Gfi Agent Removal Tool

This tool will help you to remove almost any antivirus software previously installed on your system. When trying to uninstall a GFI EndPointSecurity agent from a remote machine, the following message is displayed: Agent pending uninstall ENVIRONMENT. GFI EndPointSecurity agents are not uninstalled automatically during the un-installation of the GFI EndPointSecurity application. It is best that first you uninstall the GFI EndPointSecurity agents and next the GFI EndPointSecurity application.

From time to time, circumstances may require the removal of VIPRE without the assistance of the Windows Installer. Should an instance requiring this removal be encountered, the instructions below outline the process.
Ensure you have attempted to uninstall the Agent through Add/Remove Programs or Programs & Features.
If this fails, run the following in an Elevated Command Prompt (Depending on the installed Version):

MsiExec.exe /x {GUID} /qf /l*v '%temp%VIPRE_MsiUninstall.log' REMOVE=ALL

Gfi endpoint security agent removal tool

VIPRE Agent Install GUIDs by Version:

Version 12 Agents:
- 12.0.7873
  - Endpoint Security:C8E10C87-6B09-4049-89E5-D491262577A4
Version 10 Agents:
10.0.6290
Endpoint Security:BEEF1ABD-B362-4EC6-A106-9E858E2C08CD
10.0.6288
Endpoint Security:1E44E54A-7060-4D86-B987-CEE8FC6A39DE
10.0.6286
Endpoint Security:285887A9-D309-4D76-A934-345CA891F5EC
Version 9 Agents:
9.6.6194:
Standard:8E94C826-08F4-45AF-B225-E120BE227C0B
Premium:A0428E33-FC8A-45AF-BFAC-D2E2A4B4E0A4
Endpoint Security:070BA5FF-CB66-4376-B088-0E0234310DCF
9.6.6190:
Endpoint Security:7495E9C8-564D-4B31-97D6-840AF37D205C
9.5.6159:
Standard:C5A52260-126B-44C4-BAB6-A23D73CB8F62
Premium:3F0F54DF-836C-43D3-A1AF-AB4A4905B224
Endpoint Security:01C0B63C-D9E2-496E-B500-FEB4E0F6A1E4
9.5.6154:
Standard:7158DDCA-1459-4002-BB76-622BFE138B89
Premium:4070DFC4-DFB3-4F15-B78F-49B14A6357BF
Endpoint Security:EF078905-EA54-4E34-929E-28A75445F04D
9.3.6032:
Standard:3945FDDF-3F01-45C5-98F3-483CA13DA7BE
Premium:30D65515-CCD4-4CAF-AC61-836539CB2A63
Endpoint Security:D10CB7F9-53B4-4ABD-936F-AA93CD1D9C65
9.3.6030:
Standard:C6AB2467-7C8B-4523-A18C-C466049DBA4C
Premium:345888D4-199F-48D1-A89C-694B48F2F5A3
Endpoint Security:1D9E6C77-07CA-43B1-9A25-BF4FA0EA8758
9.3.6012:
Standard:077A97DD-E63E-4A4F-B39C-E1111AA9E151
Premium:28090F18-50E3-4AE6-B258-D27DEC2404D9
Endpoint Security:3D81A81B-477F-4D0D-8B3C-599E032CF283
9.3.6000:
Standard:2B43966F-3C72-4D34-AB5A-2D35F5320C4C
Premium:0C92648E-DC79-4A1E-A63A-FA7492E8CDA7
Endpoint Security:2645C2A8-4700-46F9-B2F7-A0E826DBCF91
Version 7 Agents:
7.5.5841:
Premium:56CA3334-8B72-48D1-81E7-3EF5243E45D5
7.5.5839:
Standard:8B2C9073-C948-4033-93EF-E7F781E43E35
Premium:1BDEA9D9-7988-4BC2-8DE3-2AE4B6E65969
7.0.5725:
Standard:82FB46C5-494D-41A8-81C4-E2CC094169BE
Premium:BAA1CAE8-8E7B-4000-AC56-38AC8BB7506A
7.0.5711:
Standard:CC1CEA69-B7AF-47EE-AB64-68B7A1E2F3CF
Premium:D685DD76-77A3-4661-B9F0-7DAE2D651260
7.0.5685:
Standard:B0783CD0-27C6-49B4-9905-AC3A6437F5A8
Premium:9CE81981-648E-4C9D-AC2F-6B129071903F
7.0.5666:
Standard:628B718E-65C3-47C8-B4C8-A86CA1B42F69
Premium:6A68DC82-9FFD-41EB-91BA-86A4CECF29C0
Version 6 Agents:
6.2.5537:
Standard:092D4B8A-D0BA-4D2D-A690-78357FEBBC38
Premium:3DF87105-29CA-4F06-9ACC-1745AFE49555
6.2.5530:
Standard:39A086B2-07D6-430B-AE5E-B8AC1CC843A7
Premium:E10809C0-E65F-4493-A31B-3F86DB6E9E2A
6.0.5481 & 6.0.5482:
Standard/Premium9D544611-F437-4153-913E-91CE036583CC
Earlier Versions
All Earier Versions:
Standard/Premium39A086B2-07D6-430B-AE5E-B8AC1CC843A7

