Loading...

Knowledge Center

Print
How to remove or prevent installation of the VirusScan Enterprise On Delivery Email Scanner
Technical Articles ID:  KB69030
Last Modified:  1/27/2015
Rated:

Environment

McAfee VirusScan Enterprise 8.8, 8.7i
McAfee ePolicy Orchestrator 4.x
IBM Lotus Notes
Microsoft Outlook

Summary

This article describes how to prevent installation of the VirusScan Enterprise (VSE) On Delivery Email Scanner components or remove them from the local VSE console after installation. 

The VSE On Delivery Email Scanner scans email at the local email client by default as follows:
  • Lotus Notes - the email is scanned on access.
  • Microsoft Outlook - the email is scanned on delivery.
You can choose not to use the client side scanning because protection is already provided on multiple layers, such as on the Server side and Perimeter, or if the email is received via an unsupported protocol. For more information, see KB52786.


IMPORTANT: 
  • The command line options in this article to prevent installation are for initial deployments only. To modify existing VSE installations, removal and re-installation are required to remove these components.
  • Although this article provides guidance on how to deploy VSE without the On Delivery Email Scanning feature, Intel Security does not recommend that you remove this protection layer.
  • The commands in this article are case-sensitive.
  • Refer to the relevant VSE installation guide for more information on deployment options.

Solution 1

Prevent installation locally via command line


Component to be removed
Command Line to type
Outlook On Delivery Email Scanner
SetupVSE.exe ADDLOCAL=ALL REMOVE=EmailScan /q
Notes On Delivery Email Scanner
SetupVSE.exe ADDLOCAL=ALL REMOVE=LotusNotesScan /q
Outlook and Notes On Delivery Email Scanner SetupVSE.exe  ADDLOCAL=ALL REMOVE=EmailScan,LotusNotesScan


For more information, refer to the discussion "Using the command line to install the software" in the appropriate Installation Guide:

Solution 2

Prevent installation via an ePolicy Orchestrator (ePO) product deployment task

NOTE: In ePolicy Orchestrator (ePO) 4.x and later the Product Deployment Task has a Command Line field.
Component to be removed
String to type in the ePO Deployment Command Line field
Remove both 
  • Outlook On Delivery Email Scanner
  • Notes On Delivery Email Scanner
ADDLOCAL=ALL REMOVE=EmailScan,LotusNotesScan 
Outlook On Delivery Email Scanner ADDLOCAL=ALL REMOVE=EmailScan
Notes On Delivery Email Scanner ADDLOCAL=ALL REMOVE=LotusNotesScan


For additional information refer to the discussion "Using the Product Deployment task to deploy products to managed systems" in the appropriate Product Guide:

Solution 3

Disable the Microsoft Exchange Scan add-in in Microsoft Outlook

Outlook 2010
  1. Launch Microsoft Outlook 2010.
  2. Click File, Options, Add-Ins.
  3. Under Add-Ins, select Microsoft Exchange Add-in and click Go.
  4. In the COM Add-Ins window, deselect Microsoft Exchange Add-in and click OK.
  5. Exit and restart Outlook.
Outlook 2007
  1. Launch Microsoft Outlook 2007.
  2. Click Tools, Trust Center, Add-ins.
  3. From the Manage drop-down menu at the bottom, select Exchange Client Extensions and click Go.
  4. In the Add In Manager window, deselect Exchange Scan and click OK.
  5. Exit and restart Outlook.
Outlook 2003
  1. Launch Microsoft Outlook 2003.
  2. Click Tools, Options and click Other.
  3. Click Advanced Options..., Add-in Manager...
  4. Deselect Outlook Scan, then click OK.
  5. Exit and restart Outlook.

Workaround 1

Manual removal of the VSE Lotus Notes email scan components

IMPORTANT: Manually removing the Lotus email scan components does not modify the existing installation of VirusScan Enterprise; it forcefully removes expected components. When you use this method, the recorded installation still expects the email scan components to be installed, and any future patch, repair, or upgrade of VSE will reinstall the email scan components.

Option 1 - Use ncdaemon.exe to remove the Lotus Notes email scan components
  1. Select Start, Run, and type cmd.
  2. Type the following command and press ENTER:

    cd \Program Files\McAfee\VirusScan Enterprise
     
  3. From the VirusScan Enterprise installation directory, type the following command and press ENTER:

    ncdaemon.exe -remove
You see a dialog box that informs you whether the removal was successful. Removal involves deleting files to the Lotus\Notes directory and updating of copies found in the NOTES.INI.

NOTE: To perform the installation silently, add the -s option to the command preceded by a space.
  1. After you have removed the Lotus Notes scanner with an administrative account, users with non-privileged accounts also have to change their NOTES.INI file by removing the following lines:

    AddInMenus=NCMenu
    EXTMGR_ADDINS=NCExtMgr

Option 2 - Manually remove the Lotus Notes Mail Scan components
  1. Delete or rename these files in the Lotus\Notes Program files directory:

    NCDAEMON.EXE
    NCEXTMGR.DLL
    NCMENU.DLL
    NCSCAN.DLL
    NCTRACE.DLL
    NCINSTALL.DLL
     
  2. Remove the following two lines in the NOTES.INI file:

    AddInMenus=NCMenu
    EXTMGR_ADDINS=NCExtMgr

Workaround 2

Manual removal of the VSE Microsoft Outlook email scan components

IMPORTANT: Manually removing the Outlook email scan components does not modify the existing installation of VirusScan Enterprise; it forcefully removes expected components. When you use this method, the recorded installation still expects the email scan components to be installed, and any future patch, repair, or upgrade of VSE will reinstall the email scan components.

CAUTION: This article contains information about opening or modifying the registry.
  • The following information is intended for System Administrators. Registry modifications are irreversible and could cause system failure if done incorrectly.
  • Before proceeding, Intel Security strongly recommends backing up your registry and understanding the restore process. For more information, see: http://support.microsoft.com/kb/256986.
  • Do not run a .REG file that is not confirmed to be a genuine registry import file.
  1. Click Start, Run, type cmd and click OK.
  2. Type the following command and press ENTER:

REG DELETE HKLM\SOFTWARE\Microsoft\Exchange\Client\Extensions /v "Outlook Scan" /f

You can also use this command in a login script (if appropriate permissions to the registry exist for the logged on user) or third-party deployment tool, using the following syntax:

REG DELETE \\%COMPUTERNAME%\HKLM\SOFTWARE\Microsoft\Exchange\Client\Extensions /v "Outlook Scan" /f

Related Information

For a full list of product documents, go to the ServicePortal at: http://support.mcafee.com. Click Knowledge Center, and select Product Documentation from the Knowledge Base list.

Rate this document

Did this article resolve your issue?

Please provide any comments below

Beta Translate with

Select a desired language below to translate this page.

Glossary of Technical Terms


Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.