Loading...

Knowledge Center


How to manually remove VirusScan Enterprise 8.8
Technical Articles ID:  KB71179
Last Modified:  3/25/2015
Rated:


Environment

McAfee VirusScan Enterprise (VSE) 8.8

For product supported environments, see KB51111.

Summary

This article describes how to manually remove VSE 8.8 if automatic removal is not an option or fails.

IMPORTANT: Use the following instructions only as a last resort for removing VSE 8.8. Before attempting a manual removal, try all other methods first.

CAUTION: This article contains information about opening or modifying the registry.
  • The following information is intended for System Administrators. Registry modifications are irreversible and could cause system failure if done incorrectly.
  • Before proceeding, Intel Security strongly recommends backing up your registry and understanding the restore process. For more information, see: http://support.microsoft.com/kb/256986.
  • Do not run a .REG file that is not confirmed to be a genuine registry import file.


Use one of the following solutions that best fits your requirements:

Solutions Descriptions
Use msiexec.exe to remove remnants (if Add/Remove Programs is unavailable)
Full manual removal instructions for 32-bit systems
Full manual removal instructions for 64-bit systems
Use this solution if you plan to re-install VSE 8.8

Solution 1

Use msiexec.exe to remove remnants (if Add/Remove Programs is unavailable)

Sometimes you can remove VSE remnants using msiexec.exe with the product installation string. This can save time, and Intel Security recommends that you use this method before you try to manually remove VSE .

For full details on how to remove VSE via the command line using msiexec.exe, see KB52648.
 

Solution 2

Full manual removal instructions for 32-bit systems
  1. Disable Access Protection:
    1. Click StartProgramsMcAfeeVirusScan Console.
    2. Right-click Access Protection and select Disable.
    3. Close the VirusScan Console
       
  2. Stop the VirusScan Services:
     
    IMPORTANT: Your system will be unprotected after this step. For security, you may prefer to continue working while disconnected from the network.
     
    1. Click StartRun, type NET STOP McShield, and press ENTER.
    2. Click StartRun, type NET STOP McTaskManager, and press ENTER. 
       
  3. Remove the Common Management Agent (CMA) reference for VSE:
    1. Click StartRun.
    2. Type the following and press ENTER:
       
      <CMA install folder>\FRMINST.exe /REMOVE=Updater /PRODUCT=VIRUSCAN8800
       
      Example: "C:\Program Files\McAfee\Common Framework\frminst.exe" /REMOVE=Updater /PRODUCT=VIRUSCAN8800
       
      NOTE: The default location for the CMA installation folder is: C:\Program Files\McAfee\Common Framework. 
        
  4. Unload the McTray Plugin, if necessary.
    1. Click Start, Run.
    2. Type the following and press ENTER:
       
      <CMA Install Folder>\mctray.exe unloadplugin=shstat.dll
       
      Example: “C:\Program Files\McAfee\Common Framework\mctray.exe” unloadplugin=shstat.dll 
        
  5. Delete the VSEPlugin key:
    1. Click Start, Run, type regedit and press ENTER.
    2. Delete the following key:
       
      HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\McTray\Plugins\VSEPlugin
        
  6. Stop the ShStat process
    1. Click Start, Run.
    2. Type the following and press ENTER:
       
      <VSE Install Folder>\shstat.exe /TERMINATE
       
      Example: “C:\Program Files\McAfee\VirusScan Enterprise\shstat.exe” /TERMINATE
         
  7. Unregister with Checkpoint:
    1. Click StartRun.
    2. Type the following and press ENTER:
       
      <VirusScan install folder>\PIREG.EXE /d <VirusScan install folder>\MCAVSCV.DLL
       
      Example: "C:\Program Files\McAfee\VirusScan Enterprise\PIREG.EXE" /d "C:\Program Files\McAfee\VirusScan Enterprise\MCAVSCV.DLL"

      NOTE: The default location for the VirusScan installation folder is: C:\Program Files\McAfee\VirusScan Enterprise.   
       
