Loading...

Knowledge Center

Print
How to remove or prevent installation of the VirusScan Enterprise On Delivery Email Scanner
Technical Articles ID:   KB69030
Last Modified:  4/5/2016
Rated:

Environment

McAfee VirusScan Enterprise (VSE) 8.8
McAfee ePolicy Orchestrator (ePO) 5.x
IBM Lotus Notes
Microsoft Outlook

Summary

This article describes how to prevent installation of the VSE On Delivery Email Scanner components or remove them from the local VSE console after installation. 

The VSE On Delivery Email Scanner scans email at the local email client by default as follows:
  • Lotus Notes - the email is scanned on access.
  • Microsoft Outlook - the email is scanned on delivery.
You can choose not to use the client side scanning because protection is already provided on multiple layers, such as on the Server side and Perimeter, or if the email is received using an unsupported protocol. For more information, see KB52786.

IMPORTANT: 
  • The command line options in this article to prevent installation are for initial deployments only. To modify existing VSE installations, removal and re-installation are required to remove these components.
  • Although this article provides guidance on how to deploy VSE without the On Delivery Email Scanning feature, Intel Security does not recommend that you remove this protection layer.
  • The commands in this article are case-sensitive.
  • Refer to the relevant VSE installation guide for more information on deployment options.

Solution

Prevent installation locally using the command line


Component to be removed
Command to type
Outlook On Delivery Email Scanner
SetupVSE.exe ADDLOCAL=ALL REMOVE=EmailScan /q
Notes On Delivery Email Scanner
SetupVSE.exe ADDLOCAL=ALL REMOVE=LotusNotesScan /q
Outlook and Notes On Delivery Email Scanner SetupVSE.exe  ADDLOCAL=ALL REMOVE=EmailScan,LotusNotesScan


For more information, refer to the section "Using the command line to install the software" in the VirusScan Enterprise 8.8 Installation Guide (PD22944).

Solution

Prevent installation using an ePO product deployment task

The product deployment task has a Command Line field.
 
Component to be removed
String to type in the ePO Deployment Command Line field
Outlook On Delivery Email Scanner ADDLOCAL=ALL REMOVE=EmailScan
Notes On Delivery Email Scanner ADDLOCAL=ALL REMOVE=LotusNotesScan
Outlook and Notes On Delivery Email Scanner ADDLOCAL=ALL REMOVE=EmailScan,LotusNotesScan

For more information, refer to the section "Use the Product Deployment task to deploy products to managed systems" in the ePolicy Orchestrator 5.3.0 Product Guide (PD25504).

Solution

Disable the Microsoft Exchange Scan add-in in Microsoft Outlook
  1. Launch Microsoft Outlook.
  2. Click File, Options, Add-Ins.
  3. Under Add-Ins, select Microsoft Exchange Add-in and click Go.
  4. In the COM Add-Ins window, deselect Microsoft Exchange Add-in and click OK.
  5. Exit and restart Outlook.

Workaround

Manual removal of the VSE Lotus Notes email scan components

IMPORTANT: Manually removing the Lotus email scan components does not modify the existing installation of VirusScan Enterprise; it forcefully removes expected components. When you use this method, the recorded installation still expects the email scan components to be installed, and any future patch, repair, or upgrade of VSE will reinstall the email scan components.

Option 1 - Use ncdaemon.exe to remove the Lotus Notes email scan components
  1. Press Windows+R, type cmd, and click OK.
  2. Type the following command and press ENTER:

    cd \Program Files\McAfee\VirusScan Enterprise
     
  3. From the VirusScan Enterprise installation directory, type the following command and press ENTER:

    ncdaemon.exe -remove
You see a dialog box that informs you whether the removal was successful. Removal involves deleting files to the Lotus\Notes directory and updating of copies found in the NOTES.INI.

NOTE: To perform the installation silently, add the -s option to the command preceded by a space.
  1. After you have removed the Lotus Notes scanner with an administrative account, users with non-privileged accounts also have to change their NOTES.INI file by removing the following lines:

    AddInMenus=NCMenu
    EXTMGR_ADDINS=NCExtMgr

Option 2 - Manually remove the Lotus Notes Mail Scan components
  1. Delete or rename these files in the Lotus\Notes Program files directory:

    NCDAEMON.EXE
    NCEXTMGR.DLL
    NCMENU.DLL
    NCSCAN.DLL
    NCTRACE.DLL
    NCINSTALL.DLL
     
  2. Remove the following two lines in the NOTES.INI file:

    AddInMenus=NCMenu
    EXTMGR_ADDINS=NCExtMgr

Workaround

Manual removal of the VSE Microsoft Outlook email scan components

IMPORTANT: Manually removing the Outlook email scan components does not modify the existing installation of VirusScan Enterprise; it forcefully removes expected components. When you use this method, the recorded installation still expects the email scan components to be installed, and any future patch, repair, or upgrade of VSE will reinstall the email scan components.

CAUTION: This article contains information about opening or modifying the registry.
  • The following information is intended for System Administrators. Registry modifications are irreversible and could cause system failure if done incorrectly.
  • Before proceeding, Intel Security strongly recommends backing up your registry and understanding the restore process. For more information, see: http://support.microsoft.com/kb/256986.
  • Do not run a .REG file that is not confirmed to be a genuine registry import file.
  1. Press Windows+R, type cmd, and click OK.
  2. Type the following command and press ENTER:

REG DELETE HKLM\SOFTWARE\Microsoft\Exchange\Client\Extensions /v "Outlook Scan" /f

You can also use this command in a login script (if appropriate permissions to the registry exist for the logged on user) or third-party deployment tool, using the following syntax:

REG DELETE \\%COMPUTERNAME%\HKLM\SOFTWARE\Microsoft\Exchange\Client\Extensions /v "Outlook Scan" /f

Related Information

For a full list of product documents, go to the ServicePortal at: http://support.mcafee.com. Click Knowledge Center, and select Product Documentation from the Knowledge Base list.

Rate this document

Did this article resolve your issue?

Please provide any comments below

Beta Translate with

Select a desired language below to translate this page.

Glossary of Technical Terms


Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.