@echo off

echo.
echo REMSAV.BAT -- Utility to remove Sophos Anti-Virus from Windows OS platforms
echo Version 1.00
echo Copyright (c) 2003, Sophos Plc, http://www.sophos.com
echo.

rem --- Set temporary environment variables
rem --- Sharepath should point to a location where REBOOT.EXE can be executed
rem ---   currently set to the same folder as REMSAV.BAT is run from

set sharepath=.
set sophos95=C:\Program Files\Sophos Sweep
set sophosnt=C:\Program Files\Sophos Sweep for NT
set tmpfile=%windir%\sophos.tmp

rem --- If operating system is NT stop Sophos Anti-Virus services

if "%os%"=="" goto skipserv

echo Stopping Sophos services
echo.

net start | find "Sophos Anti-Virus Update"
if not errorlevel 1 net stop sweepupdate
net start | find "Sophos Anti-Virus Network"
if not errorlevel 1 net stop sweepnet
net start | find "Sophos Anti-Virus"
if not errorlevel 1 net stop sweepsrv.sys

:skipserv

rem --- Build registry file to remove registry entries
rem --- Not deleting \Software\Sophos keys in registry - not required
rem --- because if NT then could also delete SAVI/MM keys
rem --- Some keys unable to remove due to permissions

echo Building registry file
echo.

echo REGEDIT4 >%tmpfile%
echo [-HKEY_CURRENT_USER\Software\Sophos\Sweep95] >>%tmpfile%
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\Sweep95] >>%tmpfile%
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] >>%tmpfile%
echo "Sweep95"=- >>%tmpfile%
echo "InterCheckMonitor"=- >>%tmpfile%
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] >>%tmpfile%
echo "Sweep95"=- >>%tmpfile%
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VxD\Sophos ICSTATIC] >>%tmpfile%
echo [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Sophos-Sweep95] >>%tmpfile%
echo [-HKEY_CURRENT_USER\Software\Sophos\SweepNT] >>%tmpfile%
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\SweepNT] >>%tmpfile%
echo [-HKEY_USERS\.DEFAULT\Software\Sophos\SweepNT] >>%tmpfile%
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\SweepNT] >>%tmpfile%
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\InterCheck Control] >>%tmpfile%
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\InterCheck Filter] >>%tmpfile%
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\InterCheck Support 01] >>%tmpfile%
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\InterCheck Support 02] >>%tmpfile%
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\InterCheck Support 03] >>%tmpfile%
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\InterCheck Support 04] >>%tmpfile%
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\InterCheck Support 05] >>%tmpfile%
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\InterCheck Support 06] >>%tmpfile%
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\InterCheck Support 07] >>%tmpfile%
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\InterCheck Support 08] >>%tmpfile%
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\InterCheck Support 09] >>%tmpfile%
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\InterCheck Support 10] >>%tmpfile%
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\InterCheck Support 11] >>%tmpfile%
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\InterCheck Support 12] >>%tmpfile%
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\InterCheck Control] >>%tmpfile%
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\InterCheck Filter] >>%tmpfile%
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\InterCheck Support 01] >>%tmpfile%
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\InterCheck Support 02] >>%tmpfile%
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\InterCheck Support 03] >>%tmpfile%
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\InterCheck Support 04] >>%tmpfile%
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\InterCheck Support 05] >>%tmpfile%
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\InterCheck Support 06] >>%tmpfile%
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\InterCheck Support 07] >>%tmpfile%
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\InterCheck Support 08] >>%tmpfile%
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\InterCheck Support 09] >>%tmpfile%
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\InterCheck Support 10] >>%tmpfile%
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\InterCheck Support 11] >>%tmpfile%
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\InterCheck Support 12] >>%tmpfile%
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MEMSWEEP] >>%tmpfile%
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SWEEPNET] >>%tmpfile%
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SWEEPSRV.SYS] >>%tmpfile%
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SWEEPUPDATE] >>%tmpfile%
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SWEEPNET] >>%tmpfile%
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SWEEPSRV.SYS] >>%tmpfile%
echo [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SWEEPUPDATE] >>%tmpfile%

rem --- Import registry file to remove entries

echo Removing Sophos Anti-Virus registry entries
echo.

regedit /s %tmpfile%

rem --- Delete Sophos Anti-Virus files and folders
rem --- Due to restrictions in the way the WININIT.INI management
rem --- works, it is not possible to build a list of files to delete
rem --- using the current set of batch commands.

echo Deleting files and folders
echo.

if "%os%"=="" goto del9x
if exist "%systemroot%\..\interc03.chk" del /f "%systemroot%\..\interc03.chk" >nul
if exist "%userprofile%\..\All Users\Start Menu\Programs\Startup\InterCheck Monitor.lnk" del /f "%userprofile%\..\All Users\Start Menu\Programs\Startup\InterCheck Monitor.lnk" >nul
if exist "%userprofile%\..\All Users\Start Menu\Programs\Sophos Anti-Virus" rmdir /s /q "%userprofile%\..\All Users\Start Menu\Programs\Sophos Anti-Virus" >nul
if exist "%sophosnt%" rmdir /s /q "%sophosnt%" >nul
goto skipdel9x

:del9x

deltree /y "c:\interchk.chk" >nul
deltree /y "%sophos95%" >nul
deltree /y "%windir%\iclog.txt" >nul
deltree /y "%windir%\Start Menu\Programs\Sophos Anti-Virus" >nul

:skipdel9x

rem --- Check for SAV program files folder and reboot if present

If exist "%sophosnt%" goto RebootNow
If exist "%sophos95%\*.*" goto RebootNow
goto end

:RebootNow
echo.
echo !! Your machine will now restart to complete removal !!
echo.
"%sharepath%\reboot.exe"
goto exit

:end
echo ----------------------------------
echo Sophos Anti-Virus removal complete
echo ----------------------------------
echo.

del %tmpfile% >nul

set sharepath=
set sophos95=
set sophosnt=
set tmpfile=

:exit
exit