If the program is still not removed, continue with the instructions below.

Note:Manual Agent removal should only be used when all other removal options have been exhausted

Stopping the VIPRE Services

Open Services.msc and Stopany of the following which are present:

VIPRE Business
VIPRE Business Premium
VIPRE Enterprise
VIPRE Enterprise Premium
VIPRE Edge Protection
SB Recovery Service
GFI LanGuard Attendant Service (Premium Only)
Note: If any service is unable to be stopped, set the start type to 'Disabled' and then reboot the computer.

Removing the NDIS IM Filter (Premium Only)

VIPRE's Firewall component integrated with the NIC needs to be removed to ensure connectivity:

Open ncpa.cpl
Right click the Active Network Connection and select Properties
Highlight theSunbelt / GFI / ThreatTrack NDIS IM Filter and select Uninstall

Important:Failure to uninstall the filter can result in no network connectivity after reboot

Gfi Agent Removal Tool Replacement

Important:Do NOT continue with removal if this step fails. Instead, Contact Support

Deleting the VIPRE Business Agents Related Services

Run the following in an Elevated Command Prompt (some services may not be present):

SC Delete GFIARK
SC Delete GFIUTIL
SC Delete SBAMSvc
SC Delete SBAPHD
SC Delete SBAPIFS
SC Delete SBEMI
SC Delete SBFW
SC Delete SBFWIMCL
SC Delete SBFWIMCLMP
SC Delete SBHIPS
SC Delete SBPIMSVC
SC Delete SBRE
SC Delete SBTIS
SC Delete SBWTIS
SC Delete VipreEdgeProtection

Removal of the VIPRE Agent's Registry Entries

Open RegEdit.exe and delete the following keys: (Not all keys will be present)
Keys specific to x86 or x64 versions of Windows:

Note:64-bit Systems store these keys under 'HKLM Software Wow6432Node '

HKLM Software Microsoft Windows CurrentVersion Uninstall {C1D1FC57-3EB9-4B21-BCA3-F1C927508200}
HKLM Software Microsoft Windows CurrentVersion Uninstall {GUID}
HKLM Software Sunbelt Software Sunbelt Enterprise Agent
HKLM Software GFI Software GFI Business Agent
HKLM Software GFI Software Deployment
HKLM Software SBAMSvc
HKLM Software SBAMSvcVolatile
HKLM Software VIPRE Business Agent

Common Registry Keys:

