Uninstall SecTeer VulnDetect Agent

Tom

Can I uninstall the Agent using the Agent and Custom Software?

Yes, that is doable, although you won't be able to see the correct state in the Job Activity, because the system won't be able to report back to the backend.

Here is a PowerShell script that does that:

$SecTeer = "SecTeer VulnDetect"
$PF = if ([Environment]::Is64BitOperatingSystem) { ${env:ProgramFiles(x86)} } else { $env:ProgramFiles }
$SecTeerPath = Join-Path $PF $SecTeer

$unins = @("unins000.exe","unins001.exe") | ForEach-Object { Join-Path $SecTeerPath $_ } | Where-Object { Test-Path $_ } | Select-Object -First 1
$ok = $true

if($unins){
  $p = Start-Process -FilePath $unins -ArgumentList "/VERYSILENT /SUPPRESSMSGBOXES /FORCECLOSEAPPLICATIONS /NOCANCEL" -Wait -PassThru -WindowStyle Hidden -ErrorAction SilentlyContinue
  if(!$p -or $p.ExitCode -ne 0){ $ok = $false; Write-Warning "Uninstaller exit code: $($p.ExitCode)" }
}else{
  $app = Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall","HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" -ErrorAction SilentlyContinue |
         Get-ItemProperty -ErrorAction SilentlyContinue | Where-Object DisplayName -Like "$SecTeer*"
  foreach($a in $app){
    if($a.UninstallString -match 'MsiExec\.exe.*?({[\w-]+})'){ Start-Process msiexec.exe "/x $($matches[1]) /qn /norestart" -Wait -ErrorAction SilentlyContinue }
    elseif($a.UninstallString){ Start-Process cmd.exe "/c $($a.UninstallString) /qn /norestart" -Wait -ErrorAction SilentlyContinue }
  }
}

Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object { $_.TaskName -like "SecTeer VulnDetect*" -or $_.TaskName -like "SecTeerVulnDetect*" } |
  ForEach-Object { Unregister-ScheduledTask -TaskName $_.TaskName -TaskPath $_.TaskPath -Confirm:$false -ErrorAction SilentlyContinue }

Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall","HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" -ErrorAction SilentlyContinue |
  Where-Object { (Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue).DisplayName -like "$SecTeer*" } |
  Remove-Item -Recurse -Force -ErrorAction SilentlyContinue

Remove-Item (Join-Path $env:ProgramData $SecTeer) -Recurse -Force -ErrorAction SilentlyContinue

if($ok){ Write-Output "$SecTeer removed."; exit 0 } else { Write-Warning "$SecTeer uninstall may have failed."; exit 1 }