TeCHemically Posted September 30, 2013 Share Posted September 30, 2013 I found the following little tid bit that has been of great use in corporate environments. Simply adding the appropriate line toward the top of your ducky script (or adding them all just in case works too) can significantly decrease AV detection (considering it removes it from the equation!) :D VirusScan Enterprise (VSE) command line removal using msiexec.exe: Click Start, Run. Type the removal string for your version of VSE, then click OK. VirusScan Enterprise 8.8 msiexec /x {CE15D1B6-19B6-4D4D-8F43-CF5D2C3356FF} REMOVE=ALL REBOOT=R /q VirusScan Enterprise 8.7i msiexec /x {147BCE03-C0F1-4C9F-8157-6A89B6D2D973} REMOVE=ALL REBOOT=R /q VirusScan Enterprise 8.5imsiexec.exe /x {35C03C04-3F1F-42C2-A989-A757EE691F65} REMOVE=ALL REBOOT=R /q VirusScan Enterprise 8.0imsiexec.exe /x {5DF3D1BB-894E-4DCD-8275-159AC9829B43} REMOVE=ALL REBOOT=R /q Switches that you can use with msiexec.exe: /q The quiet switch ensures the removal is done silently - nothing is displayed. /x This switch will automatically remove an installation. /i This switch will communicate via the UI (User Interface) and is used to Repair, Remove, or Modify an installation. /? This switch provides additional information on all msiexec.exe command switches. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.