Jump to content
Welcome to our new Citrix community!
  • 0

XenSource Windows guest agent running on VMware VM, consuming memory


Tony Scarbrough

Question

I have several Windows servers running 2008 R2 or 2012 R2 that show the XenSource Windows guest agent using several hundred MB of RAM - liteagent.exe

These VMs used to be on a XenServer host, but were recently migrated to VMware hosts. I do not see any Xen Tools or Citrix applications installed under Programs and Features. 


How can I remove this and any other lingering Citrix component remnants from these Windows VMs? Is there a cleanup utility or specific files and registry settings I can delete/adjust?

Edited by tscarbrough
EDIT: added specific file name
Link to comment

5 answers to this question

Recommended Posts

  • 1

This is the batch script I wrote. I have only used it a couple of times for testing, but it seemed to 

work pretty well. After its ran I then have a second script to remove ghosted items in 

device manager. 

 

 

@ECHO OFF

REM Remove The Management Agent
REM Server will restart if necessary
echo product where name="Citrix Xenserver Windows Management Agent" call uninstall 

REM Remove all c:\windows\inf files that are from Citrix

@echo off
for /F "delims=;" %%a in ('findstr /m /i "citrix" c:\windows\inf\*.inf') do (
@echo %%a
del %%a
)

REM Kill processes that will interfere with file deletion
TASKKILL /F /IM xenagent*
TASKKILL /F /IM xenbus_monitor* 
TASKKILL /F /IM xenserverhealthcheck*  

REM Uninstall System Drivers
wmic sysdriver where name="xenbus" delete
wmic sysdriver where name="xendisk" delete
wmic sysdriver where name="xeniface" delete
wmic sysdriver where name="xennet" delete
wmic sysdriver where name="xenvbd" delete
wmic sysdriver where name="xenvif" delete

REM Delete Services 
sc delete XenAgent
sc delete XenBus_Monitor
sc delete XenLite
sc delete XenServerHealthCheck
sc delete XenSvc
sc delete XenPVInstall


REM Delete Registry Keys

REG DELETE HKLM\SYSTEM\CurrentControlSet\Enum\XENBUS /f
REG DELETE HKLM\SYSTEM\CurrentControlSet\Enum\XENVIF /f
REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\XEN /f
REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xenagent /f
REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xenbus /f
REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xenbus_monitor /f
REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xendisk /f
REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xeniface /f
REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xennet /f
REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xenserverhealthcheck /f
REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xensvc /f
REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xenvbd /f
REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xenvif /f
REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Citrix /f
REG DELETE HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Citrix\XenTools /f
REG DELETE HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Citrix\XenToolsInstaller /f


REM Delete all of the files you can that aren't locked
del c:\windows\system32\xen* /Q
del c:\windows\system32\drivers\xen* /Q

REM Run Device Manager and remove any remaining 
REM Devices Manually. Check remove drivers if you
REM Have that option.

c:\windows\system32\devmgmt.msc

REM Delete all of the files again
del c:\windows\system32\xen* /Q
del c:\windows\system32\drivers\xen* /Q

pause

REM Final Installation Instructions
ECHO After reboot install VMware Tools and
ECHO Run removeghosts.bat
ECHO This will clean up Device Manager

 

 

  • Like 2
Link to comment
  • 0

I had to write a custom script to get rid of that crap ! Basically, not only uninstalling the program

and removing folders/files/registry settings you would expect, but you also need to remove 

the drivers so they don't re-install themselves after a reboot. Its quite the PITA actually. I don't

know of any removal tool. Thats what I remember off the top of my head. If you need the 

specifics, I can search for that script later.

 

--Alan--

 

Link to comment
  • 0

This is what I've found so far. On one server, XenSource Windows guest agent is utilizing 339 MB of memory.

 

At C:\Program Files (x86)\Citrix\XenTools\Installer I only have 2 files:
InstallGui.InstallLog
InstallGui.InstallState

 

At C:\ProgramData\Citrix there are 3 folders with a few files, mostly logs:

InstallGui
InstallWizard
XSNetSettings

 

At C:\Windows\System32 I have 8 files:

xenbus_coinst_7_1_0_12.dll

xenbus_coinst_7_2_0_51.dll

xennet_coinst_7_0_0_86.dll

xennet_coinst_7_2_0_14.dll

xenvbd_coinst.dll

xenvbd_coinst_7_2_0_40.dll

xenvif_coinst_7_1_0_11.dll

xenvif_coinst_7_2_0_56.dll


At C:\Windows\System32\drivers I have 8 files:
xen.sys

xenbus.sys

xencrsh.sys

xenfilt.sys

xeniface.sys

xennet.sys

xenvbd.sys

xenvif.sys

 

Per this article https://support.citrix.com/article/CTX225911

In the registry I have 2 keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e96a-e325-11ce-bfc1-08002be10318}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e97d-e325-11ce-bfc1-08002be10318}

Both have UpperFilters entries, but have no data.

 

Is there anything else I need to remove/address? Once I have all steps compiled I will coordinate downtime on this server and test.

If the manual process works on this server, I'll try to script it for the rest of them.

 

Link to comment
  • 0

Glad I was able to help.

 

This is the ghost removal I reference in the batch file. 

https://theorypc.ca/2017/06/28/remove-ghost-devices-natively-with-powershell/

 

This is the powershell I use to launch it. It will remove all of the ghost entries and leave any with VMware in the name alone.

powershell -NoProfile -ExecutionPolicy Bypass -Command "\\r2d2\scripts3\removeghosts\removeghosts.ps1 -filterByFriendlyName @(\"VMware\")"

 

--Alan--

 

Link to comment

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...