to be removed
• Removal of static and dynamically generated registry keys
• Un-registration of pre-defined list of DLL's
• Removal of pre-defined files and folders in dynamically generated locations
• Removal of pre-defined folders and all contents including subdirectories
• Deletion of registry key values
• Reboot of computer (optional)
• Log file containing deletion information in \logs folder named SCSCleanWipe.log in addition to all log files generated by each batch file and executable called

Notes:

UnEngVar.bat

Overview:

• UnEngVar.bat is a simple batch file that is used to set some installation path variables used by DeleteDirectoryTree.bat and ModifyRegistryValues.bat 10110v216k so that the tools can properly remove folders and subdirectories.

Dependencies:

• Proper formatting of UnEngVar.txt with correct registry key locations for which to look for values

Input:

• UnEngVar.txt containing variable environment name, variable key location, and variable key name

Output:

• System Environment variable settings
• Installation path environment variable settings

Notes:

DynamicSetEnVar.bat

Overview:

• DynamicSetEnVar.bat is generated by GenEnVar.exe and is called by RunCleanWipe.bat after GenEnVar.exe execution and prior to running DeleteDirectoryTree.bat.The purpose of this batch file is to set the installation path variables for potential applications being removed so that DeleteDirectoryTree.bat can properly remove folders and subdirectories.

Dependencies:

• Proper and prior execution of GenEnVar.exe

Input:

• Input file containing environment and application variable names fed into GenEnVar.exe.
• Proper System Environment variable registry key values

Output:

• System Environment variable settings
• Installation path environment variable settings

Notes:

TerminateProcesses.bat

Overview:

• TerminateProcesses.bat is a simple batch file that when called, terminates existing processes defined within the file. TerminateProcesses makes calls to ESUGUnEn.exe utilizing the /KILLP kill process option along with the process executable and reports process shutdown status to a log file.

Dependencies:

• Predetermined list of processes to shut down
• ESUGUnEn.exe and its dependencies

Input:

• Predetermined list of processes to shut down
• Log file location and name

Output:

• Proper termination of processes
• Log file containing processes termination information in \logs folder named TerminateProcesses.log (or custom)

Notes:

• TerminateProcesses will attempt to terminate a process even though the process may not be running.

UnregisterDLLs.bat

Overview:

• UnregisterDLLs.BAT is a simple batch file that makes calls to regsvr32 /u /s to un-register dll's defined within the file. Upon completion of this batch file, all pre-defined dll's will be un-registered with the system allowing for their removal.

Dependencies:

• Predetermined list of dll's to un-register
• Execution of UnEngVar.bat so that installation variables can be pre-set.
• Execution of DynamicSetEnVar.bat so that installation variables can be pre-set.

Input:

• Predetermined list of dll's to un-register
• Environment variables pre-set by UnEngVar.bat and DynamicSetEnvar.bat

Output:

• Un-registration of list of dll's

Notes:

DeleteDirectoryTree.bat

Overview:

• DeleteDirectoryTree.bat is a simple batch file that makes calls to the rd /s /q command line which will remove a directory including all files and subdirectories contained within it.

Dependencies:

• Proper and prior execution of GenEnVar.exe and DynamicSetEnVar.bat since DeleteDirectoryTree.bat requires population of installation path variables which are set by the aforementioned tools.
• Proper and prior execution of UnEngVar.bat since DeleteDirectoryTree.bat requires population of installation path variables which are set by the batch file.
• Existence of the folder prior to deletion. DeleteDirectorytree will only attempt to delete a folder if it or contents of it has been found. If a folder/folder contents are not found, DeleteDirectorytree will skip to the next folder entry.

Input:

• Predetermined list of folders to delete
• Installation path environment variables pre-set by DynamicSetEnVar.bat and UnEngVar.bat

Output:

• Removal of folder contents as well as all contained subdirectories
• Log file containing processes termination information in \logs folder named DeleteDirectoryTree.log (or custom)

Notes:

• Unlike DeleteFiles.exe, DeleteDirectoryTree will delete a folder regardless if it is not empty or contains files not initially part of the installation processes.

ModifyRegistryValues.bat 10110v216k

Overview:

• ModifyRegistryValues.bat 10110v216k is a simple batch file that makes calls to ESUGUnEn.exe tool and its /DELVAL feature which will delete a value from a pre-determined registry key location. This batch file and its calls will further remove the presence of applications by removing registry key value references. Unlike straight *.reg file applications, ModifyRegistryValues.bat 10110v216k utilizes environment variables to delete values that can vary based on custom installation scenarios. 

