Loading...

Knowledge Center


How to manually remove VirusScan Enterprise 8.7i
Technical Articles ID:  KB59996
Last Modified:  06/21/2013
Rated:


Environment

McAfee VirusScan Enterprise (VSE) 8.7i

 

Summary

This article describes how to manually remove VSE 8.7i if automatic removal is not an option or fails.

IMPORTANT:
  • The following instructions are intended to be used as a last resort for removing VirusScan Enterprise 8.7i.
  • Before attempting a manual removal, try all other methods first.
  • Administrators should use discretion when employing this solution.

Solution 1

Use msiexec.exe to remove remnants (when the Add/Remove programs option is not available)

Sometimes you can remove VirusScan Enterprise remnants using the MSIEXEC.EXE with the product's installation string. This can save time and is recommended before undertaking the manual removal procedure.

For full details on how to remove VirusScan Enterprise via the command line using msiexec.exe, see KB52648.

Solution 2

Manual removal procedure for VSE 8.7i (32-bit installations)

CAUTION: This article contains information about opening or modifying the registry.
  • The following information is intended for System Administrators. Registry modifications are irreversible and could cause system failure if done incorrectly.
  • Before proceeding, McAfee strongly recommends backing up your registry and understanding the restore process. For more information, see: http://support.microsoft.com/kb/256986.
  • Do not run a .REG file that is not confirmed to be a genuine registry import file.

  1. Remove the Common Management Agent (CMA) reference for VirusScan Enterprise:
    1. Click Start, Run.
    2. Type: <CMA install folder>\FRMINST.exe /REMOVE=Updater /PRODUCT=Viruscan8700 and press ENTER.

      Example: "C:\Program Files\McAfee\Common Framework\frminst.exe" /remove=updater /product=Viruscan8700

      NOTE: The default location for the CMA installation folder is: C:\Program Files\McAfee\Common Framework
       
  2. Unregister with Checkpoint:
    1. Click Start, Run.
    2. Type: <VirusScan install folder>\PIREG.EXE /d <VirusScan install folder>\MCAVSCV.DLL and press ENTER.

      Example: "C:\Program Files\McAfee\VirusScan Enterprise\PIREG.EXE" /d "C:\Program Files\McAfee\VirusScan Enterprise\MCAVSCV.DLL"

      NOTE: The default location for the VirusScan installation folder is: C:\Program Files\McAfee\VirusScan Enterprise
       
  3. Remove the AntiSpyware Enterprise module (if installed):
    1. Click Start, Run.
    2. Type: <VirusScan install folder>\scan32.exe /UninstallMAS and press ENTER.

      Example: "C:\Program Files\McAfee\VirusScan Enterprise\scan32.exe" /UninstallMAS 
       
  4. Remove the Lotus Scanner:
    1. Click Start, Run.
    2. Type: <VirusScan install folder>\NCDAEMON.exe -remove and press ENTER.

      Example: "C:\Program Files\McAfee\VirusScan Enterprise\NCDAEMON.exe" -remove 
       
  5. Delete applicable Registry keys (Part 1):
    1. Click Start, Run, type regedit, and press ENTER.
    2. Locate each of the following keys, right-click each key, and select Delete:

      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\30ECB7411F0CF9C41875A6986B2D9D37
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\9FF15957780018945A6265BC95AD719D
      HKEY_CLASSES_ROOT\Installer\Products\30ECB7411F0CF9C41875A6986B2D9D37
      HKEY_CLASSES_ROOT\Installer\Features\30ECB7411F0CF9C41875A6986B2D9D37
      HKEY_CLASSES_ROOT\Installer\UpgradeCodes\9FF15957780018945A6265BC95AD719D 
       
  6. Unload vsplugin.dll (if ePolicy Orchestrator Agent is installed):
    1. Locate the following registry location:

      HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator\Application Plugins\ViruScan8700
       
    2. Right-click the key ViruScan8700.
    3. Select New, DWORD Value.
    4. Rename the New Value #1 value to Plugin Flag and press ENTER.
    5. Right-click Plugin Flag and select Modify.
    6. In the Value Data field type 8 and click OK
       
  7. Allow access to and stoppage of VirusScan Enterprise services:
    IMPORTANT: Your system will be unprotected after this step. For security reasons, physically disconnect your computer from any network.
    1. Click Start, Programs, McAfeeVirusScan Console.
    2. Right-click Access Protection and select Disable.
    3. Close VirusScan Console.
    4. Click Start, Run, type NET STOP McShield, and press ENTER.
    5. Click Start, Run, type NET STOP McTaskManager, and press ENTER. 
       
  8. Delete applicable Registry keys (Part 2):
    1. Click Start, Run, type regedit, and press ENTER.
    2. Select Edit, Find, type 30ECB7411F0CF9C41875A6986B2D9D37, and click Find Next.
    3. Right-click any matching key found and select Delete.

      NOTE: If no other values are left in the key, also delete the parent key.
       
    4. See the Related Information section in this article for all registry values that should be located and removed in this way. 
       
  9. Delete VirusScan Enterprise Services:
    1. Locate the following registry key:

      HKEY_LOCAL_MACHINE\System\ControlSet001\Services\McShield
       
    2. Right-click the key and select New, DWORDValue.
    3. Rename the value New Value #1 to DeleteFlag and press ENTER.
    4. Right-click DeleteFlag and select Modify.
    5. In the Value Data field type 1.
    6. Create another new DWORD value named VSEFlag and change the Value Data to 1.
    7. Locate the following registry key:

      HKEY_LOCAL_MACHINE\System\ControlSet001\Services\McTaskManager 
       
    8. Create a DWORD value named DeleteFlag with a value of 1.
    9. Create a DWORD value named VSEFlag with a value of 1.
    10. Locate the following registry key:

      HKEY_LOCAL_MACHINE\System\ControlSet001\Services\McAfeeEngineService
       
    11. Create a DWORD value named DeleteFlag with a value of 1.
    12. Create a DWORD value named VSEFlag with a value of 1.
    13. Locate the following registry key:

      HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mfevtp
       
    14. Create a DWORD value named DeleteFlag with a value of 1.
    15. Create a DWORD value named VSEFlag with a value of 1
       
  10. Remove VirusScan Enterprise drivers:
    1. Select Start, Run, type cmd, and press ENTER.
    2. Locate the VirusScan installation folder.