  8. Remove Lotus Scanner:
    1. Click StartRun.
    2. Type the following and press ENTER:
       
      <VirusScan install folder>\NCDAEMON.exe -remove
       
      Example: "C:\Program Files\McAfee\VirusScan Enterprise\NCDAEMON.exe" -remove
       
  9. Unload vsplugin.dll (if ePO Agent is installed):
    1. Browse to the following registry location:
       
      HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator\Application Plugins\VIRUSCAN8800
        
    2. Right-click Plugin Flag and select Modify.
    3. In the Value Data field type and click OK.
    4. Browse to the following registry location:
       
      HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\ePolicy Orchestrator\Application Plugins\VIRUSCAN8800
        
    5. Right-click Plugin Flag and select Modify.
    6. In the Value Data field type and click OK
       
  10. Remove VirusScan Drivers:
    1. Copy the vse.xml and DAInstall.exe files into the <VSE Install Directory>\vscore folder. (See Related Information for details on how to obtain these two files.)
    2. Select StartRun, type cmd, and press ENTER.
    3. Change directory to the VirusScan VSCore folder.
       
      Example: cd "c:\program files\mcafee\virusscan enterprise\vscore"
        
    4. Type mfehidin.exe -u –x vse.xml and press ENTER. 
       
  11. Delete VirusScan Services:
    1. Click StartRun, type regedit, and press ENTER.
    2. Locate the following registry key:
       
      HKEY_LOCAL_MACHINE\System\ControlSet\Services\McTaskManager
        
    3. Create a DWORD value named DeleteFlag with a value of 1.
    4. Create a DWORD value named VSEFlag with a value of 1. 
       
  12. Unregister the shell extension:
    1. Click StartRun, type regedit , and press ENTER.
    2. Locate each of the following registry keys, right-click each key, and select Delete:
HKEY_CLASSES_ROOT\CLSID\{cda2863e-2497-4c49-9b89-06840e070a87}
HKEY_CLASSES_ROOT\Directory\shellex\ContextMenuHandlers\VirusScan
HKEY_CLASSES_ROOT\Folder\shellex\ContextMenuHandlers\VirusScan
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\VirusScan 
  1. Reboot the computer.
  2. Unregister DLLs:
    1. Select StartRun, type cmd, and press ENTER.
    2. Locate and change to the VirusScan installation folder.
       
      Example: cd "c:\Program Files\McAfee\VirusScan Enterprise"
       
    3. Type the following command and press ENTER: 
       
      regsvr32.exe /u VSUPDATE.dll
        
    4. Locate and change to the McAfee SystemCore installation folder.
       
      Example: cd "c:\Program Files\Common Files\McAfee\SystemCore"
       
    5. Type the following command and press ENTER: 
       
      regsvr32.exe /u SCRIPTSN.dll
        
  3. Delete Files/Folders:
    1. Delete the following files:
       
      %ALLUSERSPROFILE%\Start Menu\Programs\McAfee\On-Access Scan.lnk
      %ALLUSERSPROFILE%\Start Menu\Programs\McAfee\On-Demand Scan.lnk
      %ALLUSERSPROFILE%\Start Menu\Programs\McAfee\VirusScan Console.lnk
        
    2. Delete each of the following program folders:
       
      C:\Program Files\Common Files\McAfee\Engine 
      %ALLUSERSPROFILE%\Application Data\McAfee\DesktopProtection 
      C:\Program Files\McAfee\VirusScan Enterprise 
      C:\WINDOWS\Installer\{CE15D1B6-19B6-4D4D-8F43-CF5D2C3356FF}
       
    3. Delete each of the following folders if empty:
       
      %ALLUSERSPROFILE%\Start Menu\Programs\McAfee
      %ALLUSERSPROFILE%\Application Data\McAfee 
      C:\Program Files\Common Files\McAfee
      C:\Program Files\McAfee
        
  4. Delete Registry Keys - Part 1:
    1. Click StartRun, type regedit, and press ENTER.
    2. Locate each of the following keys, right-click each key, and select Delete:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\6B1D51EC6B91D4D4F834FCD5C23365FF
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\9FF15957780018945A6265BC95AD719D
HKEY_CLASSES_ROOT\Installer\Products\6B1D51EC6B91D4D4F834FCD5C23365FF
HKEY_CLASSES_ROOT\Installer\Features\6B1D51EC6B91D4D4F834FCD5C23365FF
HKEY_CLASSES_ROOT\Installer\UpgradeCodes\9FF15957780018945A6265BC95AD719D
HKEY_CURRENT_USER\Software\McAfee\DesktopProtection
HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\AVEngine
HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\DesktopProtection
HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\ePolicy Orchestrator\Application Plugins\VIRUSCAN8800
HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator\Application Plugins\VIRUSCAN8800
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CE15D1B6-19B6-4D4D-8F43-CF5D2C3356FF}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run], ShStatEXE
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet\Services\Eventlog\Application\McLogEvent 
  1. Delete Registry Keys - Part 2:
    To search the Windows Registry for and delete instances of 6B1D51EC6B91D4D4F834FCD5C23365FF:
    1. Click StartRun, type regedit, and press ENTER.
    2. Select EditFind, type 6B1D51EC6B91D4D4F834FCD5C23365FF, and click Find Next.
    3. Right-click any matching key found and select Delete.
       