Dependencies:

• Proper and prior execution of GenEnVar.exe and DynamicSetEnVar.bat since ModifyRegistryValues.bat 10110v216k requires population of installation path variables which are set by the aforementioned tools.
• Proper and prior execution of UnEngVar.bat since ModifyRegistryValues.bat 10110v216k requires population of installation path variables which are set by the batch file.

Input:

• Predetermined list of registry key values to delete
• Installation path environment variables pre-set by DynamicSetEnVar.bat and UnEngVar.bat

Output:

• Removal of environment variable-ized registry keys from the registry
• Log file containing processes termination information in \logs folder named ModifyRegistryValues.log (or custom)

Notes:

Custom Tool Overview

GenEnVar.exe

Overview:

• GenEnVar.exe is a tool which generates environment variable files used by tools within SCSCleanWipe. In addition to a log file, GenEnVar generates an environment variable file (DeleteFilesEnVar.txt) used by DeleteFiles.exe as well as an environment settings batch file (DynamicSetEnVar.bat) used by DeleteDirectoryTree.bat. The tool searches the registry for potential custom installation paths provided by keys located within an input file and if values are found, these values replace the default values defined within the source file. If no key or corresponding value is found, the default installation paths are used.

Dependencies:

• Predefined set of registry keys and corresponding default values in an external file.

Input:

• Predefined set of registry keys and corresponding default values in an external file.
• (Optional) Silent mode enablement

Output:

• Environment variable file (DeleteFilesEnVar.txt) used by DeleteFiles.exe
• Environment settings batch file (DynamicSetEnVar.bat) used by DeleteDirectoryTree.bat and called by SCSCleanWipe.
• Log file containing deletion information in \logs folder named <inputfile>.log
• (Configurable) Environment variable assignment information to window

Command line parameters:

GenEnvar <input file> <-silent>

Example:

Create environment file named DeleteFilesEnVar.txt and environment settings batch file named DynamicSetEnVar.bat silently.

GenEnVar GenEnVar_in.txt -silent

A log file named GenEnVar_in.txt.log will be created in the logs folder outlining environment variable assignments.

Notes:

• To look for custom path installations, GenEnVar.exe looks at the HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\InstalledApps key and looks for pre-defined registry key names and their corresponding values. If keys or their values are not present, the default installation paths as defined within the source file will be used.
• GenEnVar.exe and DynamicSetEnVar.bat must both be executed in order prior to running DeleteDirectoryTree.bat. DeleteDirectoryTree.bat is dependent upon environment variables set by DynamicSetEnVar.bat.

ServiceShutdown.exe

Overview:

• ServiceShutdown.exe is a tool which shuts down existing and running services on a target operating system. ServiceShutdown gathers a list of service names located in an external file and individually shuts down each service including any other services dependent on the service being shut down. If a service state is either already shut down or pending shutdown, ServiceShutdown bypasses the service and proceeds to the next applicable service. Optionally a custom wait time between 1 and 15 seconds can be passed onto the tool to ensure that services that require a longer shutdown time are properly shut down.

Dependencies:

• Predefined set of services to shut down contained in an external file.

Input:

• Predefined set of services to shut down contained in an external file.
• (Optional) Service Shutdown wait time
• (Optional) Silent mode enablement

Output:

• Service and dependent service shutdown
• Log file containing service shutdown information in \logs folder named <inputfile>.log
• (Configurable) Service Shutdown information to window

Command line parameters:

ServiceShutdown <input file> <shutdown time in ms> <-silent>

Example:

Interactively shutdown all services located in ServiceShutdown_in.txt allowing for as much as 4 seconds waiting for services to properly shutdown.

ServiceShutdown ServiceShutdown_in.txt 4000

A log file named ServiceShutdown_in.txt.log will be created in the logs folder outlining service shutdown information.

Notes:

• ServiceShutdown can be used multiple times in a batch script to shutdown services located in multiple input files. Services that can be shut down in smaller amounts of time can be grouped into one set and services that require more time, can be grouped into another set. During batch file setup, different wait-times can be assigned to each input set. Individual log files will be created as well.

