JVH Consulting's Blog

Ran into an issue where after removing/uninstalling Bitdefender from the Bitdefender GravityZone console and or by uninstalling from “programs and features” app, it still showed up in the Antivirus Product list on the device in the RMM console :(. See picture below.

I figured maybe this just might take a while to remove – nope… waited hours and pushed audits of the devices in question – no luck. 

The only thing that would clear this out was by uninstalling the Datto AEM Agent, Deleted from console and then re-installing… well this is unreasonable from a MSP usability stand point. 

Went digging further at Kaseya’s support page regarding the Antivirus Detection configurations and then the Antivirus status Override file which could be changed/deleted to clear out the bad record. From there I found that the current Antivirus Product was stored in the Antivirus.json file located here: C:\Programdata\CentraStage\AEMAgent. 

Deleting the file – after Bitdefender is uninstalled, returned the Antivirus Product back to just Windows Defender Antivirus

I created a script in the RMM to uninstall Bitdefender, delete some registry keys and then delete the json file to clear/reset the RMM to report the correct Antivirus Product left running on the System.

Batch Script includes:

BEST_uninstallTool.exe /bruteForce /noWait
reg delete hkcu\software\bitdefender /f
reg delete hklm\software\bitdefender /f
reg delete hku.default\software\Bitdefender /f

del C:\ProgramData\CentraStage\AEMAgent\DataLog\aemagent.log
del C:\ProgramData\CentraStage\AEMAgent\antivirus.json

After running this the Antivirus Product for the device shows Windows Defender Antivirus

Hope this helps MSPs using Datto RMM and needing to clear out the Antivirus that’s no longer installed on the computers.

Cheers!