Fails on McAfee Removal Tool

[mburkeSencon]

I'm fairly new to running these scripts so bear with me on this.

I've a Dell laptop here with the preinstalled McAfee application on it. When the RemoveBloat.ps1 script is run, it provides this error in the log:

McAfee Removal Tool has been run
Attempting to uninstall: [WebAdvisor by McAfee]...
Successfully uninstalled: [WebAdvisor by McAfee]
Attempting to uninstall: [McAfee]
PS>TerminatingError(Start-Process): "This command cannot be run due to the error: The system cannot find the file specified."

At the same time I notice that a McAfee prompt is displayed essentially blocking the uninstall. The prompt is the "Wait! If you uninstall, we'll miss you", with two options to say "No thanks, just uninstall it" and "Keep Web Protection".

[andrew-s-taylor]

I've added a second newer version of the removal tool, can you see if that removes it?

[jackdozier]

I'm having a similar issue on a newer Lenovo Neo Desktop. The make/model of the device is "LENOVO 12JF000RUS".

Neither the original nor newer removal tools remove McAfee from this system. I dug into it a bit and it seems that they've put some kind of check in the newer mccleanup.exe to check the parent process name and fail if it wasn't run through the GUI. Here are the log entries from the "C:\ProgramData\Debloat\mcnew\mccleanup.log" log file after running it manually via an elevated Powershell window.

INFO September 11, 2024 10:14:28 : 10764:10836 : ValidateParentProcess begin...
INFO September 11, 2024 10:14:28 : 10764:10836 : current pid =10764,parent process id : 5204
INFO September 11, 2024 10:14:28 : 10764:10836 : parent process name is : C
FAIL September 11, 2024 10:14:28 : 10764:10836 : failed to validate parent module
FAIL September 11, 2024 10:14:28 : 10764:10836 : ValidateParentProcess failed.

I cleared this log file during my testing before seeing what it contained after the original run of removebloat.ps1. I'll get the system reimaged to factory and grab the log file after a "standard" run of debloat.

I tested making a copy of powershell.exe, renaming it to McClnUI.exe, and running mccleanup.exe from that in hopes that it might trick the EXE into continuing, but it gave me the same error above. I assume "C" is from "C:\Windows\System32\WindowsPowerShell\v1.0..." of the parent process and it's cutting the process name off at the colon.

I have a system I can reliably test on, so let me know if I can provide any data that might be helpful.

[jackdozier]

I think I may have just muddied the waters on this issue. I'm unable to reproduce what I was seeing yesterday at this point. On the latest tests that I've done, the original mccleanup.exe is being successful in removing McAfee. I think I was getting inconsistent results due to either rebooting the system before cleanup was complete or signing in too soon. I will continue to play with timing to see if I can get more info.

The newer removal tool is still not running and the logs show the same that I reported earlier. So, if there are machines where the older removal tool isn't working completely, I don't believe the newer one is doing anything extra.

Sorry for the incomplete info! More than happy to help diagnose or test new updates if I can be of help, though!

[andrew-s-taylor]

I'll see if I can work out what's going on with the new one, it's the same commands as the old one so the only thing I can think of is that something has changed on the executable itself