search

mandiant / flare-vm

A collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on a VM.
Apache License 2.0
6.38k stars 900 forks source link

Uninstall fails - fixed #347

Closed ciprianmp closed 3 years ago

ciprianmp commented 3 years ago

There was another topic with my issue, but you closed it in 2018, so I had to open a new thread:

I did a mistake, installing the full Flare VM on my Win 10 Pro OS, not on a virtual machine. I installed the latest flare vm as of today from here and I did choco update/upgrade all packages. It took me 14 hours of restarts and logins, as the login always went to my wrong admin account (default admin account but with a different password) instead of my actual user I was installing to (also admin) - you might want to fix that.

I now try to uninstall it by using the Windows PowerShell (Admin) as I did with the installer, following your instructions: I change directory to the original folder (as downloaded) "cd c:\flare-vm-master", then run "choco uninstall flarevm.installer.flare" but I get this error: "flarevm.installer.flare is not installed. Cannot uninstall a non-existent package." Boxstarter shell is still installed.

What do I do wrong when i try to uninstall Flare VM and how to revert my pc to the previous state safely? Thank you!

Screenshot 2021-01-21 001904

ciprianmp commented 3 years ago

LE: I fixed the issue by running the .install.ps1 again in my BoxStarter Shell and interrupting the process a little later with Ctrl+C. Now the uninstallation went smooth. Probably there was a wrong reference for flare in my registry.

htnhan commented 3 years ago

Hi @ciprianmp, thank you for the update on how you fixed and uninstall FLARE-VM. Officially, we still don't support uninstallation. Therefore, please remember to install FLARE-VM in a VM.

htnhan

amro90 commented 3 years ago

@htnhan I did installed flare vm on my host OS. and everything seems to be changed(settings, apps are gone, and my access to certain folders). I have tried choco uninstall flarevm.installer.flare through powershell and got the same error. Could you please tell me what shall I do to get everything back to what it was!?

amro90 commented 3 years ago

@ciprianmp could you please tell me the steps in details !? As I tried what you said with no success. May be the problem is that I do not know the directory that I should be working on

ciprianmp commented 3 years ago

As I said here, I ran the install again but didn''t wait for the entire package, as it was time consuming. Then I ran uninstall as per the instructions on flare (see picture above for the actual command I used.

MalwareMechanic commented 3 years ago

@amro90 😟

Uninstallation is tricky and why it's always recommended to install in a virtual machine.

Windows settings/apps modified have no way to be restored currently since we don't backup settings prior to installation. Unfortunately, I would recommend backing up your important data and reinstalling Windows 10 on your host system. If this isn't feasible, you can try bulk uninstallation using an administrative PowerShell prompt via:

I see you mentioned you ran into errors during uninstall by trying one of the commands above. Could you elaborate?

If you keep running into issues during bulk uninstallation (using a command above), you may need to uninstall each package manually. I'll be upfront, this will be a very tedious process unless you script it. You can see a list of all packages currently installed by navigating to: %PROGRAMDATA%\chocolatey\lib or executing: choco list --local-only.

Lastly, after all packages are uninstalled you can uninstall Chocolatey itself by following the information at:

Side Note There appears to be a method to uninstall ALL chocolatey packages; however, I have NOT tested it! I crafted the command below based on the information at: https://docs.chocolatey.org/en-us/choco/commands/uninstall. Again, I have NOT tested this command and do not know the consequences.

amro90 commented 3 years ago

@ciprianmp Thank you so much for your reply. I followed exactly what You said, but I still get the same error "cannot uninstall a non existent package" Could you please tell me what I have done wrong !?image

ciprianmp commented 3 years ago

@ciprianmp Thank you so much for your reply. I followed exactly what You said, but I still get the same error "cannot uninstall a non existent package" Could you please tell me what I have done wrong !?image

Sorry, I was just a one-time user and I don't know too much about the process. I assume I was just lucky? Besides, I don't recall exactly what I did, just that I was frustrated as you are...

MalwareMechanic commented 3 years ago

@ciprianmp Thank you so much for your reply. I followed exactly what You said, but I still get the same error "cannot uninstall a non existent package" Could you please tell me what I have done wrong !?image

Please see my reply above. You'll want the command choco uninstall flarevm.win10.installer.fireeye since you installed the flarevm.win10.installer.fireeye package.

amro90 commented 3 years ago

@MalwareMechanic thank you so much for your tips. I will give it a try and feed you back with the results

amro90 commented 3 years ago

@MalwareMechanic thank you so much for your help. I used the command at boxstarter shell and it worked fine. I appreciate your help. I think I should reset windows 10 so that I make sure that windows returened to normal