eset_cleanup.ps1

eset_cleanup.ps1

Performs a complete cleanup of ESET antivirus software from Windows systems.

Overview

Performs a complete cleanup of ESET antivirus software from Windows systems. This script removes services, processes, files, registry entries, and scheduled tasks left behind after ESET uninstallation. Useful when standard uninstall fails or leaves remnants that interfere with new AV deployment.

Purpose

Performs a complete cleanup of ESET antivirus software from Windows systems. This script removes services, processes, files, registry entries, and scheduled tasks left behind after ESET uninstallation. Useful when standard uninstall fails or leaves remnants that interfere with new AV deployment.

Prerequisites

• Windows PowerShell 5.1 or PowerShell 7+
• Administrator privileges (required)
• No modules required

Configuration

Required Inputs

No inputs required. All cleanup targets are predefined based on standard ESET installation paths and patterns.

Settings

• Service removal: All services matching ESET pattern
• Process termination: egui.exe and ekrn.exe (main ESET processes)
• Folder removal: Program Files, ProgramData, AppData (user and local)
• Registry cleanup: HKLM and HKCU software keys
• Task removal: All scheduled tasks matching ESET pattern

Data Sources & Priority

1. Windows Services - Detect and remove ESET services
2. Running Processes - Kill active ESET processes
3. File System - Remove ESET installation directories
4. Registry - Remove ESET configuration keys
5. Task Scheduler - Remove ESET scheduled tasks

Behavior

1. Validates Administrator privileges (required for cleanup)
2. Stops and removes all ESET services
3. Terminates active ESET processes
4. Removes ESET installation folders
5. Removes ESET registry keys
6. Removes ESET scheduled tasks
7. Reports comprehensive cleanup status

Security Notes

• No secrets logged or displayed
• Requires elevation (will fail if not admin)
• Forcefully terminates processes (may lose unsaved ESET settings)
• Registry modifications are permanent
• Backup important data before running

Exit Codes

• 0 - Success (ESET cleanup completed)
• 1 - Failure (error during cleanup or insufficient privileges)

Example Output

[ SETUP ]
--------------------------------------------------------------
Script started : 2025-11-02 09:15:42
Administrator  : Yes

[ SERVICE CLEANUP ]
--------------------------------------------------------------
Scanning for ESET services...
Services found : 3
Stopping ekrn...
Deleting ekrn...
Stopping ESET Service...
Deleting ESET Service...
Services removed : 3

[ PROCESS CLEANUP ]
--------------------------------------------------------------
Scanning for ESET processes...
Processes found : 2
Terminating egui.exe...
Terminating ekrn.exe...
Processes terminated : 2

[ FOLDER CLEANUP ]
--------------------------------------------------------------
Removing ESET directories...
Removed : C:\Program Files\ESET
Removed : C:\ProgramData\ESET
Skipped : C:\Users\Admin\AppData\Roaming\ESET (not found)
Folders removed : 2 of 4

[ REGISTRY CLEANUP ]
--------------------------------------------------------------
Removing ESET registry keys...
Removed : HKLM:\SOFTWARE\ESET
Removed : HKLM:\SOFTWARE\Wow6432Node\ESET
Skipped : HKCU:\SOFTWARE\ESET (not found)
Registry keys removed : 2 of 3

[ SCHEDULED TASK CLEANUP ]
--------------------------------------------------------------
Removing ESET scheduled tasks...
Tasks found : 1
Deleted : ESET NOD32 Update
Tasks removed : 1

[ FINAL STATUS ]
--------------------------------------------------------------
Services removed         : 3
Processes terminated     : 2
Folders removed          : 2
Registry keys removed    : 2
Scheduled tasks removed  : 1
Cleanup status           : Complete

[ SCRIPT COMPLETED ]
--------------------------------------------------------------
Script completed successfully
Exit code : 0

Version History

• v1.0.0 (2025-11-02) - Initial migration from SuperOps

Links

• View Script Source
• Scripts - Back to script index