How to remotely uninstall software?

There’s a lot of times when you just want to uninstall a piece of software without interrupting the end user, but unfortunately there isn’t an easy, out of the box way to do it.

To uninstall software on a local machine without any user interaction, you would do something like this:
msiexec.exe /norestart /qn /x {2902F983-B4C1-44BA-B85D-5C6D52E2C441}

The last part, after /x is the GUID of installed software. To find out the guid on remote software, download this script from here and run this command:
cscript /B SwInventory.vbs RemotePC > RemotePC.txt

Open RemotePC.txt and look for GUID.

Next you need PsExec from SysInternals. This tool will allow you to run commands on the remote computer.

Once you find out the GUID of the software that you need to uninstall, you can make a batch file with msiexec.exe command on it. Like:
msiexec.exe /norestart /qn /x {2902F983-B4C1-44BA-B85D-5C6D52E2C441} and name it uninstall.bat

If you need to uninstall more than one software, just create new lines with new GUIDs, example:
msiexec.exe /norestart /qn /x {2902F983-B4C1-44BA-B85D-5C6D52E2C441}
msiexec.exe /norestart /qn /x {18455581-E099-4BA8-BC6B-F34B2F06600C}

Next you run PsExec tool and copy and run the batch file to the remote with command:
psexec remotepc -c uninstall.bat

You will need to run cmd as an administrator in order to be able to execute remote commands.

If the software uninstalled successfully, you will get error code 0, if not, it will say something like “this action is only valid for products that are currently installed.”

This will be useful when you need to uninstall same software from multiple computers. An antivirus product is a good example if you are upgrading to another one.

New malware redirects all major search engine results to Gala search

If you are being redirected to galasearch every time you search for something it may be because this shitworm planted few manual hosts on the hosts file.

First thing it does is hide the host file, so by going to C:WINDOWSSYSTEM32DRIVERSETC you will not see hosts at all. To show hosts, click on Tools from any open folder, and then go to Folder Options, switch to View tab and check “show hiden files and folders” and also uncheck “hide extension…” and ” hide protected operating system files”. Continue reading “New malware redirects all major search engine results to Gala search”