GenDynamicFilesKeys.exe

Overview:

• GenDynamicFilesKeys.exe is a tool which generates registry keys associated with applications to be removed from a target system. In addition to a log file, GenerateRegkeys generates 2 REGEDIT4 registry files (which when applied to the system, contains keys which will be removed) and DynamicMSIFilesToDelete.txt (which contains a listing of MSI files affiliated with the upgrade codes). The two registry files include removeproductkeys.reg (which contain product keys associated with the upgrade codes corresponding to applications to be removed) and removecomponentkeys.reg (which contain component keys associated with each product key).

Dependencies:

• Predefined set of applications and corresponding upgrade keys in an external file

Input:

• Predefined set of applications and corresponding upgrade keys in an external file
• (Optional) Silent mode enablement

Output:

• removeproductkeys.reg (which contain product keys associated with the upgrade codes corresponding to applications to be removed)
• removecomponentkeys.reg (which contain component keys associated with each product key).
• DynamicMSIFilesToDelete.txt (which contain a listing of msi files associated with each upgrade code which can be fed into DeleteFiles.exe for deletion)
• Log file containing deletion information in \logs folder named <inputfile>.log
• (Configurable) RegKey generation information to window

Command line parameters:

GenDynamicFilesKeys <input file> <-silent>

Example:

Create product and component key files which when applied to the system, removes traces a listing of applications contained in GenerateRegkeys_in.txt silently.

GenDynamicFilesKeys.exe GenDynamicFilesKeys_in.txt -silent

A log file named GenDynamicFilesKeys_in.txt.log will be created in the logs folder outlining which applications were found on the system and which registry keys associated with these applications were tagged for removal.

Notes:

• By using upgrade codes to classify applications to be removed, any application using the same upgrade codes will have keys removed from the system.
• The core registry hives used by GenDynamicFilesKeys.exe include

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components

DeleteFiles.exe

Overview:

• DeleteFiles.exe is a tool which detects and deletes files on a target operating system. Gathering a list of files and/or folders from an external file in addition to an environment variable file containing values for installation path variables, DeleteFiles deletes the file/folder if it is found. Files are only deleted if they are currently not in use and in the case of folders, only if they are empty.

Dependencies:

• Predefined environment variables file named (DeleteFilesEnVar.txt) containing variable names and values
• Predefined set of filers and/or files to delete contained in an external file.

Input:

• Predefined environment variables file named (DeleteFilesEnVar.txt) containing variable names and values
• Predefined set of filers and/or files to delete contained in an external file.
• (Optional) Silent mode enablement

Output:

• File and/or folder deletion
• Log file containing deletion information in \logs folder named <inputfile>.log
• (Configurable) File/Folder deletion information to window

Command line parameters:

DeleteFiles <input file> <-silent>

Example:

Interactively delete all files contained in DeleteFiles_in_AllApps_Folders.txt silently

DeleteFiles DeleteFiles_in_AllApps_Folders.txt -silent

A log file named DeleteFiles_in_AllApps_Folders.txt.log will be created in the logs folder outlining file deletion information

Notes:

• DeleteFiles can be used multiple times in a batch script to delete files in multiple input files. It is recommended that file deletions be housed in one file and folder deletions in another file. During the batch file, file deletions should be called first (so that folder contents can be emptied) and then folder deletions (since only empty folders will be deleted).
• As part of the SCSCleanWipe batch script, GenEnVar.exe dynamically generates DeleteFilesEnVar.txt. GenEnVar searches the registry for any custom installation paths and if any are found, replaces default values within DeleteFilesEnVar.txt with the custom values. If no custom paths are found, GenEnVar uses the default installation paths to populate environment variables.

Input/Data File Overview

nolu.reg

Overview:

• This regedit4 formatted file contains a listing of registry keys associated with LiveUpdate. When applied to the registry, all associated keys will be removed from the system.

Dependencies:

• This registry file is applied only if RunCleanWipe has been configured to remove LiveUpdate.

noquar.reg

Overview:

• This regedit4 formatted file contains a listing of registry keys associated with quarantine console/server. When applied to the registry, all associated keys will be removed from the system.

Dependencies:

• This registry file is called by RunCleanWipe.bat

noSymEvent.reg

Overview:

• This regedit4 formatted file contains a listing of registry keys associated with SymEvent. When applied to the registry, all associated keys will be removed from the system.

Dependencies:

• This registry file is applied only if RunCleanWipe has been configured to remove SymEvent.

removecomponentkeys.reg

Overview:

• This dynamically generated, regedit4 formatted file contains a listing of component keys associated with applications to be removed that are fed into GenDynamicFilesKeys.exe. When applied to the registry, all associated keys will be removed from the system.