      NOTE: Delete the parent key if there are no other values in the key.
       
      See the Related Information section for a full listing of all registry values that should be located and removed in this way.  
  1. Reset Microsoft Outlook Add-in Manager (if Microsoft Outlook is installed):

    NOTE: This procedure instructs Microsoft Outlook to rebuild the EXTEND.DAT for the next user to open Outlook, removing references to the VirusScan Email Scan add-in.
  1. Click StartRun, type regedit, and click OK.
  2. Locate the following registry location:
     
    HKEY_LOCAL_MACHINE\SOFTWARE\Software\Microsoft\Exchange\Client\Extensions
      
  3. Right-click the Extensions key and select NewString Value.
  4. Rename the new value to Outlook Setup Extension and press ENTER.
  5. Right-click Outlook Setup Extension and select Modify.
  6. In the Value Data field, type 4.0;Outxxx.dll;7;00000000000000;0000000;OutXXX and press ENTER.

Solution 3

Full manual removal instructions for 64-bit systems
The 32-bit instructions apply with the exception of the following:  
  • 64-bit directory structure

    Replace C:\Program Files\... 
    with C:\Program Files (x86)\...
      
  • 64-bit registry locations

    Replace HKEY_LOCAL_MACHINE\Software\McAfee
    with HKEY_LOCAL_MACHINE\Software\Wow6432Node\McAfee

Solution 4

Use this solution if you plan to re-install VSE 8.8
This solution is intended to be used when an administrator wants to perform a manual removal of VSE, for the purposes of performing a re-installation of the product that may be failing due to existing registry/file/folder corruption.

IMPORTANT:
  • This procedure relies on the assumption that Access Protection can either be disabled, or is non-functional on the system. The following information is all that is necessary to remove registry/file corruption for VSE only, and perform a clean install.
  • Ensure there is no McAfee software installed, other than the McAfee Agent and VSE. Performing this procedure can also remove drivers shared by Host Intrusion Prevention.
  1. Click Start, Run, type regedit, and then click OK.
  2. Navigate to the following location HKLM\System\CurrentControlSet\Services, and delete the following Keys:

    NOTE: Perform this for the McAfee services listed under the additional CurrentControlSet0#\Services keys as well, if they exist.

    mfeapfk
    mfeavfk
    mfeavfk01
    mfehidk
    mferkdet
    mfevtp
    mfewfpk 
    (NOTE: Possibly appears as mfetdik.sys, or mfetdi2k.sys, depending on the operating system 32-bit/64-bit)
    McShield
    McTaskManager
     
  3. Navigate to one of the following locations and delete the McAfee key.
     
    32-bit systems: HKLM\Software
    64-bit systems: HKLM\Software\Wow6432Node 
      
  4. Using Windows Explorer, navigate to one of the following locations and delete the McAfee folder:
     
    32-bit systems: C:\Program Files
    64-bit systems: C:\Program files (x86)
     
    32-bit systems: C:\Program Files\Common Files (if it exists)
    64-bit systems: C:\Program Files (x86)\Common Files
      
  5. Navigate to C:\Windows\System32\drivers and  delete the following files:
     
    IMPORTANT:  Delete only the listed drivers. In certain scenarios, there could be non-McAfee drivers that start with mfe*, and deleting those drivers could cause unwanted system changes.
     
    mfeapfk.sys
    mfeavk.sys
    mfeclnk.sys
    mfehidk.sys
    mferkdet.sys
    mfewfpk.sys

     
  6. Navigate to C:\Windows\System 32, and then delete mfevtps.exe.
     
    When completed, restart the system, and attempt a new local installation.

Rate this document

Did this article resolve your issue?

Please provide any comments below

Beta Translate with

Select a desired language below to translate this page.

Glossary of Technical Terms


Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.