I believe I have disabled the view state on all controls as well as the page itself, but the querystring still contains the __viewstate and __eventvalidation parameters.
Removing the runat="server"
attribute from the form tag will effectively remove the hidden viewstate and eventvalidation fields. But then you can't use server controls on the page, so I doubt that's what you want to do.
Are you sure the __viewstate and __eventvalidation fields appear in your querystring?? That does sound a bit strange.
Post some code and tell us why you want to remove the hidden fields in the first place. If you disable viewstate on a page-level, the values in the hidden fields should remain relatively small...