Uninstall SecTeer VulnDetect Agent

Tom

Can I uninstall the Agent using the Agent and Custom Software?

Yes, that is doable, although you won't be able to see the correct state in the Job Activity, because the system won't be able to report back to the backend.

Here is a PowerShell script that does that:

# Set environment variables for 32-bit and 64-bit Windows
$ProgramData = $env:ProgramData
$SecTeer = "SecTeer VulnDetect"
$myTaskPath = "\$SecTeer\"

if ($env:PROCESSOR_ARCHITECTURE -eq "x86") {
    $agentRegPath = 'Registry::HKLM\Software\SecTeer\Agent'
    $appRegPath = "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*"
    $ProgramFiles = "${env:ProgramFiles}"
} else {
    $agentRegPath = 'Registry::HKLM\Software\WOW6432Node\SecTeer\Agent'
    $appRegPath = "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"
    $ProgramFiles = "${env:ProgramFiles(x86)}"
}

$SecTeerPath = Join-Path -Path $ProgramFiles -ChildPath $SecTeer

# Determine the uninstall method - prefer EXE uninstaller if available
$command = if (Test-Path -Path "$SecTeerPath\unins000.exe") {
    Join-Path -Path $SecTeerPath -ChildPath "unins000.exe"
} elseif (Test-Path -Path "$SecTeerPath\unins001.exe") {
    Join-Path -Path $SecTeerPath -ChildPath "unins001.exe"
} else {
    $null
}

# Launch the uninstaller if found, attempt MSI removal otherwise
if ($command) {
    try {
        $processSpecs = New-Object System.Diagnostics.ProcessStartInfo
        $processSpecs.FileName = $command
        $processSpecs.RedirectStandardError = $True
        $processSpecs.RedirectStandardOutput = $True
        $processSpecs.UseShellExecute = $False
        $processSpecs.Arguments = "/VERYSILENT /SUPPRESSMSGBOXES /FORCECLOSEAPPLICATIONS /NOCANCEL"
        $process = [System.Diagnostics.Process]::Start($processSpecs)
        $process.WaitForExit()
    } catch {
        Write-Warning "Failed to start the uninstaller process: $_"
    }
} else {
    try {
        Uninstall-Package -Name "$SecTeer" -Force -ErrorAction SilentlyContinue
    } catch {
        Write-Warning "Failed to uninstall the package: $_"
    }
}

# Remove all scheduled tasks related to SecTeer VulnDetect
$scheduleTasks = @(
    "SecTeer VulnDetect*",
    "SecTeerVulnDetectAgentStateMonitoring",
    "SecTeerVulnDetectMaintenance*"
)

foreach ($taskName in $scheduleTasks) {
    try {
        Get-ScheduledTask -TaskName $taskName -TaskPath "\" -ErrorAction SilentlyContinue | Unregister-ScheduledTask -Confirm:$false
    } catch {
        Write-Warning "Failed to unregister task $taskName: $_"
    }
}

# Clear registry remnants in Add/Remove Programs
try {
    Get-ItemProperty "HKLM:\$appRegPath" | Where-Object { $_.DisplayName -like "$SecTeer*" } | Remove-Item -Force -ErrorAction SilentlyContinue
} catch {
    Write-Warning "Failed to remove registry remnants: $_"
}

# Purge leftover files and folders
try {
    $folderToRemove = Join-Path -Path $ProgramData -ChildPath $SecTeer
    Remove-Item -Path $folderToRemove -Recurse -Force -ErrorAction SilentlyContinue
} catch {
    Write-Warning "Failed to remove folder $folderToRemove: $_"
}

Write-Output "$SecTeer has been successfully removed."