Dependencies:

• This registry file is called by RunCleanWipe.bat

removeproductkeys.reg

Overview:

• This dynamically generated, regedit4 formatted file contains a listing of product keys associated with applications to be removed that are fed into GenDynamicFilesKeys.exe. When applied to the registry, all associated keys will be removed from the system.

Dependencies:

• This registry file is called by RunCleanWipe.bat

SCSKeys.reg

Overview:

• This regedit4 formatted file contains a listing of registry keys associated with all the products comprising SCS. When applied to the registry, all associated keys will be removed from the system.

Dependencies:

• This registry file is called by RunCleanWipe.bat

DeleteFiles_in_AllApps_files.txt

Overview:

• This file contains a listing of files comprising SCS. This list will be fed into DeleteFiles.exe and each individual file will be deleted.

Dependencies:

• This file is called by RunCleanWipe.bat in conjunction with Deletefiles.exe

DeleteFiles_in_AllApps_folders.txt

Overview:

• This file contains a listing of folders comprising SCS. This list will be fed into DeleteFiles.exe and each individual file will be deleted.

Dependencies:

• This file is called by RunCleanWipe.bat in conjunction with Deletefiles.exe

DynamicMSIFilesToDelete.txt

Overview:

• This file contains a listing of msi files detected on the system corresponding to the upgrade codes provided to GenDynamicFilesKeys. This list will be fed into DeleteFiles.exe and each individual MSI file will be deleted. This file is generated by GenDynamicFilesKeys.

Dependencies:

• This file is called by RunCleanWipe.bat in conjunction with Deletefiles.exe

DeleteFiles_in_LiveUpdate.txt

Overview:

• This file contains a listing of files comprising LiveUpdate. This list will be fed into DeleteFiles.exe and each individual file will be deleted.

Dependencies:

• This file is called by RunCleanWipe.bat in conjunction with Deletefiles.exe

DeleteFiles_in_SymEvent.txt

Overview:

• This file contains a listing of files and folders comprising SymEvent. This list will be fed into DeleteFiles.exe and each individual file will be deleted.

Dependencies:

• This file is called by RunCleanWipe.bat in conjunction with Deletefiles.exe

DeleteFiles_in_Windows_Files.txt

Overview:

• This file contains a listing of files located under %Windows% that are affiliated with each application under SCS 3.0 This list will be fed into DeleteFiles.exe and each individual file will be deleted.

Dependencies:

• This file is called by RunCleanWipe.bat in conjunction with Deletefiles.exe

DeleteFilesEnVar.txt

Overview:

• This tab-delimited file contains environment variables and a corresponding default path that will be used by DeleteFiles.exe as well as ModifyRegistryValues.bat 10110v216k . The values assigned to environment variables will correspond to locations tools will use to delete files and folders.

Dependencies:

• This is used by DeleteFiles.exe

GenEnVar_in.txt

Overview:

• This tab-delimited file contains registry key locations and corresponding key names that map to installation paths that will be used by GenEnVar.exe in development of environment and installation path variables containing locations tools will use to delete files and folders.

Dependencies:

• This is used by GenEnVar.exe

GenerateRegKeys_in.txt

Overview:

• This tab-delimited file application names and corresponding upgrade codes that GenDynamicFilesKeys.exe uses in order to develop removeproductkeys.reg and removecomponentkeys.reg. GenDynamicFilesKeys.exe will cycle through the registry in search of these upgrade codes, locate corresponding product keys and component keys, and remove them from the system.

Dependencies:

• This is used by GenDynamicFilesKeys.exe

ServiceShutdown_in.txt

Overview:

• This file contains a listing of services that will be shut down by ServiceShutdown.exe. The listing of services is the service name located in the "General" tab of the Service Control Manager (SCM)

1) To get the service name, launch the service control manager

(settings-control panel-administrative tools-services>

2) Double Click the service in the list

3) The ServiceName is located in the "General" tab.

Dependencies:

• This is used by ServiceShutdown.exe

UnEngVar.txt

Overview:

• This file is used by UnEngVar.bat and contains registry key and key names in order to derive system environment and installation paths used by DeleteDirectoryTree.bat and ModifyRegistryValues.bat 10110v216k to determine folder and file locations.

Dependencies:

• This is used by UnEngVar.bat