      Example: cd "C:\program files\mcafee\virusscan enterprise"
       
    3. Type: mfehidin.exe -u mfeavfk.sys mfeapfk.sys mfebopk.sys mferkdet.sys and press ENTER. 
       
  11. Unregister the appropriate DLL files:
    1. Select Start, Run, type cmd, and press ENTER.
    2. Locate the VirusScan installation folder.

      Example: cd "C:\Program Files\McAfee\VirusScan Enterprise"

       
    3. Type each of the following commands and press ENTER after each: 

      regsvr32.exe /u SCRIPTSN.dll
      regsvr32.exe /u x64\SCRIPTSN.dll

      (for 64-bit systems only)
      regsvr32.exe /u VSUPDATE.dll 
       
  12. To delete the applicable Registry keys (Part 3):
    1. Click Start, Run, type regedit , and press ENTER.
    2. Locate each of the following registry keys, right-click each key, and select Delete:

      HKEY_CLASSES_ROOT\CLSID\{cda2863e-2497-4c49-9b89-06840e070a87}
      HKEY_CLASSES_ROOT\Directory\shellex\ContextMenuHandlers\VirusScan
      HKEY_CLASSES_ROOT\Folder\shellex\ContextMenuHandlers\VirusScan
      HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\VirusScan
      HKEY_CURRENT_USER\Software\McAfee\DesktopProtection
      HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\AVEngine
      HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\DesktopProtection
      HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\VSCore
      HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\ePolicy Orchestrator\Application Plugins\VIRUSCAN8700
      HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator\Application Plugins\VIRUSCAN8700
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{147BCE03-C0F1-4C9F-8157-6A89B6D2D973}
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, ShStatEXE
      HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\McLogEvent  
       
    3. Restart your computer.
       
  13. Delete the applicable VirusScan Enterprise files and folders:
    1. Using Windows Explorer, locate each of the following program folders in turn:

      C:\Documents and Settings\All Users\Start Menu\Programs\McAfee
      C:\Program Files\Common Files\Network Associates\Engine
      C:\Program Files\Common Files\McAfee\Engine
      C:\Documents and Settings\All Users\Application Data\McAfee\DesktopProtection
      C:\Program Files\McAfee\VirusScan Enterprise
      C:\WINDOWS\Installer\{147BCE03-C0F1-4C9F-8157-6A89B6D2D973
       
    2. Right-click the folder found and select Delete
    3. Delete each of the following folders in the same way if empty:

      C:\Documents and Settings\All Users\Application Data\McAfee
      C:\Program Files\Common Files\McAfee
      C:\Program Files\McAfee
       
  14. Locate and delete the appropriate MSI file(s):
    1. Navigate to C:\Windows\Installer\<random name>.msi.
    2. Right-click each file, select Properties and Summary to view the application to which it belongs.
    3. If the summary states VirusScan, delete the file.
    4. Repeat this for all MSI files found.
       
  15. Reset Microsoft Outlook Add-in Manager (if Microsoft Outlook is installed): 
    1. Click Start, Run, type regedit, and click OK.
    2. Locate the following registry location:

      HKEY_LOCAL_MACHINE\SOFTWARE\Software\Microsoft\Exchange\Client\Extensions 
       
    3. Right-click the Extensions key and select New, String Value.
    4. Rename the new value to Outlook Setup Extension and press ENTER.
    5. Right-click Outlook Setup Extension and select Modify.
    6. In the Value Data field, type 4.0;Outxxx.dll;7;00000000000000;0000000;OutXXX and press ENTER. 
      This instructs Outlook to rebuild EXTEND.DAT for the next user to open Outlook, removing references to the VirusScan Email Scan add-in.
       
  16. Remove hidden drivers:
    1. Click Start, Settings, Control Panel, System.
    2. Click HardwareDevice Manager.
    3. Click View and select Show hidden Devices.
    4. Under Non-Plug and Play Drivers, locate McAfee Inc. and double-click the first entry and select Driver.
    5. If the service name equals mfetdik, click OK and press Del.
    6. When prompted to uninstall this device from your system, click OK. 
    7. When prompted to restart your computer, click Yes.
      After your computer restarts, the TDI driver will be removed.   

Solution 3

Manual removal procedure for VSE 8.7i (64-bit installations)

CAUTION: This article contains information about opening or modifying the registry.
  • The following information is intended for System Administrators. Registry modifications are irreversible and could cause system failure if done incorrectly.
  • Before proceeding, McAfee strongly recommends backing up your registry and understanding the restore process. For more information, see: http://support.microsoft.com/kb/256986.
  • Do not run a .REG file that is not confirmed to be a genuine registry import file.


The 32-bit instructions apply with the exception of the following:

  • 64-bit directory structure:
    Replace C:\Program Files (x86)\.....
     
  • 64-bit registry locations:
    Replace HKEY_LOCAL_MACHINE\Software\McAfee with HKEY_LOCAL_MACHINE\Software\Wow6432Node\McAfee

Rate this document

Did this article resolve your issue?

Please provide any comments below

Glossary of Technical Terms


Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.
United States - English
© 2003-2013 McAfee, Inc.