Check under each of the following keys for all '
Product/Feature Keys
'
- HKLM Software Microsoft Windows CurrentVersion Installer UserData S-1-5-18 Products Product/Feature Key
- HKLM Software Classes Installer Features Product/Feature Key
- HKLM Software Classes Installer Products Product/Feature Key
- HKCR Installer Products Product/Feature Key
- HKCR Installer Features Product/Feature Key
Individual Product/Feature Keys:
- 06225A5CB6214C44AB6B2AD337BCF826
- 0C90801EF56E39443AB1F368BDE6E9A2
- 116445D9734F351419E319EC305638CC
- 18918EC9E846D9C4CAF2B621091709F3
- 2B680A936D70B034EAE58BCAC18C347A
- 33E8240AA8CFFA54FBCA2D2E4A4B0E4A
- 3709C2B8849C330439FE7E7F184EE353
- 4333AC6527B81D84187EE35F42E3545D
- 4CFD07043BFD51F47BF8941BA43675FB
- 4D888543F9911D848AC996B4842F5F3A
- 50178FD3AC9260F4A9CC7154FA4E5955
- 509870FE45AE43E429E9827A45540FD4
- 51556D034DCCFAC4CA16385693BCA236
- 5C64BF28D4948A14184C2ECC901496EB
- 628C49E84F80FA542B521E02EB22C7B0
- 67DD586D3A7716649B0FD7EAD2562106
- 7642BA6CB8C732541AC84C6640D9ABC4
- 77C6E9D1AC701B34A952FBF40AAE7885
- 7C7B0FB5837462E43A5715DD34BB234F
- 81F090823E056EA42B852DD7CE42409D
- 86C7FB6C68544E4488001493060A827C
- 8A2C546200749F642B7F0A8E62BDFC19
- 8C9E5947D46513B4796D48A03FD702C5
- 8EAC1AABB7E80004CA6583CAB87B05A6
- 96AEC1CCFA7BEE74BA46867B1A2E3FFC
- 9D9AEDB188972CB4D83EA24E6B6E9596
- 9F7BC01D4B35DBA439F6AA39DCD1C956
- A45E44E1060768D49B78EC8ECFA693ED
- ACDD851795412004BB6726B2EF31B898
- B18A18D3F774D0D4B8C395E930C22F38
- C21346408A6123D4299DD1D723899DC1
- C36B0C102E9DE6945B00EF4B0E6F1A4E
- C928BABD4AA3D694D99624F210BD8691
- DBA1FEEB263B6CE41A60E958E8C280DC
- DD79A770E36EF4A43BC91E11A19A1E15
- E84629C097CDE1A46AA3AF47298EDC7A
- F66934B227C343D4BAA5D2535F23C0C4
- FD45F0F3C6383D341AFABAA494502B42
- FDDF549310F35C54893F84C31AD37AEB
- FF5AB07066BC67340B88E0204313D0FC

Unregistering SBAMScanShell.dll

SBAMScanShellExt.dll may remain registered with Windows and may need to be unregistered manually:

Open an Elevated Command Prompt window
Change directory to the Agent's Installation Folder: (Other OS/Version Locations)
- CD 'C:Program Files (x86)VIPRE Business Agent'
Unregister the'SBAMScanShellExt.dll' file:
- RegSvr32 /u SBAMScanShellExt.dll
Restart the Machine

Note:If the command returns an error, it may already be unregistered

Clearing the remaining folders and files (Must be done after rebooting the machine)

Delete any of the following folders or files that are present:

Gfi Agent Removal Tool Harbor Freight

C: Program Files VIPRE Business Agent
C: Program Files GFI Software Deployment
C: Program Files GFI Software GFIAgent
C: Program Files GFI Software LanGuard 10
C: Program Files Sunbelt Software Deployment
C: Program Files Sunbelt Software SBEAgent
C: Program Files (x86) VIPRE Business Agent
C: Program Files (x86) GFI Software Deployment
C: Program Files (x86) GFI Software GFIAgent
C: Program Files (x86) GFI Software LanGuard 10
C: Program Files (x86) Sunbelt Software Deployment
C: Program Files (x86) Sunbelt Software SBEAgent
C: ProgramData VIPRE Business Agent
C: ProgramData GFI Software Antimalware
C: ProgramData GFI Software LanGuard 10
C: ProgramData Sunbelt Software Antimalware
C: Documents and Settings All Users Application Data VIPRE Business Agent
C: Documents and Settings All Users Application Data GFI Software Antimalware
C: Documents and Settings All Users Application Data GFI Software LanGuard 10
C: Documents and Settings All Users Application Data Sunbelt Software Antimalware
C: Windows system32 drivers sbaphd.sys
C: Windows system32 drivers sbapifs.sys
C: Windows system32 drivers SbFw.sys
C: Windows system32 drivers SbFwIm.sys
C: Windows system32 drivers sbhips.sys
C: Windows system32 drivers SBREDrv.sys
C: Windows system32 drivers sbtis.sys
C: Windows system32 drivers sbwtis.sys
C: Windows system32 drivers gfiark.sys
C: Windows system32 drivers gfiutil.sys

After all these steps are complete, the VIPRE Business Agent should be fully uninstalled.

Gfi Business Agent Removal Tool

Note:Afterwards, if the Agent is still present or the instructions cannot be performed, Contact Support