Systems Management

From what I know, Wireshark is not a vendor msi so the msiexec command is not working.

I've just created an uninstall script for this application, version 1.8.4.The script should read the UninstallString from registry and execute it. Is working from SCCM also because is a silent uninstall.

Here is the Uninstall script for Wireshark:

 Option explicit

'=============================
'==== Uninstall Wireshark ====
'=============================

Dim UninstallStr_x86
Dim UninstallStr_x64
Dim UninstallStr
UninstallStr_x86 = "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wireshark\UninstallString"
UninstallStr_x64 = "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Wireshark\UninstallString"

DisableSecurity()

If ProcArchitecture("x86") then
	If ExistRegKey(UninstallStr_x86) then
		UninstallStr = GetRegValue(UninstallStr_x86)
		Launch_App UninstallStr, "/S"
	End IF
End if

If ProcArchitecture("AMD64") then
	If ExistRegKey(UninstallStr_x86) then
		UninstallStr = GetRegValue(UninstallStr_x86)
		'msgbox UninstallStr
		Launch_App UninstallStr, "/S"
	End IF
	If ExistRegKey(UninstallStr_x64) Then
		UninstallStr = GetRegValue(UninstallStr_x64)
		'msgbox UninstallStr
		Launch_App UninstallStr, "/S"
	End IF
End if

'=================================
'==== Uninstall WinPCap 4.1.2 ====
'=================================
Dim MSIRemoveCMD
Dim ProductCode
Dim objWSH

Set objWSH = CreateObject("WScript.Shell")
ProductCode = "{342A9145-3489-4533-A21D-C4D9AEEE2F9D}"
MSIRemoveCMD = "msiexec /x " & ProductCode & " /QN"

objWSH.Run MSIRemoveCMD,,True
If MSIInstalled(ProductCode) then
	objWSH.Run MSIRemoveCMD,,True
End If	


'=============================
'==== Sub's and Functions ====
'=============================
Function ExistRegKey(regKey)
    Dim wshShell, str
    Set wshShell = CreateObject("WScript.Shell")
    On Error Resume Next
    str = wshShell.RegRead(regKey)
    If str = "" Then
        ExistRegKey = False
    Else
        ExistRegKey = True
    End If
    Set wshShell = Nothing
End Function

Function GetRegValue(regKey)
    Dim wshShell, str
    Set wshShell = CreateObject("WScript.Shell")
    If ExistRegKey(regKey) Then
        str = wshShell.RegRead(regKey)
        GetRegValue = str
    Else
        GetRegValue = "NOT FOUND"
    End If
    Set wshShell = Nothing
End Function

Function Launch_App (strExePath, strArg)
	Dim strScriptPath : strScriptPath = Left(WScript.ScriptFullName, InStrRev(WScript.ScriptFullName, "\")-1)
	Dim WshShell, oExec
	Set WshShell = CreateObject("WScript.Shell") 
	'msgbox strExePath & " " & strArg
	WshShell.Run strExePath & " " & strArg,,True 

End Function

Sub DisableSecurity()
	Dim objEnvProc, objWSH
	Set objWSH = CreateObject("WScript.Shell")
	Set objEnvProc = objWSH.Environment("PROCESS")
	objEnvProc("SEE_MASK_NOZONECHECKS") = 1
End Sub

Function MSIInstalled(strProductCode)
	Dim colList
	Dim strItem
	Dim objWI
	Set objWI = CreateObject("WindowsInstaller.Installer")
	
	For Each strItem In objWI.Products
		If UCase(strProductCode) = UCase(strItem) Then
			MSIInstalled = True
			Exit Function
		End If
	Next
	MSIInstalled = False
End Function

Function ProcArchitecture(strProcArch)
	Dim strArch
	Dim objEnvSys
	Dim objWSH
	
	Set objWSH = CreateObject("WScript.Shell")
	Set objEnvSys = objWSH.Environment("System")
	
	strArch = objEnvSys("PROCESSOR_ARCHITECTURE")

	If UCase(strArch) = UCase(strProcArch) then
		ProcArchitecture = True
		Else
		ProcArchitecture = False
	End If
End Function

The script will remove any version of Wireshark and will check the OS version and architecture.

Also the script will remove the WinPCap msi because the uninstallation of the Wireshark is not removing this msi.

If you need help you can ask me.

According to the application itself and the registry entry you posted (see screenshot below), the uninstall string is: "C:\Program Files\Wireshark\uninstall.exe"

Normally, applications that are made for the same bit version of the operating system will have an uninstall string here, but it's not always the case: http://msdn.microsoft.com/en-us/library/windows/desktop/aa372105%28v=vs.85%29.aspx

In my case, I installed the 32 bit version on a 64 bit system, so it shows up here under a key called "Uninstall": \HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Wireshark\

Here are a couple of .bat files someone else wrote for SCCM: http://srikanthyellow.blogspot.com/2012/07/wireshark-unattended-installation-i-am.html

If it is msi/mst then

msiexec /x <ProductCode> /qn or /qb!